joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e04314d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x218
cmp eax, 0xffffffff
jne 0x2e043191
push 0x2e005a58
lea eax, [ebp - 0x218]
push 0x3d
push eax
call fcn.2e037fce
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e0c8a64
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e045e33
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
leave
ret

Function at 0x2e0432e8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0x2e10a4a0], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
jne 0x2e04332c
call ebx
test eax, eax
jns 0x2e043322
push 0x2e005a7c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x2e005a70
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x2e10a49c], eax
mov dword [0x2e10a4a0], 1
mov eax, dword [0x2e10a49c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x2e043348
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x2e043378
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
test eax, eax
jne 0x2e04336e
call ebx
test eax, eax
mov eax, dword [ebp + 8]
jns 0x2e043363
push dword [eax + 0xc]
call dword [eax + 8]
jmp 0x2e043368
push dword [eax + 4]
call dword [eax]
test eax, eax
je 0x2e043377
mov dword [edi], eax
push dword [ebp + 0x10]
push eax
call esi
mov dword [ebp - 4], eax
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x2e04405c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
cmp dword [ecx + 4], 0xffffffff
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x2e0440ae
call fcn.2e043cf4
test al, al
jne 0x2e0440ae
push 0x2e005e70
lea eax, [ebp - 0x258]
push 0x43
push eax
call fcn.2e037fce
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e0c8a64
lea eax, [ebp - 0x14c]
lea edi, [ebp - 0x14c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e045e33
call fcn.2e03aa6f
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test al, al
je 0x2e0440d3
push 0
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push edi
push 0x2e005e38
push 3
call fcn.2e043f81
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.2e046a1a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
movzx eax, byte [ebp + 0x10]
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x2e005e2c
cmp dword [edi + 0x18], 8
mov dword [ebp - 0x34], eax
lea eax, [edi + 4]
mov dword [ebp - 0x40], esi
mov dword [ebp + 0xc], eax
jb 0x2e04410c
mov eax, dword [eax]
cmp dword [ebx + 0x18], 8
mov dword [ebp - 0x30], eax
lea esi, [ebx + 4]
jb 0x2e04411f
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
jmp 0x2e044122
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x3c], 0x340
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x2e044184
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
cmp eax, 0x4c7
jne 0x2e044155
xor al, al
jmp 0x2e044196
cmp dword [ebx + 0x18], 8
jb 0x2e04415d
mov esi, dword [esi]
cmp dword [edi + 0x18], 8
mov ecx, dword [ebp + 0xc]
jb 0x2e044168
mov ecx, dword [ecx]
push esi
push ecx
push 0x2e005df8
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.2e038002
add esp, 0x14
jmp 0x2e044090
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x103
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x2e044cd2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
mov esi, ecx
call fcn.2e044b33
test al, al
je 0x2e044d1c
push 0x2e0061d0
lea eax, [ebp - 0x218]
push 0x53
push eax
call fcn.2e037fce
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e0c8a64
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e045e33
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x2e044d2b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x18]
push eax
xor edi, edi
push edi
push dword [ebp + 8]
push dword [esi + 0x10]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
cmp eax, edi
jne 0x2e044d61
push 0x2e0061b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.2e038002
jmp 0x2e044cfb
pop edi
mov dword [esi + 0x14], 0x103
pop esi
leave
ret 4

Function at 0x2e045b51
Capabilities:
Delete file

Disassembly:
pushal
push esi
test dl, 0xd7
btr esi, ecx
pop ecx
test cl, dh
int1
mov ebx, ecx
inc ecx
shld edi, esi, 0xdd
xadd ecx, esi
int1
call fcn.2e045f7a
call fcn.2e045df3
call 0x2e045b88
or al, ch
leave
pushfd
cmc
lahf
cld
push es
or edx, ebx
leave
pop ebx
mov cl, 0xbc
xchg esi, eax
xchg byte [ebx], dh
rol byte [ebp + 0xe383c3], cl
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebp, eax
test eax, 0x362fdc4d
shld ecx, eax, cl
push 0x1a
push 0x77
call fcn.2e045df3
pop ecx
pop ebx
mov ecx, edx
mov dh, ah
mov ah, dl
lea ebx, [0x8d123bd8]
shld edi, esi, 0x5d
rcl esi, 0x2d
pop eax
sub ebp, ebx
xchg ebx, ecx
test ebp, edx
jne 0x2e045bd9
push 0xf003f0
test ebp, edx
inc edi
pop ebp
adc ecx, ebp
bsf edi, esi
rcl ecx, 6
add eax, 0xffb1
mov ecx, 0x4081168f
add dword [eax - 0x45], 0xca53d051
add eax, 0x20bc
shrd ebp, edi, cl
add eax, 0xad1b
xadd ch, dl
mov ebx, ecx
and ecx, 0x1091661f
jmp 0x2e045c07
btc ebx, 0x31
add eax, 0xbc30
imul ebx, edx, 0x3a83c001
add eax, 0x129ad2
imul ebp, edi
bswap edx
xadd edx, ebx
shld ecx, eax, 0x4f
mov edx, eax
inc ebx
imul ebx, edx, 0xf59a6320
inc ecx
imul edi, esi, 0x8e99eb7
jmp 0x2e045c3e
push edx
invalid
Function at 0x2e045b88
Capabilities:
Delete file

Disassembly:
pushal
push esi
test dl, 0xd7
btr esi, ecx
pop ecx
test cl, dh
int1
mov ebx, ecx
inc ecx
shld edi, esi, 0xdd
xadd ecx, esi
int1
call fcn.2e045f7a
call fcn.2e045df3
call 0x2e045b88
or al, ch
leave
pushfd
cmc
lahf
cld
push es
or edx, ebx
leave
pop ebx
mov cl, 0xbc
xchg esi, eax
xchg byte [ebx], dh
rol byte [ebp + 0xe383c3], cl
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebp, eax
test eax, 0x362fdc4d
shld ecx, eax, cl
push 0x1a
push 0x77
call fcn.2e045df3
pop ecx
pop ebx
mov ecx, edx
mov dh, ah
mov ah, dl
lea ebx, [0x8d123bd8]
shld edi, esi, 0x5d
rcl esi, 0x2d
pop eax
sub ebp, ebx
xchg ebx, ecx
test ebp, edx
jne 0x2e045bd9
push 0xf003f0
test ebp, edx
inc edi
pop ebp
adc ecx, ebp
bsf edi, esi
rcl ecx, 6
add eax, 0xffb1
mov ecx, 0x4081168f
add dword [eax - 0x45], 0xca53d051
add eax, 0x20bc
shrd ebp, edi, cl
add eax, 0xad1b
xadd ch, dl
mov ebx, ecx
and ecx, 0x1091661f
jmp 0x2e045c07
btc ebx, 0x31
add eax, 0xbc30
imul ebx, edx, 0x3a83c001
add eax, 0x129ad2
imul ebp, edi
bswap edx
xadd edx, ebx
shld ecx, eax, 0x4f
mov edx, eax
inc ebx
imul ebx, edx, 0xf59a6320
inc ecx
imul edi, esi, 0x8e99eb7
jmp 0x2e045c3e
push edx
invalid

Function at 0x2e046266
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e0d530c]
jne 0x2e046270
repz ret
jmp fcn.2e04a1bf

Function at 0x2e04a1bf
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x2e10ab78], eax
mov dword [0x2e10ab74], ecx
mov dword [0x2e10ab70], edx
mov dword [0x2e10ab6c], ebx
mov dword [0x2e10ab68], esi
mov dword [0x2e10ab64], edi
mov word [0x2e10ab90], ss
mov word [0x2e10ab84], cs
mov word [0x2e10ab60], ds
mov word [0x2e10ab5c], es
mov word [0x2e10ab58], fs
mov word [0x2e10ab54], gs
pushfd
pop dword [0x2e10ab88]
mov eax, dword [ebp]
mov dword [0x2e10ab7c], eax
mov eax, dword [ebp + 4]
mov dword [0x2e10ab80], eax
lea eax, [ebp + 8]
mov dword [0x2e10ab8c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x2e10aac8], 0x10001
mov eax, dword [0x2e10ab80]
mov dword [0x2e10aa7c], eax
mov dword [0x2e10aa70], 0xc0000409
mov dword [0x2e10aa74], 1
mov eax, dword [0x2e0d530c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x2e0d5310]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x2e10aac0], eax
push 1
call fcn.2e04bdb0
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x2e006c20
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x2e10aac0], 0
jne 0x2e04a2ab
push 1
call fcn.2e04bdb0
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x2e04ef23
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.2e048687
and dword [ebp - 4], 0
cmp dword [0x2e10af2c], 0
mov ebx, eax
jne 0x2e04efd4
push 0x2e006db0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x2e04f085
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2e006da4
push edi
call esi
test eax, eax
je 0x2e04f085
push eax
call fcn.2e048615
mov dword [esp], 0x2e006d94
push edi
mov dword [0x2e10af2c], eax
call esi
push eax
call fcn.2e048615
mov dword [esp], 0x2e006d80
push edi
mov dword [0x2e10af30], eax
call esi
push eax
call fcn.2e048615
mov dword [esp], 0x2e006d64
push edi
mov dword [0x2e10af34], eax
call esi
push eax
call fcn.2e048615
pop ecx
mov dword [0x2e10af3c], eax
test eax, eax
je 0x2e04efd4
push 0x2e006d4c
push edi
call esi
push eax
call fcn.2e048615
pop ecx
mov dword [0x2e10af38], eax
mov eax, dword [0x2e10af38]
cmp eax, ebx
je 0x2e04f02c
cmp dword [0x2e10af3c], ebx
je 0x2e04f02c
push eax
call fcn.2e048690
push dword [0x2e10af3c]
mov esi, eax
call fcn.2e048690
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x2e04f02c
test edi, edi
je 0x2e04f02c
call esi
test eax, eax
je 0x2e04f023
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x2e04f023
test byte [ebp - 0xc], 1
jne 0x2e04f02c
or dword [ebp + 0x10], 0x200000
jmp 0x2e04f065
mov eax, dword [0x2e10af30]
cmp eax, ebx
je 0x2e04f065
push eax
call fcn.2e048690
pop ecx
test eax, eax
je 0x2e04f065
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x2e04f065
mov eax, dword [0x2e10af34]
cmp eax, ebx
je 0x2e04f065
push eax
call fcn.2e048690
pop ecx
test eax, eax
je 0x2e04f065
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2e10af2c]
call fcn.2e048690
pop ecx
test eax, eax
je 0x2e04f085
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x2e04f087
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2e05632f
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x2e0caa80
call fcn.2e046836
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x2e05636d
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x2e05636d
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x2e05636d
mov eax, dword [ecx + 0x50]
jmp 0x2e05638e
mov ecx, 0x4550
cmp dx, cx
jne 0x2e05639a
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x2e05639a
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x2e05639a
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x2e05639e
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.2e04687b
ret
Function at 0x2e056b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x2e056bb6
push edi
push esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.2e0621f7
mov edi, eax
cmp edi, 0xffffffff
je 0x2e056bb5
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret

Function at 0x2e057d73
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xffffffff
jne 0x2e057d83
xor eax, eax
leave
ret
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
inc edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.2e056bb9
add esp, 0x10
test eax, eax
je 0x2e057ed0
cmp dword [ebp - 4], esi
je 0x2e057ed0
push ebx
mov ebx, 0x2e10e2d8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.2e058d04
pop ecx
test eax, eax
jne 0x2e057dde
xor edi, edi
jmp 0x2e057ec8
cmp dword [0x2e10e584], esi
je 0x2e057df1
push esi
push 0x72766c72
call fcn.2e05d4f9
lea eax, [ebp - 0x14]
push eax
mov dword [0x2e10e584], 1
mov dword [ebp - 0x14], esi
call fcn.2e056adc
pop ecx
cmp eax, dword [ebp - 8]
jne 0x2e057e15
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x2e057e4e
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.2e056c06
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.2e056bb9
add esp, 0x18
test eax, eax
je 0x2e057e41
cmp dword [ebp - 4], esi
jne 0x2e057e4e
push esi
push 0x72766c73
call fcn.2e05d4f9
xor edi, edi
cmp dword [ebp + 0x14], esi
jne 0x2e057e60
cmp dword [ebp - 8], 0xea60
ja 0x2e057dd7
cmp edi, esi
je 0x2e057e7a
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.2e057b2d
add esp, 0x10
mov edi, eax
mov dword [0x2e10e584], esi
push esi
cmp edi, esi
je 0x2e057ebe
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x2e057ea9
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jne 0x2e057ea9
xor edi, edi
inc edi
jmp 0x2e057eab
xor edi, edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.2e056b70
add esp, 0xc
jmp 0x2e057ec8
push 0x74697970
call fcn.2e05d4f9
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x2e057eeb
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.2e056c06
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x2e0581b7
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, edi
jne 0x2e0581d9
push edi
push 0x36717370
call fcn.2e05d4f9
jmp 0x2e058317
push esi
mov esi, dword [ebp + 0x10]
cmp esi, edi
jne 0x2e0581ec
push edi
push 0x36717371
jmp 0x2e0582ec
cmp dword [ebp + 8], 2
je 0x2e058209
cmp dword [ebp + 8], 8
je 0x2e058209
cmp dword [ebp + 8], 3
je 0x2e058209
push edi
push 0x36717372
jmp 0x2e0582ec
cmp dword [ebx], edi
je 0x2e058218
push edi
push 0x36717373
call fcn.2e05d4f9
cmp dword [esi], edi
je 0x2e058227
push edi
push 0x37667270
call fcn.2e05d4f9
push esi
push edi
push dword [ebp + 8]
mov dword [esi], edi
call sub.Secur32.dll_GetUserNameExW
movzx edi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x2e0582f3
cmp eax, 0xea
jne 0x2e0582f3
mov eax, dword [esi]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.2e098133
pop ecx
mov dword [ebx], eax
test eax, eax
jne 0x2e058277
push eax
push 0x36717375
jmp 0x2e0582fa
mov ecx, dword [esi]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x2e058297
push 0
push 0x36717376
jmp 0x2e0582fa
mov eax, dword [esi]
dec eax
cmp dword [ebp - 4], eax
je 0x2e0582ab
push 0
push 0x36717377
call fcn.2e05d4f9
cmp edi, 2
jne 0x2e0582c7
push dword [esi]
push dword [ebx]
call fcn.2e058144
pop ecx
pop ecx
test eax, eax
jne 0x2e058316
push eax
push 0x36717378
jmp 0x2e0582fa
cmp edi, 8
jne 0x2e0582e0
push dword [ebx]
call fcn.2e056f3a
pop ecx
test eax, eax
jne 0x2e058316
push eax
push 0x36717379
jmp 0x2e0582fa
cmp edi, 3
je 0x2e058316
push 0
push 0x3671737a
call fcn.2e05d4f9
jmp 0x2e058316
push 0
push 0x36717374
call fcn.2e05d4f9
mov eax, dword [ebx]
xor edi, edi
cmp eax, edi
je 0x2e058310
push eax
call fcn.2e045e7f
pop ecx
mov dword [ebx], edi
cmp dword [esi], edi
je 0x2e058316
mov dword [esi], edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x2e05884b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x2e0d530c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x240], eax
mov ebx, 0x104
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.2e057a70
pop ecx
pop ecx
test eax, eax
jne 0x2e058888
or eax, 0xffffffff
jmp 0x2e058a63
cmp word [ebp - 0x22c], 0
push esi
lea esi, [ebp - 0x22c]
push edi
mov dword [ebp - 0x238], esi
je 0x2e0588ae
inc esi
inc esi
cmp word [esi], 0
jne 0x2e0588a0
mov dword [ebp - 0x238], esi
xor edi, edi
inc edi
push edi
call fcn.2e0565e3
mov dword [esp], 0x2e007b40
call fcn.2e05da66
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x248], eax
cmp eax, 0x64
jbe 0x2e0588da
mov dword [ebp - 0x230], edi
mov eax, esi
lea ecx, [ebp - 0x22c]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x234], eax
mov esi, 0x80
mov edi, 0xc0000000
push dword [ebp - 0x230]
lea eax, [ebp - 0x24]
push 0x2e007740
push 0xffffffffffffffff
push eax
call fcn.2e056ea8
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x2e058a0e
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.2e058400
add esp, 0xc
mov ecx, eax
call fcn.2e057ef1
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.2e06339b
xor eax, eax
push eax
push eax
push esi
push 1
push eax
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.2e0621f7
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
jne 0x2e058a13
cmp dword [ebp - 0x230], 0x64
jb 0x2e05897f
and dword [ebp - 0x230], 0
inc dword [ebp - 0x230]
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x248]
jne 0x2e0588f6
push eax
push 0x2e007740
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.2e056ea8
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x2e058a0e
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.2e058400
add esp, 0xc
mov ecx, eax
call fcn.2e057ef1
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.2e06339b
push esi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
push ebx
push ebx
push esi
push 2
push ebx
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.2e0621f7
mov dword [ebp - 0x23c], eax
jmp 0x2e058a15
call fcn.2e042995
xor ebx, ebx
cmp dword [ebp - 0x230], 0x64
pop edi
pop esi
jb 0x2e058a26
mov dword [ebp - 0x230], ebx
mov eax, dword [ebp - 0x230]
inc eax
push eax
push 0x2e007b40
call fcn.2e05d64c
call fcn.2e05663b
cmp dword [ebp - 0x240], ebx
je 0x2e058a5d
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
push dword [ebp - 0x240]
push eax
call fcn.2e056efe
add esp, 0xc
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.2e046266
leave
ret
Function at 0x2e058a70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x2e0d530c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
xor edi, edi
push eax
inc edi
call fcn.2e057a70
pop ecx
pop ecx
test eax, eax
je 0x2e058b35
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x2e007750
call fcn.2e06477f
call fcn.2e056a3c
test eax, eax
je 0x2e058b33
call fcn.2e056947
test eax, eax
jne 0x2e058b33
call fcn.2e0580cb
test eax, eax
jne 0x2e058aea
call fcn.2e057a2d
test eax, eax
je 0x2e058b33
push dword [0x2e10e338]
call fcn.2e05982b
pop ecx
test eax, eax
jne 0x2e058b33
call fcn.2e0579ec
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.2e05884b
push 0
lea ecx, [ebp - 0x20c]
push ecx
push edi
push eax
call fcn.2e057d73
mov edi, eax
add esp, 0x18
lea eax, [ebp - 0x414]
test edi, edi
jne 0x2e058b24
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x2e058b33
push esi
push 0x2e10e364
push eax
call fcn.2e056efe
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.2e046266
leave
ret
Function at 0x2e059c7c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push 0x2c
xor ebx, ebx
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.2e046a1a
xor eax, eax
inc eax
add esp, 0xc
mov word [ebp - 0x38], ax
movzx eax, word [ebp + 0xc]
push 0x3e6
push eax
push dword [ebp + 8]
mov dword [ebp - 0x44], 0x28
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x2e059cc6
xor eax, eax
jmp 0x2e059d90
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x2e059cbf
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebx
je 0x2e059cf2
movzx eax, word [esi + 4]
cmp ax, 0x20
je 0x2e059cf9
cmp ax, 0x18
je 0x2e059cf9
xor eax, eax
jmp 0x2e059d8f
movzx ecx, word [esi]
push edi
push 3
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0xc]
push ecx
push 8
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.2e059c57
mov ecx, eax
call fcn.2e059c32
mov ecx, eax
call fcn.2e059bbb
mov eax, dword [eax]
and eax, 0xfffffffc
push eax
movzx eax, word [esi + 2]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.2e059be0
movzx ecx, word [esi]
mov edi, dword [eax]
movzx eax, word [esi + 4]
add esp, 0xc
mov dword [ebp - 0x40], ecx
movzx ecx, word [esi + 2]
cmp dword [ebp + 0x10], ebx
jne 0x2e059d55
neg ecx
push ebx
push ebx
mov word [ebp - 0x36], ax
lea eax, [ebp + 0xc]
push eax
push ebx
lea eax, [ebp - 0x44]
push eax
push ebx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebp + 0x10], eax
cmp eax, ebx
je 0x2e059d8c
cmp dword [ebp + 0xc], ebx
je 0x2e059d8c
cmp dword [ebp - 0x30], edi
jae 0x2e059d95
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub eax, 6
push eax
push dword [ebp + 0xc]
add esi, 6
push esi
call fcn.2e0598cb
mov edi, dword [ebp + 0x14]
cmp edi, ebx
je 0x2e059dc1
push 0xb
pop ecx
lea esi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x2e059dcd
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
jmp 0x2e059d8e
Function at 0x2e05a940
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
jne 0x2e05a95b
mov eax, 0xa0
jmp 0x2e05aa32
push edi
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
jmp 0x2e05a9dd
mov eax, dword [esi]
xor edi, edi
cmp eax, ebx
je 0x2e05a98c
push eax
call fcn.2e06521b
mov edi, eax
cmp edi, ebx
jne 0x2e05a98c
push ebx
push 0x77626966
call fcn.2e05d4f9
mov dword [ebp - 0xc], 8
jmp 0x2e05a9a3
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x2e05a998
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0xc], eax
cmp edi, ebx
je 0x2e05a9ad
push edi
call fcn.2e05c32c
push dword [ebp - 0xc]
call fcn.2e059e93
pop ecx
test eax, eax
je 0x2e05aa19
push 0x796d7466
push ebx
call fcn.2e05d538
push dword [ebp + 8]
mov ecx, 0x2e10e5b8
call fcn.2e05a250
lea ecx, [ebp - 4]
mov dword [ebp + 8], ebx
call fcn.2e05a03a
lea ecx, [ebp - 4]
call fcn.2e05a016
movzx eax, word [esi + 0xc]
shr eax, 1
push ebx
and eax, 0x10
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call fcn.2e05a2ae
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x2e05a964
lea ecx, [ebp - 4]
call fcn.2e05a03a
mov eax, edi
jmp 0x2e05aa31
push dword [ebp + 8]
mov ecx, 0x2e10e5b8
call fcn.2e05a17b
lea ecx, [ebp - 4]
call fcn.2e05a03a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4