joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42404f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0x42f098
mov eax, dword [0x42b8a4]
push eax
call fcn.00416476
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00423ff6
add esp, 4
mov dword [ebp - 0x11c], eax
push 0
mov eax, dword [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x4240af
inc dword [ebp - 8]
mov eax, dword [ebp + 8]
cmp dword [ebp - 8], eax
jge 0x4240ee
push 1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call fcn.00423eb0
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041669b
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4240ac
mov dword [0x42d100], 0xffffffff
mov eax, dword [ebp - 4]
cmp eax, 0x100
jb 0x42410b
mov eax, 0x100
mov dword [ebp - 0x118], eax
cmp dword [ebp - 4], 0
jbe 0x4241ad
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x118]
push eax
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jg 0x424150
jmp 0x4241ad
mov eax, dword [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00418da1
add esp, 8
mov eax, dword [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x42b180]
push eax
call fcn.00423fbe
add esp, 0xc
xor eax, eax
sub eax, dword [ebp - 0x114]
neg eax
sub dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0x100
jb 0x4241a2
mov eax, 0x100
mov dword [ebp - 0x118], eax
jmp 0x424111
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCRT20.dll_fclose]
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [0x42cca4], 1
jne 0x4241e7
cmp dword [0x42b5c0], 0
je 0x4241e7
mov dword [ebp - 0x10], 3
jmp 0x424214
cmp dword [0x42cca4], 1
jne 0x424200
mov dword [ebp - 0x10], 2
jmp 0x424214
cmp dword [0x42cca4], 2
jne 0x424214
mov dword [ebp - 0x10], 1
mov eax, dword [0x42b180]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004189bf
add esp, 8
cmp dword [0x42b540], 0
je 0x42423a
mov dword [ebp - 0x10], 0xabc0
mov eax, dword [0x42b180]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004189bf
add esp, 8
mov eax, dword [0x42d100]
not eax
mov dword [0x42d100], eax
mov eax, dword [0x42b180]
push eax
mov eax, dword [0x42d100]
push eax
call fcn.004189f2
add esp, 8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424467
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp + 8]
cmp dword [eax + 0xc], ecx
je 0x424564
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
cmp eax, 1
jne 0x4244be
push 0x800
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx*4]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.MSVCRT20.dll_memmove]
add esp, 0xc
jmp 0x424558
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
cmp eax, 2
jne 0x424558
push 0
mov eax, dword [ebp + 8]
shl eax, 0xb
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x34]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
push 0x800
call fcn.0041a3d0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x34]
push eax
push 0x800
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
cmp eax, 0x800
je 0x42452f
push 0x42f988
call fcn.004081d7
add esp, 4
push 0x800
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.MSVCRT20.dll_memmove]
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [ecx + 0xc], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424569
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
movsx eax, byte [eax + 0x18]
test eax, eax
je 0x4246b2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 1
jne 0x4245f8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp - 8]
cmp dword [eax + ecx*4], 0
jne 0x4245d1
push 0x800
call fcn.0041a40d
add esp, 4
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], eax
push 0x800
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + ecx*4]
push eax
call dword [sym.imp.MSVCRT20.dll_memmove]
add esp, 0xc
jmp 0x4246a8
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 2
jne 0x4246a8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x34], 0
jne 0x424623
mov eax, dword [ebp + 8]
push eax
call fcn.00424370
add esp, 4
push 0
mov eax, dword [ebp - 8]
shl eax, 0xb
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x34]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
push 0x800
call fcn.0041a3d0
add esp, 4
mov dword [ebp - 4], eax
push 0x800
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_memmove]
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x34]
push eax
push 0x800
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_fwrite]
add esp, 0x10
cmp eax, 0x800
je 0x42469b
push 0x42fa18
call fcn.004081d7
add esp, 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x18], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x425640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x78
push 1
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
cmp eax, 0x78
je 0x425687
mov eax, 1
jmp 0x4258e0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
mov dword [0x42d100], 0xffffffff
push 0x74
lea eax, [ebp - 0x78]
push eax
call fcn.00418da1
add esp, 8
mov eax, dword [0x42d100]
cmp dword [ebp - 4], eax
je 0x4256c8
mov eax, 1
jmp 0x4258e0
lea eax, [ebp - 0x50]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x9c], 0
jmp 0x4256e6
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0x4c
jge 0x42572c
mov eax, dword [ebp - 0x9c]
cdq
xor eax, edx
sub eax, edx
and eax, 0x1f
xor eax, edx
sub eax, edx
xor ecx, ecx
mov cl, byte [eax + ebp - 0x70]
or ecx, 0x80
mov eax, dword [ebp - 0xc0]
xor cl, byte [eax]
mov eax, dword [ebp - 0xc0]
mov byte [eax], cl
inc dword [ebp - 0xc0]
jmp 0x4256e0
push 0x4c
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCRT20.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x50]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xac]
push eax
call fcn.00426266
add esp, 4
mov eax, dword [ebp - 0xc0]
xor ecx, ecx
mov cl, byte [eax]
test ecx, ecx
je 0x425797
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], eax
inc dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc4]
mov al, byte [eax]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.0042645f
add esp, 8
jmp 0x425756
lea eax, [ebp - 0xac]
push eax
call fcn.00426298
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.00426621
add esp, 0xc
push 0x20
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x98]
push eax
call sub.MSVCRT20.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00425b05
add esp, 0xc
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0xbc], eax
je 0x42580e
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xb8], eax
je 0x425826
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xb4], eax
je 0x42583e
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xb0], eax
je 0x425856
inc dword [ebp - 0x9c]
lea eax, [ebp - 0xbc]
push eax
call fcn.00426298
add esp, 4
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.0042622d
add esp, 8
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x88], eax
je 0x425893
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x84], eax
je 0x4258ab
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x80], eax
je 0x4258c0
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x7c], eax
je 0x4258d5
inc dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
jmp 0x4258e0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4269ce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x42f098
mov eax, dword [ebp + 8]
push eax
call fcn.00416476
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_fclose]
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.0041be20
add esp, 4
test eax, eax
jne 0x426a1b
push 0x4302c8
push 0
call fcn.004093aa
add esp, 8
push 0x42f098
mov eax, dword [ebp + 8]
push eax
call fcn.00416476
add esp, 8
mov dword [ebp - 4], eax
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_ftell]
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_rewind]
add esp, 4
mov eax, dword [ebp - 0xc]
add eax, 2
push eax
call fcn.0041a3d0
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCRT20.dll_fclose]
add esp, 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT20.dll_free]
add esp, 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x42ccc4], eax
cmp dword [0x42ccc4], 0
jne 0x426ac9
push 0x430338
call fcn.004081d7
add esp, 4
push 0x4269a0
call fcn.0042aa7c
add esp, 4
push 1
mov eax, dword [0x42ccc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42ccc8], eax
cmp dword [0x42ccc8], 0
jne 0x426b03
push 0x430300
call fcn.004081d7
add esp, 4
xor eax, eax
jmp 0x426b0a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427169
Capabilities:
Encode data using xor
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor eax, eax
mov al, byte [0x43279c]
test eax, eax
jne 0x427186
call fcn.00426ec0
call fcn.00426fe5
mov dword [ebp - 8], eax
call fcn.00426fbd
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
jmp 0x427285
call dword [sym.imp.MSVCRT20.dll___p__iob]
add eax, 0x20
push eax
push 7
call dword [sym.imp.MSVCRT20.dll_fputc]
add esp, 8
jmp 0x4272b9
cmp dword [ebp - 0x18], 1
jbe 0x4271c8
dec dword [ebp - 0x18]
jmp 0x4272b9
push 0x20
call fcn.00427169
add esp, 4
call fcn.00426fbd
dec eax
cdq
xor eax, edx
sub eax, edx
and eax, 7
xor eax, edx
sub eax, edx
jne case.0x427296.2
jmp 0x427357
inc dword [ebp - 8]
mov dword [ebp - 0x18], 1
jmp 0x4272b9
mov dword [ebp - 0x18], 1
jmp 0x4272b9
mov word [ebp - 4], 0
mov al, byte [ebp + 8]
mov byte [ebp - 4], al
movzx ax, byte [0x4327a0]
mov word [ebp - 2], ax
mov word [ebp - 0xa], 1
mov ax, word [ebp - 0xa]
mov word [ebp - 0xc], ax
mov word [ebp - 0x1c], 0
mov word [ebp - 0x1a], 0
mov eax, dword [ebp - 0x18]
dec eax
mov word [ebp - 0x10], ax
mov ax, word [ebp - 0x10]
mov word [ebp - 0x14], ax
mov eax, dword [ebp - 8]
dec eax
mov word [ebp - 0xe], ax
mov ax, word [ebp - 0xe]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42b0e8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
inc dword [ebp - 0x18]
jmp 0x4272b9
sub dword [ebp - 0x20], 7
cmp dword [ebp - 0x20], 6
ja case.0x427296.4
mov eax, dword [ebp - 0x20]
jmp dword [eax*4 + 0x42729d]
xor eax, eax
mov al, byte [0x42b0e4]
cmp eax, dword [ebp - 0x18]
jae 0x4272d3
mov dword [ebp - 0x18], 1
inc dword [ebp - 8]
xor eax, eax
mov al, byte [0x43279c]
cmp eax, dword [ebp - 8]
jae 0x427347
mov word [ebp - 0x12], 1
mov word [ebp - 0x14], 0
xor eax, eax
mov al, byte [0x42b0e4]
dec eax
mov word [ebp - 0x10], ax
xor eax, eax
mov al, byte [0x43279c]
dec eax
mov word [ebp - 0xe], ax
mov word [ebp - 0xc], 0
mov word [ebp - 0xa], 0
mov word [ebp - 4], 0x20
movzx ax, byte [0x4327a0]
mov word [ebp - 2], ax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x42b0e8]
push eax
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
dec dword [ebp - 8]
jmp 0x4272d3
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.00426efb
add esp, 8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4282f7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 2
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.MSVCRT20.dll_ftell]
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0xc], eax
jae 0x42842a
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT20.dll_fseek]
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.MSVCRT20.dll_fgetc]
add esp, 4
mov byte [ebp - 8], al
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0xc], eax
jae 0x4283b4
movsx eax, byte [str.PSigx]
movsx ecx, byte [ebp - 8]
cmp eax, ecx
je 0x428385
push dword [ebp + 8]
call dword [sym.imp.MSVCRT20.dll_fgetc]
add esp, 4
mov byte [ebp - 8], al
jmp 0x4283ac
push dword [ebp + 8]
call dword [sym.imp.MSVCRT20.dll_fgetc]
add esp, 4
mov byte [ebp - 8], al
movsx eax, byte [0x4329c1]
movsx ecx, byte [ebp - 8]
cmp eax, ecx
jne 0x4283ac
jmp 0x4283b4
inc dword [ebp + 0xc]
jmp 0x428352
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4283c5
jmp 0x42842a
push dword [ebp + 8]
push 4
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCRT20.dll_fread]
add esp, 0x10
cmp eax, 4
je 0x4283e7
jmp 0x42842a
lea eax, [ebp - 0x18]
push eax
mov eax, str.PSigx
add eax, 2
push eax
call sub.MSVCRT20.dll_strcmp
add esp, 8
test eax, eax
jne 0x428422
push dword [ebp + 8]
call dword [sym.imp.MSVCRT20.dll_ftell]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x428422
jmp 0x42842a
inc dword [ebp + 0xc]
jmp 0x428326
mov eax, dword [ebp - 4]
jmp 0x428432
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10002b63
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10002be2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
jne 0x10002ba4
mov esi, 0xe8
jmp 0x10002bea
lea eax, [esi + 1]
push eax
call fcn.10001000
mov edi, eax
cmp edi, ebx
je 0x10002be2
push ebx
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002be2
cmp esi, dword [ebp - 4]
je 0x10002bd1
push 0x1e
pop esi
jmp 0x10002bea
mov eax, dword [ebp + 0xc]
mov byte [esi + edi], bl
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor esi, esi
jmp 0x10002bea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [ebp + 8], 0xffffffff
je 0x10002bf9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x10002c07
cmp esi, ebx
je 0x10002c07
push edi
call fcn.10001015
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10002c10
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push 0x80
push 4
push esi
push esi
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10002c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002c6e
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10002c5f
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x10002c67
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x10002c76
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push edi
xor esi, esi
push esi
push esi
call ebx
mov edi, eax
test edi, edi
je 0x10002cd8
lea eax, [edi + 0x1d]
push eax
call fcn.10001000
mov esi, eax
test esi, esi
je 0x10002cd8
push esi
push edi
call ebx
test eax, eax
je 0x10002cd0
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [esp + 0x14]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x10002cd0
push 0x1000e21e
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10002cd8
push esi
call fcn.10001015
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x10002ce0
Capabilities:
Create directory
Get common file path

Disassembly:
push esi
push dword [esp + 8]
call fcn.10002c76
mov esi, eax
test esi, esi
je 0x10002d63
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
je 0x10002d19
lea ecx, [esi + 4]
cmp eax, ecx
jbe 0x10002d19
cmp dword [eax - 5], 0x776f4c5c
jne 0x10002d19
push eax
add eax, 0xfffffffc
push eax
call ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push esi
call edi
push 0
push esi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10002d59
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, dword [esp + 0x14]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x10002d59
push 0x1000e21e
push esi
call edi
push eax
call ebx
jmp 0x10002d61
push esi
call fcn.10001015
xor esi, esi
pop edi
pop ebx
mov eax, esi
pop esi
ret 4

Function at 0x10002dbb
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0x1000e0f4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x10002ddb
xor eax, eax
ret 8
Function at 0x100033b6
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 0x10]
mov eax, 0x1000
xor edx, edx
shr ecx, 1
cmp ecx, eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
ja 0x100033d5
mov dword [ebp - 0xc], ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edx
push 0x80
push 4
push edx
push 1
mov ebx, 0xc0000000
push ebx
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
je 0x10003454
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
push 0
lea edx, [ebp - 0x10]
push edx
add eax, ecx
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
call esi
test eax, eax
je 0x10003437
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x10003440
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000345d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], eax
jne 0x100034aa
push eax
push 0x80
push 3
push eax
push 1
push ebx
push dword [ebp + 8]
call edi
mov edi, eax
cmp edi, 0xffffffff
je 0x100034a1
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push edi
call esi
test eax, eax
jne 0x10003498
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x100034aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100036ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
push 0x38
lea eax, [ebp - 0x38]
push edi
push eax
mov dword [ebp - 0x3c], edi
call sub.ntdll.dll_memset
add esp, 0xc
push 2
push edi
xor esi, esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0x750
call fcn.10002d69
mov ebx, eax
cmp ebx, edi
je 0x10003798
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp dword [ebp + 0xc], edi
je 0x10003742
cmp eax, edi
je 0x10003704
push 0x1000e4b4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
push dword [ebp + 8]
mov esi, eax
add esi, esi
call edi
push dword [ebp + 0xc]
add esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
lea eax, [eax + eax + 0x56]
push eax
call fcn.10001000
mov esi, eax
test esi, esi
je 0x10003792
push dword [ebp + 0xc]
push ebx
push ebx
push dword [ebp + 8]
push 0x1000e628
jmp 0x10003788
cmp eax, edi
je 0x10003752
push 0x1000e49c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call esi
mov ecx, dword [ebp + 0xc]
add ecx, eax
lea eax, [ecx*4 + 0x48]
push eax
call fcn.10001000
mov esi, eax
cmp esi, edi
je 0x10003792
push dword [ebp + 8]
push ebx
push ebx
push dword [ebp + 8]
push 0x1000e690
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push ebx
call fcn.10001015
test esi, esi
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x30], 0x1000e60c
je 0x100037b3
mov dword [ebp - 0x2c], 0x1000e618
jmp 0x100037b9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x100037bc
test esi, esi
je 0x100037d4
push esi
call fcn.10001015
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebx
leave
ret 8