joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406968
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40698c
cmp dword [edi + 0x54], 0
jne 0x40698c
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040cc09
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00406929
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40bd1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40bd65
call fcn.0040cc09
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40bd65
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40bd81
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040b898
mov esi, eax
test edi, edi
je 0x40bd7f
test ebx, ebx
je 0x40bd7f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x411915
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434cb8]
jne 0x41191f
repz ret
jmp fcn.004167fc
Function at 0x41f9b0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004161e6
and dword [ebp - 4], 0
cmp dword [0x438c30], 0
mov ebx, eax
jne 0x41fa61
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41fb12
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42e93c
push edi
call esi
test eax, eax
je 0x41fb12
push eax
call fcn.00416174
mov dword [esp], 0x42e92c
push edi
mov dword [0x438c30], eax
call esi
push eax
call fcn.00416174
mov dword [esp], 0x42e918
push edi
mov dword [0x438c34], eax
call esi
push eax
call fcn.00416174
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x438c38], eax
call esi
push eax
call fcn.00416174
pop ecx
mov dword [0x438c40], eax
test eax, eax
je 0x41fa61
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00416174
pop ecx
mov dword [0x438c3c], eax
mov eax, dword [0x438c3c]
cmp eax, ebx
je 0x41fab9
cmp dword [0x438c40], ebx
je 0x41fab9
push eax
call fcn.004161ef
push dword [0x438c40]
mov esi, eax
call fcn.004161ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41fab9
test edi, edi
je 0x41fab9
call esi
test eax, eax
je 0x41fab0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41fab0
test byte [ebp - 0xc], 1
jne 0x41fab9
or dword [ebp + 0x10], 0x200000
jmp 0x41faf2
mov eax, dword [0x438c34]
cmp eax, ebx
je 0x41faf2
push eax
call fcn.004161ef
pop ecx
test eax, eax
je 0x41faf2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41faf2
mov eax, dword [0x438c38]
cmp eax, ebx
je 0x41faf2
push eax
call fcn.004161ef
pop ecx
test eax, eax
je 0x41faf2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x438c30]
call fcn.004161ef
pop ecx
test eax, eax
je 0x41fb12
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41fb14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x3f004d91
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
jne 0x3f004e6e
mov eax, 0x94
call fcn.3f0067dc
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x3f004eac
mov ecx, dword [esi + 0x10]
mov dword [0x3f011614], ecx
mov eax, dword [esi + 4]
mov dword [0x3f011620], eax
mov edx, dword [esi + 8]
mov dword [0x3f011624], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x3f011618], esi
jne 0x3f009c4f
shl eax, 8
add eax, edx
push 1
mov dword [0x3f01161c], eax
call fcn.3f0070f5
test eax, eax
pop ecx
je 0x3f004eac
call fcn.3f00714a
test eax, eax
je 0x3f009c60
call fcn.3f005374
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x3f011c94], eax
call fcn.3f0060be
mov dword [0x3f011608], eax
call fcn.3f0053b4
test eax, eax
jl 0x3f009c6a
call fcn.3f00722c
test eax, eax
jl 0x3f004ea2
call fcn.3f006204
test eax, eax
jl 0x3f004ea2
call fcn.3f006ed2
test eax, eax
jne 0x3f004ea2
inc dword [0x3f011604]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
test eax, eax
jne 0x3f009c71
cmp dword [0x3f011604], eax
jle 0x3f004eac
dec dword [0x3f011604]
cmp dword [0x3f01163c], eax
jne 0x3f004e91
call fcn.3f00526d
call fcn.3f0050f0
call fcn.3f004efd
call fcn.3f004f1b
jmp 0x3f004e63
call fcn.3f0050f0
jmp 0x3f009c6a
xor eax, eax
jmp 0x3f004e66
or esi, 0x8000
mov dword [0x3f011618], esi
jmp 0x3f004df4
call fcn.3f004f1b
jmp 0x3f004eac
call fcn.3f004efd
jmp 0x3f009c60
cmp eax, 2
jne 0x3f009cc2
push 0x88
push 1
call fcn.3f0071ba
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x3f004eac
push esi
push dword [0x3f0111d4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
push esi
je 0x3f009cb7
call fcn.3f00dd9d
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x3f004e63
call fcn.3f004d08
pop ecx
jmp 0x3f004eac
cmp eax, 3
jne 0x3f004e63
push 0
call fcn.3f00ddb0
pop ecx
jmp 0x3f004e63
Function at 0x3f00527c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.3f004b5d
xor esi, esi
inc esi
cmp dword [0x3f011640], esi
pop ecx
je 0x3f009de2
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x3f01163c], esi
mov byte [0x3f011638], al
jne 0x3f0052e8
mov ecx, dword [0x3f011c88]
test ecx, ecx
je 0x3f0052c7
mov eax, dword [0x3f011c84]
sub eax, 4
cmp eax, ecx
mov dword [0x3f011c84], eax
jae 0x3f00531f
mov eax, 0x3f01101c
mov esi, 0x3f011020
cmp eax, esi
mov edi, eax
jae 0x3f0052e8
mov eax, dword [edi]
test eax, eax
jne 0x3f009df7
add edi, 4
cmp edi, esi
jb 0x3f0052d7
mov eax, 0x3f011024
mov esi, 0x3f011028
cmp eax, esi
mov edi, eax
jae 0x3f005309
mov eax, dword [edi]
test eax, eax
jne 0x3f009dfe
add edi, 4
cmp edi, esi
jb 0x3f0052f8
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x3f009e05
push 8
call fcn.3f004b7f
pop ecx
pop ebp
ret
mov eax, dword [eax]
test eax, eax
je 0x3f005327
call eax
mov eax, dword [0x3f011c84]
sub eax, 4
cmp eax, dword [0x3f011c88]
jmp 0x3f0052c0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x3f005298
call eax
jmp 0x3f0052e1
call eax
jmp 0x3f005302
push dword [ebp + 8]
mov dword [0x3f011640], 1
call fcn.3f00e09c
jmp 0x3f00531c
Function at 0x3f005bf7
Capabilities:
Get geographical location

Disassembly:
push 0xa
lea ecx, [ebp - 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jle 0x3f005c4d
lea eax, [ebp - 0xc]
push eax
call fcn.3f006e57
pop ecx
mov dword [ebx + 0x38], eax
mov dword [ebp - 0x121c], eax
jmp 0x3f005c4d
push ebp
mov ebp, esp
mov eax, 0x1220
call fcn.3f0067dc
or dword [ebp - 0x1220], 0xffffffff
and byte [ebp - 0x1217], 0
and byte [ebp - 0x1216], 0
push ebx
mov ebx, ecx
xor eax, eax
mov al, byte [ebx + 0x31]
lea ecx, [ebp - 0x1220]
mov dword [ebp - 0x121c], 0x4e4
push eax
push dword [ebx + 0x24]
call fcn.3f007b1b
test al, al
je 0x3f00923c
mov al, byte [ebp - 0x1218]
push esi
push edi
mov byte [ebx + 0x31], al
lea eax, [ebp - 0x20c]
push 0x100
lea ecx, [ebp - 0x1220]
push eax
call fcn.3f005ce6
test eax, eax
jl 0x3f007acf
lea esi, [ebp + eax*2 - 0x20e]
xor eax, eax
mov ax, word [esi]
test ax, ax
je 0x3f005c8b
push eax
call fcn.3f005622
test eax, eax
jne 0x3f009246
inc esi
inc esi
mov eax, esi
lea ecx, [ebp - 0x20c]
sub eax, ecx
test eax, 0xfffffffe
jle 0x3f005c4d
and word [esi], 0
cmp word [ebp - 0x20c], 0x23
je 0x3f00640d
lea eax, [ebp - 0x20c]
push 0x7c
push eax
call fcn.3f002a3d
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x3f00924d
push edi
lea eax, [ebp - 0x20c]
push eax
mov ecx, ebx
call fcn.3f005a2c
test eax, eax
je 0x3f005c4d
pop edi
pop esi
pop ebx
leave
ret
push 3
lea eax, [ebp - 0x20a]
push 0x3f006454
push eax
call fcn.3f003c6d
add esp, 0xc
test eax, eax
jne 0x3f005c4d
push 0xa
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.3f00645c
test ax, ax
mov word [ebx + 0x14], ax
jne 0x3f005bc9
or word [ebx + 0x14], 0xffff
jmp 0x3f005c4d
cmp byte [ebp - 0x1216], 0
jne 0x3f00928e
and byte [ebx + 0x30], 0
mov ecx, ebx
call fcn.3f007aec
jmp 0x3f005ce1
mov eax, 0x880004
jmp 0x3f005ce3
dec esi
dec esi
jmp 0x3f005c75
and word [edi], 0
inc edi
inc edi
lea esi, [edi - 4]
xor eax, eax
jmp 0x3f009266
push eax
call fcn.3f005622
test eax, eax
je 0x3f00926e
dec esi
dec esi
mov ax, word [esi]
test ax, ax
jne 0x3f00925a
inc esi
inc esi
mov eax, esi
lea ecx, [ebp - 0x20c]
sub eax, ecx
test eax, 0xfffffffe
jle 0x3f005c4d
and word [esi], 0
jmp 0x3f005cca
mov eax, 0x860004
jmp 0x3f005ce1
Function at 0x3f0060be
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x3f011750]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x3f006168
call edi
mov esi, eax
cmp esi, ebx
je 0x3f00a071
mov dword [0x3f011750], 1
cmp esi, ebx
je 0x3f00a092
cmp word [esi], bx
mov eax, esi
je 0x3f006111
add eax, ebp
cmp word [eax], bx
jne 0x3f006103
add eax, ebp
cmp word [eax], bx
jne 0x3f006103
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x3f006158
push ebp
call fcn.3f006173
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x3f006158
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x3f00a09f
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
jne 0x3f00a0b2
jmp 0x3f0060f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x3f00a088
mov eax, ebp
mov dword [0x3f011750], eax
jmp 0x3f006168
mov eax, dword [0x3f011750]
jmp 0x3f006168
call edi
mov esi, eax
cmp esi, ebx
je 0x3f00a0ba
jmp 0x3f0060fc
push dword [esp + 0x10]
call fcn.3f004d08
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x3f006154
cmp eax, ebp
je 0x3f00a0c1
cmp eax, ebx
je 0x3f00a0c1
xor eax, eax
jmp 0x3f006161
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x3f00a0ba
cmp byte [esi], bl
je 0x3f00a0db
inc eax
cmp byte [eax], bl
jne 0x3f00a0d1
inc eax
cmp byte [eax], bl
jne 0x3f00a0d1
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.3f006173
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x3f00a0f1
xor edi, edi
jmp 0x3f00a0fc
push ebp
push esi
push edi
call fcn.3f008165
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
jmp 0x3f006161
Function at 0x3f006f9b
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
push esi
push edi
push 0x24
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, edi
je 0x3f007099
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
call fcn.3f006c5f
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x3f009a97
lea ecx, [esi + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x3f009a7e
cmp eax, edi
je 0x3f009a6c
push edi
push edi
push edi
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 4], eax
je 0x3f009a7e
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 0x10], eax
je 0x3f009a88
xor ecx, ecx
mov cx, word [ebx]
mov eax, ebx
cmp cx, di
je 0x3f00704a
cmp cx, 0x2e
je 0x3f00704a
inc eax
inc eax
mov cx, word [eax]
jmp 0x3f007038
cmp word [eax], di
je 0x3f007064
push 0x3f0070a0
push eax
call fcn.3f00398d
test eax, eax
pop ecx
pop ecx
je 0x3f009aa3
mov eax, dword [esi + 8]
cmp eax, 2
jb 0x3f00707a
mov ecx, dword [esi + 0x10]
cmp word [ecx], 0xfeff
je 0x3f009ab0
push edi
push eax
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov eax, esi
pop edi
pop esi
pop ebx
ret 8
xor eax, eax
jmp 0x3f007093
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 1
jmp 0x3f00708e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x3f009a97
push dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x3f007099
mov eax, dword [esi + 8]
not eax
and eax, 1
jmp 0x3f007085
mov dword [esi + 0x14], 1
jmp 0x3f007088

Function at 0x3f007b1b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x3f00902c
cmp eax, ebx
je 0x3f00903f
push ebx
push ebx
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x3f007b84
mov ecx, esi
call fcn.3f007b88
cmp byte [esi + 9], bl
jne 0x3f007b84
mov eax, dword [esi + 0x100c]
mov dx, word [eax]
cmp dx, 0xfeff
sete cl
cmp cl, bl
mov byte [esi + 8], cl
jne 0x3f009057
mov al, 1
pop esi
pop ebx
pop ebp
ret 8
xor al, al
jmp 0x3f007b7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x3f007b84
jmp 0x3f007b45
cmp dword [ebp + 8], ebx
jne 0x3f007b45
mov al, byte [ebp + 0xc]
mov byte [esi + 8], al
mov byte [esi + 9], 1
jmp 0x3f007b7c
cmp dx, 0xfeff
jne 0x3f007b7c
add eax, 2
mov dword [esi + 0x100c], eax
jmp 0x3f007b7c
Function at 0x3f007b88
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push 0
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0xb]
push 0x1000
push eax
push dword [esi]
mov dword [esi + 0x100c], eax
mov dword [esi + 0x1010], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x3f008fa4
cmp dword [ebp - 4], 0
je 0x3f007bd2
mov eax, dword [esi + 0x100c]
add eax, dword [ebp - 4]
mov dword [esi + 0x1010], eax
pop esi
leave
ret
mov byte [esi + 9], 1
jmp 0x3f007bcf
mov byte [esi + 9], 1
mov byte [esi + 0xa], 1
jmp 0x3f007bcf

Function at 0x3f00ac45
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x5d4], edi
jne 0x3f00ace8
push ebx
push 0x3f00acfc
push 0x3f00acf4
push dword [0x3f011600]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push dword [0x3f011600]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x3f00ace7
push 0x18
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
je 0x3f00aca1
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
jmp 0x3f00aca3
xor eax, eax
cmp eax, edi
mov dword [esi + 0x5d4], eax
je 0x3f00ace7
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [eax]
mov ecx, dword [esi + 0x5d4]
add eax, 4
push eax
call fcn.3f005503
test eax, eax
jne 0x3f00ace7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x5d4]
cmp eax, edi
je 0x3f00ace1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 0x5d4], edi
pop ebx
mov eax, dword [esi + 0x5d4]
pop edi
pop esi
ret

Function at 0x3f00b113
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
cmp byte [esi + 0x118], bl
push ebx
je 0x3f00b13b
lea eax, [ebp + 0xc]
push eax
add edi, edi
push edi
push dword [ebp + 8]
jmp 0x3f00b16a
push 0x3f00a87c
push 0x100
lea eax, [ebp - 0x100]
push eax
push edi
push dword [ebp + 8]
push ebx
push dword [esi + 0x114]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 0x100]
push eax
push dword [esi + 0x110]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp + 0xc], edi
je 0x3f00b17f
xor al, al
jmp 0x3f00b181
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x3f00b68d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [esi + 0x20], ebx
je 0x3f00b809
cmp byte [esi + 0x30], bl
push edi
je 0x3f00b7f8
push ebx
push ebx
push ebx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x3f00b6cb
mov eax, 0x890004
jmp 0x3f00b808
cmp byte [esi + 0x31], bl
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x3f00b6fb
push ebx
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 8]
push eax
push dword [esi + 0x24]
mov dword [ebp - 8], 0xfeff
call edi
test eax, eax
jne 0x3f00b6fb
mov edi, 0x890004
jmp 0x3f00b7fa
cmp word [esi + 0x14], 0xffff
je 0x3f00b7a6
cmp byte [esi + 0x31], bl
lea eax, [ebp - 4]
push ebx
push eax
je 0x3f00b758
push 0xa
push 0x3f00b81c
push dword [esi + 0x24]
call edi
push 0xa
lea eax, [ebp - 0x14]
push eax
movzx eax, word [esi + 0x14]
push eax
call fcn.3f00dbe8
add esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.3f003788
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x24]
call edi
push ebx
lea eax, [ebp - 4]
push eax
push 4
push 0x3f00a880
jmp 0x3f00b7a1
push 5
push 0x3f00b814
push dword [esi + 0x24]
call edi
push 0xa
lea eax, [ebp - 0x10]
push eax
movzx eax, word [esi + 0x14]
push eax
call fcn.3f00dbbe
lea eax, [ebp - 0x10]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x3f00b77d
sub eax, ecx
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x24]
call edi
push ebx
lea eax, [ebp - 4]
push eax
push 2
push 0x3f00b810
push dword [esi + 0x24]
call edi
push dword [esi + 0x38]
xor eax, eax
mov al, byte [esi + 0x31]
lea ecx, [ebp - 0x130]
push eax
push dword [esi + 0x24]
push esi
call fcn.3f00b0e3
lea ecx, [ebp - 0x130]
call fcn.3f00b655
cmp eax, ebx
jne 0x3f00b7f8
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x3f00b7f3
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x3f00b7f3
mov ecx, esi
mov byte [esi + 0x30], bl
call fcn.3f007aec
jmp 0x3f00b7f8
mov eax, 0x890004
mov edi, eax
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x3f00b954
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x3f00b966
mov eax, 0x940004
jmp 0x3f00b97f
cmp dword [esi + 0x28], ebx
jne 0x3f00b96f
xor eax, eax
jmp 0x3f00b97f
push edi
call fcn.3f006a0a
mov edi, eax
cmp edi, ebx
jne 0x3f00b982
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
push dword [esi + 0x2c]
call fcn.3f005141
mov eax, dword [esi + 0x20]
cmp eax, ebx
mov dword [esi + 0x2c], edi
mov byte [esi + 0x30], 1
mov dword [esi + 0x28], ebx
je 0x3f00b9bf
push ebx
push 0x80
push 3
push ebx
push ebx
push 0xc0000000
push eax
call fcn.3f006c5f
cmp eax, 0xffffffff
mov dword [esi + 0x24], eax
jne 0x3f00b9bf
mov eax, 0x920004
jmp 0x3f00b97e
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.3f00b68d
Function at 0x3f00e09c
Capabilities:
Terminate process

Disassembly:
push 0x3f00e0dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x3f00e0c1
push 0x3f00e0cc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x3f00e0c1
push dword [esp + 4]
call eax
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x3f00e0f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x3f0111d8]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x3f0111e0]
je 0x3f00e126
inc eax
cmp eax, 0x12
jb 0x3f00e117
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x3f0111e0]
jne 0x3f00e25a
mov eax, dword [0x3f01160c]
cmp eax, 1
je 0x3f00e235
cmp eax, edx
jne 0x3f00e156
cmp dword [0x3f011610], 1
je 0x3f00e235
cmp ecx, 0xfc
je 0x3f00e25a
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x3f00e18f
lea eax, [ebp - 0x10c]
push 0x3f00abb8
push eax
call fcn.3f00630e
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.3f006241
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x3f00e1d1
lea eax, [ebp - 0x10c]
push eax
call fcn.3f006241
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x3f00abb4
push edi
call fcn.3f00801c
add esp, 0x10
push edi
call fcn.3f006241
push dword [esi + 0x3f0111e4]
mov ebx, eax
call fcn.3f006241
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.3f0067dc
mov ebx, esp
push 0x3f00e270
push ebx
call fcn.3f00630e
push edi
push ebx
call fcn.3f007f38
push 0x3f00abb0
push ebx
call fcn.3f007f38
push dword [esi + 0x3f0111e4]
push ebx
call fcn.3f007f38
push 0x12010
push 0x3f00ab88
push ebx
call fcn.3f00f4b2
add esp, 0x2c
jmp 0x3f00e25a
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x3f0111e4]
push dword [esi]
call fcn.3f006241
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.3f007451
pop edi
pop esi
pop ebx
leave
ret