joyce8/EMBER2024-capa huggingface dataset:
Function at 0x688ddb85
Capabilities:
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov byte [eax + 0x38], 1
movzx edi, byte [eax + 0x3b]
mov dword [ebp - 0x1c], ecx
dec edi
cmp esi, edi
jge 0x688ddc5e
movzx eax, byte [ebx + 0x3a]
lea eax, [esi + eax + 1]
cdq
idiv edi
imul eax, edx, 0x48
lea ecx, [ebx + eax + 0x40]
cmp dword [ebx + eax + 0x44], 0
mov dword [ebp - 0x1c], ecx
jne 0x688ddbd1
imul edx, edx, 0x48
cmp dword [ebx + edx + 0x40], 0
je 0x688ddbe8
inc esi
jmp 0x688ddba0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
call fcn.688d2c1b
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x688ddbc4
jmp 0x688ddc76
mov edx, dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
mov eax, dword [ebp - 0x1c]
lea esi, [ebx + 0x24]
sub edx, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x1c]
sar edx, 3
imul edx, edx, 0x38e38e39
lea edi, [ecx + 0x10]
mov ecx, 3
mov byte [ebx + 0x3a], dl
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x2c], edx
test eax, eax
je 0x688ddc2b
mov dword [ebx + 0x28], eax
call fcn.688c8584
mov dword [ebx + 0x34], eax
jmp 0x688ddc41
cmp dword [ebx + 0x28], 0
je 0x688ddc41
mov eax, dword [ebx + 0x34]
cdq
call fcn.688d4a82
mov dword [ebx + 0x28], eax
test eax, eax
je 0x688ddc57
mov ecx, dword [ebp - 0x1c]
add esp, 0x1c
mov edx, 0x688ddb68
pop ebx
pop esi
mov eax, ecx
pop edi
pop ebp
jmp fcn.688d6120
mov eax, 7
jmp 0x688ddc76
jne 0x688ddbe8
imul esi, esi, 0x48
add esp, 0x1c
lea edx, [ebx + 0x24]
lea eax, [ebx + esi + 0x40]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.688dd9ed
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x688f4edf
Capabilities:
Print debug messages

Disassembly:
push ebp
mov eax, 0x101c
mov ebp, esp
push edi
push esi
push ebx
call fcn.6894a260
sub esp, eax
cmp dword [ebp + 0xc], 0
mov esi, dword [ebp + 8]
mov ebx, dword [0x68a2bae4]
jle 0x688f4f28
lea edx, [ebp - 0x1014]
xor eax, eax
mov ecx, 0x3ff
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, 0xffb
cmp dword [ebp + 0xc], eax
cmovle eax, dword [ebp + 0xc]
mov edi, edx
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp], edx
jmp 0x688f4f2b
mov dword [esp], esi
call ebx
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6893be64
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov byte [eax + 0x10], 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 4], str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [esp], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
call fcn.6893a30e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x6893bec9
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov dword [esp], ebx
call fcn.6893a30e
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6893fd03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
mov ecx, 6
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.6893f818

Function at 0x6893fd1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.6893f818

Function at 0x68949740
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.68958ce0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.68958ce0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x689497a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x68abf3e4]
test esi, esi
jle 0x689498c0
mov eax, dword [0x68abf3e8]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x689497d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x68949857
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x689497c0
mov dword [esp], ebx
call fcn.68949f90
mov edi, eax
test eax, eax
je 0x689498e7
mov eax, dword [0x68abf3e8]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6894a0d0
mov edx, dword [0x68abf3e8]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x689498c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x68949850
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x68949860
add dword [0x68abf3e4], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x68abf3e8]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x68949850
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.68949740
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x689497de
mov eax, dword [0x68abf3e8]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.68949740
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.68949740
lea esi, [esi]
nop
Function at 0x68949c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x68abf3f4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x68abf3ec]
sub esp, 4
test ebx, ebx
je 0x68949c55
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x68949c4e
test esi, esi
je 0x68949c4e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x68949c30
mov dword [esp], 0x68abf3f4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x68949f90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x688c0000], 0x5a4d
jne 0x68949fb5
mov ecx, dword [0x688c003c]
cmp dword [ecx + 0x688c0000], 0x4550
lea edx, [ecx + 0x688c0000]
je 0x68949fc0
ret
cmp word [ecx + 0x688c0018], 0x10b
jne 0x68949fb5
push esi
movzx eax, word [ecx + 0x688c0014]
push ebx
movzx esi, word [ecx + 0x688c0006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x688c0000
test si, si
je 0x6894a008
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x68949ffe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6894a00a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x68949ff0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x6894fb50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x220
mov ebx, dword [esp + 0x230]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x6894fcd0
cmp word [ebx], 0
je 0x6894fcb0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x6894fce0
test al, 0x10
je 0x6894fcb0
lea esi, [esp + 0x18]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sub.msvcrt.dll__wfullpath
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x68a41180
mov ebx, eax
call sub.msvcrt.dll_wcslen
mov dword [esp], 0x68a41184
add ebx, eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 0x21d]
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x6894fcef
lea edi, [eax + 0x434]
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_wcscpy
cmp word [ebx + 0x434], 0
jne 0x6894fc68
mov dword [esp], edi
mov dword [esp + 4], 0x68a41184
call sub.msvcrt.dll_wcscat
lea edx, [ebx + 0x224]
xor eax, eax
mov ecx, 0x82
mov dword [ebx + 0x42c], 0xffffffff
mov edi, edx
mov dword [ebx + 0x430], 0
mov dword [ebx + 0x21c], 0
mov dword [ebx + 0x220], 0
rep stosd dword es:[edi], eax
add esp, 0x220
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
cmp word [ebx + eax*2 + 0x432], 0x2f
je 0x6894fc0d
mov dword [esp], edi
call sub.msvcrt.dll_wcslen
cmp word [ebx + eax*2 + 0x432], 0x5c
je 0x6894fc0d
mov dword [esp + 4], 0x68a41180
mov dword [esp], edi
call sub.msvcrt.dll_wcscat
jmp 0x6894fc0d
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 0x14
add esp, 0x220
mov eax, ebx
pop ebx
pop esi
pop edi
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 0xe
jmp 0x6894fcbd
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 2
jmp 0x6894fcbd
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 0xc
jmp 0x6894fcbd
Function at 0x6895995c
Capabilities:
Resume thread

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x10], eax
lea eax, [ebp + 0x14]
mov dword [esp + 0xc], 4
mov dword [esp + 8], eax
mov eax, dword [esi + 0xa4]
add eax, 8
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp + 0x10]
sub esp, 0x14
mov eax, dword [eax + 0x28]
add eax, dword [ebp + 0x14]
mov dword [esi + 0xb0], eax
mov dword [esp + 4], esi
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push edx
push edx
mov eax, dword [ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov eax, dword [ebx + 4]
mov dword [esp], eax
call esi
push eax
mov eax, dword [ebx]
mov dword [esp], eax
call esi
push eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x68959b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov eax, dword [eax + 0x50]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub esp, 0x14
leave
ret

Function at 0x68959be0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x2c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
movzx eax, word [eax + 6]
cmp eax, ebx
jle 0x68959c3f
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0x3c]
imul ecx, ebx, 0x28
inc ebx
lea eax, [edx + eax + 0xf8]
add eax, ecx
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 0x14]
add ecx, edx
mov dword [esp + 8], ecx
mov edx, dword [ebp + 0x18]
add edx, dword [eax + 0xc]
mov dword [esp + 4], edx
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x14
jmp 0x68959bf1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x68959cb0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
leave
setne al
ret
Function at 0x6895ba20
Capabilities:
Create directory

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x10
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x6895ba58
call fcn.689e66d0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret
call dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [eax]
cmp edi, 0x11
je 0x6895ba80
call fcn.689e66e0
mov dword [ebx], edi
mov dword [ebx + 4], eax
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.689bbdf0
cmp al, 2
jne 0x6895ba65
xor eax, eax
jmp 0x6895ba71
Function at 0x6895c1f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x68a3c035
push ebx
sub esp, 0x9c
mov eax, dword [0x68a3c034]
mov dword [ebp - 0x81], eax
mov eax, dword [0x68a3c099]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.6894a260
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
mov dword [ebp - 0x8c], edx
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.68a1d20c
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x68a2d090], 0
jne 0x6895c316
mov byte [0x68a2d090], 1
call fcn.68a1c120
test eax, eax
je 0x6895c2e4
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.689493e0
mov dword [esp], 2
mov esi, dword [fcn.68958ce0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x6895c2d4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x68a3bc05
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x68a1d0fc
jmp 0x68a1d0f4
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x6895c29a
mov dword [esp], 2
call dword [0x68a2be80]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x68a1d0ef
mov dword [esp], 2
call dword [0x68a2be80]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x68a3bbb4
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
mov ebx, ecx
sub esp, 0x18
mov dword [ecx], 0x68a60310
call fcn.68a0f5a0
mov dword [esp], ebx
mov dword [esp + 4], 4
call fcn.68a1beb0
add esp, 0x18
pop ebx
ret
Function at 0x689bbba0
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 4], ebx
call fcn.689b8ad0
test al, al
je 0x689bbbfb
cmp al, 0xff
je 0x689bbc08
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.689bbdf0
cmp al, 2
je 0x689bbc20
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
jne 0x689bbc32
mov eax, dword [ebx]
test eax, eax
jne 0x689bbbfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.689e66d0
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.689e66d0
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x689bbbfb
mov eax, dword [esi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
sub esp, 4
test eax, eax
je 0x689bbbd1
call fcn.689e66d0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret

Function at 0x689bbca0
Capabilities:
Move file

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.689bbdf0
cmp al, 0xff
je 0x689bbd08
mov ecx, dword [ebx]
test ecx, ecx
jne 0x689bbcfe
test al, al
jne 0x689bbd20
mov dword [esp + 8], 3
mov eax, dword [esi]
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
je 0x689bbd70
call fcn.689e66d0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call fcn.689e66d0
mov dword [ebx], 0
mov dword [ebx + 4], eax
jmp 0x689bbccc
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0x1c], eax
call fcn.689bbdf0
mov edx, dword [ebx]
test edx, edx
jne 0x689bbcfe
mov ecx, dword [esp + 0x1c]
cmp cl, 2
je 0x689bbd58
cmp al, 2
jne 0x689bbccc
call fcn.689e66e0
mov dword [ebx], 0x14
mov dword [ebx + 4], eax
jmp 0x689bbcfe
cmp al, 2
je 0x689bbccc
call fcn.689e66e0
mov dword [ebx], 0x15
mov dword [ebx + 4], eax
jmp 0x689bbcfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x689bbda0
call edi
mov dword [eax], 5
call fcn.689e66e0
mov esi, eax
call edi
mov eax, dword [eax]
mov dword [ebx + 4], esi
mov dword [ebx], eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
call edi
mov dword [eax], 0xd
jmp 0x689bbd89
Function at 0x689c3450
Capabilities:
Get disk size

Disassembly:
push esi
push ebx
sub esp, 0x34
lea eax, [esp + 0x28]
mov dword [esp + 0x18], 0
mov ebx, dword [esp + 0x50]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
sub esp, 0x10
test eax, eax
je 0x689c3518
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov eax, esi
or eax, ecx
je 0x689c34cc
mov eax, dword [esp + 0x44]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, esi
or eax, ecx
je 0x689c34e3
mov eax, dword [esp + 0x48]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, esi
or eax, ecx
jne 0x689c3508
call fcn.689e66d0
mov dword [ebx], 0
mov dword [ebx + 4], eax
add esp, 0x34
pop ebx
pop esi
ret
mov eax, dword [esp + 0x4c]
mov dword [eax], esi
mov dword [eax + 4], ecx
jmp 0x689c34f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.689e66d0
mov dword [ebx], esi
mov dword [ebx + 4], eax
add esp, 0x34
pop ebx
pop esi
ret

Function at 0x689c8340
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x689c8380
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x689c8351
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x8b76f2
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0xdecacb
mov eax, 0x5a4d
test bp, 0x6cf6
cmp word [ecx], ax
jmp 0xdecac5
ret
mov eax, dword [ecx + 0x3c]
jmp 0xdbe78a
push ebp
mov ebp, esp
sal cx, 0x61
test di, 0x3fca
mov ecx, dword [ebp + 8]
sub esp, 0x114
test bh, 0xcb
push esi
cmc
test ecx, ecx
je 0xdecacb
mov esi, dword [ebp + 0xc]
jmp 0xdb4f8a
mov esp, ebp
pop ebp
jmp 0x81812b
je 0xdecacb
mov eax, dword [eax + ecx + 0x7c]
push ebx
stc
push edi
jmp 0x860492
test esi, esi
jmp 0x814dc4
cmp dword [eax + ecx], 0x4550
jne 0xdecacb
mov edx, dword [eax + ecx + 0x78]
cmc
test bl, 0x91
mov dword [ebp - 4], edx
stc
cmp ecx, 0x485f0769
test edx, edx
jmp 0xd5c97b
je 0x830794
xor eax, eax
mov si, 0x6fec
pop esi
jmp 0x9c65e9
Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10020cc1
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10020cc1
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10