joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d28ee
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d2926
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d0966
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d093e
jmp 0x4d2932
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d40e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d412b
call fcn.004da416
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d412b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d4122
xor eax, eax
jmp 0x4d4133
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d4139
pop edi
pop esi
pop ebx
ret 4

Function at 0x4da946
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4da974
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4da992
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004da8ac
jmp 0x4da992
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4da992
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004da8ac
test edi, edi
mov eax, edi
jne 0x4da97c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x42e700
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0
push esi
push 0x42e730
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.004446c9
add esp, 0x18
mov dword [esi + 0x1c], eax
pop esi
pop ecx
ret

Function at 0x42f0e0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
lea ecx, [esp + 4]
xor eax, eax
push ecx
push eax
push esi
push 0x42f110
push eax
push eax
mov dword [esp + 0x1c], eax
mov dword [esi + 0x4c], eax
call fcn.004446c9
add esp, 0x18
mov dword [esi + 0x20], eax
mov eax, 1
pop esi
pop ecx
ret
Function at 0x434040
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0
push esi
push 0x4341f0
push 0
push 0
mov dword [esi], 0
mov dword [esp + 0x1c], 0
call fcn.004446c9
add esp, 0x18
mov dword [esi + 8], eax
pop esi
pop ecx
ret

Function at 0x439e30
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4
Function at 0x43f220
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x442210
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1000
call fcn.00443b20
push esi
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 8]
push 0x800
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push 0x465bdc
push eax
call fcn.00443ad6
mov esi, dword [esp + 0x101c]
push 0x800
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.004452a9
push 0x800
lea edx, [esp + 0x24]
push 0x465bb0
push edx
call fcn.004452a9
push 0x800
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004452a9
push 0x800
lea ecx, [esp + 0x3c]
push str.vL
push ecx
call fcn.004452a9
mov edx, dword [esp + 0x1048]
push 0x800
lea eax, [esp + 0x48]
push edx
push eax
call fcn.004452a9
add esp, 0x48
lea ecx, [esp + 8]
push 0x800
push 0x465b70
push ecx
call fcn.004452a9
add esp, 0xc
lea edx, [esp + 8]
push 0x14
push esi
push edx
call dword [0x45a448]
push eax
call dword [0x45a3a0]
mov esi, eax
cmp esi, 6
jne 0x442310
call fcn.00442010
test eax, eax
je 0x4422f8
call fcn.00442030
test eax, eax
je 0x4422f8
push 5
push 0
push 0
push str.http:__down.360safe.com_setupbeta.exe
jmp 0x442303
push 5
push 0
push 0
push 0x4657fc
push str.open
push 0
call dword [0x45a358]
mov eax, dword [esp + 0x1014]
test eax, eax
je 0x442322
push 0
call fcn.00445198
mov eax, esi
pop edi
pop esi
add esp, 0x1000
ret
Function at 0x4046cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x78]
add esi, edi
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jbe 0x404709
lea eax, [edi + ebx*4]
add eax, dword [esi + 0x20]
push 0xffffffffffffffff
mov eax, dword [eax]
push 0xffffffffffffffff
add eax, edi
push eax
push dword [esp + 0x20]
call fcn.0040839f
add esp, 0x10
test eax, eax
je 0x40470f
inc ebx
cmp ebx, dword [esi + 0x18]
jb 0x4046e4
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi + 0x1c]
lea eax, [eax + ebx*4]
mov eax, dword [eax + edi]
add eax, edi
jmp 0x40470b

Function at 0x405239
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], ebx
call dword [0x40ebe0]
test eax, eax
je 0x405327
cmp dword [ebp - 0xc], 0xc8
jne 0x405327
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [0x40ee30]
mov esi, eax
cmp esi, 0xffffffff
je 0x405327
mov byte [ebp - 1], bl
push ebx
push dword [ebp + 0x10]
call dword [0x40ee28]
test eax, eax
je 0x4052cd
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call dword [0x40ebd4]
test eax, eax
jne 0x4052d1
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x405301
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x410]
push eax
push esi
call dword [0x40ee60]
test eax, eax
je 0x4052f8
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x4052fc
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x4052a2
push esi
call dword [0x40ee70]
push esi
call dword [0x40ee1c]
cmp byte [ebp - 1], bl
je 0x40531d
push dword [ebp + 0xc]
call fcn.00408f62
pop ecx
xor eax, eax
cmp byte [ebp - 1], bl
sete al
jmp 0x405329
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x405df2
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, eax
test esi, esi
jne 0x405e3a
push 4
push edi
call dword [0x40eee4]
test eax, eax
jne 0x405e64
cmp word [edi], 0x5a4d
jne 0x405e64
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x405e64
lea esi, [eax + 0x80]
push 8
push esi
call dword [0x40eee4]
test eax, eax
jne 0x405e64
cmp dword [esi + 4], eax
je 0x405e64
mov esi, dword [esi]
test esi, esi
je 0x405e64
add esi, edi
push ebx
push 0x14
push esi
xor bl, bl
call dword [0x40eee4]
test eax, eax
jne 0x405e92
mov eax, dword [esi + 0xc]
test eax, eax
je 0x405e8e
push 2
add eax, edi
push eax
call dword [0x40eee4]
test eax, eax
je 0x405e68
mov bl, 1
jmp 0x405e7e
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0xc]
push dword [esp + 0xc]
add eax, edi
push eax
xor bl, bl
call dword [0x40ee04]
test eax, eax
je 0x405e92
push 0x14
add esi, 0x14
push esi
call dword [0x40eee4]
test eax, eax
je 0x405e4a
test bl, bl
jne 0x405ea8
push 0x14
push esi
call dword [0x40eee4]
test eax, eax
jne 0x405ea8
cmp dword [esi + 0xc], eax
je 0x405ea8
mov eax, esi
jmp 0x405eaa
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4091a9
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
mov eax, edx
and eax, 0xffff0000
je 0x4091de
cmp word [eax], 0x5a4d
jne 0x4091d7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp ecx, edx
ja 0x4091d7
cmp dword [ecx], 0x4550
jne 0x4091d7
mov ecx, dword [ecx + 0x50]
add ecx, eax
cmp ecx, edx
ja 0x4091e0
sub eax, 0x10000
jne 0x4091b6
xor eax, eax
ret

Function at 0x4091e1
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
and esi, 0xffff0000
push edi
je 0x409239
push 0x40
push esi
call dword [0x40eee4]
test eax, eax
jne 0x409231
cmp word [esi], 0x5a4d
jne 0x409231
mov eax, dword [esi + 0x3c]
lea edi, [eax + esi]
cmp edi, ebx
ja 0x409231
push 0xf8
push edi
call dword [0x40eee4]
test eax, eax
jne 0x409231
cmp dword [edi], 0x4550
jne 0x409231
mov eax, dword [edi + 0x50]
add eax, esi
cmp eax, ebx
ja 0x40923f
sub esi, 0x10000
jne 0x4091f2
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov eax, esi
jmp 0x40923b
Function at 0x10006290
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov edx, 1
push esi
push edi
mov esi, 0x1571
mov dword [ebx + 0x1384], 0xffffffff
lea edi, [ebx + 8]
mov dword [ebx + 4], 0x1571
mov eax, esi
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, esi
imul esi, eax, 0x6c078965
add esi, edx
inc edx
mov dword [edi - 4], esi
cmp edx, 0x270
jl 0x100062b6
push 0x1388
push dword [ebp + 8]
mov dword [ebx], 0x270
push ebx
call fcn.1003c9b0
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10006300
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
lea ecx, [ecx]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jl 0x10006320
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x10006350
Capabilities:
Access peb ldr_data
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006cf01
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x10089320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x30]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call esi
test eax, eax
jne 0x100063df
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], str.Couldnt_initialize_start_time
push eax
lea ecx, [ebp - 0x28]
call fcn.1003c3c1
mov dword [ebp - 0x28], vtable.std::runtime_error.0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.10006030
lea eax, [edi + 0x38]
push eax
call esi
test eax, eax
jne 0x10006413
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], str.Couldnt_initialize_start_time
push eax
lea ecx, [ebp - 0x28]
call fcn.1003c3c1
mov dword [ebp - 0x28], vtable.std::runtime_error.0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
call fcn.10006030
lea eax, [edi + 0x40]
push eax
call esi
test eax, eax
jne 0x10006447
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], str.Couldnt_initialize_start_time
push eax
lea ecx, [ebp - 0x28]
call fcn.1003c3c1
mov dword [ebp - 0x28], vtable.std::runtime_error.0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
call fcn.10006030
lea eax, [edi + 0x48]
push eax
call esi
test eax, eax
jne 0x1000647b
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], str.Couldnt_initialize_start_time
push eax
lea ecx, [ebp - 0x28]
call fcn.1003c3c1
mov dword [ebp - 0x28], vtable.std::runtime_error.0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
push eax
call fcn.10006030
lea eax, [edi + 0x50]
push eax
call esi
test eax, eax
jne 0x100064af
lea eax, [ebp + 8]
mov dword [ebp + 8], str.Couldnt_initialize_start_time
push eax
lea ecx, [ebp - 0x34]
call fcn.1003c3c1
mov dword [ebp - 0x34], vtable.std::runtime_error.0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 4
push eax
call fcn.10006030
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
lea ecx, [edi + 0x84]
mov dword [ebp - 4], 5
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
call fcn.100075c0
mov dword [edi + 0x84], eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.10007170
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x80], eax
mov dword [edi + 0x58], ecx
mov eax, dword [ecx]
push edx
call dword [eax + 0xc]
movss xmm1, dword [ebp - 0x18]
mov ecx, edi
subss xmm1, dword [0x10072af0]
movss xmm0, dword [ebp - 0x1c]
movss dword [edi], xmm0
movss xmm0, dword [ebp - 0x14]
movss dword [edi + 8], xmm0
movss dword [edi + 4], xmm1
mov eax, dword [edi + 0x80]
mov eax, dword [eax + 0xbc]
mov dword [edi + 0x28], eax
call fcn.10008060
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100067d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
dec eax
mov ecx, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
test eax, eax
je 0x1000687c
lea esp, [esp]
mov ecx, dword [edi + 4]
dec ecx
shl esi, cl
add esi, esi
mov dword [ebp - 4], esi
jmp 0x10006800
mov esi, dword [edi]
mov eax, dword [esi]
cmp eax, 0x270
jne 0x10006814
mov ecx, esi
call fcn.100077e0
jmp 0x10006822
cmp eax, 0x4e0
jb 0x10006822
mov ecx, esi
call fcn.10007720
mov eax, dword [esi]
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [edi + 8]
ja 0x10006800
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 4]
dec ecx
shl ebx, cl
or esi, eax
mov ecx, dword [ebp + 8]
add ebx, ebx
or ebx, dword [edi + 8]
lea eax, [ecx - 1]
cmp ebx, eax
jb 0x100067f0
xor edx, edx
mov eax, ebx
div ecx
mov ecx, eax
mov ebx, edx
xor edx, edx
mov eax, esi
div dword [ebp + 8]
cmp eax, ecx
mov ecx, dword [ebp + 8]
jb 0x1000689f
lea eax, [ecx - 1]
cmp ebx, eax
jne 0x100067e0
mov eax, esi
xor edx, edx
div ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10007680
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
mov edi, edi
mov ecx, dword [edi + 4]
dec ecx
shl ebx, cl
add ebx, ebx
jmp 0x100076a0
mov esi, dword [edi]
mov eax, dword [esi]
cmp eax, 0x270
jne 0x100076b4
mov ecx, esi
call fcn.100077e0
jmp 0x100076c2
cmp eax, 0x4e0
jb 0x100076c2
mov ecx, esi
call fcn.10007720
mov eax, dword [esi]
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [edi + 8]
ja 0x100076a0
mov eax, dword [ebp - 4]
or ebx, ecx
add eax, dword [edi + 4]
mov dword [ebp - 4], eax
cmp eax, 0x20
jb 0x10007690
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007720
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
dec ecx
jne 0x10007730
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi]
lea esi, [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
dec edi
jne 0x10007770
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret

Function at 0x100077e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea eax, [ecx + 8]
mov esi, 0x270
lea esp, [esp]
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
dec esi
jne 0x100077f0
pop esi
ret
Function at 0x10012680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e0cf
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10089320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], eax
lea esi, [edi + 0x50]
mov dword [ebp - 4], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], ax
mov dword [esi + 0x38], 7
mov dword [esi + 0x34], eax
mov word [esi + 0x24], ax
lea ecx, [esi + 0x44]
mov byte [ebp - 4], 2
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
call fcn.10015120
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [edi + 0xb8], 7
mov dword [edi + 0xb4], 0
mov word [edi + 0xa4], ax
mov dword [edi + 0xd0], eax
mov dword [edi + 0xd4], eax
mov dword [edi + 0xd8], eax
lea esi, [edi + 0xdc]
mov byte [ebp - 4], 4
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.10015150
mov dword [esi], eax
lea ecx, [esi + 8]
mov byte [ebp - 4], 5
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.10015150
mov dword [esi + 8], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100152f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e428
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10089320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x10015421
cmp byte [ebx + 0x46], 0
je 0x10015421
mov eax, dword [ebx]
push 0xffff
call dword [eax + 0xc]
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
jne 0x1001534f
xor al, al
jmp 0x10015423
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
nop
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100153ba
dec eax
je 0x100153be
sub eax, 2
je 0x1001540a
xor bl, bl
jmp 0x1001540c
mov byte [ebx + 0x46], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x100153f0
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1003e21c
add esp, 0x10
cmp esi, eax
jne 0x100153b6
cmp byte [ebx + 0x46], 0
je 0x1001540a
test esi, esi
jne 0x10015380
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10019210
jmp 0x10015380
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x1001541d
push dword [ebp - 0x28]
call fcn.1003b27d
add esp, 4
mov al, bl
jmp 0x10015423
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003c550
mov esp, ebp
pop ebp
ret
Function at 0x10040f28
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x406810
Capabilities:
Copy file

Disassembly:
sub esp, 0x210
push ebx
push esi
push edi
mov edi, dword [esp + 0x224]
test edi, edi
je 0x406956
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push edi
call ebx
add esp, 4
test eax, eax
je 0x406956
mov esi, dword [esp + 0x220]
test esi, esi
je 0x406956
push esi
call ebx
add esp, 4
test eax, eax
je 0x406956
push edi
call fcn.00439b70
add esp, 4
test eax, eax
je 0x406956
lea eax, [esp + 0x14]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
push 1
lea ecx, [esp + 0x20]
push 0
push ecx
call fcn.00438460
push esi
call ebx
lea eax, [esi + eax*2 - 2]
add esp, 0x18
cmp eax, esi
jb 0x40689f
cmp word [eax], 0x5c
je 0x40689f
sub eax, 2
cmp eax, esi
jae 0x406892
add eax, 2
lea edx, [esp + 0x14]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscat]
push esi
call fcn.00438aa0
lea eax, [esp + 0x20]
fstp st(0)
push eax
call fcn.00438aa0
mov eax, dword [esp + 0x238]
add esp, 0x10
test eax, eax
fstp st(0)
je 0x4068ee
push 0
lea ecx, [esp + 0x18]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
neg eax
add esp, 0x210
ret
push esi
call fcn.00438aa0
fstp qword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
call fcn.00438aa0
fcomp qword [esp + 0x14]
add esp, 8
fnstsw ax
test ah, 0x40
je 0x406938
push esi
call fcn.00439d70
mov edi, eax
lea eax, [esp + 0x18]
push eax
call fcn.00439d70
add esp, 8
cmp edi, eax
jne 0x406938
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x210
ret
lea ecx, [esp + 0x14]
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
neg eax
add esp, 0x210
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret
Function at 0x418930
Capabilities:
Delete file

Disassembly:
sub esp, 0x608
push ebx
push ebp
mov ebp, dword [esp + 0x614]
push esi
push 2
push 0
push ebp
call fcn.00444970
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x41895d
pop esi
pop ebp
pop ebx
add esp, 0x608
ret
mov ebx, dword [esp + 0x61c]
lea eax, [esp + 0x414]
lea ecx, [esp + 0x214]
push eax
push ecx
push 0
push 0
push ebx
call dword [sym.imp.MSVCRT.dll__wsplitpath]
mov eax, dword [esp + 0x634]
add esp, 0x14
test eax, eax
jne 0x4189b2
lea edx, [esp + 0x414]
lea eax, [esp + 0x214]
push edx
push eax
lea ecx, [esp + 0x14]
push 0x45821c
push ecx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
jmp 0x4189c1
lea edx, [esp + 0xc]
push eax
push edx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
push edi
push 2
push 0
lea eax, [esp + 0x18]
push ebx
push eax
push esi
call fcn.00444a00
push esi
mov edi, eax
call fcn.00440310
add esp, 0x18
test al, al
push esi
je 0x4189e9
call fcn.004402c0
jmp 0x4189ee
call fcn.00444b10
add esp, 4
test edi, edi
pop edi
je 0x418a09
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x608
ret
mov eax, dword [esp + 0x624]
test eax, eax
je 0x418a1b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x608
ret