joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022200
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bfe66
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xc0]
call fcn.10012980
push 0x100deb8c
lea eax, [ebp - 0xc0]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.10003d00
add esp, 0xc
lea eax, [ebp - 0xa8]
mov byte [ebp - 4], 1
push eax
call fcn.10006ad0
add esp, 4
test al, al
jne 0x10022316
mov edx, dword [ebp - 0x94]
cmp edx, 8
jb 0x100222b6
mov ecx, dword [ebp - 0xa8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100222ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10022488
push edx
push ecx
call fcn.1008a52b
add esp, 8
mov edx, dword [ebp - 0xac]
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
cmp edx, 8
jb 0x10022484
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002247a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002248d
jmp 0x1002247a
push 0x80
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.1008c730
add esp, 0xc
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0x94], 8
cmovae eax, dword [ebp - 0xa8]
push eax
push 0x40
lea eax, [ebp - 0x90]
push eax
push 0x100e1bcc
push str.ServiceTime
push 0x100deb6c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 0x100e1bcc
lea eax, [ebp - 0x90]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10022396
test dx, dx
je 0x10022392
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10022396
add eax, 4
add ecx, 4
test dx, dx
jne 0x10022370
xor eax, eax
jmp 0x1002239b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10022276
lea eax, [ebp - 0x90]
push eax
call fcn.1009b10c
mov esi, dword [ebp - 0x94]
add esp, 4
mov edi, eax
mov ebx, edx
cmp esi, 8
jb 0x100223f6
mov ecx, dword [ebp - 0xa8]
lea esi, [esi*2 + 2]
mov eax, ecx
cmp esi, 0x1000
jb 0x100223ec
mov ecx, dword [ecx - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10022488
push esi
push ecx
call fcn.1008a52b
add esp, 8
mov edx, dword [ebp - 0xac]
xor eax, eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
cmp edx, 8
jb 0x1002244f
mov ecx, dword [ebp - 0xc0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10022445
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10022488
push edx
push ecx
call fcn.1008a52b
add esp, 8
push ebx
push edi
call fcn.10036180
add esp, 8
test al, al
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
push edx
push ecx
call fcn.1008a52b
add esp, 8
mov al, 1
jmp 0x1002245e
call fcn.1008e2b2
call fcn.1008e2b2
int3
Function at 0x10022680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bfed8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.100ae190
add esp, 4
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], 0
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x680053
lea edx, [eax + 2]
mov dword [ebp - 0x3c], 0x650069
mov dword [ebp - 0x38], 0x64006c
mov dword [ebp - 0x34], 0x32005f
mov dword [ebp - 0x30], 0x340033
mov dword [ebp - 0x2c], 0x450035
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10022732
sub eax, edx
lea ecx, [ebp - 0x58]
sar eax, 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10003a30
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.10003a20
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x10022766
mov esi, dword [esi]
lea ecx, [ebp - 0x58]
call fcn.10010300
xor ecx, ecx
test al, al
setne cl
add ecx, 0x32
mov word [esi + 0xa], cx
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x44]
cmp edx, 8
jb 0x100227b9
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100227af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100227f1
push edx
push ecx
call fcn.1008a52b
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 4
call fcn.1008e2b2
int3

Function at 0x10022800
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x144]
push eax
call fcn.1000fb30
add esp, 4
test al, al
jne 0x1002283b
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 4
push esi
xor esi, esi
cmp dword [ebp - 0x140], 5
jne 0x10022879
mov eax, dword [ebp - 0x13c]
cmp eax, 2
jne 0x10022870
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [ebp - 0x2a], 1
jne 0x10022869
cmp word [ebp - 0x28], 9
je 0x10022875
mov esi, 1
jmp 0x10022884
cmp eax, 1
ja 0x10022879
xor esi, esi
jmp 0x10022884
mov eax, 1
cmp byte [ebp - 0x2a], al
cmovne esi, eax
call fcn.1000faa0
test al, al
mov edx, 0x40
mov ecx, 0x20
cmovne ecx, edx
push ecx
push esi
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push str._d._d._d._d
push edi
call fcn.10009560
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
mov al, 1
pop esi
pop edi
call fcn.1008a187
mov esp, ebp
pop ebp
ret 4
Function at 0x100281d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c086d
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x9c], ecx
push 8
lea eax, [ebp - 0x98]
mov dword [ebp - 0xac], ecx
push eax
mov dword [ebp - 0xa8], 0
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
mov esi, dword [ebp - 0x98]
xor ecx, ecx
and esi, 0xf
mov dword [ebp - 0xa0], 0
add esi, 5
mov edx, 2
mov dword [ebp - 0x9c], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1008aa7c
mov ebx, eax
add esp, 4
mov dword [ebp - 0xa0], ebx
lea eax, [esi*2 + 2]
mov dword [ebp - 4], 1
push eax
push 0
push ebx
call fcn.1008c730
mov ecx, 0x1f
lea edi, [ebp - 0x90]
mov esi, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
cmp dword [ebp - 0x9c], edi
jbe 0x100282f8
lea esi, [ebp - 0x90]
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100282b0
sub esi, ecx
sar esi, 1
nop
push 8
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
push 0
push esi
push dword [ebp - 0x94]
push dword [ebp - 0x98]
call fcn.1008aaf0
mov ax, word [ebp + eax*2 - 0x90]
mov word [ebx + edi*2], ax
inc edi
cmp edi, dword [ebp - 0x9c]
jl 0x100282c0
mov esi, dword [ebp - 0xa4]
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10028316
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
push ebx
call fcn.10003a30
mov dword [ebp - 0xa8], 1
mov byte [ebp - 4], 0
test ebx, ebx
je 0x10028349
push ebx
call fcn.1008a87c
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
Function at 0x1002a850
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c0ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x34]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0
call fcn.10006370
push 0x80
push 4
push 1
push 0x80000000
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.100117f0
test al, al
je 0x1002aa02
mov esi, dword [ebp - 0x34]
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
test esi, esi
je 0x1002a8f1
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1002a8f1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1002a8eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1002a8f1
xor edi, edi
mov edi, ebx
jmp 0x1002a8f4
mov edi, dword [ebp - 0x40]
lea eax, [edi + 1]
push eax
call fcn.1008aa7c
push edi
mov ebx, eax
push 0
push ebx
call fcn.1008c730
add esp, 0x10
mov dword [ebp - 0x30], 0
test esi, esi
je 0x1002a9dd
test ebx, ebx
je 0x1002a9dd
cmp dword [esi], 0xffffffff
je 0x1002a9dd
push 0
lea eax, [ebp - 0x30]
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002a9dd
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1002a95b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1002a95b
mov dword [esi], 0xffffffff
push dword [ebp - 0x30]
mov edx, ebx
lea ecx, [ebp - 0x2c]
call fcn.10036590
push ebx
mov byte [ebp - 4], 1
call fcn.1008a87c
mov eax, dword [ebp - 0x38]
add eax, 0x48
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10008fa0
add esp, 0x10
test eax, eax
sete bl
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x1002a9c4
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002a9ba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002aa33
push edx
push ecx
call fcn.1008a52b
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], al
jmp 0x1002aa04
push ebx
call fcn.1008a87c
add esp, 4
test esi, esi
je 0x1002aa02
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1002aa02
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1002aa02
mov dword [esi], 0xffffffff
xor bl, bl
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10011780
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 8
call fcn.1008e2b2
int3
Function at 0x1002ce90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c0f5d
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.100b7420
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1010]
mov ebx, dword [ebp + 0xc]
push 0x1000
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x1030], esi
push eax
mov dword [ebp - 0x1014], 0
call fcn.1008c730
mov edx, dword [edi + 8]
add esp, 0xc
cmp dword [edx + 0x14], 8
jb 0x1002cf02
mov edx, dword [edx]
mov eax, dword [edi + 4]
cmp dword [eax + 0x14], 8
jb 0x1002cf0d
mov eax, dword [eax]
mov ecx, dword [edi]
cmp dword [ecx + 0x14], 8
jb 0x1002cf17
mov ecx, dword [ecx]
push edx
push 0x7fe
lea edx, [ebp - 0x1010]
push edx
push 0x100e1bcc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x1010]
lea edi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1002cf40
sub edx, edi
lea eax, [ebp - 0x1010]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.10003a30
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1010]
xor eax, eax
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 7
mov word [ebp - 0x102c], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002cfd0
sub ecx, edx
lea eax, [ebp - 0x1010]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x102c]
call fcn.10003a30
push esi
lea eax, [ebp - 0x102c]
mov dword [ebp - 4], 1
push 0x7c
push eax
call fcn.100099c0
add esp, 0xc
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x1018]
cmp edx, 8
jb 0x1002d04e
mov ecx, dword [ebp - 0x102c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d044
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002d08e
push edx
push ecx
call fcn.1008a52b
add esp, 8
xor eax, eax
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 7
mov word [ebp - 0x102c], ax
mov byte [ebp - 4], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 8
call fcn.1008e2b2
int3
Function at 0x1002d810
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
call fcn.10006ad0
mov ecx, dword [esi + 0x14]
add esp, 4
test al, al
jne 0x1002d864
cmp ecx, 8
jb 0x1002d842
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x1002d84a
mov edi, dword [edi]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 8
mov eax, esi
cmp ecx, 8
jb 0x1002d86d
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call ebx
test eax, eax
je 0x1002d8a6
cmp dword [esi + 0x14], 8
jb 0x1002d883
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x1002d88b
mov edi, dword [edi]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 8
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.1008c730
lea eax, [ebp - 0x804]
push eax
call fcn.1009b84a
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
call ebx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1002d8db
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x804]
push ecx
push eax
call ebx
mov ecx, dword [esi + 0x14]
test eax, eax
je 0x1002d918
cmp ecx, 8
jb 0x1002d8f9
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x1002d901
mov edi, dword [edi]
push esi
push edi
call ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 8
cmp ecx, 8
jb 0x1002d91f
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x1002d927
mov edi, dword [edi]
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1008a187
mov esp, ebp
pop ebp
ret 8
Function at 0x1002d950
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c0ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x34]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0
call fcn.10006370
push 0x80
push 4
push 1
push 0x80000000
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.100117f0
test al, al
je 0x1002db19
mov esi, dword [ebp - 0x34]
xorps xmm0, xmm0
movlpd qword [ebp - 0x40], xmm0
test esi, esi
je 0x1002d9f1
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1002d9f1
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1002d9eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1002d9f1
xor edi, edi
mov edi, ebx
jmp 0x1002d9f4
mov edi, dword [ebp - 0x40]
lea eax, [edi + 1]
push 0x10101880
push eax
call fcn.1008ab65
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1002dafd
push edi
push 0
push ebx
call fcn.1008c730
add esp, 0xc
mov dword [ebp - 0x30], 0
test esi, esi
je 0x1002daf4
cmp dword [esi], 0xffffffff
je 0x1002daf4
push 0
lea eax, [ebp - 0x30]
push eax
push edi
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002daf4
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1002da63
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1002da63
mov dword [esi], 0xffffffff
push dword [ebp - 0x30]
mov edx, ebx
lea ecx, [ebp - 0x2c]
call fcn.10036590
push ebx
mov byte [ebp - 4], 1
call fcn.1008a87c
mov ecx, dword [ebp - 0x38]
mov edx, 0x84
mov eax, 0x34
cmp byte [ecx], 0
cmove eax, edx
add eax, ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10008fa0
add esp, 0x10
test eax, eax
sete bl
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x1002dadb
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1002dad1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002db4a
push edx
push ecx
call fcn.1008a52b
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], al
jmp 0x1002db1b
push ebx
call fcn.1008a87c
add esp, 4
test esi, esi
je 0x1002db19
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1002db19
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1002db19
mov dword [esi], 0xffffffff
xor bl, bl
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10011780
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 8
call fcn.1008e2b2
int3
Function at 0x1002dbf0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
push esi
call fcn.10006ad0
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 4
test al, al
je 0x1002dc20
cmp dword [esi + 0x14], 8
jb 0x1002dc19
mov esi, dword [esi]
push 4
push 0
push esi
call ebx
mov esi, dword [ebp + 8]
push esi
call fcn.10006ad0
add esp, 4
test al, al
je 0x1002dc3f
cmp dword [esi + 0x14], 8
jb 0x1002dc38
mov esi, dword [esi]
push 4
push 0
push esi
call ebx
push edi
call fcn.10006940
add esp, 4
test al, al
je 0x1002dc5b
cmp dword [edi + 0x14], 8
jb 0x1002dc54
mov edi, dword [edi]
push 4
push 0
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10033950
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100f3558
push 0x1008ba60
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x1010001c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x438], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.10003a20
mov dword [ebp - 0x43c], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x100339b9
mov eax, dword [eax]
lea ecx, [ebp - 0x43c]
push ecx
push eax
call fcn.10003b90
add esp, 8
mov edx, esi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.10033ad0
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x10033a07
test bl, bl
jne 0x10033aa4
cmp edi, 0x1a
jne 0x10033aa4
mov ecx, esi
call fcn.10003a20
mov dword [ebp - 0x438], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x10033a38
mov eax, dword [eax]
lea ecx, [ebp - 0x438]
push ecx
push eax
call fcn.10003b90
push 0x410
push 0
lea eax, [ebp - 0x430]
push eax
call fcn.1008c730
add esp, 0x14
push 0x207
lea eax, [ebp - 0x430]
push eax
push 0x100e2e2c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x430]
push eax
call fcn.10003bf0
add esp, 4
push eax
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.10003a30
mov ecx, esi
call fcn.10004080
movzx ebx, bl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
Function at 0x10036960
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c29b4
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1010001c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10003a00
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10003a00
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10003a00
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10003a00
mov byte [ebp - 4], 3
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.10003a00
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret