joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x40115f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x2c], 1
je 0x401178
movzx esi, word [esp + 0x30]
xor eax, eax
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x402660], eax
mov dword [ebp - 0x4c], 0x30
call fcn.0040114f
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x401050
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Lyrik
mov dword [ebp - 0x20], eax
call fcn.00401142
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x40124c
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0x80
push str.Dindom
push str.Lyrik
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x402668], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402668]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x40124c
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401230
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42ffd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x910900
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.00901340
mov eax, dword [0x98eb88]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi + 0x18]
push dword [esi]
push dword [esi + 0x10]
push 0x958308
push 3
call fcn.00902480
mov eax, dword [esi + 0x18]
push 0x958350
push 0x1004
movsx ax, byte [eax]
mov dword [ebp - 0xa], 0x3a
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x2014]
push eax
call fcn.00930860
lea eax, [ebp - 0x2014]
push eax
call fcn.00930660
lea ecx, [ebp - 0x2014]
push str.D:_tinderbox_add_7.0_srcVBoxAdditionscommonVBoxServiceVBoxServiceAutoMount.cpp
push 0
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x2018], ecx
mov ecx, 0x2008
sub ecx, eax
lea eax, [ebp - 0x2018]
push ecx
push eax
push 0xffffffffffffffff
push dword [esi + 0x10]
call fcn.0092f2a0
mov edi, eax
add esp, 0x3c
test edi, edi
jns 0x9109c5
push edi
push dword [esi + 0x10]
push 0x95835c
call fcn.00901db0
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2014]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x9583a0
push 3
call fcn.00902480
push 0x20
lea eax, [ebp - 0x2038]
push 0
push eax
call fcn.00901060
add esp, 0x1c
mov dword [ebp - 0x2034], 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0x201c], 0x9583e0
mov dword [ebp - 0x2028], eax
lea eax, [ebp - 0x2014]
mov dword [ebp - 0x2024], eax
mov eax, dword [ebp - 0x2018]
push 0
push 0
mov dword [ebp - 0x2020], eax
lea eax, [ebp - 0x2038]
push 0
push eax
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
test edi, edi
jne 0x910a62
push dword [esi + 0x18]
push dword [esi + 0x10]
push 0x958414
push eax
call fcn.00902480
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
push edi
call fcn.0091bf10
push edi
push eax
push dword [esi + 0x18]
push dword [esi + 0x10]
push 0x958450
call fcn.00901db0
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
mov eax, 0xffffff9b
pop edi
pop esi
call fcn.00901200
mov esp, ebp
pop ebp
ret
Function at 0x912e10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x98eb88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00901060
push 0x104
lea eax, [ebp - 0x4b0]
push 0
push eax
call fcn.00901060
push 0x124
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.00901060
add esp, 0x24
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
push eax
push str._sdrivers
lea eax, [ebp - 0x22c]
push 0x124
push eax
call fcn.00915890
lea eax, [ebp - 0x108]
mov dword [ebp - 0x51c], str.VBoxControl.exe
mov dword [ebp - 0x520], eax
add esp, 0x10
mov dword [ebp - 0x518], eax
xor esi, esi
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4e0], eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x514], str.VBoxHook.dll
mov dword [ebp - 0x50c], str.VBoxDisp.dll
mov dword [ebp - 0x504], str.VBoxTray.exe
mov dword [ebp - 0x4fc], str.VBoxService.exe
mov dword [ebp - 0x4f4], str.VBoxMRXNP.dll
mov dword [ebp - 0x4ec], str.VBoxGINA.dll
mov dword [ebp - 0x4e4], str.VBoxCredProv.dll
mov dword [ebp - 0x4dc], str.VBoxOGL.dll
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x4d4], str.VBoxGuest.sys
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4cc], str.VBoxMouseNT.sys
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], str.VBoxMouse.sys
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], str.VBoxSF.sys
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], str.VBoxVideo.sys
jmp 0x912fa0
mov edi, dword [ebp + esi*8 - 0x51c]
lea eax, [ebp - 0x2ac]
push 0x80
push eax
push edi
push dword [ebp + esi*8 - 0x520]
call fcn.00903380
push edi
push str._VirtualBox_GuestAdd_Components__s
mov ebx, eax
lea eax, [ebp - 0x3ac]
push 0x100
push eax
call fcn.00915890
add esp, 0x20
cmp ebx, 0xffffff9a
je 0x913006
cmp ebx, 0xffffff99
je 0x913006
lea eax, [ebp - 0x2ac]
push eax
push 0x94f200
lea eax, [ebp - 0x3ac]
push eax
push dword [ebp + 8]
call fcn.00903450
add esp, 0x10
jmp 0x91301a
push 0
lea eax, [ebp - 0x3ac]
push eax
push dword [ebp + 8]
call fcn.00903450
add esp, 0xc
inc esi
cmp esi, 0xe
jb 0x912fa0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00901200
mov esp, ebp
pop ebp
ret
Function at 0x913d70
Capabilities:
Create service
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x98eb88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push str.Installing_service_..._n
push 1
call fcn.00902480
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00901060
add esp, 0x14
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
jne 0x913df5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_SCM__Error:__ld_n
call fcn.00901db0
add esp, 8
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00901200
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 1
push 3
push 0x110
push 0xf01ff
push str.VirtualBox_Guest_Additions_Service
push str.VBoxService
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
test esi, esi
je 0x913e41
push str.Service_successfully_installed__n
push 0
call fcn.00902480
add esp, 8
jmp 0x913ed8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x913e55
mov edi, str.Could_not_create_service__Error:__ld_n
jmp 0x913ec8
push str.Service_already_exists__just_updating_the_service_config._n
push 1
call fcn.00902480
add esp, 8
push 0xf01ff
push str.VBoxService
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x913ebd
push str.VirtualBox_Guest_Additions_Service
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 1
push 3
push 0x110
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x913eb6
push str.The_service_config_has_been_successfully_updated._n
push 1
call fcn.00902480
add esp, 8
jmp 0x913ed8
mov edi, str.Could_not_change_service_config__Error:__ld_n
jmp 0x913ec2
mov edi, str.Could_not_open_service__Error:__ld_n
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.00901db0
mov edi, eax
add esp, 8
test edi, edi
jne 0x913f21
mov edi, dword [0x991f24]
test edi, edi
je 0x913f1f
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], str.Manages_VM_runtime_information__time_synchronization__guest_control_execution_and_miscellaneous_utilities_for_guest_operating_systems.
push eax
push 1
push esi
mov ecx, edi
call dword [section..rdata]
call edi
test eax, eax
jne 0x913f1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cannot_set_the_service_description__Error:__ld_n
call fcn.00901db0
add esp, 8
mov edi, 1
jmp 0x913f21
xor edi, edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00901200
mov esp, ebp
pop ebp
ret
Function at 0x9141d0
Capabilities:
Delete registry key
Delete service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.Uninstalling_service_..._n
push 1
call fcn.00902480
add esp, 8
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x914215
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_SCM__Error:__d_n
call fcn.00901db0
add esp, 8
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0xf01ff
push str.VBoxService
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x9142cf
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x9142a2
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesEventLogSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x91427a
push str.VBoxService
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Service_successfully_uninstalled__n
push 0
call fcn.00902480
add esp, 8
xor ebx, ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_remove_service__Error:__d_n
call fcn.00901db0
add esp, 8
mov ebx, eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_open_service__Error:__d_n
call fcn.00901db0
add esp, 8
mov ebx, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x918740
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x992034], 0
push esi
mov esi, 0x1c
jne 0x9187c1
push 0
push 1
push 0
push 1
push 0x992034
call fcn.00934ce0
mov esi, eax
add esp, 0x14
test esi, esi
js 0x9187c1
call fcn.0091d6c0
mov esi, eax
test esi, esi
js 0x9187a9
push str.main
push 8
push 0
push 4
call fcn.00917ce0
mov esi, eax
add esp, 0x10
test esi, esi
js 0x9187a9
push 4
call fcn.009018a0
mov esi, eax
add esp, 4
test esi, esi
js 0x9187a9
mov byte [0x992028], 1
xor eax, eax
pop esi
ret
push dword [0x992034]
call fcn.00934e00
add esp, 4
mov dword [0x992034], 0
mov eax, esi
pop esi
ret

Function at 0x91d5c0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [0x98eb90]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x91d5dd
mov eax, 0xffffffe8
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [ebp + 8]
call fcn.0091d490
add esp, 8
xor eax, eax
pop ebp
ret
Function at 0x91d600
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x44]
cmp ecx, 0xffffffff
jae 0x91d676
test ecx, ecx
je 0x91d629
lea eax, [ecx + 0xffff]
and eax, 0xffff0000
cmp eax, ecx
jne 0x91d629
add ecx, 0x1000
lea eax, [ebp - 4]
mov dword [esi + 0x20], 0xffffffff
push eax
push 0
push esi
push 0x91d180
push ecx
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x91d662
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
pop esi
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0091bf10
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x91d7e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
rdtsc
push 0
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_Sleep]
rdtsc
sub eax, esi
sbb edx, edi
pop edi
mov dword [ebp - 4], edx
pop esi
jne 0x91d810
cmp eax, 0x5dc
ja 0x91d810
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x927ad0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push 8
push 0
push eax
call fcn.00901060
push 0x28
push 0
push dword [ebp + 0xc]
call fcn.00901060
add esp, 0x18
lea eax, [ebp - 8]
push 0x18
push 0x28
push dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
setns al
mov esp, ebp
pop ebp
ret

Function at 0x927b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x927c1c
push edi
push 1
mov dword [ebp - 4], eax
lea edi, [esi + 0x14]
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x927c03
mov eax, dword [esi + 0x2c]
mov edx, dword [ebp - 4]
cmp edx, eax
jae 0x927ba5
mov ecx, dword [esi + 0x28]
sub eax, edx
push eax
mov dword [esi + 0x2c], eax
lea eax, [ecx + edx]
push eax
push ecx
call fcn.00901510
add esp, 0xc
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0x2c]
push dword [esi + 0x28]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x927bb1
mov eax, dword [esi + 0x2c]
mov edx, dword [ebp - 4]
cmp edx, eax
jb 0x927b64
mov byte [esi + 0xa], 0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x927bc9
pop edi
mov eax, 0x34
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xa], 0
cmp eax, 0xe8
jne 0x927be3
pop edi
mov byte [esi + 0xc], 1
mov eax, 0xfffffed3
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0091bf10
add esp, 4
cmp eax, 0xfffffed3
jne 0x927bab
pop edi
mov byte [esi + 0xc], 1
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xa], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0091bf10
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x102
jne 0x927c2d
mov eax, 0x34
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xa], 0
cmp eax, 0x80
jne 0x927c42
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0091bf10
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x931380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x1000]
cmp eax, 0x2000
jb 0x931570
cmp dword [edi], 0x19530414
jne 0x931570
mov eax, dword [ebp + 0xc]
add eax, 0x1000
cmp eax, 0x2000
jb 0x931566
lea eax, [edi + 4]
push esi
push eax
call fcn.0092c4c0
mov esi, eax
add esp, 4
test esi, esi
js 0x93155e
lock inc dword [edi + 0x24]
cmp dword [edi + 0x30], 0
jne 0x931550
push ebx
call fcn.0091d5b0
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
mov dword [edi + 0x30], eax
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x931505
jmp 0x931400
cmp byte [edi + 0x29], 0
mov dword [ebp - 8], 0
jne 0x931500
cmp byte [edi + 0x28], 0
jne 0x9314b0
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea esi, [edi + 4]
push esi
call fcn.0092c660
add esp, 4
lea ecx, [edi + 0x38]
cmp ebx, 0xffffffff
ja 0x93143c
mov eax, ebx
jmp 0x93143f
or eax, 0xffffffff
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 0xc]
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x931460
push esi
call fcn.0092c4c0
add esp, 4
jmp 0x93149c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x93153a
push 0xffffffffffffffff
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call fcn.0092c4c0
add esp, 4
lea eax, [ebp - 8]
push 1
push eax
lea eax, [edi + 0x38]
push eax
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x9314f7
mov eax, dword [ebp - 8]
sub ebx, eax
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], eax
add ecx, eax
mov dword [ebp - 4], ecx
xor esi, esi
jmp 0x9314ed
lea eax, [edi + 4]
push eax
call fcn.0092c660
add esp, 4
push 0xea60
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
lea eax, [edi + 4]
push eax
call fcn.0092c4c0
push esi
push edi
call fcn.00931040
mov ecx, dword [ebp - 4]
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x9314ed
cmp esi, 0xffffffd8
jne 0x931505
test ebx, ebx
jne 0x931400
jmp 0x931505
cmp byte [edi + 0x29], 0
je 0x93153a
mov ecx, dword [ebp - 4]
mov esi, 0xffffffba
mov eax, dword [ebp + 0x14]
pop ebx
test eax, eax
je 0x931522
mov dword [eax], ecx
test esi, esi
jns 0x931522
test ecx, ecx
je 0x931522
xor eax, eax
cmp esi, 0xfffffffa
setne al
dec eax
and esi, eax
push edi
mov dword [edi + 0x30], 0
call fcn.00930df0
add esp, 4
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0091bf10
mov ecx, dword [ebp - 4]
add esp, 4
mov esi, eax
jmp 0x931505
push edi
mov esi, 0xffffffea
call fcn.00930df0
add esp, 4
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffa
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffc
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x931580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0x1000]
cmp eax, 0x2000
jb 0x93172c
cmp dword [edi], 0x19530414
jne 0x93172c
mov eax, dword [ebp + 0xc]
add eax, 0x1000
cmp eax, 0x2000
jb 0x931722
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x931717
lea eax, [edi + 4]
push esi
push eax
call fcn.0092c4c0
mov esi, eax
add esp, 4
test esi, esi
js 0x93170e
lock inc dword [edi + 0x24]
cmp dword [edi + 0x4c], 0
jne 0x931700
call fcn.0091d5b0
mov dword [edi + 0x4c], eax
cmp byte [edi + 0x29], 0
mov dword [ebp - 4], 0
jne 0x9316e2
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [edi + 4]
push eax
call fcn.0092c660
add esp, 4
lea esi, [edi + 0x54]
lea eax, [ebp - 4]
push esi
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x931634
xor esi, esi
jmp 0x93167d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x9316d4
push 0xffffffffffffffff
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x9316b8
push 1
lea eax, [ebp - 4]
push eax
push esi
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x93166c
xor esi, esi
jmp 0x93167d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0091bf10
add esp, 4
mov esi, eax
cmp dword [ebp - 4], ebx
jbe 0x931685
mov dword [ebp - 4], ebx
lea eax, [edi + 4]
push eax
call fcn.0092c4c0
add esp, 4
test esi, esi
js 0x9316e7
mov eax, dword [ebp - 4]
add dword [ebp + 0xc], eax
sub ebx, eax
jne 0x9315f1
push edi
mov dword [edi + 0x4c], ebx
call fcn.00930df0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
cmp eax, 0x102
jne 0x9316c6
mov esi, 0xffffffd8
jmp 0x93167d
cmp eax, 0x80
jne 0x93166c
mov esi, 0xfffffffc
jmp 0x93167d
cmp eax, 0xe8
jne 0x931672
mov esi, 0xfffffed3
jmp 0x93167d
mov esi, 0xffffffba
push edi
mov dword [edi + 0x4c], 0
call fcn.00930df0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push edi
mov esi, 0xffffffea
call fcn.00930df0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
pop ebx
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffa
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffc
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x932610
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
or eax, 0x8001
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.SetDllDirectoryW
push dword [0x996674]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x93266d
push 0x960cf0
mov ecx, ebx
call dword [section..rdata]
call ebx
test eax, eax
je 0x932668
mov dword [0x98ecb8], 2
jmp 0x93266d
mov edi, 0xffffff1d
and esi, 4
cmp dword [0x996550], 0x6c
jg 0x93267d
test esi, esi
je 0x9326d1
push str.SetDefaultDllDirectories
push dword [0x996674]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x9326d1
neg esi
mov ecx, ebx
sbb esi, esi
and esi, 0xfffffe00
add esi, 0xa00
push esi
call dword [section..rdata]
call ebx
test eax, eax
je 0x9326c8
and esi, 0x200
neg esi
sbb esi, esi
add esi, 4
mov dword [0x98ecb8], esi
jmp 0x9326d1
test edi, edi
js 0x9326d1
mov edi, 0xffffff1c
push str.GetCurrentThreadStackLimits
push dword [0x996674]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetUnhandledExceptionFilter
push dword [0x996674]
mov dword [0x996544], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UnhandledExceptionFilter
push dword [0x996674]
mov dword [0x9966a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x9966a8]
mov dword [0x9966ac], eax
test esi, esi
je 0x932749
cmp dword [0x996548], 0
jne 0x932749
push 0x932ca0
mov ecx, esi
call dword [section..rdata]
call esi
mov ecx, eax
sub ecx, 0x932ca0
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [0x996548], ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret