joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42201a
Capabilities:
Get graphical window text

Disassembly:
push 0x14
mov eax, 0x43fd0c
call fcn.0042db7c
mov eax, dword [ebp + 8]
push 0x40b
push dword [eax + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xor esi, esi
push esi
push esi
push 0xe
push eax
mov dword [ebp - 0x10], eax
call edi
lea ebx, [eax + 1]
lea eax, [ebp + 0xb]
push eax
mov eax, ebx
lea ecx, [ebp - 0x20]
mov byte [ebp + 0xb], 0
call fcn.004081bc
mov dword [ebp - 4], esi
lea esi, [ebp - 0x20]
call fcn.004081a3
push eax
push ebx
push 0xd
push dword [ebp - 0x10]
call edi
call fcn.004081a3
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00408773
call fcn.00420b6d
call fcn.0042dc54
ret 8

Function at 0x4226c4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
mov esi, eax
push 0x42f
push dword [esi + 8]
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push 0
push 0x430
push dword [esi + 8]
call edi
push eax
call ebx
push 0
push 0x42c
push dword [esi + 8]
call edi
push eax
call ebx
push 0
push 0x431
push dword [esi + 8]
call edi
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
push eax
push 0x42f
push dword [esi + 8]
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
call ebx
lea eax, [ebp - 0x20]
push eax
push 0x432
push dword [esi + 8]
call edi
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call ebx
mov edi, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x2c]
mov ebx, edi
neg ebx
push ebx
push 0x432
call fcn.004227cf
push ebx
push 0x433
call fcn.004227cf
push ebx
push 0x42a
call fcn.004227cf
push ebx
push 0x42b
call fcn.004227cf
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 1
cdq
xor eax, edx
sub eax, edx
sub eax, edi
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42acb7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x448138]
jne 0x42acc1
repz ret
jmp fcn.004323fa

Function at 0x43b3a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00431be8
xor ebx, ebx
cmp dword [0x44a2f4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x43b475
push 0x402f3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x43b3e0
xor eax, eax
jmp 0x43b539
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402f30
push edi
call esi
cmp eax, ebx
je 0x43b3d9
push eax
call fcn.00431b85
mov dword [esp], 0x402f20
push edi
mov dword [0x44a2f4], eax
call esi
push eax
call fcn.00431b85
mov dword [esp], 0x402f0c
push edi
mov dword [0x44a2f8], eax
call esi
push eax
call fcn.00431b85
mov dword [0x44a2fc], eax
lea eax, [ebp - 8]
push eax
call fcn.0042e1ce
test eax, eax
pop ecx
pop ecx
je 0x43b443
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042af84
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x43b475
push 0x402ef0
push edi
call esi
push eax
call fcn.00431b85
cmp eax, ebx
pop ecx
mov dword [0x44a304], eax
je 0x43b475
push 0x402ed8
push edi
call esi
push eax
call fcn.00431b85
pop ecx
mov dword [0x44a300], eax
mov eax, dword [0x44a300]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x43b4ee
cmp dword [0x44a304], esi
je 0x43b4ee
push eax
call fcn.00431bf1
pop ecx
call eax
cmp eax, ebx
je 0x43b4bb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x44a304]
call fcn.00431bf1
pop ecx
call eax
test eax, eax
je 0x43b4bb
test byte [ebp - 0x18], 1
jne 0x43b4ee
lea eax, [ebp - 0xc]
push eax
call fcn.0042e205
test eax, eax
pop ecx
je 0x43b4d6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042af84
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x43b4e5
or dword [ebp + 0x10], 0x200000
jmp 0x43b51f
or dword [ebp + 0x10], 0x40000
jmp 0x43b51f
mov eax, dword [0x44a2f8]
cmp eax, esi
je 0x43b51f
push eax
call fcn.00431bf1
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43b51f
mov eax, dword [0x44a2fc]
cmp eax, esi
je 0x43b51f
push dword [ebp - 4]
push eax
call fcn.00431bf1
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x44a2f4]
call fcn.00431bf1
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40645d
pop dword [ebp - 0x10]
mov eax, 0x1206d877
sub eax, 0x11c6741a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe7f31a7b
add dword [ebp - 0x20], 0x665f2ad0
mov dword [ebp - 0x1c], 0xf41a1f26
add dword [ebp - 0x1c], 0x3e192d1f
mov dword [ebp - 0x18], 0xd5f18bd3
add dword [ebp - 0x18], 0x765ab85b
mov dword [ebp - 0x14], 0x273f8b0a
add dword [ebp - 0x14], 0xd8c074f6
lea eax, [ebp - 0x20]
push eax
mov eax, 0x7c2108f3
sub eax, 0x7be0887b
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xe6924a3e
add dword [ebp - 0x20], 0x8de01f18
mov dword [ebp - 0x1c], 0x53579677
sub dword [ebp - 0x1c], 0x11eb3502
mov dword [ebp - 0x18], 0x809f2f87
sub dword [ebp - 0x18], 0x1d2fc31b
mov dword [ebp - 0x14], 0xf4f6972d
add dword [ebp - 0x14], 0xb0968d3
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x38413
push 0
call eax
mov ecx, 0xf15e931b
add ecx, 0xea1b9b4
xor ebx, ebx
add ebx, eax
mov esi, 0x36bdb530
sub esi, 0x3678a130
add esi, dword [ebp - 0x10]
mov edx, 0x90f8dc57
sub edx, 0x2b1bab74
xor dword [ebp - 8], eax
mov edi, dword [esi]
mov dword [ebp - 4], 0x82b3a008
add edi, edx
sub dword [ebp - 4], 0xb3c69630
mov dword [ebx], edi
mov dword [ebp - 8], 0x9521bfed
add ebx, 0x273ee20
add ebx, 0xfd8c11e4
add esi, 0xba47763c
add esi, 0x45b889c8
loop 0x40657c
add eax, 0x1260f
mov ebx, eax
add eax, 0xb8a482d7
add eax, 0x475b7d2e
mov ecx, 0xaaf5f511
sub ecx, 0xaab5f511
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x10005e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1001d994], 0
jne 0x1000610a
push esi
push str.0:db0:lk0:hs1:ld0:ll0:hb0:pj9_.1_.4202:zb0.1:bb
mov byte [0x1001d994], 1
call fcn.1000765f
push 0x12a0
push 0
push 0x1001c6e0
call fcn.1000c8f0
push 0
push 0x1001c6fe
push 0x100175cc
call fcn.10005d60
push 0
push 0x1001c8fc
push 0x100175d4
call fcn.10005d60
push 0x1001c938
push 0
push 0x100175dc
call fcn.10005d60
push 0
push 0x1001c93c
push 0x100175e4
call fcn.10005d60
add esp, 0x40
push 0
push 0x1001cb3a
push 0x100175ec
call fcn.10005d60
push 0x1001cb78
push 0
push 0x100175f4
call fcn.10005d60
push 0
push 0x1001cb7c
push 0x100175fc
call fcn.10005d60
push 0
push 0x1001cd7a
push 0x10017604
call fcn.10005d60
push 0x1001cdb8
push 0
push 0x1001760c
call fcn.10005d60
push 0
push 0x1001cdbc
push 0x10017614
call fcn.10005d60
add esp, 0x48
push 0
push 0x1001cdf8
push 0x1001761c
call fcn.10005d60
push 0
push 0x1001ce34
push 0x10017624
call fcn.10005d60
push 0
push 0x1001ce98
push 0x1001762c
call fcn.10005d60
push 0
push 0x1001cefc
push 0x10017634
call fcn.10005d60
push 0x1001cf60
push 0
push 0x1001763c
call fcn.10005d60
push 0x1001cf64
push 0
push 0x10017644
call fcn.10005d60
add esp, 0x48
push 0x1001cf68
push 0
push 0x1001764c
call fcn.10005d60
push 0x1001cf6c
push 0
push 0x10017654
call fcn.10005d60
push 0x1001cf70
push 0
push 0x1001765c
call fcn.10005d60
push 0x1001cf74
push 0
push 0x10017664
call fcn.10005d60
push 0x1001cf78
push 0
push 0x1001766c
call fcn.10005d60
push 0x1001cf7c
push 0
push 0x10017674
call fcn.10005d60
add esp, 0x48
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.Console
push connect
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006032
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
push str.IpDate
push eax
call esi
cmp dword [ebp - 4], 0xa
jbe 0x10006109
push 0x7d0
push 0
push str.0:db0:lk0:hs1:ld0:ll0:hb0:pj9_.1_.4202:zb0.1:bb
call fcn.1000c8f0
mov eax, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push str.0:db0:lk0:hs1:ld0:ll0:hb0:pj9_.1_.4202:zb0.1:bb
lea edx, [ebp - 8]
push edx
push 0
push str.IpDate
push eax
call esi
push 0
push 0x1001c6fe
push 0x100175cc
call fcn.10005d60
push 0
push 0x1001c8fc
push 0x100175d4
call fcn.10005d60
push 0x1001c938
push 0
push 0x100175dc
call fcn.10005d60
push 0
push 0x1001c93c
push 0x100175e4
call fcn.10005d60
push 0
push 0x1001cb3a
push 0x100175ec
call fcn.10005d60
push 0x1001cb78
push 0
push 0x100175f4
call fcn.10005d60
add esp, 0x48
push 0
push 0x1001cb7c
push 0x100175fc
call fcn.10005d60
push 0
push 0x1001cd7a
push 0x10017604
call fcn.10005d60
push 0x1001cdb8
push 0
push 0x1001760c
call fcn.10005d60
add esp, 0x24
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006380
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x100063d2
cmp dword [0x1001d980], eax
jne 0x100063d2
push str.0:db0:lk0:hs1:ld0:ll0:hb0:pj9_.1_.4202:zb0.1:bb
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x1e
jle 0x100063d2
call fcn.10005e30
cmp dword [0x1001cf70], 0
je 0x100063d2
push 0
push 0
push 0
push 0x10006110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x1001d980], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop ebp
ret 0xc

Function at 0x10006420
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1001d980], 0
jne 0x10006480
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push str.0:db0:lk0:hs1:ld0:ll0:hb0:pj9_.1_.4202:zb0.1:bb
call fcn.1000c970
add esp, 0xc
call fcn.10005e30
push 0
push 0
push 0
push 0x10006110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x1001d980], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x1001d980]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret

Function at 0x10006490
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10006110
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x1001d980], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
ret

Function at 0x100068f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100191b0]
jne 0x100068ff
repz ret
jmp fcn.10007962
Function at 0x434018
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x43ebd0
cmp edx, dword [eax]
je 0x43403a
add eax, 8
inc ecx
cmp eax, 0x43ec60
jl 0x43402b
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x43ebd0]
jne 0x434168
mov eax, dword [0x43f57c]
cmp eax, 1
je 0x434142
test eax, eax
jne 0x43406b
cmp dword [0x43c7b4], 1
je 0x434142
cmp edx, 0xfc
je 0x434168
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4340a2
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004352d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004336a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4340e5
lea eax, [ebp - 0x1a4]
push eax
call fcn.004336a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4387bc
push edi
call fcn.0042e160
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004352d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004352e0
lea eax, [ebp - 0xa0]
push 0x43879c
push eax
call fcn.004352e0
push dword [esi + 0x43ebd4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004352e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00436604
add esp, 0x2c
pop edi
jmp 0x434168
lea eax, [ebp + 8]
lea esi, [esi + 0x43ebd4]
push 0
push eax
push dword [esi]
call fcn.004336a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10001000
Capabilities:
Clear file content

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x10]
add ecx, 0xffffd1ab
push ebx
mov ebx, dword [esp + 0x18]
xor ecx, 0x27c7
push esi
mov esi, dword [esp + 0x14]
add eax, 0xfffffdb9
push edi
lea edi, [ebx + 0xe4]
cmp eax, ecx
jle 0x1000103e
mov eax, dword [esi + 0x6c]
xor eax, 0x2c5e
sub dword [0x10141428], eax
jmp 0x10001051
mov eax, dword [esi + 0xd8]
xor eax, dword [0x1014143c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, 0x357
cmp edi, ebx
jl 0x1000109d
mov eax, dword [esi + 0x120]
cmp eax, dword [esi + 0x44]
jne 0x10001089
mov eax, dword [esi + 0x110]
sub eax, dword [0x10141534]
add eax, 0xcdc1
add dword [esi + 0x90], eax
xor edi, 0x219
mov eax, edi
pop edi
pop esi
pop ebx
ret
mov edx, dword [0x100f26ac]
mov ecx, 0xffe69d42
sub ecx, dword [edx + 0x100]
add dword [edx + 0x10], ecx
xor edi, 0x219
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x10001210
Capabilities:
Get common file path

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
lea edi, [edx + 0x4e3]
lea eax, [ecx - 0x181]
cmp edi, eax
jne 0x10001283
lea eax, [ecx - 0x34c0]
mov ecx, dword [0x100f26ac]
cmp edx, eax
je 0x10001258
mov eax, dword [esi + 0x10c]
sub eax, dword [esi + 0x9c]
add eax, 0x81b09
imul eax, dword [ecx + 0x40]
mov dword [ecx + 0x40], eax
jmp 0x10001283
mov eax, dword [esi + 0x100]
imul eax, edi
cmp dword [ecx + 0x9c], eax
jb 0x10001289
sub edx, dword [ecx + 0x74]
mov eax, dword [esp + 0x18]
sub edx, 0x23d4
push edx
add eax, 0x2a2e
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [0x100f26ac]
mov eax, dword [ecx + 0x44]
add eax, dword [esi + 0x24]
xor eax, 0xf6c11ca0
sub dword [ecx + 0xfc], eax
lea eax, [edi - 0x125]
pop edi
pop esi
ret
Function at 0x10001520
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
add eax, 0xfffffbc7
mov ecx, dword [esp + 0x20]
xor edx, 0x2c0e
push ebx
push ebp
push esi
mov dword [esp + 0xc], eax
add ecx, 0xffffd43c
mov eax, dword [esp + 0x18]
mov esi, eax
push edi
mov edi, dword [esp + 0x20]
xor esi, 9
mov dword [esp + 0x20], ecx
lea ebx, [eax - 0x2e5c]
lea ebp, [edi + 0xaa]
xor edi, 0xc5c
lea eax, [esi - 0x460]
cmp edx, eax
jg 0x10001583
lea eax, [ebx + 0x2e55]
cmp esi, eax
jne 0x100015a6
add ebx, 0x2baf
mov eax, dword [0x100f26ac]
mov ecx, dword [0x1014149c]
cmp ecx, dword [eax + 0x24]
jb 0x10001696
or dword [0x10141528], 0x26311
jmp 0x100016ab
mov eax, dword [0x10141488]
add eax, ecx
cmp ebp, eax
je 0x10001583
mov eax, dword [0x100f26ac]
mov ecx, dword [eax + 0x110]
sub ecx, dword [eax + 0x14]
add ecx, dword [0x1014153c]
cmp ebp, ecx
jne 0x10001588
mov eax, dword [esp + 0x20]
mov ecx, eax
or ecx, 0x2e55
add eax, 0xfffffe6d
mov dword [esp + 0x28], ecx
mov ecx, ebp
sub ecx, edx
add eax, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
nop
mov edx, dword [esp + 0x18]
mov eax, dword [0x10141454]
xor eax, esi
or eax, dword [edx + 0xe0]
mov ecx, dword [edx + 0x98]
sub ecx, dword [0x10141534]
push eax
mov eax, dword [esp + 0x2c]
add eax, edi
push eax
push edx
push dword [esp + 0x3c]
push ecx
call section..text
mov edi, dword [0x100f26ac]
mov dword [esp + 0x34], eax
mov ecx, dword [edi + 0xcc]
mov esi, dword [edi + 0x120]
or ecx, eax
mov edx, dword [edi + 0xe4]
or esi, ebx
mov eax, dword [edi + 0x11c]
mov edi, dword [esp + 0x2c]
or edx, dword [esp + 0x24]
imul eax, dword [edi + 0xe0]
mov edi, dword [0x100f26ac]
push eax
push ecx
push dword [esp + 0x48]
push edx
push esi
push edi
call fcn.1000d1c0
mov edi, dword [esp + 0x4c]
mov esi, eax
mov eax, dword [0x100f26ac]
add ebp, 4
add esp, 0x2c
mov ecx, dword [eax + 0x110]
sub ecx, dword [eax + 0x14]
add ecx, dword [0x1014153c]
cmp ebp, ecx
je 0x100015f0
jmp 0x10001588
mov eax, dword [esp + 0x18]
mov ecx, dword [0x10141504]
mov dword [eax + 0xe8], ecx
mov eax, dword [0x100f26ac]
mov ecx, dword [eax + 8]
add dword [0x10141500], ecx
xor ebx, 0x327
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x10001780
Capabilities:
Delete file

Disassembly:
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add ecx, 0xfffffb8b
push ebx
mov ebx, dword [esp + 0xc]
xor edx, 0xbff
push ebp
mov ebp, dword [esp + 0x14]
mov eax, ebx
add ebp, 0x679
xor eax, 0x759
push esi
lea esi, [ebx - 0x2b9b]
mov dword [esp + 0x14], eax
xor ebx, 0x2b9b
lea eax, [ebp - 0x6a3]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, eax
jg 0x10001812
lea eax, [edx - 0x289]
cmp ecx, eax
jl 0x10001812
cmp dword [edi + 0x5c], 0x10d7f
je 0x10001802
mov eax, dword [0x100f26ac]
mov eax, dword [eax + 0x11c]
add eax, dword [edi + 0x9c]
xor eax, dword [edi + 0x94]
xor eax, 0x1dbaf4
mov dword [edi + 0x94], eax
jmp 0x1000180c
xor dword [0x10141490], 0x1aa9f
add esi, 0x2985
mov eax, ecx
xor eax, 0x5b0
cmp ebx, eax
jg 0x1000188f
mov eax, dword [0x100f26ac]
xor ebp, 0x5c5
mov ebx, dword [esp + 0x18]
push edi
mov eax, dword [eax + 0x78]
add eax, 0xc38a9
mov dword [edi + 0x70], eax
lea eax, [esi + 0x33d]
xor eax, 0xb05
push eax
lea eax, [ebx - 0x43a]
push eax
push ebp
lea eax, [edx + 0x247]
push eax
lea eax, [ecx - 0x70]
push eax
lea eax, [ebx - 0xfe]
push eax
call fcn.100010b0
add esp, 0x1c
cmp dword [0x101414d8], 0xbbea
jae 0x10001884
mov eax, dword [edi + 0x90]
add eax, 0x950c6
imul eax, dword [edi + 0x6c]
mov dword [edi + 0x6c], eax
pop edi
lea eax, [esi + 0x97]
pop esi
pop ebp
pop ebx
ret
mov eax, dword [0x10141458]
add eax, ecx
or eax, 0x2cd4
cmp esi, eax
jae 0x100018c8
mov eax, dword [0x100f26ac]
imul eax, dword [eax + 0x120], 0x2baf
or dword [0x10141518], eax
mov eax, dword [edi + 0xbc]
sub eax, edx
sub eax, 0x2ad4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
lea eax, [esi - 0x2a6]
pop esi
pop ebp
pop ebx
ret
Function at 0x10001af0
Capabilities:
Clear file content

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
mov edx, eax
mov ecx, dword [esp + 0x1c]
xor edx, 0xd13
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ebp, ecx
push edi
lea edi, [eax + 0xc1]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x30]
xor ebp, 0xbff
add eax, 0xfffffdea
mov dword [esp + 0x2c], edi
mov dword [esp + 0x10], eax
xor esi, 0x297
lea eax, [ecx + 0xb4]
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], eax
mov eax, edi
xor eax, 0x45c
cmp ebp, eax
jge 0x10001b7a
mov eax, dword [ebx + 0x84]
cmp eax, dword [ebx + 0xc4]
ja 0x10001c17
mov ecx, dword [0x100f26ac]
mov eax, dword [ebx + 0x110]
add eax, 0x101d69
add dword [ecx + 0x74], eax
jmp 0x10001c17
mov edi, esi
and edi, 0x27f1
cmp ebp, edi
jg 0x10001c13
sub edi, ebp
inc edi
nop dword [eax]
lea eax, [ebp - 0x2985]
cmp dword [ebx + 0x40], eax
jbe 0x10001c0a
mov eax, dword [0x100f26ac]
mov esi, dword [0x1014142c]
mov ecx, dword [ebx + 0x74]
sub esi, edx
or ecx, ebp
mov edx, dword [eax + 0x108]
add ecx, ebp
mov eax, dword [0x10141480]
mov ebp, dword [esp + 0x24]
or eax, ebp
and edx, dword [ebx + 0xc0]
sub ebp, dword [esp + 0x2c]
and edx, 0x2a1c
push eax
mov eax, dword [esp + 0x30]
or ebp, 0x27c7
add eax, dword [esp + 0x34]
push eax
push ecx
push edx
push 0x10141418
push ebp
push esi
call fcn.10001af0
mov ecx, dword [esp + 0x4c]
add esp, 0x1c
xor ecx, dword [esp + 0x28]
mov ebp, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
sub edi, 1
jne 0x10001b90
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x10]
mov eax, ebp
xor eax, 0x21e
cmp edx, eax
jg 0x10001ce6
lea ecx, [esi - 0x4fb]
cmp ebp, ecx
je 0x10001cce
push dword [0x100f26ac]
lea eax, [esi + 0x193]
push eax
lea eax, [edi + 0x16d]
push eax
push dword [esp + 0x3c]
lea eax, [ebp + 0x33d]
push ecx
push eax
lea eax, [edi - 0x97]
push eax
call fcn.10001210
mov ecx, dword [ebx + 0x44]
add esp, 0x1c
mov eax, dword [0x100f26ac]
add ecx, 0x1ab8b3
mov edx, dword [esp + 0x28]
mov dword [eax + 0x110], ecx
cmp dword [ebx + 0xe4], 0x146c4
jae 0x10001cb0
mov eax, dword [0x100f26ac]
pop edi
pop esi
pop ebp
mov eax, dword [eax + 0x9c]
xor eax, dword [ebx + 0xb8]
add dword [0x10141538], eax
xor edx, 0x25c
mov eax, edx
pop ebx
pop ecx
ret
mov eax, dword [0x101414b8]
pop edi
add eax, 0x1a5555
or dword [ebx + 0x120], eax
xor edx, 0x25c
pop esi
pop ebp
mov eax, edx
pop ebx
pop ecx
ret
mov ecx, dword [0x100f26ac]
mov ecx, dword [ecx + 0x11c]
or ecx, dword [0x101414b0]
add dword [0x1014150c], ecx
pop edi
pop esi
xor edx, 0x25c
pop ebp
mov eax, edx
pop ebx
pop ecx
ret
Function at 0x10005510
Capabilities:
Connect pipe

Disassembly:
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0xc]
add eax, 0xffffd1ab
push ebp
mov ebp, dword [esp + 0xc]
lea edx, [ecx - 0x2c45]
push esi
mov esi, dword [esp + 0x18]
add ebp, 0x5cd
add esi, 0xffffd288
add ebx, 0xffffd43c
push edi
lea edi, [ecx - 0x81]
lea ecx, [esi + 0x2e55]
cmp eax, ecx
jg 0x10005587
lea eax, [edx + 0x2c0e]
cmp ebx, eax
je 0x100055b0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0xe4]
mov dword [ecx + 0x10c], 0x1cd5de
cmp eax, dword [0x101414b4]
jbe 0x10005594
mov eax, dword [0x10141534]
add eax, 0xffec986a
mov dword [ecx], eax
xor edi, 0x34c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
imul eax, dword [0x1014149c], 0x1cd5de
xor edi, 0x34c
mov dword [0x1014149c], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [0x101414cc]
mov ecx, dword [0x100f26ac]
or eax, ebp
add eax, edx
cmp dword [ecx + 0x110], eax
ja 0x10005587
mov eax, dword [0x10141474]
neg eax
cmp esi, eax
je 0x10005587
mov eax, ebx
sub eax, dword [ecx + 0xf0]
xor eax, ebp
push eax
mov eax, dword [0x10141454]
sub eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov eax, dword [0x10141474]
inc esi
neg eax
cmp esi, eax
je 0x10005587
mov ecx, dword [0x100f26ac]
jmp 0x100055d2