joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e01095c
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor edx, edx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, 0x80070000
cmp ecx, edx
je 0x2e010990
lea eax, [ebp - 4]
push eax
push ecx
push edx
call fcn.2e010810
mov esi, eax
jmp 0x2e0109cf
lea ecx, [ebp - 4]
push ecx
push dword [eax + 0x30]
movzx ecx, byte [eax + 0x12]
push dword [eax + 0x2c]
add eax, 0xc
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x2e0109d3
call edi
mov esi, eax
test esi, esi
jle 0x2e0109d1
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e010a05
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x2e0109fb
call edi
mov esi, eax
test esi, esi
jle 0x2e0109f9
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e010a05
xor eax, eax
cmp dword [ebp - 8], eax
sete al
mov esi, eax
cmp dword [ebp - 4], 0
je 0x2e010a14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x2e010ff5
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2e01109a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x2e01109a
movzx eax, word [ebx]
push esi
xor esi, esi
mov ecx, ebx
test ax, ax
je 0x2e011044
movzx eax, ax
cmp ax, 0x5c
jne 0x2e011036
mov esi, ecx
inc ecx
inc ecx
movzx eax, word [ecx]
test ax, ax
jne 0x2e01102e
test esi, esi
jne 0x2e01104b
mov edi, 0x80070003
jmp 0x2e011099
push dword [ebp + 0xc]
xor eax, eax
push ebx
mov word [esi], ax
call fcn.2e010ff5
mov edi, eax
push 0x5c
pop eax
mov word [esi], ax
test edi, edi
jl 0x2e011099
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2e011097
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x2e011085
xor edi, edi
inc edi
jmp 0x2e011099
test eax, eax
jle 0x2e011093
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x2e011099
xor edi, edi
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x2e01129f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov ebx, 0x80070000
cmp eax, esi
jne 0x2e0112e9
call edi
mov esi, eax
test esi, esi
jle 0x2e0112e3
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e011378
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x2e011302
mov esi, 0x8007000e
jmp 0x2e011369
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x2e011329
call edi
mov esi, eax
test esi, esi
jle 0x2e011327
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e011369
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x2e0017f0
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x2e011356
call edi
mov esi, eax
test esi, esi
jle 0x2e011354
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e011369
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp - 4], 0
je 0x2e011378
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x2e0113f0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x2e011495
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 5
jne 0x2e011484
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x2e01142b
mov esi, 0x80070005
jmp 0x2e011494
test al, 0x10
je 0x2e011436
mov esi, 0x8000ffff
jmp 0x2e011494
test al, 7
je 0x2e011494
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, 0x80070000
test eax, eax
jne 0x2e011465
call edi
mov esi, eax
test esi, esi
jle 0x2e011463
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e011494
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x2e011494
call edi
mov esi, eax
test esi, esi
jle 0x2e011494
and esi, 0xffff
or esi, ebx
jmp 0x2e011494
test eax, eax
jle 0x2e011492
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x2e01149d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.2e010ad7
mov ebx, eax
cmp ebx, edi
jl 0x2e01158d
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor esi, esi
cmp dword [ebp - 4], 0xffffffff
jne 0x2e011552
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push esi
push dword [ebp + 8]
push dword [ebp - 0xc]
push 0x2e00225c
push eax
call fcn.2e010ee1
mov ebx, eax
add esp, 0x18
cmp ebx, edi
jl 0x2e01158d
push edi
push 0x80
push 1
push edi
push 1
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x2e011549
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x2e011537
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, 0x80070050
jne 0x2e011545
xor ebx, ebx
jmp 0x2e011549
cmp ebx, edi
jl 0x2e01158d
inc esi
cmp esi, 0x3e8
jl 0x2e0114d7
cmp dword [ebp + 0x10], edi
je 0x2e01156a
push 0xfde9
push edi
push dword [ebp - 8]
push dword [ebp + 0x10]
call fcn.2e010c5c
mov ebx, eax
mov eax, dword [ebp + 0x14]
cmp eax, edi
je 0x2e011576
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp ebx, edi
jl 0x2e01157e
cmp eax, edi
jne 0x2e01158d
cmp dword [ebp - 4], 0xffffffff
je 0x2e01158d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x2e01159a
push dword [ebp - 8]
call fcn.2e0110b3
cmp dword [ebp - 0xc], edi
je 0x2e0115a7
push dword [ebp - 0xc]
call fcn.2e0110b3
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x2e0115b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x210], 0
or dword [ebp - 0x214], 0xffffffff
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x2e011624
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x2e01161c
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x2e011718
jmp 0x2e01162a
mov esi, dword [ebp - 0x21c]
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x214], 0xffffffff
jne 0x2e0116d0
push ebx
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push edi
push eax
lea eax, [ebp - 0x210]
push 0x2e002268
push eax
call fcn.2e010ecd
mov esi, eax
add esp, 0x18
test esi, esi
jl 0x2e011718
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp eax, 0xffffffff
jne 0x2e0116ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x2e0116a8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070050
jne 0x2e0116b6
xor esi, esi
jmp 0x2e0116ba
test esi, esi
jl 0x2e011718
inc dword [ebp - 0x218]
cmp dword [ebp - 0x218], 0x3e8
jl 0x2e011631
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x2e0116e2
mov eax, dword [ebp - 0x214]
mov dword [ecx], eax
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x2e0116fb
mov edx, dword [ebp - 0x210]
and dword [ebp - 0x210], 0
mov dword [eax], edx
test esi, esi
jl 0x2e011703
test ecx, ecx
jne 0x2e011718
cmp dword [ebp - 0x214], 0xffffffff
je 0x2e011718
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x210], 0
je 0x2e01172c
push dword [ebp - 0x210]
call fcn.2e0110b3
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e013f7c
leave
ret 0x10

Function at 0x2e011ec0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
or eax, 0xffffffff
push esi
mov esi, 0xff
cmp dword [0x2e022300], ecx
jne 0x2e011f09
mov dword [0x2e022300], 1
push edi
push 8
mov edx, ecx
pop edi
test dl, 1
je 0x2e011ef5
shr edx, 1
xor edx, 0xedb88320
jmp 0x2e011ef7
shr edx, 1
dec edi
test edi, edi
jg 0x2e011ee6
mov dword [ecx*4 + 0x2e021f00], edx
inc ecx
cmp ecx, esi
jle 0x2e011ee1
pop edi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jbe 0x2e011f2a
mov edx, dword [ebp + 8]
movzx edx, byte [edx]
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x2e021f00]
inc dword [ebp + 8]
dec ecx
jne 0x2e011f10
not eax
pop esi
pop ebp
ret 8
Function at 0x2e0125ae
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x20c], eax
xor eax, eax
push edi
mov dword [ebp - 0x208], eax
mov ebx, 0xffff
mov edi, 0x80070000
lea ecx, [ebp - 0x218]
push ecx
push eax
push eax
push eax
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x204]
push ecx
push eax
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jle 0x2e01261a
and esi, ebx
or esi, edi
test esi, esi
jne 0x2e01269a
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x2e012649
and esi, ebx
or esi, edi
test esi, esi
jl 0x2e0126af
push dword [ebp - 0x208]
call fcn.2e0125ae
mov esi, eax
test esi, esi
jle 0x2e012662
and esi, ebx
or esi, edi
test esi, esi
jl 0x2e0126af
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
test esi, esi
jle 0x2e012696
and esi, ebx
or esi, edi
test esi, esi
jl 0x2e0126af
jmp 0x2e0126a2
cmp esi, 0x80070103
je 0x2e0126ad
test esi, esi
jne 0x2e0126af
xor eax, eax
jmp 0x2e0125df
xor esi, esi
cmp dword [ebp - 0x208], 0
je 0x2e0126c4
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e013f7c
leave
ret 4

Function at 0x2e0126d7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.2e014127
add esp, 0x10
cmp eax, 0x50
jne 0x2e012714
mov eax, 0x8007007a
jmp 0x2e012755
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x2e012764
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.2e014eed
pop ecx
pop ecx
test eax, eax
je 0x2e012745
xor ecx, ecx
mov word [eax], cx
cmp cx, word [eax + 2]
je 0x2e012726
cmp word [ebp - 0x20c], 0
je 0x2e012753
test eax, eax
jne 0x2e012714
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.2e013f7c
leave
ret 8
cmp eax, 2
je 0x2e01277e
cmp eax, 3
je 0x2e01277e
test eax, eax
jle 0x2e012780
and eax, 0xffff
or eax, 0x80070000
jmp 0x2e012780
xor eax, eax
cmp eax, 1
je 0x2e012714
jmp 0x2e012755
Function at 0x2e012787
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x2e0127b1
xor ebx, ebx
inc ebx
jmp 0x2e0127fe
push esi
push edi
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
jle 0x2e0127c5
and eax, edi
or eax, esi
mov ebx, eax
test ebx, ebx
jl 0x2e0127fc
push dword [ebp - 4]
call fcn.2e0125ae
mov ebx, eax
test ebx, ebx
jl 0x2e0127fc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jle 0x2e0127fa
and eax, edi
or eax, esi
mov ebx, eax
pop edi
pop esi
cmp dword [ebp - 4], 0
je 0x2e01280d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x2e01287f
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp edi, eax
je 0x2e0128cd
cmp word [edi], ax
je 0x2e0128cd
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
push dword [ebp + 0xc]
mov ebx, eax
call esi
lea eax, [ebx + eax + 3]
push eax
push edi
lea eax, [ebp - 4]
push eax
call fcn.2e010b22
mov edi, eax
test edi, edi
jl 0x2e012a60
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
jmp 0x2e012906
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
add eax, 3
push eax
lea eax, [ebp - 4]
push eax
call fcn.2e010a8d
mov edi, eax
test edi, edi
jl 0x2e012a60
push 0xffffffffffffffff
push ebx
push 4
push dword [ebp - 4]
call fcn.2e014127
add esp, 0x10
add ebx, 6
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 4]
movzx eax, word [ecx]
push 0x5c
pop edx
cmp dx, ax
jne 0x2e01291a
cmp dx, word [ecx + 2]
je 0x2e012956
push 0x61
pop edx
cmp dx, ax
ja 0x2e01292a
push 0x7a
pop edx
cmp dx, ax
jae 0x2e01293a
push 0x41
pop edx
cmp dx, ax
ja 0x2e01294c
push 0x5a
pop edx
cmp dx, ax
jb 0x2e01294c
push 0x3a
pop eax
cmp ax, word [ecx + 2]
jne 0x2e01294c
push 0x5c
pop eax
cmp ax, word [ecx + 4]
je 0x2e012956
mov edi, 0x80070057
jmp 0x2e012a63
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x2e012971
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 8], eax
push ecx
call esi
mov ecx, dword [ebp - 4]
lea ebx, [ecx + eax*2]
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test ax, ax
je 0x2e012a63
mov esi, 0x80070000
push 0x5c
pop edx
cmp dx, ax
jne 0x2e0129a2
mov edx, dword [ebp + 0xc]
cmp dword [ebp + 8], edx
je 0x2e012a4b
push 0x5c
pop ecx
mov word [ebx], ax
cmp cx, ax
jne 0x2e012a46
push dword [ebp - 8]
xor eax, eax
mov word [ebx + 2], ax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x2e012a18
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
jne 0x2e012a07
cmp dword [ebp + 0x14], 0
je 0x2e012a03
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x2e012a03
call edi
mov edi, eax
test edi, edi
jle 0x2e012a01
and edi, 0xffff
or edi, esi
test edi, edi
jl 0x2e012a60
xor edi, edi
jmp 0x2e012a18
test eax, eax
jle 0x2e012a12
and eax, 0xffff
or eax, esi
mov edi, eax
test edi, edi
jl 0x2e012a60
cmp dword [ebp + 0x18], 0
je 0x2e012a46
push dword [ebp + 0x18]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x2e012a46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x2e012a44
and edi, 0xffff
or edi, esi
test edi, edi
jl 0x2e012a60
mov ecx, dword [ebp - 4]
inc ebx
inc ebx
add dword [ebp + 8], 2
mov eax, dword [ebp + 8]
movzx eax, word [eax]
test ax, ax
jne 0x2e01298e
jmp 0x2e012a63
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x2e012a6d
push ecx
call fcn.2e0110b3
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x2e012e4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push 0x900
xor ebx, ebx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp + 0xc], eax
cmp eax, edi
jne 0x2e012ea2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x2e012e9c
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e012f26
cmp dword [ebp + 0xc], edi
jbe 0x2e012eec
push edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
sub eax, ebx
push eax
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push dword [0x2e021004]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x2e012ee4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x2e012ee2
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e012f26
add ebx, dword [ebp - 8]
cmp ebx, dword [ebp + 0xc]
jb 0x2e012ea7
cmp dword [ebp + 0x14], edi
je 0x2e012f26
push edi
lea eax, [ebp - 8]
push eax
push 2
push dword [0x2e02100c]
push dword [0x2e021004]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x2e012f26
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, edi
jle 0x2e012f26
and esi, 0xffff
or esi, 0x80070000
cmp dword [ebp - 4], edi
je 0x2e012f34
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x2e012f3d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.2e010dd4
mov ebx, eax
cmp ebx, esi
jl 0x2e012ff7
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp + 0xc], eax
cmp eax, esi
jbe 0x2e012fbe
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
sub eax, esi
push eax
mov eax, dword [ebp - 4]
add eax, esi
push eax
push dword [0x2e021004]
call edi
test eax, eax
jne 0x2e012fb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x2e012fb4
and ebx, 0xffff
or ebx, 0x80070000
test ebx, ebx
jl 0x2e012ff6
add esi, dword [ebp - 8]
cmp esi, dword [ebp + 0xc]
jb 0x2e012f7c
cmp dword [ebp + 0x10], 0
je 0x2e012ff6
push 0
lea eax, [ebp - 8]
push eax
push 2
push dword [0x2e02100c]
push dword [0x2e021004]
call edi
test eax, eax
jne 0x2e012ff6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x2e012ff6
and ebx, 0xffff
or ebx, 0x80070000
pop edi
cmp dword [ebp - 4], 0
je 0x2e013005
push dword [ebp - 4]
call fcn.2e0110b3
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x2e013124
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
cmp dword [0x2e021004], 0xffffffff
mov eax, 0x104
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x41c], esi
mov ebx, 0x2e002444
je 0x2e01327a
cmp dword [0x2e022308], esi
je 0x2e01327a
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0x208
test eax, eax
jne 0x2e01319a
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.2e0140ad
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.2e01129f
test eax, eax
jge 0x2e0131c4
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x2e0131ed
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.2e0140ad
add esp, 0xc
push esi
call fcn.2e013d15
push eax
push 0x2e002428
push 1
call fcn.2e013110
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x41c]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
mov eax, dword [ebp - 0x418]
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x2e0023fc
push 1
call fcn.2e013110
mov eax, dword [0x2e021008]
add esp, 0x2c
sub eax, esi
pop edi
je 0x2e013261
dec eax
je 0x2e01325a
dec eax
je 0x2e013253
dec eax
jne 0x2e013266
mov ebx, 0x2e0023f4
jmp 0x2e013266
mov ebx, 0x2e0023ec
jmp 0x2e013266
mov ebx, 0x2e0023e0
jmp 0x2e013266
mov ebx, 0x2e0023d8
push ebx
push 0x2e0023bc
push 1
call fcn.2e013110
add esp, 0xc
xor eax, eax
jmp 0x2e01327d
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.2e013f7c
leave
ret
Function at 0x2e013a72
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10018
call fcn.2e0142c9
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10010], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x10014], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
mov dword [ebp - 0x10018], eax
mov dword [ebp - 0x10008], edi
mov dword [ebp - 0x1000c], edi
call fcn.2e0139d8
mov esi, eax
cmp esi, edi
jl 0x2e013b91
push ebx
lea eax, [ebp - 0x10008]
push eax
push edi
push edi
push dword [ebp + 0xc]
push dword [0x2e02230c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x80070000
jmp 0x2e013b46
push 0
lea eax, [ebp - 0x1000c]
push eax
push 0x10000
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10010]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x2e013b22
call edi
mov esi, eax
test esi, esi
jle 0x2e013b20
and esi, 0xffff
or esi, ebx
test esi, esi
jl 0x2e013b90
xor esi, esi
cmp dword [ebp - 0x1000c], esi
jbe 0x2e013b60
push esi
push dword [ebp - 0x1000c]
lea eax, [ebp - 0x10004]
push eax
push dword [ebp - 0x10008]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x2e013ae9
call edi
mov esi, eax
test esi, esi
jle 0x2e013b5c
and esi, 0xffff
or esi, ebx
test esi, esi
jge 0x2e013ae9
jmp 0x2e013b90
push 0
push dword [ebp - 0x10018]
push dword [ebp - 0x10014]
push 2
push dword [ebp - 0x10008]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x2e013b90
call edi
mov esi, eax
test esi, esi
jle 0x2e013b90
and esi, 0xffff
or esi, ebx
pop ebx
cmp dword [ebp - 0x10008], 0
je 0x2e013ba6
push dword [ebp - 0x10008]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.2e013f7c
leave
ret 0x10