joyce8/EMBER2024-capa huggingface dataset:
Function at 0x689240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x89b044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
cmp dword [0x8a149c], 0
je 0x689281
mov eax, dword [0x8a149c]
push eax
push 0x8904d0
lea ecx, [ebp - 0x110]
push ecx
push 0xe6
call fcn.00686eb0
add esp, 0x10
jmp 0x689362
call fcn.00688050
test eax, eax
je 0x6892f7
lea edx, [ebp - 0x320]
push edx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x320]
push eax
call fcn.00687910
add esp, 4
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0
je 0x6892eb
mov ecx, dword [ebp - 0x324]
push ecx
push 0x8904d4
lea edx, [ebp - 0x110]
push edx
push 0xe6
call fcn.00686eb0
add esp, 0x10
mov eax, dword [ebp - 0x324]
push eax
call fcn.007238ab
add esp, 4
jmp 0x6892f5
mov eax, 7
jmp 0x689493
jmp 0x689362
lea ecx, [ebp - 0x430]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x430]
push edx
call fcn.006878c0
add esp, 4
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x689358
mov eax, dword [ebp - 0x434]
push eax
push 0x8904d8
lea ecx, [ebp - 0x110]
push ecx
push 0xe6
call fcn.00686eb0
add esp, 0x10
mov edx, dword [ebp - 0x434]
push edx
call fcn.007238ab
add esp, 4
jmp 0x689362
mov eax, 7
jmp 0x689493
lea eax, [ebp - 0x110]
push eax
call fcn.006871f0
add esp, 4
mov esi, eax
push str.etilqs_
call fcn.006871f0
add esp, 4
lea ecx, [esi + eax + 0x11]
cmp ecx, dword [ebp + 8]
jl 0x689393
mov eax, 1
jmp 0x689493
lea edx, [ebp - 0x110]
push edx
call fcn.006871f0
add esp, 4
mov dword [ebp - 0x114], eax
jmp 0x6893b9
mov eax, dword [ebp - 0x114]
sub eax, 1
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jbe 0x6893d7
mov ecx, dword [ebp - 0x114]
movsx edx, byte [ebp + ecx - 0x111]
cmp edx, 0x5c
jne 0x6893d7
jmp 0x6893aa
mov eax, dword [ebp - 0x114]
mov byte [ebp + eax - 0x110], 0
lea ecx, [ebp - 0x110]
push ecx
push str._setilqs_
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
sub eax, 0x11
push eax
call fcn.00686eb0
add esp, 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.006871f0
add esp, 4
mov dword [ebp - 0x118], eax
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x118]
push edx
push 0xf
call fcn.00686fb0
add esp, 8
mov dword [ebp - 0x114], 0
jmp 0x689454
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
cmp dword [ebp - 0x114], 0xf
jae 0x689485
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x118]
movzx eax, byte [edx]
xor edx, edx
mov ecx, 0x3e
div ecx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x118]
mov cl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [eax], cl
jmp 0x689436
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x118]
mov byte [edx], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0071fe0b
mov esp, ebp
pop ebp
ret
Function at 0x6894b0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.006890a0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6894e3
mov eax, 7
jmp 0x6895b1
call fcn.00688050
test eax, eax
je 0x68953a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x689518
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 5
jne 0x689538
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 5
jge 0x689538
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
test ecx, ecx
jne 0x6894ec
jmp 0x689586
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x689566
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 5
jne 0x689586
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 5
jge 0x689586
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 1
test edx, edx
jne 0x68953a
mov eax, dword [ebp - 8]
push eax
call fcn.007238ab
add esp, 4
cmp dword [ebp - 4], 0xffffffff
jne 0x6895a7
cmp dword [ebp - 0x10], 2
jne 0x6895a7
mov dword [ebp - 0x14], 0
jmp 0x6895ae
mov dword [ebp - 0x14], 0xa0a
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x689840
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x89b044]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x120], 0x200
mov dword [ebp - 4], 0
lea eax, [ebp - 0x118]
push eax
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006896e0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6899bd
lea eax, [ebp - 0x118]
push eax
call fcn.006890a0
add esp, 4
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x6899ad
call fcn.00688050
test eax, eax
je 0x68992d
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x128], ecx
jmp 0x6898d5
mov edx, dword [ebp - 0x128]
add edx, 2
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x128]
movzx ecx, word [eax]
test ecx, ecx
je 0x6898ff
mov edx, dword [ebp - 0x128]
movzx eax, word [edx]
cmp eax, 0x5c
jne 0x6898fd
xor ecx, ecx
mov edx, dword [ebp - 0x128]
mov word [edx], cx
jmp 0x6898ff
jmp 0x6898c6
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp - 4], eax
jmp 0x68999e
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x12c], edx
jmp 0x68994a
mov eax, dword [ebp - 0x12c]
add eax, 1
mov dword [ebp - 0x12c], eax
mov ecx, dword [ebp - 0x12c]
movsx edx, byte [ecx]
test edx, edx
je 0x689972
mov eax, dword [ebp - 0x12c]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x689970
mov edx, dword [ebp - 0x12c]
mov byte [edx], 0
jmp 0x689972
jmp 0x68993b
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x124]
push edx
call fcn.007238ab
add esp, 4
cmp dword [ebp - 4], 0
jne 0x6899bd
mov dword [ebp - 0x120], 0x200
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0071fe0b
mov esp, ebp
pop ebp
ret

Function at 0x689d60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov dword [0x8a3280], eax
mov dword [0x8a3284], eax
mov dword [0x8a3288], eax
mov dword [0x8a328c], eax
mov dword [0x8a3290], eax
mov dword [0x8a3294], eax
mov dword [0x8a3298], eax
mov dword [0x8a329c], eax
mov dword [0x8a32a0], eax
push 0x8a3280
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 1
push 0x890518
call fcn.00683d00
add esp, 8
xor eax, eax
pop ebp
ret
Function at 0x6c6c20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
jne 0x6c6c31
xor eax, eax
jmp 0x6c6dae
push 0x50
mov eax, dword [ebp + 8]
push eax
call fcn.00685330
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6c6c4f
xor eax, eax
jmp 0x6c6dae
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.006c6ac0
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.006c6dc0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006c6680
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006c6ac0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006c6680
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006c6ac0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov cl, byte [eax + 4]
mov byte [edx + 4], cl
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006c6c20
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006c6680
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.006c6680
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 6]
and edx, 0xfffffff7
mov eax, dword [ebp - 4]
mov word [eax + 6], dx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x6feab0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xc], ecx
cmp dword [ebp + 0x18], 0
je 0x6feb46
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str.CREATE_TABLE___w_.__w_node__nodeno_INTEGER_PRIMARY_KEY__data_BLOB__CREATE_TABLE___w_.__w_rowid__rowid_INTEGER_PRIMARY_KEY__nodeno_INTEGER__CREATE_TABLE___w_.__w_parent__nodeno_INTEGER_PRIMARY_KEY__parentnode_INTEGER__INSERT_INTO__q._q_node_VALUES_1__zeroblob__d__
call fcn.00686e10
add esp, 0x28
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x6feb13
mov eax, 7
jmp 0x6fec2a
push 0
push 0
push 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.006b6940
add esp, 0x14
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x30]
push edx
call fcn.00684fa0
add esp, 4
cmp dword [ebp - 4], 0
je 0x6feb46
mov eax, dword [ebp - 4]
jmp 0x6fec2a
mov eax, dword [ebp + 8]
add eax, 0x234
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
add ecx, 0x238
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 8]
add edx, 0x23c
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 8]
add eax, 0x240
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
add ecx, 0x244
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
add edx, 0x248
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
add eax, 0x24c
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
add ecx, 0x250
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 0x254
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
jmp 0x6febc1
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x6fec27
cmp dword [ebp - 4], 0
jne 0x6fec27
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x8969c4]
push ecx
call fcn.00686e10
add esp, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x6fec12
push 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x2c]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.006b87a0
add esp, 0x14
mov dword [ebp - 4], eax
jmp 0x6fec19
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x34]
push eax
call fcn.00684fa0
add esp, 4
jmp 0x6febb8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x6fec30
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
je 0x6feca4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
push ecx
push str.PRAGMA__Q.page_size
call fcn.00686e10
add esp, 8
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.006fecf0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6feca2
mov edx, dword [ebp - 0xc]
sub edx, 0x40
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
imul edx, edx, 0x33
add edx, 4
mov eax, dword [ebp + 0xc]
cmp edx, dword [eax + 0x10]
jge 0x6feca2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
imul edx, edx, 0x33
add edx, 4
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], edx
jmp 0x6fecdc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x24]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
push ecx
push str.SELECT_length_data__FROM__q._q_node_WHERE_nodeno__1
call fcn.00686e10
add esp, 0xc
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
add edx, 0x10
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.006fecf0
add esp, 0xc
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call fcn.00684fa0
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x701380
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x701396
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x7013b5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x899f60]
mov dword [edx + ecx*4 + 0x88], eax
jmp 0x70138d
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret

Function at 0x701de0
Capabilities:
Hash data using sha512

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0
jmp 0x701df7
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x701e24
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov esi, dword [eax*8 + 0x899fc0]
mov dword [edx + ecx*8 + 0x108], esi
mov eax, dword [eax*8 + 0x899fc4]
mov dword [edx + ecx*8 + 0x10c], eax
jmp 0x701dee
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x7021b0
Capabilities:
Hash data using sha384

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0
jmp 0x7021c7
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x7021f4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov esi, dword [eax*8 + 0x899f80]
mov dword [edx + ecx*8 + 0x108], esi
mov eax, dword [eax*8 + 0x899f84]
mov dword [edx + ecx*8 + 0x10c], eax
jmp 0x7021be
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x702c30
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret
Function at 0x707030
Capabilities:
Get file size

Disassembly:
push ecx
mov ecx, dword [ecx]
push esi
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x707058
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x707058
xor al, al
pop esi
pop ecx
ret 4
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
call fcn.00729750
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
pop ecx
ret 4

Function at 0x707230
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp]
test eax, eax
mov dword [edx], ecx
setne al
pop ecx
ret 0xc
mov eax, dword [esp + 8]
mov edx, dword [0x89a5b8]
cmp eax, edx
jbe 0x707240
mov eax, edx
mov dword [esp + 8], eax
jmp 0x7071f0

Function at 0x707310
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [0x89a5b8]
cmp eax, edx
jbe 0x707320
mov eax, edx
mov ecx, dword [ecx]
push 0
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
test eax, eax
mov dword [edx], ecx
setne al
ret 0xc

Function at 0x707610
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x707690
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push esi
call fcn.00707610
add esp, 8
test al, al
jne 0x7076a6
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
ret

Function at 0x7079b0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 8], 0x105
push edi
jg 0x7079cb
push 0x105
mov ecx, esi
call fcn.00704f10
mov eax, dword [esi]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x7079ee
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x7079e4
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x707c90
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 8], 0x105
push edi
jg 0x707cab
push 0x105
mov ecx, esi
call fcn.00704f10
mov eax, dword [esi]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x707cce
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x707cc4
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret
Function at 0x707cf0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi + 8], 0x105
push edi
jg 0x707d0b
push 0x105
mov ecx, esi
call fcn.00704f10
mov eax, dword [esi]
mov ecx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x707d3a
mov edx, edi
jmp 0x707d30
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x707d30
xor edx, edx
mov word [edi + ecx*2], dx
pop edi
mov dword [esi + 4], ecx
pop esi
ret
Function at 0x70a3d2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x8a1568], 0
push esi
jne 0x70a340
call fcn.0070a254
test eax, eax
je 0x70a383
mov eax, dword [0x8a1568]
cmp eax, 1
jne 0x70a361
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x70a383
pop esi
ret
push eax
call dword [0x8a1570]
test eax, eax
jne 0x70a3cb
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x70a387
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x8a1568]
call dword [0x8a1570]
mov edi, eax
test edi, edi
je 0x70a3ac
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x70a3c8
mov edi, esi
add esi, 0xff0
push edi
push dword [0x8a1568]
call dword [0x8a156c]
add edi, 0x10
cmp edi, esi
jb 0x70a3b4
mov eax, edi
pop edi
pop esi
ret
jmp 0x70a32d

Function at 0x70d1d3
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x7c95f4
call fcn.007337aa
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x70d2e5
cmp byte [esi + 0x42], bl
je 0x70d2e5
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x70d20f
xor al, al
jmp 0x70d2e7
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00614100
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x70d27f
dec eax
je 0x70d283
dec eax
dec eax
je 0x70d2e1
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004073b0
mov al, bl
jmp 0x70d2e7
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x70d2c3
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0042f520
mov ecx, eax
call fcn.006099a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0072b81c
add esp, 0x10
cmp edi, eax
jne 0x70d26d
cmp byte [esi + 0x42], 0
je 0x70d2e1
test edi, edi
jne 0x70d21d
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00460c90
jmp 0x70d21d
mov bl, 1
jmp 0x70d26f
mov al, 1
call fcn.0073382d
ret