joyce8/EMBER2024-capa huggingface dataset:
Function at 0x532138
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x57421c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x5321d0
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x5321b0
xor eax, eax
push ebp
push 0x5321a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x5321ec
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5321b0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x57421c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x57421c], ax
mov esp, ebp
pop ebp
ret

Function at 0x532ed0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00531b84
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x580d05], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x532e98
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x5345c4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x534780
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x534625
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x53479c
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x534697
xor eax, eax
push ebp
push 0x534690
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0053441c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x534679
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x5347bc
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534697
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x534778
cmp byte [ebp - 0xd], 0
jne 0x5346d9
cmp byte [ebp - 0x12], 0
je 0x534778
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x5346f2
dec ebx
cmp byte [ebx], 0x2e
je 0x534701
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x5346f1
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x534778
inc ebx
cmp byte [ebp - 0x12], 0
je 0x53472e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x534778
cmp byte [ebp - 0xd], 0
je 0x534778
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x534778
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x534b6c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x534c54
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x5810e8], 1
jae 0x534c46
xor eax, eax
mov dword [0x580cf4], eax
xor eax, eax
mov dword [0x580cfc], eax
xor eax, eax
mov dword [0x580d00], eax
mov byte [0x580d06], 2
mov byte [0x580d07], 2
mov byte [0x580d08], 3
mov word [0x5810b0], 0
mov word [0x5810c0], 1
mov word [0x5810d0], 0xa
mov dword [0x5810d8], 0x80020004
mov dword [0x5810a4], 0x533c24
mov dword [0x5810a8], 0x533c1c
mov dword [0x5810ac], 0x533c24
call fcn.00532108
test al, al
je 0x534c05
call fcn.00532138
call fcn.005321fc
mov eax, 0x580d0c
mov edx, 0x534c60
call fcn.0052f89a
mov eax, 0x580ed8
mov edx, 0x534c60
call fcn.0052f89a
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x580cec], eax
call fcn.00530840
mov dword [0x580ce8], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x580ce0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x534c5b
ret

Function at 0x536e10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x536e2c
call fcn.0053832c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x536e48
test bl, 1
je 0x536e48
call fcn.0053ea04
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x53702c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00537ec8
test byte [ebp + 0xd], 0xc0
jne 0x537050
mov eax, dword [0x575158]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x53705d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x53708a
je 0x53709c
sub ecx, 0x100
je 0x5370aa
sub ecx, 0x100
je 0x5370b1
sub ecx, 0x100
je 0x5370a3
jmp 0x5370b8
sub ecx, 0x600
je 0x5370b1
sub ecx, 0x100
je 0x53709c
jmp 0x5370b8
mov edi, 1
jmp 0x5370bd
mov edi, 2
jmp 0x5370bd
mov edi, 4
jmp 0x5370bd
mov edi, 5
jmp 0x5370bd
mov edi, 3
test byte [ebp + 0xd], 1
je 0x5370e4
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x574bd0]
test al, 0x80
je 0x5370dd
mov ebx, 0x80
jmp 0x5370f6
mov ebx, 1
jmp 0x5370f6
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5370f6
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x537108
je 0x537111
dec eax
je 0x53711a
jmp 0x537123
mov dword [ebp - 4], 0x80000000
jmp 0x537132
mov dword [ebp - 4], 0x40000000
jmp 0x537132
mov dword [ebp - 4], 0xc0000000
jmp 0x537132
push 1
call fcn.005382c0
pop ecx
mov ebx, eax
jmp 0x537222
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x53714e
sub eax, 0x10
je 0x537155
sub eax, 0x10
je 0x53715e
sub eax, 0x10
je 0x537167
jmp 0x537167
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x53716e
mov dword [ebp - 8], 1
jmp 0x53716e
mov dword [ebp - 8], 2
jmp 0x53716e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x5371db
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x5371d0
test byte [ebp + 0xd], 1
je 0x5371cb
mov ebx, 0x50
jmp 0x5371d0
mov ebx, 2
push ebx
call fcn.005382c0
pop ecx
mov ebx, eax
jmp 0x537222
mov edi, esi
push edi
call fcn.00536f90
pop ecx
test eax, eax
je 0x5371ef
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x5371fb
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00537fe8
add esp, 8
mov ebx, eax
inc eax
jne 0x537222
push 4
call fcn.005382c0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.00537efc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53b708
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.00535bec
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00535c7c
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.00535c7c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x575d79
lea ecx, [ebp - 0x200]
push ecx
call fcn.00535bec
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.00535c7c
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0053c8a4
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x53b819
push esi
call fcn.00535c7c
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.00535c7c
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.00535668
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x53b7f0
xor eax, eax
jmp 0x53b8a0
push esi
call fcn.00535c7c
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.00535c7c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.00535b48
add esp, 0xc
jmp 0x53b859
mov edi, dword [ebx + 0x24]
push edi
call fcn.00535c7c
pop ecx
push eax
push esi
call fcn.00535c7c
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.00535c7c
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.00535688
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x53b859
xor eax, eax
jmp 0x53b8a0
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.00535bec
add esp, 8
push 0x575d7b
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00535bec
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.00535bec
add esp, 8
push 0x575d7d
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.00535bec
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53e99c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x53e9fe
call fcn.0053e94c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00535c7c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00535c7c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x53ea7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x57640c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x53eb56
cmp dword [0x576408], 0
jne 0x53eb56
cmp dword [0x5765ec], 0
je 0x53eb10
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0053e84c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x53eaf6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0053e84c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x53eaf6
lea ebx, [ebp - 0x84]
jmp 0x53eaf7
inc ebx
call fcn.0053ea38
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x53eb91
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x576410
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00535c7c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x576413
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x53eb91
cmp dword [0x576408], 0
je 0x53eb70
cmp dword [0x576408], 0xffffffff
je 0x53eb91
push esi
call dword [0x576408]
pop ecx
mov eax, dword [0x57640c]
test eax, eax
je 0x53eb91
cmp dword [0x57640c], 0xffffffff
je 0x53eb91
cmp byte [eax], 0

Function at 0x546494
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x5464c2
mov eax, ebx
call fcn.00546f38
cmp dword [ebx + 0x3c], 0
je 0x5464bb
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x546533
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x546525
cmp dword [ebx + 8], 0
je 0x5464e4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x5464f6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x546525
cmp dword [ebx + 8], 0
je 0x5464d7
cmp eax, 3
je 0x546509
dec eax
jne 0x5464d7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5464d7
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x5464d7
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x546551
cmp dword [ebx + 0x10], 0xcc
je 0x546551
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0054655c
pop ebx
ret
Function at 0x10025c8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10012d4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov byte [ebp - 0x15], al
inc dword [ebp - 0x10]
cmp byte [ebp - 0x15], 0
jne 0x10025e3
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jb 0x1002637
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
push eax
call dword [sym.imp.msvcrt.dll_isalpha]
pop ecx
test eax, eax
je 0x1002637
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x1002637
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
pop ecx
sub eax, 0x40
mov byte [ebp - 5], al
jmp 0x1002640
call dword [sym.imp.msvcrt.dll__getdrive]
mov byte [ebp - 5], al
movsx eax, byte [ebp - 5]
add eax, 0x40
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x1002768
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x100279d
push dword [ebp + 0xc]
push 0x1001180
push 0x1001320
jmp 0x1002801
push ebx
push esi
lea ecx, [ebp - 0xc]
push ecx
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov esi, dword [ebp + 8]
or ebx, eax
lea eax, [esi + 2]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
push dword [ebp - 4]
or ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call fcn.01002685
mov word [esi + 4], ax
pop esi
cmp ebx, edi
pop ebx
jne 0x1002810
push dword [ebp + 0xc]
push 0x1001180
push 0x10012f0
push dword [ebp + 0x10]
call fcn.010020f0
add esp, 0x10
xor eax, eax
jmp 0x1002813
xor eax, eax
inc eax
pop edi
leave
ret 0xc
Function at 0x1002818
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
push esi
push esi
push 3
push esi
push esi
mov ebx, 0x40000000
push ebx
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x100285e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push esi
push 3
push esi
push esi
push ebx
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x10028da
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
xor eax, eax
mov ax, word [edi + 2]
push eax
xor eax, eax
mov ax, word [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
or ebx, eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 4]
or ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ax, word [edi + 4]
push eax
call fcn.0100266f
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or eax, ebx
jne 0x10028da
push dword [ebp + 8]
push 0x1001180
push 0x1001338
push dword [ebp + 0x10]
call fcn.010020f0
add esp, 0x10
xor eax, eax
jmp 0x10028dd
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10028e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.msvcrt.dll__open]
push edi
mov edi, dword [ebp + 0xc]
push 0x8000
push edi
call esi
cmp eax, 0xffffffff
pop ecx
pop ecx
mov dword [ebp - 8], eax
jne 0x100292a
push edi
push 0x1001180
push 0x1001320
push dword [ebp + 0x20]
call fcn.010020f0
add esp, 0x10
jmp 0x1002a53
push ebx
mov ebx, dword [ebp + 0x20]
push ebx
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.01002768
test eax, eax
je 0x1002a38
cmp dword [ebp + 0x18], 0
je 0x100295a
push ebx
push dword [ebp + 0x1c]
lea eax, [ebp - 0x14]
push eax
call dword [ebp + 0x18]
test eax, eax
je 0x1002a38
cmp dword [ebp + 0x10], 0
jne 0x100296c
mov dword [ebp - 0xc], 1
jmp 0x1002a38
push dword [ebp + 0x14]
call dword [sym.imp.msvcrt.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x1002999
push dword [ebp + 8]
push edi
push 0x10011b8
push 0x1001398
push ebx
call fcn.010020f0
add esp, 0x14
jmp 0x1002a38
push 0x180
push 0x8301
push dword [ebp + 8]
call esi
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x10029c5
push dword [ebp + 8]
push 0x1001180
push 0x1001320
push ebx
jmp 0x1002a7b
mov ebx, dword [sym.imp.msvcrt.dll__eof]
jmp 0x10029fc
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__read]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x1002a5c
test esi, esi
je 0x10029fc
push esi
push dword [ebp - 4]
push edi
call dword [sym.imp.msvcrt.dll__write]
add esp, 0xc
cmp eax, esi
jne 0x1002a6b
push dword [ebp - 8]
call ebx
test eax, eax
pop ecx
je 0x10029cd
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
or edi, 0xffffffff
call fcn.01002818
test eax, eax
je 0x1002a38
mov dword [ebp - 0xc], 1
cmp edi, 0xffffffff
je 0x1002a38
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__close]
cmp dword [ebp - 4], 0
pop ecx
pop ebx
je 0x1002a53
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 0x1c
push dword [ebp + 0xc]
push 0x1001180
push 0x1001380
jmp 0x1002a78
push dword [ebp + 0xc]
push 0x1001180
push 0x1001368
push dword [ebp + 0x20]
call fcn.010020f0
add esp, 0x10
jmp 0x1002a2b

Function at 0x1003aa2
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push dword [esp + 0x14]
push dword [esp + 0x14]
push esi
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp esi, dword [section..data]
mov edi, eax
jne 0x1003ad2
mov eax, dword [0x100b2ac]
add eax, edi
mov dword [0x100b2ac], eax
jmp 0x1003ae6
cmp esi, dword [0x100b004]
jne 0x1003af8
mov eax, dword [0x100b2a4]
add eax, edi
mov dword [0x100b2a4], eax
cmp eax, dword [0x100b2b0]
jbe 0x1003af8
mov dword [0x100b2b0], eax
call fcn.010036ed
mov eax, edi
pop edi
pop esi
ret
Function at 0x1004d23
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
call fcn.01002114
xor ebx, ebx
push 0x1074
mov dword [ebp - 0x14], ebx
mov byte [0x100c440], bl
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x1004d80
lea eax, [ebp - 0x218]
push 0x1001f70
push eax
call fcn.010020f0
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
push ebx
call fcn.010032e6
push 1
call dword [sym.imp.msvcrt.dll_exit]
mov edi, dword [sym.imp.msvcrt.dll_printf]
mov dword [0x100c540], esi
push 0x1001ef8
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x858], ebx
mov dword [esi + 0x850], ebx
mov dword [esi + 0x854], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0xe64], bl
mov dword [esi + 0x1064], ebx
mov dword [esi + 0x106c], ebx
call edi
pop ecx
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.010045bc
test eax, eax
jne 0x1004df9
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.010032e6
jmp 0x1004e58
mov eax, dword [esi]
cmp eax, 1
jne 0x1004e15
push 0x1001440
call edi
mov dword [esp], 0x1001b28
call edi
jmp 0x1004ebe
cmp eax, 5
lea eax, [ebp - 0x218]
push eax
push esi
jne 0x1004e31
call fcn.010037ad
test eax, eax
jne 0x1004ebf
jmp 0x1004dea
call fcn.0100488e
test eax, eax
jne 0x1004e5d
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.010032e6
mov eax, dword [0x100c424]
cmp eax, 0xffffffff
je 0x1004e58
push eax
call fcn.0100355b
pop ecx
xor eax, eax
inc eax
jmp 0x1004ec1
mov eax, dword [esi + 0x3c]
cmp eax, ebx
jne 0x1004e82
lea ebx, [esi + 0x150]
push 0x1001b14
push ebx
call fcn.01002f97
push ebx
push 0x10014d0
call edi
add esp, 0x10
jmp 0x1004eb7
cmp dword [esi], 3
jne 0x1004eb7
cmp eax, 1
mov ecx, 0x1001afc
je 0x1004e96
mov ecx, 0x1001ae4
push dword [esi + 0x40]
lea ebx, [esi + 0x150]
push eax
push 0x1001ad4
push ecx
push ebx
call fcn.01002f97
push ebx
push 0x10014d0
call edi
add esp, 0x1c
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret