joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100062fa
pop dword [ebp - 0x50]
mov eax, 0xaa7fb15e
add eax, 0x6580b19c
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x33834
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x47171aed
sub ecx, 0x4716e8f7
xor edx, edx
add edx, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x50]
mov edi, 0x5d1af42b
add edi, 0x8ae13165
add dword [ebp - 0x14], edi
mov esi, dword [ebx]
xor dword [ebp - 0x14], 0x47e0d48
add esi, edi
xor dword [ebp - 0x44], 0xac87ac42
mov dword [edx], esi
sub dword [ebp - 0x30], edi
add edx, 0x979ac0a6
sub edx, 0x979ac0a2
add ebx, 0x44ed5de2
sub ebx, 0x44ed5dde
loop 0x10006350
add eax, 0xa1a38348
add eax, 0x5e5d3763
xor ebx, ebx
add ebx, eax
add eax, 0x66d07846
sub eax, 0x66d07841
mov ecx, 0x23f91bee
sub ecx, 0x13f91bee
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x2e017339
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax - 0x3a]
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.2e016ae4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2e016a99
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.2e016ae4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2e016a99
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.2e016ae4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2e016a99
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.2e016ad4
in al, 0xd5
jae 0x2e0175af
and byte [ebp - 0x534], 0
and byte [ebp - 0x533], 0
mov byte [ebp - 0x532], 0x68
and byte [ebp - 0x531], 0
mov byte [ebp - 0x530], 0xd4
mov byte [ebp - 0x52f], 0xfb
mov byte [ebp - 0x52e], 0xf8
mov byte [ebp - 0x52d], 0xe4
mov byte [ebp - 0x52c], 0xf2
mov byte [ebp - 0x52b], 0xdf
mov byte [ebp - 0x52a], 0xf6
mov byte [ebp - 0x529], 0xf9
mov byte [ebp - 0x528], 0xf3
mov byte [ebp - 0x527], 0xfb
mov byte [ebp - 0x526], 0xf2
mov byte [ebp - 0x525], 0x97
lea eax, [ebp - 0x534]
push eax
call fcn.2e016ae4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2e016a99
add esp, 0xc
mov dword [ebp - 0x680], eax
call fcn.2e016ad4
jo 0x2e01764c
mov dword [0x9ca58018], eax
stc
invalid
hlt
Function at 0x2e0179cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.2e016ab2
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
call dword [ebp - 0x73]
test dword [esp + edi*8 - 0x17af0001], edx
xor esi, eax
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.2e016a99
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.2e016ad4
hlt
Function at 0x4397e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x439805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x439878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x43983a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x43986d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x43986b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x439831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4397fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10007fbe
pop dword [ebp - 0x3c]
mov eax, 0xb9970db7
add eax, 0x56697207
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xfe44bcce
sub dword [ebp - 0x4c], 0xaff27783
mov dword [ebp - 0x48], 0x719259db
add dword [ebp - 0x48], 0xc0a0f26a
mov dword [ebp - 0x44], 0x86e52888
add dword [ebp - 0x44], 0xc5671ba6
mov dword [ebp - 0x40], 0xc0c08dc7
add dword [ebp - 0x40], 0x3f3f7239
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x976daf74
sub eax, 0x876beef4
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x4c344717
sub dword [ebp - 0x4c], 0xd7c1ddc1
mov dword [ebp - 0x48], 0x35007235
sub dword [ebp - 0x48], 0xf39410c0
mov dword [ebp - 0x44], 0x6b362188
add dword [ebp - 0x44], 0xf8394ae4
mov dword [ebp - 0x40], 0x9ced2c6c
add dword [ebp - 0x40], 0x6312d394
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34c53
push 0
call eax
mov ecx, 0x3d18
xor esi, esi
add esi, eax
mov edi, 0x4827165e
sub edi, 0x3824ae5e
add edi, dword [ebp - 0x3c]
mov ebx, 0xbbf76df9
xor dword [ebp - 0x2c], 0xafe00338
mov edx, dword [edi]
xor dword [ebp - 4], 0x875096ca
sub edx, ebx
add dword [ebp - 0xc], eax
mov dword [esi], edx
sub dword [ebp - 4], ecx
add esi, 0xb05fdf0e
sub esi, 0xb05fdf0a
add edi, 4
loop 0x100080d1
add eax, 0x7c002a69
add eax, 0x8400bcca
xor ebx, ebx
add ebx, eax
add eax, 0x6c6ffe29
sub eax, 0x6c6ffe24
mov ecx, 0xb95019e7
sub ecx, 0xa95019e7
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_406
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_109
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_109
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10002e10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push esi
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.10008920
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
call fcn.10007e80
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x1009e768
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, dword [ebp + 8]
test eax, eax
jne 0x10002e7e
push dword [ebp - 0x14]
push esi
call fcn.10007c10
add esp, 8
push edi
push str.BrightData_
push esi
call fcn.10007d20
mov edx, dword [ebp - 0xc]
add esp, 8
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002e95
lea eax, [ebp - 8]
sub ecx, edi
push eax
push ecx
push edx
call fcn.10009010
add esp, 0xc
pop edi
test eax, eax
jne 0x10002ede
push 0x14
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.100092e0
push dword [ebp - 4]
call fcn.10007b30
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
call fcn.10007dc0
push dword [eax]
push esi
call fcn.10007d20
add esp, 0x20
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002ef5
push eax
call fcn.100672c9
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x10002f0c
push eax
call fcn.100672c9
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10002f23
push eax
call fcn.100672c9
add esp, 4
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
call fcn.10007bc0
lea eax, [ebp - 0x10]
push eax
call fcn.10007bc0
add esp, 8
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003010
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.10008920
lea eax, [ebp - 4]
push 0x1009d884
push eax
call fcn.10007d20
add esp, 0xc
cmp dword [section..data], 0
je 0x100030b0
push dword [ebp - 4]
call fcn.10008660
add esp, 4
test eax, eax
jne 0x100030b0
lea eax, [ebp - 4]
push esi
push eax
call fcn.10002e10
push 0x5c
push dword [ebp - 4]
call fcn.10066e44
mov esi, eax
xor eax, eax
mov word [esi], ax
push dword [ebp - 4]
call fcn.10067301
push 0x1ff
push dword [ebp - 4]
call fcn.10067332
mov eax, 0x5c
mov word [esi], ax
push dword [ebp - 4]
call fcn.10067301
push 0x1ff
push dword [ebp - 4]
call fcn.10067332
add esp, 0x24
lea eax, [ebp - 4]
pop esi
push eax
call fcn.10007bc0
add esp, 4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call fcn.10008920
push 0x1ff
push dword [ebp - 8]
call fcn.10007890
lea eax, [ebp - 8]
push eax
call fcn.10007bc0
push dword [ebp - 4]
call fcn.10067301
push 0x1ff
push dword [ebp - 4]
call fcn.10007890
add esp, 0x1c
lea eax, [ebp - 4]
push eax
call fcn.10007bc0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10003100
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x100b9550]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x25c]
xor esi, esi
push eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], esi
call fcn.10008920
lea eax, [ebp - 0x25c]
push 0x1009d884
push eax
call fcn.10007d20
add esp, 0xc
cmp dword [section..data], esi
je 0x1000316c
push dword [ebp - 0x25c]
call fcn.10008660
add esp, 4
test eax, eax
jne 0x1000316c
lea eax, [ebp - 0x25c]
push eax
call fcn.10002e10
add esp, 4
push dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
call fcn.10007c10
lea eax, [ebp - 0x258]
push str.perr_.sent
push eax
call fcn.10007d20
add esp, 0x10
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
cmove ebx, eax
test ebx, ebx
je 0x100032bb
push edi
jmp 0x100031c0
lea eax, [ebp - 0x228]
push 0x1009d904
push eax
call fcn.10007cf0
add esp, 8
test eax, eax
jne 0x1000324a
push dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
push eax
call fcn.10007c10
lea eax, [ebp - 0x258]
push 0x1009d918
push eax
call fcn.10007d20
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.10007d20
push 1
push 0xc
call fcn.10067289
push dword [ebp - 0x258]
mov edi, eax
lea ecx, [edi + 8]
push ecx
call fcn.10007c10
add esp, 0x28
test esi, esi
je 0x1000323f
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
jmp 0x10003244
mov dword [edi + 4], edi
mov esi, edi
mov dword [edi], 0
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100031c0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
je 0x100032ba
jmp 0x10003270
push dword [esi + 8]
call fcn.100673e5
mov edi, esi
add esp, 4
mov esi, dword [esi]
mov ecx, dword [edi]
test ecx, ecx
je 0x1000328d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10003297
test esi, esi
je 0x10003297
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
lea eax, [edi + 8]
mov dword [edi], 0
push eax
mov dword [edi + 4], 0
call fcn.10007bc0
push edi
call fcn.100672c9
add esp, 8
test esi, esi
jne 0x10003270
pop edi
lea eax, [ebp - 0x258]
push eax
call fcn.10007bc0
lea eax, [ebp - 0x25c]
push eax
call fcn.10007bc0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
pop ebx
call fcn.100676f5
mov esp, ebp
pop ebp
ret
Function at 0x10003350
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100bb01c]
sub esp, 0xc
test eax, eax
jne 0x1000345b
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10008920
lea eax, [ebp - 0xc]
push 0x1009db54
push eax
call fcn.10007d20
push dword [ebp - 0xc]
call fcn.100085f0
add esp, 0x10
test eax, eax
je 0x10003438
push 0x1009db70
push dword [ebp - 0xc]
call fcn.10008570
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x10003438
push esi
push 2
push 0
push eax
call fcn.10065bf2
push dword [ebp - 4]
call fcn.10066005
push dword [ebp - 4]
mov esi, eax
call fcn.1006624c
add esp, 0x14
cmp esi, 0x32
jg 0x10003437
lea eax, [ebp - 8]
push esi
push eax
call fcn.100079e0
push dword [ebp - 4]
push esi
push 1
push dword [ebp - 8]
call fcn.10065ab7
mov eax, dword [ebp - 8]
add esp, 0x18
xor ecx, ecx
mov byte [esi + eax], 0
mov edx, dword [ebp - 8]
test esi, esi
jle 0x10003429
mov al, byte [ecx + edx]
cmp al, 0x30
jl 0x1000340c
cmp al, 0x39
jle 0x10003424
cmp al, 0x41
jl 0x10003414
cmp al, 0x5a
jle 0x10003424
cmp al, 0x61
jl 0x1000341c
cmp al, 0x7a
jle 0x10003424
cmp al, 0x2e
je 0x10003424
cmp al, 0x5f
jne 0x10003437
inc ecx
cmp ecx, esi
jl 0x10003401
push edx
push 0x100bb01c
call fcn.10007dc0
add esp, 8
pop esi
lea eax, [ebp - 4]
push eax
call fcn.100085d0
lea eax, [ebp - 8]
push eax
call fcn.10007a10
lea eax, [ebp - 0xc]
push eax
call fcn.10007bc0
mov eax, dword [0x100bb01c]
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10003a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1009dc90
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10003a81
imul eax, dword [ebp + 0x14], 0x64
pop edi
pop esi
inc eax
mov dword [0x100bab28], eax
xor eax, eax
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10003a9f
imul eax, dword [ebp + 0x14], 0x64
pop edi
pop esi
add eax, 2
mov dword [0x100bab28], eax
xor eax, eax
pop ebp
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x10003ac0
imul eax, dword [ebp + 0x14], 0x64
pop ebx
pop edi
pop esi
add eax, 3
mov dword [0x100bab28], eax
xor eax, eax
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10003b80
Capabilities:
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
imul esi, dword [ebp + 0x14], 0x64
push edi
or edi, 0xffffffff
mov dword [ebp - 8], 0
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10003a50
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp + 0x14], 0
mov dword [ebp - 4], 0
test eax, eax
je 0x10003cff
lea eax, [ebp + 0x14]
push eax
call fcn.10008920
lea eax, [ebp + 0x14]
push 0x1009d884
push eax
call fcn.10007d20
add esp, 0xc
cmp dword [section..data], 0
je 0x10003c03
push dword [ebp + 0x14]
call fcn.10008660
add esp, 4
test eax, eax
jne 0x10003c03
lea eax, [ebp + 0x14]
push eax
call fcn.10002e10
add esp, 4
push ebx
lea eax, [ebp + 0x14]
push 0x1009dca0
push eax
call fcn.10007d20
push dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
call fcn.10007d20
push dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
call fcn.10007c10
lea eax, [ebp - 4]
push 0x1009dca4
push eax
call fcn.10007d20
push dword [ebp - 4]
call fcn.100673e5
push dword [ebp + 0x14]
call fcn.100085f0
mov ebx, dword [ebp - 0x10]
add esp, 0x28
test eax, eax
je 0x10003ca7
push ebx
push dword [ebp - 0xc]
push dword [ebp + 0x14]
call fcn.10003ae0
add esp, 0xc
test eax, eax
jne 0x10003cfc
push dword [ebp + 0x14]
call fcn.100673e5
push dword [ebp + 0x14]
call fcn.100085f0
add esp, 8
test eax, eax
je 0x10003c8e
push dword [ebp - 4]
push dword [ebp + 0x14]
call fcn.100673ee
add esp, 8
push dword [ebp + 0x14]
call fcn.100085f0
add esp, 4
test eax, eax
je 0x10003ca7
lea eax, [esi + 2]
mov dword [0x100bab28], eax
jmp 0x10003cfe
push 0x1009dcb0
push dword [ebp + 0x14]
call fcn.10008570
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x10003cdf
push 0x1009dcbc
push dword [ebp + 0x14]
call fcn.10008570
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x10003cdf
lea eax, [esi + 3]
mov dword [0x100bab28], eax
jmp 0x10003cfe
push eax
push ebx
push 1
push dword [ebp - 0xc]
call fcn.100661ca
add esp, 0x10
cmp eax, ebx
je 0x10003cfc
lea eax, [esi + 4]
mov dword [0x100bab28], eax
jmp 0x10003cfe
xor edi, edi
pop ebx
lea eax, [ebp + 0x14]
push eax
call fcn.10007bc0
lea eax, [ebp - 4]
push eax
call fcn.10007bc0
lea eax, [ebp - 8]
push eax
call fcn.100085d0
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push dword [ebp + 8]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 8], 0
xor esi, esi
call fcn.10007d20
lea eax, [ebp - 4]
push 0x1009e2d0
push eax
call fcn.10007d20
push dword [ebp - 4]
call fcn.100673e5
push esi
call fcn.1006726a
push str.rbe
push dword [ebp - 4]
call fcn.10008570
add esp, 0x20
mov dword [ebp - 8], eax
test eax, eax
jne 0x100046a8
push str.wbe
push dword [ebp - 4]
call fcn.10008570
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x100046a8
call fcn.100671b1
imul esi, dword [eax], 0x64
inc esi
jmp 0x100046d3
push 0
call fcn.1006726a
push dword [ebp - 8]
push 1
push 1
push 0x1009e2cc
call fcn.100661ca
add esp, 0x14
cmp eax, 1
je 0x100046d3
call fcn.100671b1
imul esi, dword [eax], 0x64
add esi, 2
lea eax, [ebp - 8]
push eax
call fcn.100085d0
push dword [ebp - 4]
call fcn.100673e5
lea eax, [ebp - 4]
push eax
call fcn.10007bc0
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10008260
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0x10]
push 2
push dword [edi]
call fcn.10069835
add esp, 8
mov dword [edi], eax
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x10]
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x100082a3
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
cmp dword [ebp - 4], ebx
jg 0x100082b7
pop ebx
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
inc eax
push esi
mov dword [ebp + 0x10], eax
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 0
call fcn.10069835
add esp, 8
mov dword [ebp - 8], eax
xor ecx, ecx
mov word [eax], cx
push ecx
push ecx
push ecx
push ecx
mov word [esi + eax], cx
lea ecx, [ebp + 0x10]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop esi
test eax, eax
je 0x100082fd
pop ebx
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
test eax, eax
je 0x10008312
push eax
call fcn.100672c9
add esp, 4
mov dword [edi], 0
mov eax, dword [ebp - 8]
mov dword [edi], eax
xor eax, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret