joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20a
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQPCMgrSoftMgr
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jl 0x10023296
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret

Function at 0x100232c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x80
lea eax, [ebp - 0x84]
mov edi, edx
push 0
push eax
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
push 0x20a
lea eax, [ebp - 0x290]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea ecx, [ebp - 0x290]
call fcn.10023220
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1002332e
push eax
lea eax, [ebp - 0x290]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
movzx eax, word [esi + 6]
push eax
movzx eax, word [esi + 2]
push eax
movzx eax, word [esi]
push eax
push str.PL_04d_02d_02d
lea eax, [ebp - 0x84]
push 0x3f
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x18
mov esi, eax
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, esi
cmp eax, 0xfa
jle 0x1002337d
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x100233b0
Capabilities:
Check if file exists
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20a
lea eax, [ebp - 0x210]
mov dword [ebp - 0x630], edx
push 0
push eax
mov edi, ecx
call sub.VCRUNTIME140.dll_memset
push 0x20a
lea eax, [ebp - 0x628]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x20a
lea eax, [ebp - 0x41c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x210]
add esp, 0x24
push 0x104
push edi
push eax
call esi
push 0x104
push edi
lea eax, [ebp - 0x628]
push eax
call esi
push 0x104
push edi
lea eax, [ebp - 0x41c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
lea eax, [ebp - 0x210]
push str..bak
push eax
call esi
push str..tmp
lea eax, [ebp - 0x628]
push eax
call esi
push str..dat
lea eax, [ebp - 0x41c]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x628]
push eax
call edi
test eax, eax
je 0x1002348d
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100234e8
push 0
lea eax, [ebp - 0x62c]
push eax
push dword [ebp + 8]
push dword [ebp - 0x630]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100234e8
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x62c], eax
jne 0x100234e8
mov esi, 1
jmp 0x100234ea
xor esi, esi
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
je 0x10023504
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x41c]
push eax
call edi
test eax, eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
je 0x10023565
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
test ebx, ebx
jne 0x10023548
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x41c]
push eax
push str._s_move_error__d
call fcn.10002780
add esp, 0xc
jmp 0x10023574
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
push str._s_move_ok__s
call fcn.10002780
add esp, 0xc
jmp 0x10023574
push str._s_no_move__s
call fcn.10002780
add esp, 0xc
xor ebx, ebx
lea eax, [ebp - 0x628]
push eax
call edi
test eax, eax
je 0x10023597
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
je 0x100235b5
test ebx, ebx
je 0x100235b5
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x100241e0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
jne 0x100241fc
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
jg 0x1002420b
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
jne 0x1002421c
pop edi
mov eax, 0xfffffffd
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jg 0x1002422e
pop edi
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10024240
lea eax, [ebx - 5]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
jg 0x10024253
pop ebx
pop edi
mov eax, 0xfffffffa
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, eax
jge 0x10024263
pop ebx
pop edi
mov eax, 0xfffffff9
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
xor ecx, ecx
nop word [eax + eax]
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x200], al
lea eax, [edx + 1]
mov byte [ebp + ecx - 0x100], cl
inc ecx
cdq
idiv esi
cmp ecx, 0x100
jl 0x10024270
xor edi, edi
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
mov dl, byte [ebp + esi - 0x100]
movzx eax, byte [ebp + esi - 0x200]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x100242c6
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x100]
mov byte [ebp + edi - 0x100], dl
mov byte [ebp + esi - 0x100], al
inc esi
cmp esi, 0x100
jl 0x100242a0
mov edi, dword [ebp + 0x14]
xor esi, esi
xor edx, edx
test edi, edi
jle 0x10024360
sub dword [ebp + 0x10], ebx
inc edx
and edx, 0x800000ff
jns 0x10024303
dec edx
or edx, 0xffffff00
inc edx
movzx eax, byte [ebp + edx - 0x100]
add esi, eax
and esi, 0x800000ff
jns 0x1002431d
dec esi
or esi, 0xffffff00
inc esi
movzx eax, byte [ebp + edx - 0x100]
mov cl, byte [ebp + esi - 0x100]
mov byte [ebp + esi - 0x100], al
mov byte [ebp + edx - 0x100], cl
movzx eax, byte [ebp + esi - 0x100]
movzx ecx, cl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ebp + eax - 0x100]
xor al, byte [ecx + ebx]
mov byte [ebx], al
inc ebx
sub edi, 1
jne 0x100242f2
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10024370
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
jne 0x1002438c
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
jg 0x1002439b
pop edi
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x100243ad
lea eax, [ebx - 3]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jg 0x100243c0
pop ebx
pop edi
mov eax, 0xfffffffc
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
jne 0x100243d2
pop ebx
pop edi
mov eax, 0xfffffffb
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
jg 0x100243e5
pop ebx
pop edi
mov eax, 0xfffffffa
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, eax
jge 0x100243f5
pop ebx
pop edi
mov eax, 0xfffffff9
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
xor ecx, ecx
nop dword [eax]
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x200], al
lea eax, [edx + 1]
mov byte [ebp + ecx - 0x100], cl
inc ecx
cdq
idiv esi
cmp ecx, 0x100
jl 0x10024400
xor edi, edi
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
mov dl, byte [ebp + esi - 0x100]
movzx eax, byte [ebp + esi - 0x200]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x10024456
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x100]
mov byte [ebp + edi - 0x100], dl
mov byte [ebp + esi - 0x100], al
inc esi
cmp esi, 0x100
jl 0x10024430
mov edi, dword [ebp + 0x14]
xor esi, esi
xor edx, edx
test edi, edi
jle 0x100244f0
sub dword [ebp + 0x10], ebx
inc edx
and edx, 0x800000ff
jns 0x10024493
dec edx
or edx, 0xffffff00
inc edx
movzx eax, byte [ebp + edx - 0x100]
add esi, eax
and esi, 0x800000ff
jns 0x100244ad
dec esi
or esi, 0xffffff00
inc esi
movzx eax, byte [ebp + edx - 0x100]
mov cl, byte [ebp + esi - 0x100]
mov byte [ebp + esi - 0x100], al
mov byte [ebp + edx - 0x100], cl
movzx eax, byte [ebp + esi - 0x100]
movzx ecx, cl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp + 0x10]
movzx eax, byte [ebp + eax - 0x100]
xor al, byte [ecx + ebx]
mov byte [ebx], al
inc ebx
sub edi, 1
jne 0x10024482
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10025790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
nop
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x1002581f
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x100257ef
sub eax, esi
jmp 0x100257f1
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x100257e0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x10025810
sub eax, esi
jmp 0x10025812
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x10025801
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x10025953
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x1002584c
xor eax, eax
jmp 0x1002589f
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x10025869
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.10024740
jmp 0x10025881
cmp eax, 2
jne 0x10025887
mov edx, dword [ebx]
test edx, edx
jne 0x10025878
xor eax, eax
jmp 0x10025884
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.1005a2c0
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x100258c7
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x100258db
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x100257a0
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x10025953
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x10025923
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x10025953
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a350
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e412
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x414], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x424], 0
push 0x10068a0c
mov dword [ebp - 0x428], esi
mov dword [esi], 0
call fcn.1002a990
push 0
push 0
push 3
push 0
push 3
push 0
mov dword [ebp - 4], 0
push 0x10068a10
mov dword [ebp - 0x424], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1002a499
push 0x400
xorps xmm0, xmm0
mov dword [ebp - 0x414], 0
lea eax, [ebp - 0x410]
movq qword [ebp - 0x420], xmm0
push 0
push eax
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push 0xc
lea eax, [ebp - 0x420]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1002a492
lea ebx, [ebp - 0x410]
add ebx, dword [ebp - 0x400]
movsx eax, byte [ebx]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x1002a492
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002a480
sub ecx, edx
push ecx
push ebx
mov ecx, esi
call fcn.1002ac80
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x1002a720
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e4f0
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x1002a75a
xor eax, eax
jmp 0x1002a906
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
call fcn.1002a350
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.1002a4c0
mov byte [ebp - 4], 1
call fcn.10007090
mov ecx, eax
test ecx, ecx
jne 0x1002a798
push 0x80004005
call fcn.1002af80
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.1002a5c0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xbc], 0x67452301
mov dword [ebp - 0xb8], 0xefcdab89
mov dword [ebp - 0xb4], 0x98badcfe
cmp dword [edx - 4], 1
mov edi, dword [edx - 0xc]
mov dword [ebp - 0xb0], 0x10325476
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
jle 0x1002a81b
push edi
lea ecx, [ebp - 0x1c]
call fcn.1002aa40
mov edx, dword [ebp - 0x1c]
push edi
lea ecx, [ebp - 0xbc]
call fcn.10030fd0
mov edx, dword [ebp - 0x18]
add esp, 4
cmp dword [edx - 4], 1
mov edi, dword [edx - 0xc]
jle 0x1002a842
push edi
lea ecx, [ebp - 0x18]
call fcn.1002aa40
mov edx, dword [ebp - 0x18]
push edi
lea ecx, [ebp - 0xbc]
call fcn.10030fd0
mov edx, dword [ebp - 0x14]
add esp, 4
cmp dword [edx - 4], 1
mov edi, dword [edx - 0xc]
jle 0x1002a869
push edi
lea ecx, [ebp - 0x14]
call fcn.1002aa40
mov edx, dword [ebp - 0x14]
push edi
lea ecx, [ebp - 0xbc]
call fcn.10030fd0
add esp, 4
lea ecx, [ebp - 0xbc]
mov edx, esi
call fcn.100310b0
mov byte [ebp - 4], 2
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002a8a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002a8c4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002a8e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1002a901
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
Function at 0x1002af10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1002af29
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002af66
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1002af62
nop word [eax + eax]
cmp esi, edx
jae 0x1002af66
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1002af50
cmp esi, edx
jb 0x1002af6d
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002bf60
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [eax]
cmp esi, 0xffffffff
je 0x1002c028
mov edi, dword [edi]
cmp edi, 0xffffffff
je 0x1002c028
push 0x44
lea eax, [ebp - 0x80]
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x34], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str._ipconfig___all]
add esp, 0xc
or dword [ebp - 0x54], 0x101
xor eax, eax
mov dword [ebp - 0x80], 0x44
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x34]
movups xmmword [ebp - 0x24], xmm0
push eax
movups xmm0, xmmword [0x10068a78]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x40], esi
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x44], esi
push eax
push 0
mov dword [ebp - 0x48], edi
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x1002c028
push dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 8
Function at 0x1002c040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e5c6
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x420], ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x41c], ebx
call fcn.10007090
mov ecx, eax
test ecx, ecx
jne 0x1002c095
push 0x80004005
call fcn.1002af80
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x414], esi
mov dword [ebp - 4], 0
mov eax, dword [edi]
test eax, eax
je 0x1002c0ca
cmp eax, 0xffffffff
je 0x1002c0ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1002c211
mov dword [edi], 0xffffffff
push 0
lea eax, [ebp - 0x418]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
push dword [ebx]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
call ebx
test eax, eax
je 0x1002c1a4
mov esi, dword [ebp - 0x418]
test esi, esi
je 0x1002c1a4
call fcn.10007090
test eax, eax
je 0x1002c08b
mov edx, dword [eax]
mov ecx, eax
push 1
push esi
call dword [edx]
test eax, eax
je 0x1002c21f
lea edi, [eax + 0x10]
mov dword [ebp - 0x424], edi
test esi, esi
js 0x1002c215
cmp esi, dword [edi - 8]
jg 0x1002c215
lea eax, [ebp - 0x410]
mov dword [edi - 0xc], esi
push esi
push eax
mov edx, esi
mov byte [edi + esi], 0
mov ecx, edi
call fcn.1002afa0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x414]
push dword [edi - 0xc]
push edi
call fcn.1002e160
mov byte [ebp - 4], 0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1002c17d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
push 0
lea eax, [ebp - 0x418]
push eax
push 0x400
lea eax, [ebp - 0x410]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax]
call ebx
test eax, eax
jne 0x1002c0f1
mov ebx, dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push eax
mov ecx, ebx
call fcn.1002c230
mov ecx, ebx
call fcn.1002ced0
push ecx
mov ecx, ebx
call fcn.1002d350
mov esi, dword [ebp - 0x414]
mov edi, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1002c1f1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret 0xc
xor edi, edi
jmp 0x1002c1d2
push 0x80070057
call fcn.1002af80
call fcn.1002abb0
int3
Function at 0x1002e9c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1007b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x1002eaa3
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002ea11
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
jge 0x1002ea92
test ecx, ecx
jle 0x1002ea5b
mov eax, 0x5c
cmp ax, word [ebp + ecx*2 - 0x212]
je 0x1002ea5b
mov word [ebp + ecx*2 - 0x210], ax
lea eax, [ecx*2 + 2]
cmp eax, 0x20a
jae 0x1002eab7
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
push 0xffffffffffffffff
push 0x10068a3c
lea eax, [ebp - 0x210]
push 0x105
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 4], eax
test eax, eax
jne 0x1002eaa3
or dword [0x1007de24], 1
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1005b6db
mov esp, ebp
pop ebp
ret
call fcn.1005bfc9
int3