joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467e70
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x50b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x110]
push 0x50f538
push str._s.
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp eax, 0xffffffff
jne 0x467ed4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
nop dword [eax]
mov ecx, 0x4fb2b4
lea eax, [ebp - 0x224]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x467f10
test dl, dl
je 0x467f0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x467f10
add eax, 2
add ecx, 2
test dl, dl
jne 0x467ef0
xor eax, eax
jmp 0x467f15
sbb eax, eax
or eax, 1
test eax, eax
je 0x467fda
mov eax, 0x4fb2c8
lea ecx, [ebp - 0x224]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x467f48
test dl, dl
je 0x467f44
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x467f48
add ecx, 2
add eax, 2
test dl, dl
jne 0x467f28
xor eax, eax
jmp 0x467f4d
sbb eax, eax
or eax, 1
test eax, eax
je 0x467fda
test byte [ebp - 0x250], 0x10
jne 0x467fda
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
lea esi, [ebp - 0x224]
add esi, eax
mov eax, dword [esi]
cmp eax, 0x7461642e
jne 0x467fa7
lea eax, [ebp - 0x224]
push eax
push 0x50f538
lea eax, [ebp - 0x110]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call ebx
mov eax, dword [esi]
cmp eax, 0x67706a2e
jne 0x467fd4
lea eax, [ebp - 0x224]
push eax
push 0x50f538
lea eax, [ebp - 0x110]
push str._s_s
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call ebx
mov esi, dword [ebp - 0x254]
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x467ee0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret
Function at 0x468570
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x50b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x877dd8], 0
je 0x468707
push str.access.dat
push 0x50f538
lea eax, [ebp - 0x108]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x114], eax
cmp eax, 0xffffffff
je 0x468707
push 0
push dword [edi + 0x877dd8]
call dword [sym.imp.PAL.dll_PalListGetDataCount]
add esp, 8
test eax, eax
je 0x4686e4
mov esi, eax
shl esi, 5
add esi, eax
push 0
push esi
call dword [sym.imp.PAL.dll_PalMemoryAlloc]
mov ebx, eax
add esp, 8
mov dword [ebp - 0x10c], ebx
test ebx, ebx
je 0x468707
push 0
push dword [edi + 0x877dd8]
call dword [sym.imp.PAL.dll_PalListFind]
mov edi, eax
add esp, 8
test edi, edi
je 0x468662
push 0
push 0
push edi
call dword [sym.imp.PAL.dll_PalListGetData]
push 0x21
push eax
push ebx
call fcn.0048c470
push edi
add ebx, 0x21
call dword [sym.imp.PAL.dll_PalListFindNext]
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x468635
mov ebx, dword [ebp - 0x10c]
mov ecx, esi
mov dword [ebp - 0x110], esi
and ecx, 3
je 0x468679
mov eax, esi
sub eax, ecx
mov dword [ebp - 0x110], eax
mov edi, dword [ebp - 0x10c]
mov cl, 4
mov edx, dword [ebp - 0x110]
mov eax, 0xff987dee
xor dword [edi], eax
mov eax, 0x84df873
xor dword [edi], eax
ror byte [edi], cl
add edi, 4
add cl, 1
and cl, 0xff
sub edx, 4
jne 0x468687
push 0
lea eax, [ebp - 0x118]
push eax
push esi
mov esi, dword [ebp - 0x114]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.PAL.dll_PalMemoryFree]
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x114]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret
Function at 0x468a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x50b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.system.dat
push 0x50f538
lea eax, [ebp - 0x108]
mov esi, ecx
push str._s_s
push eax
mov dword [ebp - 0x114], esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x468ab2
push 0x4fb478
call dword [sym.imp.PAL.dll_PalErrorLogPrintf]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.PAL.dll_PalCheckWindowMode]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov dword [esi + 8], eax
lea eax, [ebp - 0x110]
push eax
push 2
push 0x4f3dbc
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
push 0x330
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264c8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264cc]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264d4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264d0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x264d8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264e4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264e8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264f0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x264ec]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x264f4]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x26660]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xb34
lea eax, [esi + 0x2666c]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 8
lea eax, [esi + 0x271a0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea eax, [esi + 0x44868]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
add esi, 0x877de8
push eax
push 4
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
push dword [esi]
mov esi, dword [ebp - 0x114]
push dword [esi + 0x877de0]
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
add esi, 0x877de4
push eax
push 4
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x114]
push dword [esi]
push dword [eax + 0x877ddc]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret
Function at 0x46b930
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [0x50b070]
xor eax, esp
mov dword [esp + 0x1a4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x14]
push edi
mov edi, dword [0x6ef908]
push eax
push 0x101
mov dword [edi], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSAStartup]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x46b9a1
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x80004005
pop edi
pop esi
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x46b9b7
push eax
jmp 0x46b97a
mov eax, 2
mov word [esp + 8], ax
mov eax, dword [esi + 0xc]
push 0x50
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x46b978
mov ecx, dword [esp + 0x1ac]
pop edi
pop esi
xor ecx, esp
call fcn.0048a3ac
mov esp, ebp
pop ebp
ret 8
Function at 0x46c860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], 0x84df873
mov dword [ebp - 0x14], 0xff987dee
and eax, 3
je 0x46c88a
sub edx, eax
mov dword [ebp - 8], edx
push edi
mov edi, dword [ebp - 0xc]
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
rol byte [edi], cl
add cl, 1
and cl, 0xff
mov eax, dword [ebp - 0x10]
xor dword [edi], eax
mov eax, dword [ebp - 0x14]
xor dword [edi], eax
add edi, 4
sub edx, 4
jne 0x46c894
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4cf67b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cee55

Function at 0x4cf686
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cf090

Function at 0x4cfc78
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004cf9ff

Function at 0x4d5206
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d4e0b

Function at 0x4d5211
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d4f8c
Function at 0x4011e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul eax
add esi, 0x9b
or ebx, 0xb3
sub eax, 0xdf
imul edx
rcr esi, 0x1e
add ebx, 0xe0
add edi, 0x83
sbb ebx, 0xcb
imul esi
sub esi, 0x6f
imul edi
mov edi, 0x57
bswap edx
imul eax
bswap ebx
imul eax
neg edx
mov edi, 0xc6
neg esi
neg ebx
inc esi
bswap ebx
inc edx
or eax, 0x52
imul edi
bswap edi
neg eax
dec eax
ror eax, 7
sub esi, 0x72
not edx
and edi, 0xbe
sub edx, 0xb8
and ebx, 0xce
ror esi, 0x48
bswap esi
ror eax, 0x62
or eax, 0xb5
rcl ebx, 0xdc
rol edi, 0xac
not ebx
bswap edi
ror ebx, 0x46
bswap edi
and edx, 0xb9
neg edi
add edx, 0xb5
add ebx, 0x31
mov edi, 0x41
xor ecx, ecx
xor edi, edi
not eax
bswap esi
inc edi
add edi, 0x4f
sbb edx, 0x39
inc edi
dec edx
imul edx
sbb edx, 0x8c
and eax, 0x1f
imul edx
imul ebx
dec esi
sub esi, 0x7d
sub esi, 0xcd
or esi, 0x4a
inc eax
neg ebx
imul edx
rol esi, 0x67
sbb edi, 0x32
and edx, 0x1b
inc eax
sub eax, 0x34
or ebx, 0x5a
add edi, 0x30
ror edi, 0x39
sbb eax, 0x4a
not ebx
sub edx, 0xfd
sbb eax, 0x71
bswap eax
sub edi, 0x69
not ebx
or edi, 3
not esi
imul esi
bswap ebx
inc edi
and eax, 0x50
imul edx
ror edi, 0x8f
rol esi, 0xa0
not edi
or eax, 0xa7
inc edi
add edi, 0xb5
and eax, 0xd5
imul ebx
mov edi, 0x12
mov ecx, dword [ebp + 0xc]
dec ebx
or edi, 0xe9
rcl ebx, 0x19
neg esi
add ebx, 0xbd
dec edx
sub eax, 0xaf
dec eax
neg eax
mov esi, 0x23
rcr eax, 0x9d
sbb esi, 0x6e
mov edi, 0xd0
or esi, 0xad
bswap eax
imul eax
sbb edi, 0x1d
rcr esi, 0x4c
dec edi
mov edx, 0xec
rcr esi, 0x9d
rcl eax, 0xd3
add edi, 0x7a
rol ebx, 0x92
ror edx, 0x28
sub esi, 0x60
neg edx
rcl edi, 0xfc
sbb ebx, 0xb4
add eax, 0x64
or esi, 0x65
inc edx
sub edx, 0x84
or edi, 0xc2
rcl ebx, 0x9b
neg edx
rcl edi, 0x53
rol ebx, 0x1a
rol edi, 0xbf
neg eax
bswap esi
imul eax
mov esi, 0x40
or edx, 0xf4
rol ebx, 0xb5
dec edx
sub edi, 0x13
and ebx, 0x66
bswap edi
not eax
mov edi, dword [ebp + 8]
xor eax, esi
xor ebx, ebx
mov esi, esi
not byte [edi]
mov ebx, esi
mov eax, esi
xor eax, esi
sub byte [edi], 0x88
mov ebx, eax
xor ebx, esi
xor ebx, esi
add byte [edi], 0x49
mov eax, ebx
mov ebx, eax
mov ebx, ebx
imul byte [edi]
inc edi
loop 0x4013bf
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401420
Capabilities:
Encode data using xor

Disassembly:
imul esi, dword [0x7d5408d4], 0xffffffb1
rcr al, 0x9d
lcall 0x4c69, 0x6a6dc0c0
mov ebx, 0xfd08bd4b
xor byte [eax], cl
scasd eax, dword es:[edi]
lodsb al, byte [esi]
add al, 0x78
sal eax, 0x3f
aad 0xc6
rol al, 0xc0
leave
call 0xc05acfc1
rol al, 0x75
cmp eax, 0xf0ffb1f1
movsb byte es:[edi], byte [esi]
leave
invalid

Function at 0x404ec8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f05c]
jne 0x404ed2
repz ret
jmp fcn.00406bc5
Function at 0x408403
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f49
and dword [ebp - 4], 0
cmp dword [0x41064c], 0
mov ebx, eax
jne 0x4084b4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408565
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408565
push eax
call fcn.00404ed7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41064c], eax
call esi
push eax
call fcn.00404ed7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x410650], eax
call esi
push eax
call fcn.00404ed7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x410654], eax
call esi
push eax
call fcn.00404ed7
pop ecx
mov dword [0x41065c], eax
test eax, eax
je 0x4084b4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ed7
pop ecx
mov dword [0x410658], eax
mov eax, dword [0x410658]
cmp eax, ebx
je 0x40850c
cmp dword [0x41065c], ebx
je 0x40850c
push eax
call fcn.00404f52
push dword [0x41065c]
mov esi, eax
call fcn.00404f52
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40850c
test edi, edi
je 0x40850c
call esi
test eax, eax
je 0x408503
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408503
test byte [ebp - 0xc], 1
jne 0x40850c
or dword [ebp + 0x10], 0x200000
jmp 0x408545
mov eax, dword [0x410650]
cmp eax, ebx
je 0x408545
push eax
call fcn.00404f52
pop ecx
test eax, eax
je 0x408545
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408545
mov eax, dword [0x410654]
cmp eax, ebx
je 0x408545
push eax
call fcn.00404f52
pop ecx
test eax, eax
je 0x408545
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41064c]
call fcn.00404f52
pop ecx
test eax, eax
je 0x408565
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408567
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4055d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
mov bl, 1
rcl byte [eax - 0x63d9f115]
add byte [0x618268af], al
xchg esi, eax
dec ebp
inc ecx
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
cmpsd dword [esi], dword es:[edi]
jnp 0x405576
paddb mm5, mm1
aas
mov ecx, 0xc9855477

Function at 0x406fa0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xffffffea
push ebx
push esi
js 0x406fc2
adc al, 0x33
sar byte [edx - 0xd], 0xee
mov dword [ebp + 0x7f], esi
jne 0x406fba
mov esi, str.0.0.0.0
mov al, byte [esi]
cmp al, 0x30
fmul dword [ecx + edi*4 + 0x3ca7f100]
insb byte es:[edi], dx
int1
cmpsd dword [esi], dword es:[edi]
cmp al, 0x6c
jg 0x40707d
push 0x1d86fc
push esi
call dword [0x5640c11c]
mov edx, eax
mov edi, esi
mov ch, 0xc9
push dword [ebx]
rcl byte [ecx - 0x510df719], 0xf7
ror dword [ecx - 0x1a], 1
ror dword [edi], 1
test dword [eax + eax - 0xa91f00], ecx
adc eax, sym.imp.WSOCK32.dll_inet_addr
out 0xd1, al
jne 0xe140707d
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [eax + edi*8], ebp
mov dword [0x4d8df745], eax
in al, dx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp dword [ecx], ebx
je 0x4070c6
mov dword [ebp - 4], ebx
mov esi, dword [esp + ebx]
push 0x38
push edx
call fcn.00403160
jbe 0x407026
xor eax, eax
mov esi, eax
mov ecx, 0x2b00000e
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
mov dword [esi], eax
mov edx, dword [ecx + 0xc]
mov esp, dword [ebx]
pop ss
jecxz 0x406fe9
popfd
adc al, 0x52
push 2
mov ecx, dword [eax]
xor eax, 0xe8124e89
jne 0x40704b
invalid
retf
Function at 0x4000d815
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x40025d24]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x41c], 0
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x424], eax
cmp dword [edi + 0xc], 0
jne 0x4000d8d8
mov ecx, eax
lea esi, [ebp - 0x414]
xor eax, eax
movzx edx, word [ecx]
mov dword [ebp - 0x420], 0x5c
cmp word [ebp - 0x420], dx
je 0x4000d872
mov word [esi], dx
add esi, 2
and dword [ebp - 0x420], 0
cmp word [ebp - 0x420], dx
je 0x4000d88d
add ecx, 2
inc eax
cmp eax, 0x104
jl 0x4000d856
xor eax, eax
mov word [ebp - 0x20e], ax
lea eax, [ebp - 0x414]
push eax
push 0x4000259c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.40007625
add esp, 0x10
test eax, eax
js 0x4000d8ce
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 0xc], eax
cmp dword [edi + 0xc], 0
je 0x4000d9dd
push 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4000d8ef
xor ebx, ebx
inc ebx
jmp 0x4000d98c
mov eax, dword [ebx]
push 0x20
push 2
push ebx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x400272ac]
call esi
push ecx
mov ecx, dword [ebp - 0x424]
lea edx, [ebp - 0x20c]
call fcn.40016e19
mov esi, dword [ebx]
lea eax, [ebp - 0x20c]
push 0
push eax
push 2
mov ecx, dword [esi + 0x14]
push ebx
call dword [0x400272ac]
call dword [esi + 0x14]
jmp 0x4000d943
push 0x5dc
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4000d950
mov ecx, ebx
call fcn.40016586
test eax, eax
je 0x4000d931
jmp 0x4000d95a
mov dword [ebp - 0x41c], 1
mov esi, dword [ebx]
push 0
push 0x400025c4
push 2
mov ecx, dword [esi + 0x14]
push ebx
call dword [0x400272ac]
call dword [esi + 0x14]
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x400272ac]
call esi
mov ebx, dword [ebp - 0x41c]
test ebx, ebx
je 0x4000d9e3
mov ecx, dword [edi]
lea edx, [edi + 4]
push edx
push 0x400025b4
push ecx
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x400272ac]
call esi
test eax, eax
js 0x4000d9e3
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x415]
push 1
push ecx
push dword [edi + 8]
mov byte [ebp - 0x415], 0
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0xc]
call dword [0x400272ac]
call dword [esi + 0xc]
test eax, eax
jns 0x4000d9e3
lea ecx, [edi + 4]
call fcn.400075d8
jmp 0x4000d9e3
mov ebx, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.40020a80
leave
ret 8
Function at 0x4000eef7
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x40025d24]
xor eax, esp
mov dword [esp + 0x228], eax
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [edx + 0x52]
mov esi, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], edx
mov eax, 0x40001ecc
and dword [edi], 0
xor ecx, ecx
mov eax, dword [eax + ecx*4]
cmp eax, dword [edx + ecx*4 + 0x52]
jne 0x4000ef66
inc ecx
mov eax, 0x40001ecc
cmp ecx, 4
jne 0x4000ef36
push ecx
lea eax, [esp + 0x2c]
push eax
push edx
call fcn.400102c9
push edi
push ebx
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.4000e457
jmp 0x4000ef73
push edi
push ebx
push dword [esp + 0x18]
mov ecx, esi
call fcn.4000e65e
cmp eax, 0x8001010d
jne 0x4000f02f
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], ebx
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0x80004005
mov dword [esp + 0x20], ebx
mov eax, dword [esi]
push esi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x400272ac]
call esi
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
push 0x4000ee90
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4000efff
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x10], ebx
jl 0x4000eff8
push edi
push dword [esp + 0x18]
push dword [esp + 0x28]
call dword [sym.imp.ole32.dll_CoGetInterfaceAndReleaseStream]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x400272ac]
call esi
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x4000f02b
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x400272ac]
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.40020a80
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4001090e
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c0
mov eax, dword [0x40025d24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x2b4
push ebx
push eax
mov word [edi], ax
lea eax, [ebp - 0x4c0]
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0xa]
lea ecx, [ebp - 0x4c0]
add esp, 0xc
and eax, 8
add eax, eax
push 0x410
push ebx
push ecx
push eax
push ecx
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.400102c9
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x40010989
lea eax, [ebp - 0x2ac]
mov edx, 0x104
push eax
mov ecx, edi
call fcn.4000a269
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.40020a80
leave
ret 0xc