joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102f86ec
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
call fcn.10164199
mov edi, dword [ebp + 0x10]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push edi
call fcn.102f86b8
call fcn.102f9923
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push edi
call fcn.102f86b8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push edi
call fcn.102f86b8
call fcn.102fab0c
movzx eax, ax
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push edi
call fcn.102f86b8
push dword [ebp + 0x18]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.102f8c81
pop edi
pop ebp
ret 0x14
Function at 0x102fde8f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 0
push 2
push str.office.odf
push str.SoftwareMicrosoftOffice16.0CommonFilesPaths
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
neg eax
sbb eax, eax
inc eax
pop ebp
ret 8

Function at 0x102ff802
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x1c
test byte [0x10669580], 0x20
push esi
push edi
mov esi, ecx
je 0x102ff843
push dword [ebx + 0xc]
push dword [ebx + 8]
push 0x103aa6c8
push dword [0x1066958c]
push dword [0x10669588]
call fcn.1002c851
push 0x1c135e
call fcn.10153dc1
lea eax, [esi + 8]
mov ecx, dword [eax]
mov esi, ecx
mov edi, dword [eax + 4]
mov edx, edi
mov dword [ebp - 4], eax
mov eax, ecx
shr eax, 0xc
dec eax
mov dword [ebp - 0x10], esi
shl eax, 0xc
xor eax, ecx
and eax, 0x7f000
xor ecx, eax
mov eax, esi
mov esi, dword [ebp - 4]
push ebx
mov ebx, ecx
mov ecx, edi
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x102ff88b
cmp ecx, edi
je 0x102ff8bb
mov esi, eax
mov dword [ebp - 0x10], ecx
shr esi, 0xc
mov edi, eax
dec esi
mov edx, ecx
shl esi, 0xc
xor esi, eax
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lock cmpxchg8b qword [esi]
pop ebx
mov ecx, edx
cmp eax, edi
jne 0x102ff88b
cmp ecx, dword [ebp - 0x10]
jne 0x102ff88b
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x10303eed
Capabilities:
Encode data using xor

Disassembly:
push esi
lea esi, [ecx + 0x10]
mov edx, dword [esi]
mov eax, edx
mov ecx, edx
and eax, 0xffffc000
add eax, 0x4000
xor eax, edx
and eax, 0xfffc000
xor edx, eax
mov eax, ecx
lock cmpxchg dword [esi], edx
mov edx, eax
cmp edx, ecx
jne 0x10303ef3
pop esi
ret

Function at 0x103049d2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x103049ee
mov ebx, 0x80004005
jmp 0x10304aa6
mov eax, dword [esi + 0x38]
push edi
cmp eax, dword [esi + 0x34]
ja 0x10304a1e
lea eax, [eax*4 + 0x14]
push eax
lea edi, [esi + 0x2c]
push edi
call fcn.100dc755
pop ecx
pop ecx
test eax, eax
jne 0x10304a18
mov ebx, 0x8007000e
jmp 0x10304aa5
add dword [esi + 0x38], 5
mov dword [edi], eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.10304aae
mov ebx, eax
test ebx, ebx
js 0x10304a97
mov ecx, dword [esi + 0x40]
or ecx, dword [esi + 0x44]
jne 0x10304a43
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edx
mov edi, dword [ebp - 4]
lock inc dword [edi + 0x908]
lea eax, [edi + 0x8f0]
push eax
xor eax, eax
push eax
push edi
push 0x10304e57
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10304a77
mov ecx, edi
call fcn.10304c6f
mov ebx, 0x80004005
jmp 0x10304a9a
mov dword [edi + 0x8ec], eax
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x2c]
push 0x3e
mov dword [eax + ecx*4], edi
xor edi, edi
inc dword [esi + 0x34]
lea eax, [esi + 0x30]
pop ecx
lock xadd dword [eax], ecx
jmp 0x10304a9a
mov edi, dword [ebp - 4]
test edi, edi
je 0x10304aa5
mov ecx, edi
call fcn.10304c6f
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1030a9fe
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [edi + 8]
mov dword [ebp - 0x24], eax
cmp eax, dword [edx + 4]
jne 0x1030aa74
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
and ecx, 0x7ff
cmp ecx, dword [edi + 0x14]
jne 0x1030aa74
mov eax, dword [edi + 8]
inc dword [eax + 8]
test byte [0x10669580], 0x80
je 0x1030aa61
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x103aa748
push dword [0x1066958c]
push dword [0x10669588]
call fcn.102eee35
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov byte [ebp - 8], 0
push ebx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x15], al
push esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
nop word [eax + eax]
mov eax, ecx
xor ebx, ebx
and eax, 0x7ff
mov edx, ecx
cmp eax, 0x7fb
sete bl
test ebx, ebx
jne 0x1030aaca
test eax, eax
je 0x1030aaca
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], ebx
cmp byte [ebp - 0x15], bl
jne 0x1030aaf4
and ecx, 0xfffff800
add ecx, 0x800
and ecx, 0xfffff800
jmp 0x1030aaf2
mov eax, dword [edi + 0x14]
xor eax, ecx
mov dword [ebp - 0x20], 1
and eax, 0x7ff
xor ecx, eax
cmp byte [ebp - 0x15], 0
je 0x1030aaf4
mov eax, ecx
shr eax, 0xb
dec eax
shl eax, 0xb
and ecx, 0x7ff
or ecx, eax
mov esi, dword [edi + 8]
mov eax, edx
lock cmpxchg dword [esi], ecx
mov ecx, eax
cmp ecx, edx
jne 0x1030aa90
cmp dword [ebp - 0x20], 0
mov eax, dword [edi + 8]
jne 0x1030abb9
mov eax, dword [eax]
and eax, 0xfffff800
cmp eax, 0x28f5800
jb 0x1030ab28
push 0x1c124c
call fcn.10153dc1
mov ebx, dword [ebp + 8]
cmp ebx, 0xffffffff
je 0x1030ab60
cmp byte [ebp - 0x15], 0
jne 0x1030ab47
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [ebp - 0x1c], esi
test ebx, ebx
jne 0x1030ab60
jmp 0x1030ab4a
mov esi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, ebx
jae 0x1030ab7d
sub ebx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x15], 1
mov dword [ebp - 0x10], ebx
call fcn.1030ad4e
jmp 0x1030aa82
mov eax, dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [edi + 8]
mov ecx, eax
shr ecx, 0xb
mov edx, eax
dec ecx
and eax, 0x7ff
shl ecx, 0xb
or ecx, eax
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x1030ab82
pop esi
pop ebx
mov eax, 0x102
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov eax, dword [edi + 8]
mov dword [eax + 8], 1
test byte [0x10669580], 0x80
je 0x1030abf2
mov eax, dword [edi + 8]
push dword [eax + 0xc]
push dword [eax + 8]
push edi
push 0x103aa748
push dword [0x1066958c]
push dword [0x10669588]
call fcn.102eee35
mov ecx, dword [ebp - 4]
neg ebx
pop esi
sbb ebx, ebx
xor ecx, ebp
and ebx, 0x80
mov eax, ebx
pop ebx
pop edi
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
Function at 0x1030d887
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x408], eax
test esi, esi
jne 0x1030d8d0
xor eax, eax
jmp 0x1030da35
and dword [esi], 0
push ebx
push edi
xor edi, edi
inc edi
push edi
push eax
push ecx
push 0x400
lea eax, [ebp - 0x404]
push eax
call fcn.1030ee05
mov edx, dword [ebp - 0x408]
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x418], ecx
shr eax, 0x1a
xor ebx, ebx
and dword [ebp - 0x41c], ebx
not eax
and eax, edi
mov dword [ebp - 0x414], eax
test ecx, ecx
je 0x1030d937
mov eax, edx
shr eax, 0x17
push ecx
and eax, edi
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov edx, dword [ebp - 0x408]
mov dword [esi], eax
mov eax, dword [ebp - 0x414]
cmp dword [esi], ebx
jne 0x1030d9da
test eax, eax
je 0x1030d9da
xor eax, eax
push edi
lea eax, [ebp - 0x40c]
push eax
push edx
call fcn.1030ebbb
test eax, eax
je 0x1030d9ca
mov eax, dword [ebp - 0x408]
push dword [ebp - 0x418]
shr eax, 0x19
and eax, edi
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x410], eax
lea eax, [ebp - 0x40c]
push edi
push eax
push dword [ebp - 0x408]
call fcn.1030ecef
mov eax, dword [ebp - 0x410]
cmp eax, 5
jne 0x1030d9cc
cmp dword [ebp - 0x41c], ebx
jne 0x1030d9cc
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 0x418]
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x41c], edi
jmp 0x1030d911
mov eax, ebx
cmp dword [esi], ebx
je 0x1030d9da
xor ebx, ebx
cmp eax, 0xb7
setne bl
cmp dword [esi], 0
je 0x1030d9e4
cmp dword [esi], 0xffffffff
jne 0x1030d9fe
cmp dword [ebp - 0x414], 0
je 0x1030d9f7
push 0x1631e1
call fcn.10153dc1
and dword [esi], 0
xor ebx, ebx
xor edi, edi
mov edx, dword [ebp - 0x420]
test edx, edx
je 0x1030da25
mov ecx, dword [ebp - 0x418]
mov eax, 0x103548cd
test ecx, ecx
cmovne eax, ecx
push eax
push dword [ebp + 0x14]
push edx
call fcn.1029a655
add esp, 0xc
mov eax, dword [ebp - 0x424]
test eax, eax
je 0x1030da31
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1030ea18
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x54], esi
push edi
test ebx, ebx
jne 0x1030ea44
push 0x15b3c8
jmp 0x1030ea7c
cmp dword [0x10818688], esi
je 0x1030ea5b
mov eax, dword [0x10661bd8]
xor edi, edi
mov dword [ebx], eax
inc edi
jmp 0x1030eb87
lea eax, [ebp - 0x50]
mov dword [ebx], esi
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1030ea88
push 0x15b3c9
call fcn.10153dc1
mov edi, esi
jmp 0x1030eb87
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
je 0x1030eaa6
push 0x15b3ca
jmp 0x1030ea7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1030eab8
push 0x15b3cb
jmp 0x1030ea7c
push dword [ebp - 0x54]
lea ecx, [ebp - 0x4c]
call fcn.10112002
mov esi, dword [ebp - 0x4c]
test al, al
jne 0x1030eadb
push 0x15b3cc
call fcn.10153dc1
xor edi, edi
jmp 0x1030eb7a
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push esi
push 2
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x1030eaf5
push 0x15b3cd
jmp 0x1030eacf
push 0x44
pop edi
push edi
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.1027bff1
add esp, 0xc
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0xb
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x1030eb27
push 0x15b3ce
jmp 0x1030eacf
xor ecx, ecx
mov dword [ebp - 0x58], ecx
test esi, esi
je 0x1030ebad
lea eax, [esi + 4]
xor edi, edi
mov dword [ebp - 0x4c], eax
inc edi
cmp ecx, dword [esi]
jae 0x1030eb6d
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1030eb5c
mov eax, dword [ebp - 0x4c]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1030eb6b
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x4c]
inc ecx
mov dword [ebp - 0x58], ecx
add eax, 8
jmp 0x1030eb33
mov dword [ebx], edi
mov dword [0x10818688], edi
mov eax, dword [ebx]
mov dword [0x10661bd8], eax
test esi, esi
je 0x1030eb85
push esi
call fcn.102a9552
pop ecx
xor esi, esi
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x1030eb98
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
mov dword [0], 1
int 0x29
Function at 0x1030eff6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x1030f03e
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x1030f03e
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1030f03e
cmp word [eax + 2], 0
je 0x1030f03e
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x1030f03e
add eax, 0x30
jmp 0x1030f043
mov eax, 0x105fef54
pop esi
pop ebp
ret
Function at 0x8fe058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8fe1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8fe07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8fe06a
add dl, dl
jne 0x8fe089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8fe0dc
xor eax, eax
add dl, dl
jne 0x8fe096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8fe17d
add dl, dl
jne 0x8fe0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8fe0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8fe0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8fe0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8fe0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8fe075
mov eax, 1
add dl, dl
jne 0x8fe0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8fe0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8fe0e1
sub eax, ebx
mov ebx, 1
jne 0x8fe128
mov ecx, 1
add dl, dl
jne 0x8fe10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8fe119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8fe105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8fe075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8fe13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8fe14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8fe136
cmp eax, 0x7d00
jae 0x8fe16d
cmp eax, 0x500
jb 0x8fe168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8fe075
cmp eax, 0x7f
ja 0x8fe170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8fe075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8fe19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8fe075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401c66
pop dword [ebp - 8]
mov eax, 0x401c66
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x37a6fafc
add dword [ebp - 0x18], 0x16ab4a4f
mov dword [ebp - 0x14], 0xd4536bd8
sub dword [ebp - 0x14], 0xa2201f93
mov dword [ebp - 0x10], 0xc491e6d8
add dword [ebp - 0x10], 0x87ba5d56
mov dword [ebp - 0xc], 0x81f960f4
sub dword [ebp - 0xc], 0x81f960f4
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x67f1768
add dword [ebp - 0x18], 0x6df351ee
mov dword [ebp - 0x14], 0xe4227963
add dword [ebp - 0x14], 0x5d49e812
mov dword [ebp - 0x10], 0xb0f10314
sub dword [ebp - 0x10], 0x4d8196a8
mov dword [ebp - 0xc], 0xd5ef3ba8
sub dword [ebp - 0xc], 0xd5ef3ba8
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xc942a88a
add eax, 0x36fd87a2
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x36b82
push 0
call eax
mov ecx, 0xbe4312d9
add ecx, 0x41bd361b
xor esi, esi
add esi, eax
mov edi, 0xcc7b46a
add edi, 0xf378bb96
add edi, dword [ebp - 8]
mov edx, 0x59c44870
add edx, 0x1340ffa9
mov dword [ebp - 4], 0x950b5cf8
mov ebx, dword [edi]
sub dword [ebp - 4], eax
xor ebx, edx
add dword [ebp - 4], 0x4fdfd372
mov dword [esi], ebx
sub dword [ebp - 4], eax
add esi, 0xbc3209b2
add esi, 0x43cdf652
add edi, 0x33e56cf
sub edi, 0x33e56cb
loop 0x401d80
add eax, 0x116a3
mov ebx, eax
add eax, 0x74f1fd59
add eax, 0x8b0e02ac
mov ecx, 0xb41d0467
sub ecx, 0xb3dd0467
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x40191e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40195d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40195d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40195d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40195d
cmp dword [ecx + 0x74], 0xe
jbe 0x40195d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409593
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x409630
push ebx
push esi
call fcn.0040955c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004094f0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4095dd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40962f
push edi
push eax
call fcn.0040a1d4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4095fd
call fcn.00408051
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40962e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004094f0
add esp, 0x20
test eax, eax
jne 0x40961c
push edi
call fcn.00408051
jmp 0x409624
push ebx
call fcn.00408051
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40ac23
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51c730
push 0x51c728
push str.FlsAlloc
push 0x1f
call fcn.0040aae2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ac57
push dword [ebp + 8]
mov ecx, esi
call dword [0x51a504]
call esi
jmp 0x40ac5d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40aca1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51c740
push 0x51c738
push str.FlsGetValue
push 0x21
call fcn.0040aae2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40acd8
push dword [ebp + 8]
mov ecx, esi
call dword [0x51a504]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40ace0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51c748
push 0x51c740
push str.FlsSetValue
push 0x22
call fcn.0040aae2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ad1a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x51a504]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4116b2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x57db70]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4116f2
cmp byte [ebx], 0xa
jne 0x4116f2
or byte [edi + eax + 0x28], 4
jmp 0x4116f7
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x4117f6
mov dl, byte [eax]
cmp dl, 0x1a
je 0x4117d9
inc eax
cmp dl, 0xd
je 0x411723
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x411749
cmp eax, ecx
jae 0x411757
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41170b
jmp 0x4117f6
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4117d4
cmp dword [ebp - 0x10], 0
je 0x4117d4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x57db70]
test byte [eax + edi + 0x28], 0x48
je 0x4117ae
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x411799
mov byte [esi], dl
jmp 0x4117aa
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x57db70]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4117f6
cmp byte [ebp - 1], 0xa
jne 0x4117bd
cmp esi, ebx
jne 0x4117bd
mov byte [esi], 0xa
jmp 0x4117f5
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00411622
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4117f6
mov byte [esi], 0xd
jmp 0x4117f5
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x57db70]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4117f3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4117f6
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret