joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ea30
Capabilities:
Encode data using xor

Disassembly:
test edi, edi
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
je 0x1001ea85
test edx, edx
je 0x1001ea85
mov eax, dword [esp + 0x14]
xor ecx, ecx
xor esi, esi
test edx, edx
jbe 0x1001ea85
push 0x5851f42d
push 0x4c957f2d
push ecx
push eax
call fcn.1005b6f0
add eax, 1
adc edx, 0
mov ecx, edx
mov ebx, eax
mov ebp, ecx
shrd ebx, ebp, 0x13
mov edx, esi
and edx, 3
xor bl, byte [esp + edx + 0x14]
add esi, 1
xor byte [esi + edi - 1], bl
shr ebp, 0x13
cmp esi, dword [esp + 0x10]
jb 0x1001ea4b
pop esi
pop ebp
pop ebx
ret

Function at 0x1001ee70
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
test eax, eax
push esi
mov esi, 0x80004005
mov dword [esp + 4], 0
je 0x1001eec0
mov ecx, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
cmp ecx, 0xffffffff
je 0x1001eec0
push 0
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x1c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001eec0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1001eeb9
mov ecx, dword [esp + 4]
mov dword [eax], ecx
xor eax, eax
pop esi
pop ecx
ret 0x10
mov eax, esi
pop esi
pop ecx
ret 0x10

Function at 0x1001eed0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push esi
mov esi, 0x80004005
je 0x1001ef1e
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + 4]
cmp ecx, 0xffffffff
je 0x1001ef1e
push 0
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
push edx
push eax
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001ef1e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1001ef18
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop esi
ret 0x10
mov eax, esi
pop esi
ret 0x10

Function at 0x1001f090
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
mov edi, 0x80004005
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
je 0x1001f0e5
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x1001f0e5
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1001f0e5
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esi + 4], eax
pop edi
mov dword [esi], edx
xor eax, eax
pop esi
add esp, 8
ret 8
mov eax, edi
pop edi
pop esi
add esp, 8
ret 8
Function at 0x1001f120
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
push ebp
push esi
push edi
mov ebp, 0x80004005
mov dword [esp + 0x10], 0
je 0x1001f198
mov edx, dword [esp + 0x20]
test edx, edx
jl 0x1001f1a2
mov ecx, dword [esp + 0x1c]
jg 0x1001f150
test ecx, ecx
jb 0x1001f1a2
mov edi, dword [esp + 0x24]
test edi, edi
je 0x1001f1a2
mov esi, dword [esp + 0x28]
test esi, esi
je 0x1001f1a2
push 0
push 0
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1001f198
mov ecx, dword [ebx + 4]
push 0
lea eax, [esp + 0x14]
push eax
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001f198
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1001f196
mov edx, dword [esp + 0x10]
mov dword [eax], edx
xor ebp, ebp
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 0x18
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
pop ecx
ret 0x18

Function at 0x1001f390
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x10077f38
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edx, dword [str.InstallLocation]
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallKingsoft_Internet_Security]
lea eax, [esp + 0x10]
push eax
call fcn.1001f250
add esp, 4
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], 0
jne 0x1001f416
or edi, 0xffffffff
mov dword [esp + 0x20], edi
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x1001f401
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
lea ebx, [esp + 0x10]
call fcn.1001f4a0
mov ecx, ebx
mov ebx, dword [str.kxetray.exe]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.10005f20
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001f462
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x10]
je 0x1001f3e8
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x1001f48b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x100231c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x100231dc
mov eax, dword [ebp - 4]
jmp 0x100232b7
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x10023292
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x10084218]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x10084218]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x10084218]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x10084218]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x10084218]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x10084218]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x10084218]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10084218]
dec ebp
jne 0x100231fc
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x100232ae
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x10084218]
dec ecx
jne 0x1002329c
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100239d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10079518
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
mov ebx, ecx
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], eax
mov byte [esp + 0x10], al
mov dword [esp + 0x38], eax
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov edx, esi
call fcn.1002f300
test al, al
je 0x10023a64
mov eax, ebx
lea edx, [esp + 0xc]
call fcn.1001c640
test al, al
jne 0x10023a8e
mov ecx, dword [ebp + 8]
push ecx
mov ecx, ebx
push edi
mov ebx, esi
call fcn.1002f880
cmp dword [esp + 0x24], 0x10
jb 0x10023a60
mov edx, dword [esp + 0x10]
push edx
call fcn.100549f0
add esp, 4
mov al, 1
jmp 0x10023aa4
mov eax, dword [ebp + 8]
test al, al
je 0x10023a8e
push eax
mov ecx, ebx
push edi
mov ebx, esi
call fcn.1002f880
cmp dword [esp + 0x24], 0x10
jb 0x10023a60
mov eax, dword [esp + 0x10]
push eax
call fcn.100549f0
add esp, 4
mov al, 1
jmp 0x10023aa4
cmp dword [esp + 0x24], 0x10
jb 0x10023aa2
mov ecx, dword [esp + 0x10]
push ecx
call fcn.100549f0
add esp, 4
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1005574a
mov esp, ebp
pop ebp
ret 4
Function at 0x10023ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10079d28
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x80]
xor ebx, ebx
xor edi, edi
cmp ebp, ebx
mov dword [esp + 0x14], edi
je 0x10023c57
mov edi, edi
cmp dword [ebp], ebx
je 0x10023bf9
mov ecx, dword [ebp + 4]
mov edi, 0xf
mov eax, ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x10023b32
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x3c]
call fcn.100014f0
mov dword [esp + 0x74], ebx
mov ecx, dword [ebp]
mov eax, ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea esi, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x10023b60
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.100014f0
mov eax, dword [esp + 0x84]
mov esi, dword [esp + 0x7c]
push eax
lea ecx, [esp + 0x38]
lea edi, [esp + 0x1c]
mov byte [esp + 0x78], 1
call fcn.100239d0
mov esi, 0x10
cmp dword [esp + 0x30], esi
mov byte [esp + 0x80], al
jb 0x10023bb3
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.100549f0
add esp, 4
mov dword [esp + 0x74], 0xffffffff
cmp dword [esp + 0x4c], esi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x10023bde
mov edx, dword [esp + 0x38]
push edx
call fcn.100549f0
add esp, 4
cmp byte [esp + 0x80], bl
je 0x10023bec
add dword [esp + 0x14], 1
add ebp, 8
mov edi, dword [esp + 0x14]
jne 0x10023b10
cmp edi, ebx
jbe 0x10023c57
cmp byte [esp + 0x8c], bl
mov eax, dword [esp + 0x7c]
je 0x10023c1f
mov ecx, dword [esp + 0x88]
push 0xffffffffffffffff
push ebx
add eax, 0x10
push eax
call fcn.10001720
jmp 0x10023c57
lea esi, [esp + 0x50]
call fcn.1002ef40
mov ecx, dword [esp + 0x88]
push 0xffffffffffffffff
push ebx
push eax
mov dword [esp + 0x80], 2
call fcn.10001720
cmp dword [esp + 0x68], 0x10
jb 0x10023c57
mov ecx, dword [esp + 0x54]
push ecx
call fcn.100549f0
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret 0x14
Function at 0x1002d320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
rcl si, 0xe
rcr si, cl
btc esi, ecx
mov esi, dword [esp + 0x54]
bt ebx, edi
test dh, 3
cmc
stc
push dword [esp + 0x58]
popfd
mov byte [esp + 0x14], dh
mov byte [esp], 0x81
mov dword [esp + 4], 0xc55a48ba
lea esp, [esp + 0x5c]
jmp 0x1001228f
push ecx
pushfd
rep movsb byte es:[edi], byte [esi]
clc
btc di, 8
push 0x2106f320
or si, si
mov edi, dword [esp + 0x50]
jmp 0x1001121b
mov edi, eax
pushal
pushfd
mov word [esp], 0x455
cld
pushfd
jmp 0x1002c2b0
pushfd
pop dword [esp]
std
push esi
bswap di
mov esi, edx
push 0x8842dc0c
pop edi
not edi
not di
lea edi, [ecx + eax - 0x40]
pushal
xchg dword [esp + 0x1c], edi
jmp 0x1002d263
Function at 0x1002eb60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1007a156
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
xor ebx, ebx
mov ebp, 7
mov esi, ecx
mov dword [esp + 0x80], ebp
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], bx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
lea edi, [esp + 0x30]
mov byte [esp + 0xc8], 1
call fcn.10017c10
movzx eax, byte [esi + 5]
movzx ecx, byte [esi + 4]
movzx edx, byte [esi + 3]
push eax
movzx eax, byte [esi + 2]
push ecx
movzx ecx, byte [esi + 1]
push edx
movzx edx, byte [esi]
push eax
push ecx
push edx
push str._02X:_02X:_02X:_02X:_02X:_02X
mov eax, edi
call fcn.10018380
mov eax, edi
push ebx
push eax
lea edi, [esp + 0x38]
call fcn.100189e0
add esp, 0x24
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x70]
mov byte [esp + 0xd0], 2
call fcn.10008bc0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x1002ec41
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100549f0
add esp, 4
mov dword [esp + 0x9c], ebp
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], bx
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], bx
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xb4], ebx
mov word [esp + 0xa4], bx
mov byte [esp + 0xc8], 5
cmp dword [esp + 0x80], esi
mov eax, dword [esp + 0x6c]
jae 0x1002ec93
lea eax, [esp + 0x6c]
push eax
lea edx, [esp + 0x54]
push edx
mov edx, dword [esp + 0xd8]
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0xb0]
push ecx
push edx
call fcn.10031df0
cmp dword [esp + 0xb8], esi
jb 0x1002eccf
mov eax, dword [esp + 0xa4]
push eax
call fcn.100549f0
add esp, 4
cmp dword [esp + 0x64], esi
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xb4], ebx
mov word [esp + 0xa4], bx
jb 0x1002ecf8
mov ecx, dword [esp + 0x50]
push ecx
call fcn.100549f0
add esp, 4
cmp dword [esp + 0x9c], esi
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], bx
jb 0x1002ed1e
mov edx, dword [esp + 0x88]
push edx
call fcn.100549f0
add esp, 4
cmp dword [esp + 0x48], 0x10
mov dword [esp + 0x9c], ebp
mov dword [esp + 0x98], ebx
mov word [esp + 0x88], bx
jb 0x1002ed48
mov eax, dword [esp + 0x34]
push eax
call fcn.100549f0
add esp, 4
cmp dword [esp + 0x80], esi
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
jb 0x1002ed6e
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.100549f0
add esp, 4
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.1005574a
add esp, 0xb8
ret
Function at 0x1002ee20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1007a101
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
call fcn.1001c1a0
mov dword [esi + 8], eax
mov byte [eax + 0x45], 1
mov eax, dword [esi + 8]
mov dword [eax + 4], eax
mov eax, dword [esi + 8]
mov dword [eax], eax
mov eax, dword [esi + 8]
mov dword [eax + 8], eax
xor eax, eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], eax
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], eax
mov byte [ecx + 4], al
mov dword [esi + 0x2c], eax
or edx, 0xffffffff
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], edx
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], edx
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], eax
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
mov byte [esp + 0x20], 2
call fcn.10001720
mov cl, byte [esp + 0x24]
mov byte [esi], cl
push 1
mov ecx, esi
call fcn.100300e0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0xc
Function at 0x10031990
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x418
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x414], eax
push 0x40e
lea eax, [esp + 0xa]
push 0
push eax
mov word [esp + 0x10], 0
call fcn.1005a450
add esp, 0xc
push str.kinfoc.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10031abf
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebp
push 0x104
lea ecx, [esp + 0x10]
push ecx
push eax
call ebx
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
je 0x10031a39
push esi
push edi
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea edi, [esp + 0x14]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10031a10
mov ecx, 0xd
mov esi, str.operationcaskinfoc.dll
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x14]
push ecx
call ebp
test eax, eax
pop edi
pop esi
jne 0x10031abd
push 0x410
lea edx, [esp + 0x10]
push 0
push edx
call fcn.1005a450
add esp, 0xc
push 0x104
lea eax, [esp + 0x10]
push eax
push 0x10000000
call ebx
test eax, eax
je 0x10031ab6
lea eax, [esp + 0xc]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10031a70
sub eax, edx
sar eax, 1
je 0x10031ab6
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.operationcaskinfoc.dll
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10031ab6
lea ecx, [esp + 0xc]
push ecx
call ebp
test eax, eax
jne 0x10031abd
push str.operationcaskinfoc.dll
call ebp
pop ebp
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.1005574a
add esp, 0x418
ret
Function at 0x10039040
Capabilities:
Create thread

Disassembly:
push 0x18
call fcn.100551e8
add esp, 4
test eax, eax
jne 0x1003904f
ret
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x10]
push 0
push 0
push eax
push 0x10039090
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x1c]
push 0
push 0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call fcn.10058070
add esp, 0x18
ret

Function at 0x10039120
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x10079218
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x7c], eax
push ebx
push esi
push edi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
xor edi, edi
mov esi, ecx
mov ebx, edx
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], edi
mov word [esp + 0x74], di
push 1
push 0x10086274
lea ecx, [esp + 0x78]
mov dword [esp + 0xa0], edi
call fcn.10018800
cmp esi, edi
je 0x100391ae
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10039194
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x78]
call fcn.10018800
push 2
push 0x10086278
lea ecx, [esp + 0x78]
call fcn.10018800
cmp ebx, edi
je 0x100391e1
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100391c7
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x78]
call fcn.10018800
mov eax, dword [esp + 0x84]
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100548be
mov esi, eax
add esp, 4
cmp esi, edi
jne 0x10039228
cmp dword [esp + 0x88], 8
jb 0x10039221
mov eax, dword [esp + 0x74]
push eax
call fcn.100549f0
add esp, 4
xor eax, eax
jmp 0x100392f9
cmp dword [esp + 0x88], 8
mov eax, dword [esp + 0x74]
jae 0x1003923a
lea eax, [esp + 0x74]
mov ecx, dword [esp + 0x84]
push eax
add ecx, 1
push ecx
push esi
call fcn.10058ba9
push 0x40
lea edx, [esp + 0x38]
push edi
push edx
xor ebx, ebx
call fcn.1005a450
add esp, 0x18
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push esi
push edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], di
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100392b3
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 1
push esi
call fcn.10055759
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
cmp eax, edi
je 0x100392d1
push eax
call esi
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x100392e0
push eax
call esi
mov dword [esp + 0x18], edi
cmp dword [esp + 0x88], 8
jb 0x100392f7
mov eax, dword [esp + 0x74]
push eax
call fcn.100549f0
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.1005574a
add esp, 0x8c
ret
Function at 0x10039370
Capabilities:
Enumerate processes

Disassembly:
push edi
lea edi, [esi + 0xc]
push 0x22c
push 0
push edi
call fcn.1005a450
add esp, 0xc
mov dword [edi], 0x22c
cmp byte [esi + 8], 0
push edi
jne 0x100393a0
mov eax, dword [esi + 4]
push eax
mov byte [esi + 8], 1
call sub.KERNEL32.dll_Process32FirstW
jmp 0x100393a9
mov ecx, dword [esi + 4]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne al
test al, al
je 0x100393c3
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
test al, al
je 0x10039374
mov eax, edi
pop edi
ret
xor eax, eax
pop edi
ret
Function at 0x1003a550
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1007a070
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x5c]
mov ebp, dword [esp + 0x58]
mov esi, edx
mov dword [esp + 0x1c], eax
lea eax, [esi + 0x1008c]
push eax
mov dword [edi], 2
mov byte [esp + 0x1b], 0
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
mov dword [esp + 0x4c], ecx
mov eax, dword [esi + 0x10020]
cmp ebx, eax
jne 0x1003a63f
or dword [edi], 1
mov edi, 0xf
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ecx
mov byte [esp + 0x28], cl
push esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 1
call fcn.1003a2d0
mov esi, dword [esp + 0x3c]
cmp esi, 0x10
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x28]
mov dword [ebp], eax
mov ecx, ebx
jae 0x1003a5ff
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x24]
push ecx
call fcn.1005a4d0
add esp, 0xc
cmp esi, 0x10
jb 0x1003a61c
push ebx
call fcn.100549f0
add esp, 4
mov edx, dword [esp + 0x18]
push edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x1003a6fb
mov edi, dword [esi + 0x10038]
sub edi, dword [esi + 0x10058]
sub edi, eax
add edi, ebx
jns 0x1003a663
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
jmp 0x1003a6fb
push ecx
push ecx
mov ecx, dword [esi + 0x10018]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x10040]
mov ebx, dword [ebp]
mov eax, edi
cdq
sub ecx, eax
mov eax, dword [esi + 0x10044]
sbb eax, edx
xor edx, edx
cmp eax, edx
jg 0x1003a6a0
jl 0x1003a695
cmp ecx, ebx
jae 0x1003a6a0
mov edx, dword [esi + 0x10040]
sub edx, edi
mov dword [ebp], edx
mov ecx, dword [ebp]
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x24]
push eax
mov eax, dword [esi + 0x10018]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003a6cc
mov ecx, dword [esp + 0x20]
mov dword [ebp], ecx
mov bl, 1
jmp 0x1003a6d0
mov bl, byte [esp + 0x17]
mov edx, dword [esi + 0x10048]
add edx, dword [esi + 0x10038]
mov eax, dword [esi + 0x10018]
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1005574a
add esp, 0x3c
ret 0xc