joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56381c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5639e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov eax, dword [0x5b1ee0]
cmp dword [eax], 2
je 0x5639c8
xor eax, eax
push ebp
push 0x5639be
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4428f8]
call fcn.004429f8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5639ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00442a98
xor ecx, ecx
mov edx, 0x563a04
mov eax, dword [ebp - 0xc]
call fcn.00442afc
test al, al
je 0x563997
mov edx, 0x563a24
mov eax, dword [ebp - 0xc]
call fcn.00442f28
test eax, eax
je 0x563997
push 0xff
lea eax, [ebp - 0x115]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 0x11c]
lea eax, [ebp - 0x115]
call fcn.0040af44
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x10]
mov edx, 0x563a44
call fcn.004436fc
mov eax, dword [ebp - 0x10]
call fcn.004054d0
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x563997
xor eax, eax
push ebp
push 0x563990
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x563a54
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
mov eax, dword [0x5b1a8c]
cmp byte [eax], 3
jne 0x563946
mov eax, dword [0x5b19a8]
mov eax, dword [eax]
cmp byte [eax + 0x484], 0
je 0x563946
push 0xffffffffffffffff
call sub.user32.dll_ShowCursor
mov eax, dword [0x5b19a8]
mov eax, dword [eax]
call fcn.0045465c
push eax
call ebx
mov byte [ebp - 1], al
mov eax, dword [0x5b1a8c]
cmp byte [eax], 3
jne 0x563979
mov eax, dword [0x5b19a8]
mov eax, dword [eax]
cmp byte [eax + 0x484], 0
je 0x563979
push 0
call sub.user32.dll_ShowCursor
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x563997
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5639b4
mov eax, dword [ebp - 0xc]
call fcn.004040e0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5639f0
lea eax, [ebp - 0x11c]
call fcn.00404ff4
lea eax, [ebp - 0x10]
call fcn.00404ff4
ret
Function at 0x59d6f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404ff4
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x59d784
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x59d77f
xor eax, eax
push ebp
push 0x59d778
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x104
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10d]
push eax
push 0
push 0
push 0x59d7c0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x59d761
mov edx, ebx
lea eax, [ebp - 0x10d]
call fcn.0040af44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59d77f
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59d7c4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc0
mov edi, edx
mov esi, eax
xor ebx, ebx
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x3c
call fcn.0040387c
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x40
mov eax, dword [0x5b1c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 0xc], eax
mov eax, esi
call fcn.004054d0
mov dword [esp + 0x14], eax
mov eax, edi
call fcn.004054d0
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x20], eax
lea eax, [esp + 4]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x59d85f
mov eax, dword [0x5b1c4c]
mov eax, dword [eax]
call fcn.0046d9ec
push esp
mov eax, dword [esp + 0x40]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
cmp dword [esp], 0x103
jne 0x59d858
mov eax, dword [0x5b1c4c]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
je 0x59d828
cmp dword [esp], 0
sete bl
mov eax, ebx
add esp, 0x40
pop edi
pop esi
pop ebx
ret

Function at 0x59de00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x59ded0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x59dee8
call fcn.00405048
xor ebx, ebx
lea eax, [ebp - 4]
xor edx, edx
mov dl, bl
add edx, 0x41
call fcn.004051dc
lea eax, [ebp - 4]
mov edx, 0x59def8
call fcn.004052d8
mov eax, dword [ebp - 4]
call fcn.004054d0
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x59de68
cmp eax, dword [esp]
pop edx
pop eax
jne 0x59dea2
lea eax, [ebp - 8]
xor edx, edx
mov dl, bl
add edx, 0x41
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.004036f0
mov edx, 0x59defc
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.004036c0
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00405258
jmp 0x59dea3
inc ebx
cmp bl, 0x19
ja 0x59deba
mov eax, dword [esi]
mov edx, 0x59dee8
call fcn.0040541c
je 0x59de2e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59ded7
lea eax, [ebp - 4]
call fcn.00404ff4
ret
Function at 0x59df00
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.00404ff4
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x59e004
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x59e004
xor eax, eax
push ebp
push 0x59dffd
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x59dfea
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x59dfe3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalSize
mov edx, 0x7fffffff
call fcn.00443490
mov esi, eax
mov eax, esi
call fcn.00402c7c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59dfc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.00402f2c
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040af44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59dfcc
mov eax, dword [ebp - 4]
call fcn.00402cac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e004
call sub.user32.dll_CloseClipboard
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x59e138
Capabilities:
Get session user name

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, eax
mov dword [esp], 0x104
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x59e165
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040af44
jmp 0x59e176
mov esi, dword [0x5b1a54]
mov esi, dword [esi]
mov edx, ebx
mov eax, 0xe4
call esi
add esp, 0x10c
pop esi
pop ebx
ret
Function at 0x59e180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x59e2bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404ff4
mov eax, dword [0x5b1d04]
cmp dword [eax], 0
je 0x59e204
lea eax, [ebp - 0x105]
push eax
push 0
push 0
push esi
push 0
mov eax, dword [0x5b1d04]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x59e29d
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.0040af44
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040ecec
jmp 0x59e29d
sub esi, 5
je 0x59e219
sub esi, 0x1f
je 0x59e227
dec esi
je 0x59e25c
dec esi
je 0x59e291
jmp 0x59e29d
mov eax, ebx
mov edx, 0x59e2d0
call fcn.00405048
jmp 0x59e29d
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
test eax, eax
jbe 0x59e29d
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x105]
call fcn.0040af44
mov eax, dword [ebp - 0x110]
mov edx, ebx
call fcn.0040ecec
jmp 0x59e29d
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
jbe 0x59e29d
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x105]
call fcn.0040af44
mov eax, dword [ebp - 0x114]
mov edx, ebx
call fcn.0040ecec
jmp 0x59e29d
mov eax, ebx
mov edx, 0x59e2ec
call fcn.00405048
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e2c2
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00405018
ret

Function at 0x59e314
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x59e38b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jbe 0x59e36b
lea edx, [ebp - 0x10c]
lea eax, [ebp - 0x105]
call fcn.0040af44
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.0040ecd8
jmp 0x59e372
mov eax, ebx
call fcn.00404ff4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59e392
lea eax, [ebp - 0x10c]
call fcn.00404ff4
ret

Function at 0x59e398
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffff4
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x59e3cc
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x59e3c5
mov eax, dword [esp]
jmp 0x59e3c7
xor eax, eax
add esp, 0xc
ret
Function at 0x5a0be8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a0d1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5b1c4c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5a0d05
xor eax, eax
push ebp
push 0x5a0cfe
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
test ebx, ebx
jbe 0x5a0ceb
lea eax, [ebp - 0xc]
mov ecx, 0x5a0d34
mov edx, ebx
call fcn.0040531c
mov eax, dword [ebp - 0xc]
call fcn.004052d0
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a0cd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5a0cc2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004052d0
push eax
lea eax, [ebp - 0xc]
call fcn.00405528
mov edx, dword [ebp - 8]
pop ecx
call fcn.00402f2c
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0cc9
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0d05
call sub.user32.dll_CloseClipboard
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a0d22
lea eax, [ebp - 0xc]
call fcn.00404ff4
ret
Function at 0x10030010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x10
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov ebx, dword [ebp + 0xc]
movsd qword [esp], xmm0
mov dword [esp + 8], 0
mov dword [esp], 4
mov eax, dword [edi]
mov dword [esp + 4], eax
mov eax, esp
mov dword [edi], eax
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax]
mov esi, dword [0x107c5520]
push esi
push 0x20
push 0x1b0
push dword [edi + 8]
call sym._ijl_gc_pool_alloc_instrumented
add esp, 0x10
mov dword [eax - 4], esi
mov ecx, dword [ebx + 0x10]
mov dword [eax + 0x10], ecx
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
mov dword [esp + 8], eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
sub esp, 4
push dword [ebp + 0x10]
push eax
push edi
call dword [0x107c5524]
add esp, 4
push eax
call sym._ijl_throw
nop word [eax + eax]
Function at 0x2e03257b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x2e032596
mov eax, dword [esi]
jmp 0x2e032598
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x2e0325ef
cmp eax, 0x50
je 0x2e0325ef
cmp eax, 0xb7
je 0x2e0325ef
cmp dword [edi + 0x18], 8
jb 0x2e0325bb
mov esi, dword [esi]
push esi
push 0x2e004648
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.2e02fdfb
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
pop edi
pop esi
leave
ret 4

Function at 0x2e0325f5
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x218
cmp dword [eax + 0x18], 8
jb 0x2e03260c
mov eax, dword [eax + 4]
jmp 0x2e03260f
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x2e032653
push 0x2e004678
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.2e02fdfb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
leave
ret 4
Function at 0x2e0328dc
Capabilities:
Enumerate files on windows

Disassembly:
push 0x4cc
mov eax, 0x2e072d6f
call fcn.2e0564b8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push ebx
mov dword [ebp - 0x2a4], esi
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], eax
call fcn.2e03254e
test al, al
jne 0x2e032953
cmp dword [ebx + 0x18], 8
jb 0x2e03291b
mov ebx, dword [ebx + 4]
jmp 0x2e03291e
add ebx, 4
push ebx
push 0x2e00471c
lea eax, [ebp - 0x4d8]
push 0x22
push eax
call fcn.2e028862
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x3cc]
lea edi, [ebp - 0x3cc]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
mov ecx, esi
call fcn.2e02a243
xor edi, edi
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 7
call fcn.2e0284cb
push 0xffffffffffffffff
push edi
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.2e029687
mov esi, 0x2e00407c
push esi
lea ecx, [ebp - 0x2c]
call fcn.2e029c6b
push 1
push eax
push ebx
mov byte [ebp - 4], 1
call fcn.2e02ef54
mov bl, al
neg bl
push edi
sbb bl, bl
push 1
lea ecx, [ebp - 0x2c]
inc bl
mov byte [ebp - 4], 0
call fcn.2e028abf
test bl, bl
je 0x2e0329d9
push esi
lea ecx, [ebp - 0x2c]
call fcn.2e029c6b
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.2e029786
push edi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.2e028abf
push 0xffffffffffffffff
push edi
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x48]
call fcn.2e029786
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x2e0329f6
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x298]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x29c], eax
cmp eax, 0xffffffff
jne 0x2e032a41
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x2e032b1c
cmp eax, 2
je 0x2e032b1c
push 0x2e0046e4
push eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.2e02fdfb
add esp, 0xc
jmp 0x2e032935
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x2c]
call fcn.2e029a8d
push esi
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 3
call fcn.2e029c6b
push 1
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 4
call fcn.2e02ef54
mov bl, al
neg bl
push edi
sbb bl, bl
push 1
lea ecx, [ebp - 0x2c0]
inc bl
mov byte [ebp - 4], 3
call fcn.2e028abf
test bl, bl
je 0x2e032abb
push esi
lea ecx, [ebp - 0x2c0]
call fcn.2e029c6b
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.2e029786
push edi
push 1
lea ecx, [ebp - 0x2c0]
mov byte [ebp - 4], 3
call fcn.2e028abf
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.2e029c90
lea eax, [ebp - 0x2c]
push eax
call fcn.2e031288
test al, al
je 0x2e032ae6
mov ecx, dword [ebp - 0x2a4]
lea eax, [ebp - 0x2c]
push eax
call fcn.2e02a7a6
push edi
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.2e028abf
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x2e032a41
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.2e028abf
call fcn.2e05653b
ret 0xc
Function at 0x2e032d75
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x2e032d90
mov eax, dword [edi]
jmp 0x2e032d92
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x2e032de4
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp dword [esi + 0x18], 8
jb 0x2e032dad
mov edi, dword [edi]
push eax
push edi
push 0x2e004744
call ebx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.2e02fdfb
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
pop edi
pop esi
leave
ret 4

Function at 0x2e032e00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10220
call fcn.2e0574fb
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x10008], 0
cmp dword [eax + 0x18], 8
push esi
push edi
mov edi, dword [ebp + 8]
jb 0x2e032e31
mov eax, dword [eax + 4]
jmp 0x2e032e34
add eax, 4
mov esi, 0x7fff
push esi
lea ecx, [ebp - 0x10004]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x2e032e70
cmp eax, esi
ja 0x2e032e70
lea eax, [ebp - 0x10004]
push eax
mov ecx, edi
call fcn.2e029c6b
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.2e056441
leave
ret 8
push 0x2e004778
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10220]
push eax
call fcn.2e02fdfb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10114]
lea edi, [ebp - 0x10114]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
int3

Function at 0x2e032eaa
Capabilities:
Accept command line arguments

Disassembly:
push 0x240
mov eax, 0x2e072df3
call fcn.2e0564b8
mov eax, dword [ebp + 8]
and dword [ebp - 0x30], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x2e032f13
push 0x2e0047a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.2e02fdfb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x140]
lea edi, [ebp - 0x140]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
xor esi, esi
cmp dword [ebp - 0x30], esi
jle 0x2e032f4b
push dword [edi + esi*4]
lea ecx, [ebp - 0x2c]
call fcn.2e029c6b
mov ecx, dword [ebp - 0x34]
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.2e02a7a6
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2e028abf
inc esi
cmp esi, dword [ebp - 0x30]
jl 0x2e032f1a
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call fcn.2e05653b
ret 4
Function at 0x2e033145
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x218
cmp eax, 0xffffffff
jne 0x2e033189
push 0x2e00484c
lea eax, [ebp - 0x218]
push 0x3d
push eax
call fcn.2e028862
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
leave
ret 4

Function at 0x2e033197
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x218
cmp eax, 0xffffffff
jne 0x2e0331db
push 0x2e00484c
lea eax, [ebp - 0x218]
push 0x3d
push eax
call fcn.2e028862
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
leave
ret

Function at 0x2e033b9c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x268
mov eax, 0x2e072fc5
call fcn.2e0564b8
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [edi + 0x24]
test eax, eax
jne 0x2e033bf1
push 0x2e004bb0
lea eax, [ebp - 0x274]
push 0x3a
push eax
call fcn.2e028862
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x168]
lea edi, [ebp - 0x168]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
cmp dword [esi + 0x18], 8
lea ecx, [esi + 4]
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], ecx
jb 0x2e033c0d
mov ecx, dword [ecx]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x34]
push edx
push 0
lea edx, [ebp - 0x38]
push edx
push 0
push ecx
push eax
call ebx
cmp eax, 2
je 0x2e033cf4
cmp dword [ebp - 0x38], 7
jne 0x2e033cf4
test eax, eax
je 0x2e033c6f
cmp dword [esi + 0x18], 8
mov ecx, dword [ebp - 0x30]
jb 0x2e033c45
mov ecx, dword [ecx]
cmp dword [edi + 0x20], 8
jb 0x2e033c50
mov edi, dword [edi + 0xc]
jmp 0x2e033c53
add edi, 0xc
push ecx
push edi
push 0x2e0049f8
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.2e02fdfb
add esp, 0x14
jmp 0x2e033bd3
add dword [ebp - 0x34], 2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5c]
call fcn.2e03356f
and dword [ebp - 4], 0
cmp dword [esi + 0x18], 8
mov eax, dword [ebp - 0x30]
jb 0x2e033c8d
mov eax, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x38]
push ecx
push 0
push eax
push dword [edi + 0x24]
call ebx
test eax, eax
jne 0x2e033c3a
mov eax, dword [ebp - 0x5c]
xor esi, esi
push eax
lea ecx, [ebp - 0x2c]
call fcn.2e029c6b
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.2e02a7a6
mov eax, dword [ebp - 0x18]
push 0
push 1
lea ecx, [ebp - 0x2c]
lea esi, [esi + eax + 1]
mov byte [ebp - 4], 0
call fcn.2e028abf
mov eax, dword [ebp - 0x5c]
lea eax, [eax + esi*2]
cmp byte [eax], 0
jne 0x2e033ca9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.2e033507
mov al, 1
jmp 0x2e033cf6
xor al, al
call fcn.2e05653b
ret 8