joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006ab40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x1006ab6c
jl 0x1006ab60
test esi, esi
jne 0x1006ab6c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1006ab85
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov edx, dword [eax]
test edx, edx
je 0x1006abbf
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1006abbf
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x1006ac40
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1006abe8
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x1006ac2c
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x1006ac53
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1006ac00
test edx, edx
je 0x1006ac40
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006af80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100b900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1006afb0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080de9
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1006afe0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1006afe0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080de9
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1006b0b6
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1006b009
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1006b015
movsx eax, bl
jmp 0x1006b04d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1006b077
sub eax, 1
je 0x1006b077
sub eax, 2
jne 0x1006b0b6
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080de9
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1006b095
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1006b0b6
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1006b0b6
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080de9
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10080de9
mov esp, ebp
pop ebp
ret 4
Function at 0x1007ab10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100b900c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1007abcc
cmp byte [esi + 0x3d], 0
je 0x1007abcc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1007abba
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1007ab81
sub eax, 1
je 0x1007ab85
sub eax, 2
jne 0x1007abba
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080de9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1007aba3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1007abba
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080de9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080de9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10080de9
mov esp, ebp
pop ebp
ret

Function at 0x1007e1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 3
xor eax, eax
mov dl, byte [edi + eax - 0x2dde7edd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007e1ce
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1007e1b1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007e1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xb5
xor eax, eax
mov dl, byte [edi + eax - 0x39e8c79c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007e20e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1007e1f1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007e220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x7e
xor eax, eax
mov dl, byte [edi + eax + 0x47b30cfa]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007e24e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1007e231
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1007e260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x90
xor eax, eax
mov dl, byte [edi + eax + 0x2c0f6166]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1007e28e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1007e271
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10080b80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100913fd
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100b900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x84]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x84], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x67452301
mov dword [ebp - 0x34], 0xefcdab89
mov dword [ebp - 0x30], 0x98badcfe
mov dword [ebp - 0x2c], 0x10325476
call fcn.10080a10
cmp byte [ebp - 0x84], 0
jne 0x10080cd1
xor edx, edx
lea ecx, [ebp - 0x3f]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10080c15
mov edx, dword [ebp - 0x40]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x84]
push eax
push 0x100baaa0
call fcn.10080a10
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x84]
call fcn.10080a10
xor edx, edx
lea ecx, [ebp - 0x37]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x28], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x27], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x26], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x25], al
add edx, 4
cmp edx, 0x10
jb 0x10080c84
push 0x40
lea eax, [ebp - 0x83]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x84], 1
add esp, 0xc
movq qword [ebp - 0x40], xmm0
push esi
lea ecx, [ebp - 0x84]
call fcn.10080ac0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10080d13
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10080d09
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10080d09
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1008170f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080de9
mov esp, ebp
pop ebp
ret
Function at 0xa9f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a9f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9f06a
add dl, dl
jne 0xa9f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9f0dc
xor eax, eax
add dl, dl
jne 0xa9f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9f17d
add dl, dl
jne 0xa9f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa9f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa9f075
mov eax, 1
add dl, dl
jne 0xa9f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa9f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9f0e1
sub eax, ebx
mov ebx, 1
jne 0xa9f128
mov ecx, 1
add dl, dl
jne 0xa9f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa9f136
cmp eax, 0x7d00
jae 0xa9f16d
cmp eax, 0x500
jb 0xa9f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9f075
cmp eax, 0x7f
ja 0xa9f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa9f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa9f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x27501f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*8 + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x18], ecx
and dword [ebp - 4], 0
jmp 0x27501f93
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x27501fd8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x14], edx
push dword [ebp - 0x14]
push dword [ebp + 0x14]
call fcn.27501eed
pop ecx
pop ecx
cmp eax, dword [ebp + 0x10]
jne 0x27501fd6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x27501fda
jmp 0x27501f8c
xor eax, eax
leave
ret

Function at 0x27501fdc
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
je 0x27502050
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x30]
call fcn.27501afe
pop ecx
cmp dword [ebp + 8], eax
jne 0x27502046
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
jmp 0x27502052
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x2750201f
xor eax, eax
leave
ret
Function at 0x401ac4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
push 7
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x2f]
mov byte [ebp - 0x30], bl
push 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x4f]
mov byte [ebp - 0x50], bl
rep stosd dword es:[edi], eax
push ebx
push ebx
stosw word es:[edi], ax
push ebx
push ebx
push str.Testing
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 1], bl
stosb byte es:[edi], al
call dword [0x40c4e8]
push ebx
push 0x80000000
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push eax
call dword [0x40c498]
mov esi, eax
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
push 0x13
push esi
call dword [0x40c4d4]
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
push 0x13
push esi
call dword [0x40c4d4]
test eax, eax
je 0x401c18
push 3
lea eax, [ebp - 0x30]
push 0x40990c
push eax
call fcn.00402f70
add esp, 0xc
test eax, eax
jne 0x401c13
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x50]
push eax
push 5
push esi
call dword [0x40c4d4]
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x50]
push eax
push 5
push esi
call dword [0x40c4d4]
test eax, eax
je 0x401c13
lea eax, [ebp - 0x50]
push eax
call fcn.00401a6c
pop ecx
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401c13
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 1]
push 1
push eax
push esi
call dword [0x40c4dc]
test eax, eax
je 0x401be9
cmp dword [ebp - 8], ebx
je 0x401be9
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 1]
push 1
push eax
push edi
call dword [0x40c49c]
jmp 0x401bbb
push esi
call dword [0x40c4a0]
push dword [ebp - 0xc]
call dword [0x40c4a0]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
push dword [ebp + 0xc]
call dword [0x40c4e4]
pop edi
pop esi
pop ebx
leave
ret
push esi
call dword [0x40c4a0]
push dword [ebp - 0xc]
call dword [0x40c4a0]
push ebx
call fcn.00402e91
Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x158]
push edi
xor esi, esi
push eax
push esi
call dword [0x40c4e0]
test eax, eax
je 0x401d87
lea eax, [ebp - 0x158]
push edi
push eax
lea eax, [ebp - 0x158]
push eax
call dword [0x40c4a4]
test eax, eax
je 0x401d87
lea eax, [ebp - 0x360]
push edi
push eax
call dword [0x40c4c0]
lea eax, [ebp - 0x360]
push str.cmd.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x25c]
push str.__c__del
push eax
call fcn.00402fb0
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.00402fc0
lea eax, [ebp - 0x25c]
push str.___nul
push eax
call fcn.00402fc0
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x360]
push eax
call fcn.00402fc0
add esp, 0x20
xor eax, eax
lea edi, [ebp - 0x50]
mov dword [ebp - 0x10], esi
push 0x10
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x54], 0x44
push 0x100
mov dword [ebp - 0x28], edi
mov word [ebp - 0x24], si
call dword [0x40c4f8]
push eax
call dword [0x40c4c4]
push 0xf
call dword [0x40c4d0]
push eax
call dword [0x40c4ac]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0xc
push esi
push esi
lea eax, [ebp - 0x360]
push esi
push eax
push esi
call dword [0x40c4f4]
test eax, eax
je 0x401d6a
push 0x40
push dword [ebp - 0x10]
call dword [0x40c4c4]
push 0xfffffffffffffff1
push dword [ebp - 0xc]
call dword [0x40c4ac]
push dword [ebp - 0xc]
call dword [0x40c4b0]
mov eax, edi
pop edi
pop esi
leave
ret
push 0x20
call dword [0x40c4f8]
push eax
call dword [0x40c4c4]
push esi
call dword [0x40c4d0]
push eax
call dword [0x40c4ac]
push esi
call fcn.00402e91

Function at 0x401f06
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401f70
push 2
push edi
push 0xffffffffffffffda
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 8]
push edi
push eax
push 0x26
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401f70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call fcn.00403150
cmp eax, 0x26
pop ecx
je 0x401f70
push 0x26
push edi
push dword [ebp + 0xc]
call fcn.00402d00
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x401f74
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
push esi
push 0x80
push 3
push esi
push esi
push 0x10000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401fc7
push 2
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x401fc7
lea eax, [ebp + 8]
push esi
push eax
push dword [ebp + 0xc]
call fcn.00403150
pop ecx
push eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401fcb
xor eax, eax
jmp 0x401fd5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
pop ebp
ret

Function at 0x4022d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x208], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x207]
and byte [ebp - 0x104], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x208]
push str.V3Medic.exe
push eax
call fcn.00402fc0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00401f06
add esp, 0x10
lea eax, [ebp - 0x208]
push 0
push eax
push 0x40c508
call dword [0x40c4ec]
test eax, eax
je 0x4023c9
lea eax, [ebp - 0x104]
push eax
call fcn.00403150
cmp eax, 0x26
pop ecx
jne 0x40237b
lea eax, [ebp - 0x104]
push eax
call fcn.004021a8
pop ecx
push esi
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00402d00
lea eax, [ebp - 0x104]
push eax
call fcn.00401dd7
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00401f74
lea eax, [ebp - 0x104]
push eax
call fcn.00401fd9
add esp, 0x1c
test eax, eax
je 0x4023c9
lea eax, [ebp - 0x104]
push eax
call fcn.004020b1
pop ecx
pop edi
pop esi
leave
ret
Function at 0x402aac
Capabilities:
Create process on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
call fcn.00401145
call fcn.00402a05
call fcn.00402a3d
test eax, eax
mov dword [0x40c4c8], 0x409030
jne 0x402adc
mov dword [0x40c4c8], 0x4090b0
lea eax, [ebp - 0x25c]
push ebx
push eax
push 0x104
call dword [0x40c500]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x360]
push str._s_ver.exe
push eax
call fcn.0040333c
add esp, 0xc
xor ebx, ebx
lea eax, [ebp - 0x360]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
call fcn.00401eee
test eax, eax
jne 0x402b3b
call fcn.004022d1
call fcn.0040297c
call fcn.00401c2e
xor eax, eax
jmp 0x402bfa
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x402bb4
push str.start
push dword [ebp + 0x10]
call fcn.004030d0
pop ecx
test eax, eax
pop ecx
je 0x402bb4
push edi
call fcn.004029dd
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x157]
mov byte [ebp - 0x158], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x158]
push eax
push 0x40c508
call fcn.00401f06
lea eax, [ebp - 0x158]
push eax
call fcn.00403150
add esp, 0xc
cmp eax, 0x26
pop edi
jne 0x402baa
lea eax, [ebp - 0x158]
push eax
call fcn.004020b1
pop ecx
call fcn.0040297c
push 1
pop eax
jmp 0x402bfa
push esi
push 0x44
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.00402d00
mov esi, 0x40c508
push str.__start
push esi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 5
call fcn.00402fc0
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
pop esi
pop ebx
leave
ret 0x10