joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dd30b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100dd34a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100dd34a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100dd34a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100dd34a
cmp dword [ecx + 0x74], 0xe
jbe 0x100dd34a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100e23b8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101184b0
push 0x101184a8
push 0x1010d6b8
push 0x1f
call fcn.100e21e3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100e23ec
push dword [ebp + 8]
mov ecx, esi
call dword [0x10104608]
call esi
jmp 0x100e23f2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100e2436
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101184c0
push 0x101184b8
push str.FlsGetValue
push 0x21
call fcn.100e21e3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100e246d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10104608]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100e2475
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101184c8
push 0x101184c0
push str.FlsSetValue
push 0x22
call fcn.100e21e3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100e24af
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10104608]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100e65d6
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100e6552
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100e6745
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100e6745
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100e66fa
jg 0x100e6632
test eax, eax
je 0x100e66f0
push 1
push 0x1000
call fcn.100e0c68
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100e6655
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100e66e7
push 0x8000
push ebx
call fcn.100e604f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100e667e
jg 0x100e6679
cmp ecx, 0x1000
jb 0x100e667e
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100d6c05
add esp, 0x10
cmp eax, 0xffffffff
je 0x100e66c3
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100e6679
jl 0x100e66aa
test ecx, ecx
jne 0x100e666b
push dword [ebp - 0xc]
push ebx
call fcn.100e604f
push esi
call fcn.100e0cc5
add esp, 0xc
xor ebx, ebx
jmp 0x100e6753
cmp byte [edi + 0x24], 0
je 0x100e66da
cmp dword [edi + 0x20], 5
jne 0x100e66da
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100e66e5
mov ebx, dword [edi + 0x18]
jmp 0x100e66e7
xor ebx, ebx
push esi
call fcn.100e0cc5
pop ecx
jmp 0x100e6753
test ecx, ecx
jg 0x100e66bc
jl 0x100e66fa
test eax, eax
jae 0x100e66bc
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100d62bd
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100e671a
cmp byte [edi + 0x1c], 0
je 0x100e66bc
jmp 0x100e674b
push ebx
call fcn.100e64e8
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100e66bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100e6753
cmp byte [edi + 0x1c], 0
je 0x100e6750
mov ebx, dword [edi + 0x18]
jmp 0x100e6753
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100d62bd
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100e676d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x101442d8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100e67ad
cmp byte [ebx], 0xa
jne 0x100e67ad
or byte [edi + eax + 0x28], 4
jmp 0x100e67b2
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x100e68b1
mov dl, byte [eax]
cmp dl, 0x1a
je 0x100e6894
inc eax
cmp dl, 0xd
je 0x100e67de
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100e6804
cmp eax, ecx
jae 0x100e6812
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x100e67c6
jmp 0x100e68b1
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100e688f
cmp dword [ebp - 0x10], 0
je 0x100e688f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x101442d8]
test byte [eax + edi + 0x28], 0x48
je 0x100e6869
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100e6854
mov byte [esi], dl
jmp 0x100e6865
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x101442d8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100e68b1
cmp byte [ebp - 1], 0xa
jne 0x100e6878
cmp esi, ebx
jne 0x100e6878
mov byte [esi], 0xa
jmp 0x100e68b0
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100d62bd
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100e68b1
mov byte [esi], 0xd
jmp 0x100e68b0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x101442d8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100e68ae
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100e68b1
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100e68ba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x101442d8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100e6900
cmp word [ebx], dx
jne 0x100e6900
or byte [eax + edi + 0x28], 4
jmp 0x100e6905
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x100e6a68
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x100e6a48
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x100e6946
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100e697c
cmp eax, edx
jae 0x100e698a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100e6921
jmp 0x100e6a68
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100e6a43
cmp dword [ebp - 0x18], 0
je 0x100e6a43
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x101442d8]
test byte [eax + edi + 0x28], 0x48
je 0x100e6a19
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100e69dd
mov word [esi], cx
jmp 0x100e6a14
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x101442d8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x101442d8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x101442d8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x100e6a68
pop eax
cmp word [ebp - 4], ax
jne 0x100e6a29
cmp esi, ebx
jne 0x100e6a29
mov word [esi], ax
jmp 0x100e6a65
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100d62bd
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x100e6a68
push 0xd
pop eax
jmp 0x100e6a24
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x101442d8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x100e6a62
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x100e6a68
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100e8b6b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100e8c08
push ebx
push esi
call fcn.100e8b34
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100e5535
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100e8bb5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100e8c07
push edi
push eax
call fcn.100e0d9b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100e8bd5
call fcn.100e0cc5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100e8c06
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100e5535
add esp, 0x20
test eax, eax
jne 0x100e8bf4
push edi
call fcn.100e0cc5
jmp 0x100e8bfc
push ebx
call fcn.100e0cc5
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100e8c0b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100e8c1c
pop esi
ret
push ebx
push edi
push esi
call fcn.100e8b34
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100e0d9b
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100e8c44
push ebx
push esi
push edi
call fcn.100c5d20
add esp, 0xc
push 0
call fcn.100e0cc5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100e9014
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100e8c59

Function at 0x100eb80c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100df2b8
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100eb87b
cmp esi, dword [ebp - 4]
je 0x100eb876
cmp dword [ebp + 0xc], 0
je 0x100eb876
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100eb853
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100eb35e
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100eb87d
xor eax, eax
inc eax
jmp 0x100eb87d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100eb8e2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1013cfc4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100df2b8
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100df2b8
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100eb959
cmp word [ecx], dx
je 0x100eb959
mov eax, dword [0x1011c4a4]
push edi
dec eax
push eax
push 0x1011c390
call fcn.100eb881
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100eb9cc
cmp word [eax], dx
je 0x100eb9cc
mov eax, dword [edi]
test eax, eax
je 0x100eb97d
cmp word [eax], dx
je 0x100eb97d
lea eax, [ebp - 0x10]
push eax
call fcn.100eb264
jmp 0x100eb986
lea eax, [ebp - 0x10]
push eax
call fcn.100eb2ff
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100eb9f6
mov eax, dword [0x1011c38c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1011c080
call fcn.100eb881
add esp, 0xc
test al, al
je 0x100eb9f6
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100eb9c1
cmp word [eax], di
je 0x100eb9c1
lea eax, [ebp - 0x10]
push eax
call fcn.100eb264
pop ecx
jmp 0x100eb9f8
lea eax, [ebp - 0x10]
push eax
call fcn.100eb2ff
jmp 0x100eb9be
mov eax, dword [edi]
test eax, eax
je 0x100eb9e3
cmp word [eax], dx
je 0x100eb9e3
lea eax, [ebp - 0x10]
push eax
call fcn.100eb219
pop ecx
jmp 0x100eb9f6
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100ebac1
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100eb706
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100ebac1
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100ebac1
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100ebac1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100eba4e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100e25f4
test ebx, ebx
je 0x100ebabc
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100e25f4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100ebac1
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100ebac1
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100d06e8
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100ebac3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ab5ce
leave
ret
Function at 0x100f0b50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.100f0c80
add esp, 8
test al, al
je 0x100f0b75
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100f0b75
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x100f0c80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x100f1000
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100f102b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100f102b
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x402330
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x49e0c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, esi
push edi
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402350
sub eax, edx
xor ecx, ecx
mov edx, 2
lea ebx, [eax + 1]
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045dd88
lea ecx, [ebx + ebx]
mov edi, eax
push ecx
push 0
push edi
call fcn.00457cb0
mov ecx, esi
add esp, 0x10
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402390
push ebx
push edi
sub ecx, edx
push ecx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0x3c
lea eax, [ebp - 0x40]
movlpd qword [ebp - 0x1c], xmm0
push eax
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], str.OPEN
mov dword [ebp - 0x30], str.cmd.exe
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call fcn.0045d329
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00455c59
mov esp, ebp
pop ebp
ret

Function at 0x402430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x49e0c4]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0x3c
lea eax, [ebp - 0x40]
movlpd qword [ebp - 0x1c], xmm0
push eax
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], str.OPEN
mov dword [ebp - 0x30], str.cmd.exe
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455c59
mov esp, ebp
pop ebp
ret
Function at 0x4118f0
Capabilities:
Create directory
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47c525
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x49e0c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push str.C:Tempissdu
call fcn.0045bbda
add esp, 8
cmp eax, 0xffffffff
jne 0x41195a
push 0
push str.C:Temp
call fcn.0045bbda
add esp, 8
cmp eax, 0xffffffff
jne 0x41194d
push str.C:Temp
call fcn.0045d4f3
add esp, 4
push str.C:Tempissdu
call fcn.0045d4f3
add esp, 4
cmp byte [0x4a0228], 0
je 0x41196d
call fcn.0040c990
jmp 0x411a63
cmp byte [0x4a022e], 0
je 0x411a5e
push 4
call fcn.00455d31
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [eax], 0x402220
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x415d80
push 0
push 0
call fcn.0045b0f5
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x411aa4
push 4
mov dword [ebp - 4], 1
call fcn.00455d31
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [eax], fcn.0040cf10
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x415d80
push 0
push 0
call fcn.0045b0f5
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
je 0x411a96
mov byte [ebp - 4], 3
cmp dword [ebp - 0x14], 0
je 0x411a8f
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
je 0x411a88
push 0
push ecx
push dword [ebp - 0x18]
call fcn.00455581
add esp, 0xc
test eax, eax
jne 0x411a81
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
cmp dword [ebp - 0x1c], eax
je 0x411a8f
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
je 0x411a88
push 0
push ecx
push dword [ebp - 0x20]
call fcn.00455581
add esp, 0xc
test eax, eax
jne 0x411a81
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
cmp dword [ebp - 0x14], eax
jne 0x411a7c
jmp 0x411a63
call fcn.0040cf10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455c59
mov esp, ebp
pop ebp
ret
call fcn.0045bc47
push 2
call fcn.00454b95
push 5
call fcn.00454b95
push 1
call fcn.00454b95
push 6
mov dword [ebp - 0x1c], 0
call fcn.00454b95
push 6
mov dword [ebp - 0x14], 0
call fcn.00454b95
int3
Function at 0x412100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x4121e6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x4121d5
jg 0x412140
test edx, edx
je 0x4121d5
nop dword [eax]
call fcn.00413bf0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x412194
jg 0x412157
test esi, esi
je 0x412194
cmp ebx, eax
jg 0x412167
jl 0x412161
cmp edi, esi
jae 0x412167
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00457730
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x4121b9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x4121cf
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x412140
jl 0x4121cf
test edi, edi
jne 0x412140
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x412208
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x41220a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x412288
jg 0x41221d
test esi, esi
je 0x412288
test eax, eax
jl 0x41226c
jg 0x412227
test ebx, ebx
je 0x41226c
cmp edi, eax
jg 0x412237
jl 0x412231
cmp esi, ebx
jae 0x412237
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00457730
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x412288
jg 0x41226f
test esi, esi
je 0x412288
jmp 0x41226f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x412288
push eax
push esi
push 1
push edx
call fcn.0045cff9
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc