joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf00a10c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0f00703d
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
cmp dword [0xf07811c], ebx
jne 0xf00a1e5
push ebx
push ebx
push 0xf001e80
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0xf00a150
xor eax, eax
jmp 0xf00a2a9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xf001e74
push edi
call esi
cmp eax, ebx
je 0xf00a149
push eax
call fcn.0f006fc5
mov dword [esp], 0xf001e64
push edi
mov dword [0xf07811c], eax
call esi
push eax
call fcn.0f006fc5
mov dword [esp], 0xf001e50
push edi
mov dword [0xf078120], eax
call esi
push eax
call fcn.0f006fc5
mov dword [0xf078124], eax
lea eax, [ebp - 8]
push eax
call fcn.0f00627f
pop ecx
pop ecx
test eax, eax
je 0xf00a1b3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0f009383
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0xf00a1e5
push 0xf001e34
push edi
call esi
push eax
call fcn.0f006fc5
pop ecx
mov dword [0xf07812c], eax
cmp eax, ebx
je 0xf00a1e5
push 0xf001e1c
push edi
call esi
push eax
call fcn.0f006fc5
pop ecx
mov dword [0xf078128], eax
mov eax, dword [0xf078128]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0xf00a25e
cmp dword [0xf07812c], esi
je 0xf00a25e
push eax
call fcn.0f00704b
pop ecx
call eax
cmp eax, ebx
je 0xf00a22b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0xf07812c]
call fcn.0f00704b
pop ecx
call eax
test eax, eax
je 0xf00a22b
test byte [ebp - 0x18], 1
jne 0xf00a25e
lea eax, [ebp - 0xc]
push eax
call fcn.0f0062c0
pop ecx
test eax, eax
je 0xf00a246
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0f009383
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0xf00a255
or dword [ebp + 0x10], 0x200000
jmp 0xf00a28f
or dword [ebp + 0x10], 0x40000
jmp 0xf00a28f
mov eax, dword [0xf078120]
cmp eax, esi
je 0xf00a28f
push eax
call fcn.0f00704b
pop ecx
call eax
mov dword [ebp - 4], eax
cmp eax, ebx
je 0xf00a28f
mov eax, dword [0xf078124]
cmp eax, esi
je 0xf00a28f
push dword [ebp - 4]
push eax
call fcn.0f00704b
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0xf07811c]
call fcn.0f00704b
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xf00cef1
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
xor esi, esi
push eax
mov dword [ebp - 0xc], esi
call fcn.0f00627f
pop ecx
test eax, eax
je 0xf00cf26
push esi
push esi
push esi
push esi
push esi
call fcn.0f009383
add esp, 0x14
push 4
pop eax
call fcn.0f00dcd0
mov dword [ebp - 0x14], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0xf00d042
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x58]
dec edi
neg edi
sbb edi, edi
and edi, 0x103
inc edi
cmp dword [ebp - 0xc], 2
mov dword [ebp - 8], esi
jne 0xf00cfbb
mov dword [ebp - 0x10], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0xf001dfc
call esi
test eax, eax
jne 0xf00cf92
push 0xf001de0
call esi
test eax, eax
je 0xf00cfbb
push 0xf0029e8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xf00cfbb
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
call eax
cmp eax, 1
jne 0xf00cfbb
mov eax, dword [ebp - 0x10]
test eax, eax
jbe 0xf00cfbb
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea esi, [ebx - 1]
push esi
push dword [ebp - 8]
call fcn.0f006943
add esp, 0xc
test eax, eax
jl 0xf00d042
not esi
and dword [ebp - 8], esi
je 0xf00cfed
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp - 8]
call fcn.0f006943
add esp, 0xc
test eax, eax
jl 0xf00d042
lea eax, [ebx + ebx]
cmp dword [ebp - 8], eax
jae 0xf00cff8
mov dword [ebp - 8], eax
lea esi, [ebx - 1]
not esi
and esi, dword [ebp - 0x14]
sub esi, dword [ebp - 8]
cmp dword [ebp - 0xc], 1
jne 0xf00d00c
push 0x11
pop ebx
mov eax, dword [ebp - 0x18]
add ebx, eax
cmp esi, ebx
jb 0xf00d042
push 4
push 0x1000
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0xf00d042
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0xf00d042
xor eax, eax
inc eax
jmp 0xf00d044
xor eax, eax
lea esp, [ebp - 0x68]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0f0057d5
leave
ret
Function at 0xf0188ee
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0x449
call fcn.0f04451f
cmp al, 0x11
jne 0xf018908
or dword [ebp - 4], 0xffffffff
jmp 0xf018918
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov eax, dword [eax*4 + 0xf075550]
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x485
call fcn.0f04451f
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0xf08c440]
movzx eax, al
lea esi, [edx + ecx*4]
mov dword [ebp + 0x10], eax
cmp ebx, 1
jne 0xf018972
test eax, eax
jbe 0xf0189b4
mov ebx, dword [ebp + 0x18]
shl ebx, 2
push edi
call fcn.0f04451f
movzx eax, al
mov ecx, eax
shl ecx, 8
or eax, ecx
mov ecx, eax
shl ecx, 0x10
or ecx, eax
and ecx, dword [ebp - 4]
inc edi
xor dword [esi], ecx
add esi, ebx
dec dword [ebp + 0x10]
jne 0xf01894c
jmp 0xf0189b4
mov ecx, dword [ebp + 0x18]
sub ecx, ebx
test eax, eax
jbe 0xf0189b4
mov eax, ecx
shl eax, 2
mov dword [ebp + 0x18], eax
push edi
call fcn.0f04451f
movzx ecx, al
mov eax, ecx
shl eax, 8
or ecx, eax
mov eax, ecx
shl eax, 0x10
or eax, ecx
and eax, dword [ebp - 4]
inc edi
mov ecx, ebx
test ebx, ebx
jbe 0xf0189ac
xor dword [esi], eax
add esi, 4
dec ecx
jne 0xf0189a4
add esi, dword [ebp + 0x18]
dec dword [ebp + 0x10]
jne 0xf018983
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0xf01e3ca
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
xor ebx, ebx
and al, 0x1f
mov dword [ebp - 4], ebx
cmp al, 3
jne 0xf01e40a
push edi
mov edi, 0xf0acb80
mov al, byte [esi + 1]
push dword [ebp + 0xc]
xor al, bl
and al, 3
xor byte [esi + 1], al
push esi
call dword [edi]
add edi, 0x1c
inc ebx
cmp edi, 0xf0acbf0
jl 0xf01e3e8
mov eax, dword [ebp - 4]
pop edi
jmp 0xf01e41f
movzx eax, byte [esi + 1]
push dword [ebp + 0xc]
and eax, 3
imul eax, eax, 0x1c
push esi
call dword [eax + 0xf0acb80]
cwde
pop esi
pop ebx
leave
ret 8

Function at 0xf0297c2
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
call sym.ntvdm.exe_SuspendTimerThread
mov esi, dword [ebp + 8]
xor eax, eax
cmp dword [0xf07df54], eax
jne 0xf029847
mov ecx, dword [esi]
cmp dword [ecx], 0xc0000005
jne 0xf029847
cmp dword [0xf082dc4], eax
je 0xf029810
mov eax, dword fs:[0x18]
cmp dword [sym.ntvdm.exe_CurrentMonitorTeb], eax
je 0xf029803
push dword [0xf0ad4a8]
jmp 0xf029809
push dword [0xf0ad4a4]
call fcn.0f0430f6
jmp 0xf029847
push eax
push dword [0xf0ad1c0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xf029847
push 0x41d
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x419
push 0xf002b90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f02cb1f
push esi
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
mov edi, eax
cmp edi, 1
jne 0xf029860
mov eax, dword [esi]
push dword [eax]
push 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
call sym.ntvdm.exe_ResumeTimerThread
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0xf029af4
Capabilities:
Create thread

Disassembly:
push 0xf0adc8c
push 4
push 0
push 0xf029a56
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0xf0adc88], eax
test eax, eax
jne 0xf029b38
push 0x109
push 0xf002b90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f02cb1f
call fcn.0f02d021
push 1
call fcn.0f0315f6
ret
Function at 0xf02adf2
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x28]
push eax
push 1
xor ebx, ebx
push ebx
mov edi, 0xf002c74
push edi
push 0x80000002
mov dword [ebp - 0x30], 0x20
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0xf02ae3e
push 0x21
push ebx
push edi
push 0x155
call fcn.0f02c9f5
jmp 0xf02af2b
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0xf02ae94
push 0x21
push 0xf002c70
push edi
push 0x155
call fcn.0f02c9f5
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0xf02af2b
push esi
push dword [ebp - 0x2c]
call fcn.0f005706
mov esi, eax
pop ecx
cmp esi, ebx
jne 0xf02aec1
push 0x21
push 0xf002c70
push edi
push 0x154
call fcn.0f02c9f5
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0xf02af2a
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x34]
push eax
push ebx
mov ebx, 0xf002c70
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf02af0c
cmp dword [ebp - 0x34], 7
jne 0xf02af0c
mov edi, esi
jmp 0xf02aefb
push esi
call fcn.0f02ac2f
push 0
push esi
call fcn.0f05ef00
pop ecx
inc eax
pop ecx
mov esi, eax
cmp byte [esi], 0
jne 0xf02aee8
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
jmp 0xf02af24
push 0x21
push ebx
push edi
push 0x155
call fcn.0f02c9f5
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0f00996a
pop ecx
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret
Function at 0xf02af41
Capabilities:
Allocate thread local storage
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0xf07df68]
push ebx
push esi
push edi
mov edi, 0x208
cmp eax, edi
ja 0xf02af69
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ebx, ax
push 4
lea eax, [ebp - 0x210]
push eax
mov esi, 0x714
push esi
call fcn.0f0443c3
and dword [ebp - 0x210], 0xfffffbef
push dword [ebp - 0x210]
push esi
call fcn.0f044397
call fcn.0f01e03c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xf0adac4], eax
call fcn.0f00febb
call fcn.0f02adf2
call fcn.0f03b74f
lea eax, [ebp - 0x230]
push eax
call fcn.0f02f0a1
test eax, eax
je 0xf02afd7
lea eax, [ebp - 0x230]
push eax
call fcn.0f06b00c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0f02abd9
push 4
lea eax, [ebp - 0x21c]
push eax
push esi
call fcn.0f0443c3
mov eax, dword [ebp - 0x21c]
or dword [ebp - 0x210], eax
push edi
push dword [0xf07df64]
lea eax, [ebp - 0x20c]
push eax
call fcn.0f0057f0
movzx eax, bx
add esp, 0xc
sub eax, 0x404
push 0xd
je 0xf02b056
pop ecx
sub eax, ecx
je 0xf02b04e
dec eax
je 0xf02b046
sub eax, 0x3f2
je 0xf02b03e
sub eax, 0x400
je 0xf02b03e
push 0xa
push 0xf002cec
jmp 0xf02b05b
push ecx
push 0xf002cdc
jmp 0xf02b05b
push ecx
push 0xf002ccc
jmp 0xf02b05b
push ecx
push 0xf002cbc
jmp 0xf02b05b
push 0xf002cac
mov eax, 0x207
sub eax, edi
push eax
lea eax, [ebp + edi - 0x20c]
push eax
call fcn.0f05efc3
add esp, 0x10
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0xf02b155
lea eax, [ebp - 0x214]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x218], eax
cmp eax, ebx
je 0xf02b155
cmp dword [ebp - 0x214], ebx
jne 0xf02b155
mov eax, dword [0xf0adabc]
push ebx
lea ecx, [ebp - 0x214]
push ecx
push dword [ebp - 0x218]
add eax, 0x700
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf02b143
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x214]
jne 0xf02b143
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x210]
push esi
call fcn.0f044397
push 0x70
call sym.ntvdm.exe_setCS
push ebx
call sym.ntvdm.exe_setIP
cmp dword [0xf07df54], ebx
je 0xf02b123
push 0x20
jmp 0xf02b137
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, 0x100
jne 0xf02b13f
push 0x80
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor eax, eax
jmp 0xf02b174
lea eax, [ebp - 0x20c]
push eax
push 1
push 9
call fcn.0f02c789
jmp 0xf02b16a
lea eax, [ebp - 0x20c]
push eax
push 1
push 9
call fcn.0f02c789
cmp edi, 0xffffffff
je 0xf02b171
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 8
Function at 0xf02c4e3
Capabilities:
Create thread
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [0xf07de3c], ebx
je 0xf02c513
push 4
pop eax
jmp 0xf02c6cf
mov dword [0xf07de3c], 1
call sym.ntvdm.exe_SuspendTimerThread
mov eax, dword [0xf0ad4b8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x10c], edi
cmp dword [0xf07df54], ebx
je 0xf02c582
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call esi
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x120]
push eax
push 0xf02ba17
call dword [sym.imp.USER32.dll_EnumWindows]
call esi
cmp dword [ebp - 0x120], eax
jne 0xf02c5b2
mov dword [ebp - 0x120], ebx
jmp 0xf02c5b2
mov dword [ebp - 0x120], eax
cmp dword [sym.ntvdm.exe_CurrentMonitorTeb], ebx
je 0xf02c5b2
mov eax, dword fs:[0x18]
cmp dword [sym.ntvdm.exe_CurrentMonitorTeb], eax
je 0xf02c5a6
push dword [0xf0ad4a8]
jmp 0xf02c5ac
push dword [0xf0ad4a4]
push ebx
call fcn.0f030282
cmp dword [ebp - 0x120], ebx
je 0xf02c5d8
lea eax, [ebp - 0x108]
push eax
push 0x103
push 0xd
push dword [ebp - 0x120]
call dword [sym.imp.USER32.dll_DefWindowProcA]
test eax, eax
jne 0xf02c5de
mov byte [ebp - 0x108], bl
test byte [ebp + 0x10], 0x80
je 0xf02c61b
push 5
pop edi
lea eax, [ebp - 0x124]
push eax
push ebx
lea eax, [ebp - 0x11c]
push eax
push fcn.0f02c43b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
jne 0xf02c659
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
dec edi
test eax, eax
jne 0xf02c5e7
lea eax, [ebp - 0x11c]
push eax
call fcn.0f02c43b
call sym.ntvdm.exe_ResumeTimerThread
cmp dword [ebp - 0x118], 1
jne 0xf02c682
cmp dword [0xf07df54], ebx
je 0xf02c67d
mov eax, dword fs:[0x18]
cmp dword [eax + 0xc0], ebx
je 0xf02c67d
mov eax, dword [0xf082de4]
cmp eax, ebx
je 0xf02c67d
push ebx
call eax
jmp 0xf02c682
push 0x3e8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0xf02c674
cmp dword [ebp - 0x118], ebx
je 0xf02c659
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xf02c627
call fcn.0f02d021
dec dword [0xf07de3c]
cmp dword [0xf07df54], ebx
jne 0xf02c6c9
mov eax, dword fs:[0x18]
cmp dword [sym.ntvdm.exe_CurrentMonitorTeb], eax
je 0xf02c6b2
push dword [0xf0ad4a8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0xf0ad4a8]
jmp 0xf02c6c4
push dword [0xf0ad4a4]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [0xf0ad4a4]
call fcn.0f0430f6
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret 0xc
Function at 0xf02c822
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc04
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [0xf0adac4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
shl edx, cl
test eax, edx
jne 0xf02c8f3
push ebx
push esi
push edi
or edx, eax
push edx
push dword [0xf0adac4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, 0x400
push esi
lea eax, [ebp - 0xc04]
push eax
push 0x12c
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
push eax
call ebx
test eax, eax
je 0xf02c8ce
push esi
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp + 8]
add eax, 0x12d
push eax
push 0
call edi
push eax
call ebx
test eax, eax
je 0xf02c8ce
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.0f02bf9a
add esp, 0x10
mov byte [ebp - 5], 0
jmp 0xf02c8e0
push 0xf07dba0
push esi
lea eax, [ebp - 0x404]
push eax
call fcn.0f02ab71
push 0x25
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.0f02c4e3
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0f0057d5
leave
ret 4

Function at 0xf02cf0e
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0xf07df44], esi
jne 0xf02cc28
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push esi
mov dword [0xf07df48], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0xf07df44], eax
pop esi
ret
call fcn.0f03868e
cmp dword [0xf082b84], 0
je 0xf02cf32
mov dword [0xf0ad950], 2
mov dword [0xf082af8], 1
jmp 0xf02cf42
call fcn.0f030596
push dword [0xf0ad9bc]
call fcn.0f032ea4
call fcn.0f030072
push dword [0xf0adc88]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
call fcn.0f029d28
cmp dword [0xf0ad950], 1
jne 0xf02cf65
push 0
jmp 0xf02cf67
push 1
call fcn.0f068b71
jmp 0xf02cc01
Function at 0xf02d2de
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 8
call fcn.0f005706
mov esi, eax
pop ecx
test esi, esi
je 0xf02d346
mov eax, dword [ebp + 0x10]
push edi
push dword [ebp + 0x1c]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push 4
push esi
push 0xf02d271
push dword [ebp + 0xc]
mov dword [esi + 4], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0xf02d33c
mov eax, dword fs:[0x18]
push dword [eax + 0xf18]
push edi
call sym.ntvdm.exe_cpu_createthread
test byte [ebp + 0x18], 4
jne 0xf02d343
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0xf02d343
push esi
call fcn.0f00996a
pop ecx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x18

Function at 0xf02d4bb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
and dword [ebp + 8], 0
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [eax*4 + 0xf0754f4]
mov eax, dword [esi + 0x1e4]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x194]
push edi
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, 0x4000
mov edi, ebx
sub edi, dword [esi + 0x4c]
sub ebx, dword [esi + 0x44]
cmp ebx, edi
jae 0xf02d57b
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 0x40]
add eax, dword [esi + 0x44]
push ebx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0xf02d559
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0xf02d547
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0xf02d559
push 0
lea eax, [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
and dword [ebp + 8], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0xf02d579
add dword [esi + 0x4c], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0xf02d576
and dword [esi + 0x44], 0
sub edi, dword [ebp + 8]
jmp 0xf02d57b
add dword [esi + 0x44], eax
xor edi, edi
test edi, edi
je 0xf02d5ec
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 0x40]
add eax, dword [esi + 0x44]
push edi
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0xf02d5d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0xf02d5c4
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0xf02d5d6
push 0
lea eax, [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
and dword [ebp + 8], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0xf02d5ec
add dword [esi + 0x4c], eax
mov eax, dword [ebp + 8]
add dword [esi + 0x44], eax
mov eax, dword [ebp + 8]
add dword [ebp - 4], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xf02dabf
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax*4 + 0xf0754f4]
push edi
push dword [ebp + 0xc]
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.0f02d6ee
cmp dword [esi + 0x214], edi
je 0xf02db5a
lea ebx, [esi + 0x154]
push ebx
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x138]
lea eax, [esi + 0x70]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0xf02db3b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov dword [ebp - 4], eax
cmp eax, 0x3e5
jne 0xf02db39
push 1
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0xf02db35
call edi
mov dword [ebp - 4], eax
jmp 0xf02db39
and dword [ebp - 4], 0
xor edi, edi
cmp dword [ebp - 4], edi
je 0xf02db4d
push edi
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push dword [ebp + 8]
call fcn.0f01ce6d
jmp 0xf02dc06
mov ecx, dword [esi + 0x190]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ecx
imul eax, eax, 0x14
lea eax, [eax + esi + 0x164]
cmp dword [eax], edi
je 0xf02db9d
add ecx, 0x11
imul ecx, ecx, 0x14
push 1
lea eax, [ebp + 0xc]
push eax
add ecx, esi
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0xf02db96
mov dword [ebp - 4], edi
jmp 0xf02dba6
call ebx
mov dword [ebp - 4], eax
jmp 0xf02dba6
mov ecx, dword [esi + ecx*4 + 0x1e8]
mov dword [eax], ecx
mov eax, dword [esi + 0x190]
add eax, 0x11
imul eax, eax, 0x14
add eax, esi
push eax
lea eax, [ebp + 0xc]
push eax
push dword [esi + 0x138]
lea eax, [esi + 0x70]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0xf02dbf1
call ebx
mov dword [ebp - 4], eax
cmp eax, 0x3e5
jne 0xf02dbe0
xor eax, eax
mov dword [ebp - 4], eax
cmp eax, edi
je 0xf02dbf1
push edi
lea eax, [ebp - 4]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
inc dword [esi + 0x190]
cmp dword [esi + 0x190], 3
jne 0xf02dc06
mov dword [esi + 0x190], edi
mov dword [esi + 0x138], edi
pop edi
pop esi
pop ebx
leave
ret 8