joyce8/EMBER2024-capa huggingface dataset:
Function at 0x76f01bf3
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x76f11248]
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], ebx
je 0x76f01c26
mov eax, dword [edi + 0x14]
jmp 0x76f01c29
mov eax, dword [edi + 0x18]
cmp eax, ebx
mov dword [ebp - 0x10c], eax
je 0x76f01d5b
mov dword [ebp - 0x110], ebx
push esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x110]
mov dword [ebp - 0x11c], 0x103
push dword [0x76f11f48]
call dword [sym.imp._CADVAPI.DLL_RegEnumKeyExA]
cmp eax, ebx
jne 0x76f01d5a
push dword [edi + 0xc]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp._Cmvrt.DLL__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x76f01c92
inc dword [ebp - 0x110]
jmp 0x76f01c3e
lea eax, [ebp - 0x108]
push eax
call fcn.76f0152e
mov esi, eax
cmp esi, ebx
je 0x76f01c8a
push dword [edi + 0x10]
push dword [esi + 0x10]
call fcn.76ef4b04
test eax, eax
je 0x76f01d4f
push dword [ebp - 0x10c]
push dword [esi + 0x18]
call fcn.76ef4b04
test eax, eax
jne 0x76f01cdb
push dword [ebp - 0x10c]
push dword [esi + 0x14]
call fcn.76ef4b04
test eax, eax
je 0x76f01d4f
push dword [ebp - 0x10c]
xor ebx, ebx
push dword [esi + 0x18]
inc ebx
call fcn.76ef4b04
test eax, eax
je 0x76f01cf2
xor ebx, ebx
push dword [esi + 0x2c]
push dword [edi + 0x2c]
push dword [ebp - 0x10c]
call fcn.76f056cf
test eax, eax
je 0x76f01d4d
push ebx
push esi
call fcn.76f00b2e
test eax, eax
je 0x76f01d4d
push eax
push dword [ebp - 0x118]
call fcn.76ef4896
cmp dword [ebp - 0x114], 0
mov dword [ebp - 0x118], eax
je 0x76f01d4d
mov eax, dword [ebp - 0x114]
cmp dword [eax], 0
jne 0x76f01d4d
cmp dword [edi + 0x60], 0
jne 0x76f01d4d
mov eax, dword [esi + 0x30]
test eax, eax
je 0x76f01d4d
mov ecx, dword [ebp - 0x114]
mov dword [ecx], eax
xor ebx, ebx
push esi
call fcn.76f002e8
jmp 0x76f01c8a
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x118]
pop edi
pop ebx
call fcn.76ef2630
leave
ret 0xc
Function at 0x76f0290e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x76f029b0
push 0x76ef90a0
call fcn.76ef90b2
pop ecx
pop ecx
mov ebx, 0x76f11d00
push ebx
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
xor edi, edi
cmp dword [0x76f12f18], edi
je 0x76f02955
push ebx
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push dword [0x76f110a8]
call dword [sym.imp._CKERNEL.DLL_PulseEvent]
xor eax, eax
jmp 0x76f029ab
push esi
push dword [0x76f110ac]
mov esi, dword [sym.imp._CKERNEL.DLL_ResetEvent]
mov dword [ebp - 4], edi
mov dword [0x76f110a4], edi
mov dword [0x76f12f14], edi
call esi
push dword [0x76f110b0]
call esi
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x76f0265c
push edi
push edi
call dword [sym.imp._CKERNEL.DLL_CreateThread]
cmp eax, edi
mov dword [0x76f12f18], eax
pop esi
jne 0x76f029a1
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x76f043ae
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x76efe8d8
call fcn.76efa1be
xor esi, esi
push esi
push esi
push 1
push esi
mov dword [0x76f12f34], esi
call dword [sym.imp._CKERNEL.DLL_CreateEventA]
cmp eax, esi
mov dword [0x76f12f20], eax
mov edi, 0x76f11ce0
je 0x76f044af
push esi
push 0xffff
push esi
push esi
call dword [sym.imp._CKERNEL.DLL_CreateSemaphoreA]
cmp eax, esi
mov dword [0x76f12f24], eax
je 0x76f044af
mov ecx, dword [0x76f12f20]
mov dword [0x76f12f28], ecx
mov dword [0x76f12f2c], eax
call fcn.76f0bea7
push 0x76f12f3c
push 0x76f12f38
call fcn.76f06cf9
mov ebx, eax
cmp ebx, esi
je 0x76f0443a
mov dword [0x76f12f38], esi
mov dword [0x76f12f3c], esi
jmp 0x76f044b7
push edi
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
push edi
mov dword [0x76f12f44], esi
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x76f04493
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call fcn.76f0d6e1
cmp eax, esi
mov dword [0x76f12f48], eax
jne 0x76f04470
push 0xe
pop ebx
jmp 0x76f044c3
push esi
call fcn.76ef7369
test eax, eax
jne 0x76f0448c
push dword [0x76f12f48]
push esi
call fcn.76f0b16b
mov ebx, eax
cmp ebx, esi
je 0x76f04493
mov ebx, 0x558
jmp 0x76f04506
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x76f042bb
push esi
push esi
call dword [sym.imp._CKERNEL.DLL_CreateThread]
cmp eax, esi
mov dword [0x76f12f30], eax
jne 0x76f044b7
call dword [sym.imp._CKERNEL.DLL_GetLastError]
mov ebx, eax
cmp ebx, esi
je 0x76f04506
cmp ebx, 0x558
je 0x76f04506
mov eax, dword [0x76f12f38]
cmp eax, esi
je 0x76f044d8
push eax
call fcn.76f06e91
mov dword [0x76f12f38], esi
mov eax, dword [0x76f12f3c]
cmp eax, esi
je 0x76f044ed
push eax
call fcn.76f06e91
mov dword [0x76f12f3c], esi
push edi
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
push edi
mov dword [0x76f12f44], esi
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
call fcn.76f0434e
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x76f04ade
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp dword [0x76f12f54], 5
mov dword [ebp - 4], edi
jbe 0x76f04b11
call fcn.76ef369a
mov ecx, dword [0x76f12f50]
add ecx, 0x708
cmp ecx, eax
ja 0x76f04b6d
mov dword [0x76f12f54], edi
push esi
push 0x76f04b74
push edi
call dword [sym.imp._CADVAPI.DLL_RegisterEventSourceW]
mov esi, eax
cmp esi, edi
je 0x76f04b6c
cmp dword [ebp + 0x18], edi
je 0x76f04b33
mov dword [ebp - 4], 4
lea ebx, [ebp + 0x18]
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp._CADVAPI.DLL_ReportEventA]
push esi
call dword [sym.imp._CADVAPI.DLL_DeregisterEventSource]
inc dword [0x76f12f54]
cmp dword [0x76f12f54], 5
jb 0x76f04b6c
call fcn.76ef369a
mov dword [0x76f12f50], eax
pop esi
pop edi
pop ebx
leave
ret 0x14

Function at 0x76f0696c
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
cmp eax, 1
mov dword [ebp - 4], esi
mov dword [edi + 0x10], eax
jne 0x76f06990
mov dword [edi + 0x30], esi
jmp 0x76f069f1
cmp eax, 3
je 0x76f0699a
cmp eax, 2
jne 0x76f069f1
mov eax, dword [edi]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x76f069a7
push 0x57
jmp 0x76f069c8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x76f069aa
sub eax, edx
movzx esi, ax
lea eax, [esi + esi + 2]
push eax
call fcn.76ef3674
mov ebx, eax
test ebx, ebx
jne 0x76f069cb
push 0xe
pop eax
jmp 0x76f06a32
push 1
push dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push esi
push 0
push ebx
call fcn.76ef26ec
test eax, eax
jne 0x76f069ea
mov dword [ebp - 4], 0x7b
jmp 0x76f06a13
mov dword [edi + 0x30], esi
mov dword [edi], ebx
xor esi, esi
cmp dword [edi + 0x24], esi
je 0x76f06a2c
lea eax, [ebp - 8]
push eax
push esi
push edi
push fcn.76f06832
push esi
push esi
call dword [sym.imp._CKERNEL.DLL_CreateThread]
cmp eax, esi
jne 0x76f06a1e
call dword [sym.imp._CKERNEL.DLL_GetLastError]
push ebx
call fcn.76ef264e
mov eax, dword [ebp - 4]
jmp 0x76f06a32
push eax
call dword [sym.imp._CKERNEL.DLL_CloseHandle]
mov eax, 0x3e5
jmp 0x76f06a32
push edi
call fcn.76f06832
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x76f0782e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
cmp edi, 0x3f
jbe 0x76f07848
xor eax, eax
jmp 0x76f078cc
mov eax, dword [ebp + 0xc]
and dword [eax + 4], 0
push esi
push 0x410
mov dword [eax], edi
call fcn.76ef3674
mov esi, eax
test esi, esi
je 0x76f078cb
push ebx
mov ebx, dword [sym.imp._Cmvrt.DLL_wcscpy]
push 0x76f078d4
push esi
call ebx
lea eax, [edi + edi*2]
push dword [eax*4 + 0x76f11860]
lea eax, [esi + 6]
push eax
call ebx
add esp, 0x10
mov edi, 0x104
push edi
lea ebx, [esi + 0x208]
push ebx
push esi
call dword [sym.imp._CKERNEL.DLL_GetEnvironmentVariableW]
test eax, eax
je 0x76f078b9
cmp eax, edi
jae 0x76f078b9
push 0xa
push 0
push ebx
call dword [sym.imp._Cmvrt.DLL_wcstoul]
mov ecx, dword [ebp + 0xc]
xor edi, edi
add esp, 0xc
mov dword [ecx + 4], eax
inc edi
jmp 0x76f078bc
mov edi, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
push esi
mov dword [eax + 8], edi
call fcn.76ef264e
mov eax, edi
pop ebx
pop esi
pop edi
leave
ret 8

Function at 0x76f09cc7
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x76f13184
push esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
cmp dword [0x76f1319c], ebx
jne 0x76f09d29
push 0xf0000000
xor edi, edi
inc edi
push edi
push 0x76f09d70
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp._CADVAPI.DLL_CryptAcquireContextA]
test eax, eax
jne 0x76f09d0d
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
mov dword [0x76f13180], eax
call dword [sym.imp._CKERNEL.DLL_GetTickCount]
push eax
call dword [sym.imp._Cmvrt.DLL_srand]
pop ecx
mov dword [0x76f1319c], edi
push esi
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
mov eax, dword [0x76f13180]
cmp eax, ebx
je 0x76f09d46
lea ecx, [ebp - 8]
push ecx
push 2
push eax
call dword [sym.imp._CADVAPI.DLL_CryptGenRandom]
mov esi, dword [ebp - 8]
cmp si, bx
jne 0x76f09d67
mov edi, dword [sym.imp._Cmvrt.DLL_rand]
call edi
mov esi, eax
shl esi, 0xf
call edi
or esi, eax
cmp si, bx
mov dword [ebp - 8], esi
je 0x76f09d54
pop edi
mov ax, si
pop esi
pop ebx
leave
ret
Function at 0x401060
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x40]
mov dword [esp], eax
call sym._I_RpcFree_4
mov eax, dword [ebx + 0x44]
sub esp, 4
mov dword [esp], eax
call sym._I_RpcFree_4
mov eax, dword [ebx + 0x48]
sub esp, 4
mov dword [esp], eax
call sym._I_RpcFree_4
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov dword [edx + 4], eax
mov edx, dword [ebx]
sub esp, 4
mov dword [eax], edx
xor edx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret
Function at 0x4027ca
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 8]
test byte [0x4090c0], 8
mov esi, dword [ecx + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1c], eax
jne 0x402918
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov dword [esp], 0x4090a0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [0x4090b8]
sub esp, 4
cmp ebx, 0x4090b8
je 0x4028f0
mov edi, dword [esi]
add esi, 4
jmp 0x402836
mov ebx, dword [ebx]
cmp ebx, 0x4090b8
je 0x4028f0
mov eax, dword [ebx + 0x10]
cmp dword [eax], edi
jne 0x402828
mov dword [esp + 8], edi
add eax, 4
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._memcmp
test eax, eax
jne 0x402828
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 8]
mov ecx, dword fs:[0x18]
mov eax, dword [eax]
add eax, 4
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x20]
mov dword [edx], eax
sub esp, 0xc
test eax, eax
je 0x402948
mov ecx, dword [ebx + 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [edx]
mov edx, dword [ebx + 8]
mov ecx, dword [eax]
lea edi, [eax + 4]
mov dword [ebp - 0x28], edx
lea esi, [edx + 4]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
cmp ecx, 8
jae 0x402952
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov dword [esp], 0x4090a0
mov dword [ebp - 0x1c], edx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x1c]
mov eax, edx
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp], 0x4090a0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov edx, 0x800401e3
mov eax, edx
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov edx, 0x40a24b
mov ecx, str.IrotGetObject
mov dword [esp + 0x10], esi
mov ebx, 0x4090c0
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x4027f0
mov edx, 0x8007000e
jmp 0x4028c2
test edi, 1
jne 0x402995
test edi, 2
jne 0x402982
test edi, 4
je 0x4028b5
mov eax, dword [esi]
add edi, 4
add esi, 4
mov dword [edi - 4], eax
sub dword [ebp - 0x20], 4
jmp 0x4028b5
movzx eax, word [esi]
add edi, 2
add esi, 2
mov word [edi - 2], ax
sub dword [ebp - 0x20], 2
jmp 0x402962
movzx ecx, byte [esi]
lea edi, [eax + 5]
mov byte [eax + 4], cl
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x20]
lea esi, [eax + 5]
jmp 0x40295a
Function at 0x402e4a
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, dword [ecx]
mov dword [esp], 0x4090a0
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
sub esp, 4
mov dword [edx + 4], eax
mov edx, dword [ebx]
mov dword [eax], edx
mov dword [esp], 0x4090a0
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
lock dec dword [ebx + 0x20]
je 0x402ea8
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 4
mov eax, dword [ebx + 8]
mov edi, dword fs:[0x18]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0xc]
xor edx, edx
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x10]
xor ecx, ecx
sub esp, 0xc
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x402e90

Function at 0x402f30
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, dword fs:[0x18]
push ebp
mov ebp, esp
push ecx
sub esp, 0x14
mov edx, dword [ecx]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
sub esp, 0xc
leave
lea esp, [ecx - 4]
ret 4

Function at 0x402fb0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov edx, dword [ebx]
mov dword [ebp - 4], edi
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [eax + 4]
mov edi, dword fs:[0x18]
mov dword [edx + 4], eax
mov edx, dword [ebx]
mov dword [eax], edx
mov eax, dword [ebx + 0x1c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor edx, edx
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
sub esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x403540
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, ecx
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 8
push ecx
sub esp, 0x28
mov ecx, dword [ecx + 4]
mov esi, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, 0x24
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
mov esi, dword fs:[0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
je 0x4036db
mov ecx, dword [ebp - 0x24]
mov ebx, eax
test byte [ebp - 0x1c], 3
mov edx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [ebp - 0x1c], edx
mov dword [ebx + 8], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ecx + 0xc]
sete cl
mov dword [ebx + 0x14], eax
movzx eax, byte [ebx + 0x20]
and al, 0xfe
or al, cl
mov byte [ebx + 0x20], al
mov eax, dword [edx]
xor edx, edx
mov dword [esp + 4], edx
add eax, 4
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x1c]
mov dword [ebx + 0x1c], eax
sub esp, 0xc
test eax, eax
je 0x4036e2
mov ecx, dword [edx]
lea esi, [edx + 4]
mov dword [eax], ecx
cmp ecx, 8
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebx + 0x1c]
lea edi, [eax + 4]
jae 0x403680
mov ecx, dword [ebp - 0x1c]
mov eax, 1
rep movsb byte es:[edi], byte [esi]
lock xadd dword [0x40d004], eax
mov edi, dword [ebp - 0x28]
inc eax
mov dword [ebx + 0x18], eax
mov dword [edi], eax
mov dword [esp], 0x40917c
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx], 0x409174
mov eax, dword [0x409178]
mov dword [ebx + 4], eax
sub esp, 4
mov dword [eax], ebx
mov dword [esp], 0x40917c
mov dword [0x409178], ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
test edi, 1
jne 0x4036b0
test edi, 2
jne 0x4036c8
test edi, 4
je 0x403617
mov eax, dword [esi]
add edi, 4
add esi, 4
mov dword [edi - 4], eax
sub dword [ebp - 0x1c], 4
jmp 0x403617
movzx ecx, byte [edx + 4]
lea edi, [eax + 5]
lea esi, [edx + 5]
mov byte [eax + 4], cl
dec dword [ebp - 0x1c]
jmp 0x403688
movzx eax, word [esi]
add edi, 2
add esi, 2
mov word [edi - 2], ax
sub dword [ebp - 0x1c], 2
jmp 0x403690
mov eax, 0x8007000e
jmp 0x40366a
mov dword [esp + 8], ebx
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 0x8007000e
sub esp, 0xc
jmp 0x40366a
Function at 0x40354c
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, ecx
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 8
push ecx
sub esp, 0x28
mov ecx, dword [ecx + 4]
mov esi, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, 0x24
mov edi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
mov esi, dword fs:[0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
je 0x4036db
mov ecx, dword [ebp - 0x24]
mov ebx, eax
test byte [ebp - 0x1c], 3
mov edx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [ebp - 0x1c], edx
mov dword [ebx + 8], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ecx + 0xc]
sete cl
mov dword [ebx + 0x14], eax
movzx eax, byte [ebx + 0x20]
and al, 0xfe
or al, cl
mov byte [ebx + 0x20], al
mov eax, dword [edx]
xor edx, edx
mov dword [esp + 4], edx
add eax, 4
mov dword [esp + 8], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x1c]
mov dword [ebx + 0x1c], eax
sub esp, 0xc
test eax, eax
je 0x4036e2
mov ecx, dword [edx]
lea esi, [edx + 4]
mov dword [eax], ecx
cmp ecx, 8
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebx + 0x1c]
lea edi, [eax + 4]
jae 0x403680
mov ecx, dword [ebp - 0x1c]
mov eax, 1
rep movsb byte es:[edi], byte [esi]
lock xadd dword [0x40d004], eax
mov edi, dword [ebp - 0x28]
inc eax
mov dword [ebx + 0x18], eax
mov dword [edi], eax
mov dword [esp], 0x40917c
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx], 0x409174
mov eax, dword [0x409178]
mov dword [ebx + 4], eax
sub esp, 4
mov dword [eax], ebx
mov dword [esp], 0x40917c
mov dword [0x409178], ebx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor eax, eax
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
test edi, 1
jne 0x4036b0
test edi, 2
jne 0x4036c8
test edi, 4
je 0x403617
mov eax, dword [esi]
add edi, 4
add esi, 4
mov dword [edi - 4], eax
sub dword [ebp - 0x1c], 4
jmp 0x403617
movzx ecx, byte [edx + 4]
lea edi, [eax + 5]
lea esi, [edx + 5]
mov byte [eax + 4], cl
dec dword [ebp - 0x1c]
jmp 0x403688
movzx eax, word [esi]
add edi, 2
add esi, 2
mov word [edi - 2], ax
sub dword [ebp - 0x1c], 2
jmp 0x403690
mov eax, 0x8007000e
jmp 0x40366a
mov dword [esp + 8], ebx
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, 0x8007000e
sub esp, 0xc
jmp 0x40366a
Function at 0x407a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x407a90
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x407a88
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x40d0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x407a4d
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret