joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100024f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063c15
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
push dword [esi + 0xc]
mov ecx, dword [0x10099dfc]
lea eax, [ebp - 0x14]
push eax
call fcn.1002a4e0
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_bool___thiscall_ScCore::String::operator_class_ScCore::String_const__const]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
test bl, bl
je 0x1000261b
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
push 0
push 1
mov esi, dword [edi]
push 0
push eax
push eax
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x10070958]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
je 0x10002605
push 0
push dword [esi + 0x14]
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_char_const___class_ScCore::Encoder_const__]
push 0x2c
mov dword [ebp - 4], 1
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x100025e4
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc]
mov ecx, eax
push dword [esi + 4]
call fcn.1002a4e0
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
xor esi, esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov ecx, dword [0x10099dfc]
add eax, 0xc
push eax
call fcn.1002a4e0
mov ecx, dword [esi]
push eax
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x10070958]
mov ecx, dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004300
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006408f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x100043cc
je 0x100043c7
cmp eax, 0x80000000
je 0x100043c7
test eax, eax
jne 0x100043d3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
mov eax, dword [0x10099e0c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000437e
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.1002a4e0
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setString_unsigned_short_int_const__]
mov eax, dword [0x10099e0c]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x100043ac
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100043ef
xorps xmm0, xmm0
jmp 0x100043ea
cmp eax, 0x40000000
je 0x100043df
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100043e6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b1f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066c15
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScScript::ScopeInfo.0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_void_]
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::SparseArray::constructor_void_]
mov dword [esi + 0x2c], 0
mov eax, esi
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 4], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0x10000
mov dword [esi + 0x14], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002a4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1002a4ef
pop dword [ebp - 0x10]
mov eax, 0x565a948c
add eax, 0xb9a81063
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xa466a356
add dword [ebp - 0x20], 0xa9eba1f5
mov dword [ebp - 0x1c], 0xe0497527
add dword [ebp - 0x1c], 0x51e9d71e
mov dword [ebp - 0x18], 0x89e36e03
sub dword [ebp - 0x18], 0x3d9729d5
mov dword [ebp - 0x14], 0xf24c3129
sub dword [ebp - 0x14], 0xf24c3129
lea eax, [ebp - 0x20]
push eax
mov eax, 0x1b377519
sub eax, 0xb307515
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x60795c93
sub dword [ebp - 0x20], 0xec06f33d
mov dword [ebp - 0x1c], 0xf28c04d
add dword [ebp - 0x1c], 0x3243a128
mov dword [ebp - 0x18], 0x6f96823
add dword [ebp - 0x18], 0x5c760449
mov dword [ebp - 0x14], 0xa03282eb
sub dword [ebp - 0x14], 0xa03282eb
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x9a0fc0dc
add eax, 0x75f73f2c
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x47153
push 0
call eax
mov ecx, 0x892152ad
add ecx, 0x76def77c
mov edi, eax
mov ebx, 0xd7032c17
sub ebx, 0xc6f88e17
add ebx, dword [ebp - 0x10]
mov edx, 0xe75575b9
sub edx, 0xa382f12c
add dword [ebp - 0xc], 0xd9799969
mov esi, dword [ebx]
xor dword [ebp - 0xc], ecx
add esi, edx
add dword [ebp - 4], ebx
mov dword [edi], esi
sub dword [ebp - 0xc], 0x7079c9b7
add edi, 0x9a69f8fe
add edi, 0x65960706
add ebx, 0xa1d388c0
sub ebx, 0xa1d388bc
loop 0x1002a611
add eax, 0x49640bf
add eax, 0xfb6adab8
mov ebx, eax
add eax, 5
mov ecx, 0x28fe52ba
add ecx, 0xe701ad46
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x33d48cff
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x33d48d59
push edi
mov edi, 0x33e14e88
mov byte [esi + 5], 1
mov eax, edi
jmp 0x33d48d28
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, edi
or ecx, 0xffffffff
lock xadd dword [eax], ecx
xor ecx, ecx
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jne 0x33d48d16
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [esi + 8]
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
call edi
push dword [esi + 0xc]
and dword [esi + 8], 0
call edi
and dword [esi + 0xc], 0
pop edi
pop esi
ret
Function at 0x33d62d2d
Capabilities:
Get file system object information

Disassembly:
push 0x2c4
mov eax, 0x33dd6c0c
call fcn.33dcf80d
mov esi, dword [ebp + 8]
call fcn.33d629f4
mov edi, eax
push esi
add edi, 0x28
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x2c8], eax
jne 0x33d62d66
mov dword [ebp - 0x2c8], 0x33d35420
lea eax, [ebp - 0x2cc]
push eax
push dword [ebp - 0x2c8]
mov ecx, edi
mov dword [ebp - 0x2cc], ebx
call fcn.33da5ee5
test al, al
jne 0x33d62e22
push 0x2b0
lea eax, [ebp - 0x2c0]
push ebx
push eax
mov dword [ebp - 0x2c4], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x410
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push 0x80
push dword [ebp - 0x2c8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x33d62e22
lea eax, [ebp - 0xb0]
push eax
call fcn.33da5ee5
mov esi, eax
inc esi
push esi
lea ecx, [ebp - 0x2d0]
call fcn.33da5ee5
mov dword [ebp - 4], ebx
push esi
mov esi, dword [ebp - 0x2d0]
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.33da5ee5
push 1
push dword [ebp - 0x2c8]
mov ecx, edi
call fcn.33dc8b45
mov dword [eax], esi
mov dword [ebp - 0x2d0], ebx
mov dword [ebp - 0x2cc], esi
or dword [ebp - 4], 0xffffffff
push ebx
call fcn.33da5ee5
mov eax, dword [ebp - 0x2cc]
call fcn.33dcf890
ret 4

Function at 0x33d6b823
Capabilities:
Delete file
Set file attributes

Disassembly:
push 4
mov eax, 0x33dd8a81
call fcn.33dcf7a4
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
mov eax, dword [esi]
push 0x80
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
push dword [esi]
call dword [sym.imp.kernel32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
mov esi, dword [esi]
cmp word [esi], 0
je 0x33d6b863
add esi, 0xfffffff8
push esi
call fcn.33da5ee5
call fcn.33dcf87c
ret

Function at 0x33d6b89d
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x33dd8ac7
call fcn.33dcf7a4
mov esi, ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
push dword [esi]
call dword [sym.imp.kernel32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
mov esi, dword [esi]
cmp word [esi], 0
je 0x33d6b8cf
add esi, 0xfffffff8
push esi
call fcn.33da5ee5
call fcn.33dcf87c
ret
Function at 0x33d73baf
Capabilities:
Get memory capacity

Disassembly:
push 0x38
mov eax, 0x33ddafc9
call fcn.33dcf7a4
mov esi, ecx
lea ecx, [ebp - 0x1c]
call fcn.33d738cc
and dword [ebp - 4], 0
lea ecx, [esi + 0x3c]
call fcn.33d73682
test eax, eax
setg bl
add esi, 0x24
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], eax
call fcn.33da5ee5
lea ecx, [ebp - 0x30]
call fcn.33dc7cf6
test eax, eax
je 0x33d73951
mov esi, dword [eax]
jmp 0x33d73953
xor esi, esi
test esi, esi
je 0x33d7399a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test bl, bl
mov edi, eax
mov eax, dword [esi]
mov ecx, esi
je 0x33d73987
push 0xa
push 8
call dword [eax + 0x14]
push eax
call dword [sym.imp.kernel32.dll_MulDiv]
cmp edi, eax
ja 0x33d7398e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
cmp edi, eax
jae 0x33d73941
jmp 0x33d7398e
call dword [eax + 0xc]
cmp edi, eax
jbe 0x33d73941
lea ecx, [ebp - 0x1c]
call fcn.33dc762d
mov dword [eax], esi
jmp 0x33d73941
cmp dword [ebp - 0x18], 0
je 0x33d739ed
mov eax, dword [ebp - 0x10]
cdq
idiv dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
call fcn.33da5ee5
lea ecx, [ebp - 0x44]
call fcn.33dc7cf6
test eax, eax
je 0x33d739c5
mov esi, dword [eax]
jmp 0x33d739c7
xor esi, esi
test esi, esi
je 0x33d739ed
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov edi, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
add eax, ebx
cmp eax, edi
ja 0x33d739e3
mov eax, edi
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x18]
jmp 0x33d739b5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.33d738ed
call fcn.33dcf87c
ret
push esi
push 2
mov esi, ecx
call fcn.33da5ee5
mov ecx, esi
pop esi
jmp 0x33d7390b
push esi
push 2
mov esi, ecx
call fcn.33da5ee5
test al, al
jne 0x33d73b2d
push 3
mov ecx, esi
call fcn.33da5ee5
test al, al
jne 0x33d73b2d
push 1
mov ecx, esi
call fcn.33da5ee5
test al, al
jne 0x33d73b2d
mov ecx, esi
pop esi
jmp 0x33d7390b
pop esi
ret
push ebx
push esi
mov esi, dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
push edi
mov ebx, ecx
lea edi, [ebx + 0x3c]
push edi
call esi
mov ecx, ebx
call fcn.33da5ee5
push edi
call esi
mov ecx, edi
call fcn.33d73662
test eax, eax
je 0x33d73c05
cmp eax, 0x28
je 0x33d73bfb
cmp eax, 0x41
je 0x33d73bee
cmp eax, 0x5a
jne 0x33d73bf7
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp 0x33d73afd
push 2
mov ecx, ebx
call fcn.33da5ee5
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp 0x33d73aeb
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp 0x33d7390b
Function at 0x33d794d1
Capabilities:
Check os version

Disassembly:
push 0x11c
mov eax, 0x33ddc12b
call fcn.33dcf80d
mov eax, dword [ebp + 8]
test eax, eax
mov esi, ecx
jne 0x33d794fc
push eax
push 0x76757479
call dword [sym.imp.MSO.dll_Ordinal_6848]
push 2
call fcn.33dcca40
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x2c], eax
mov dword [0x33e16774], eax
call dword [sym.imp.MSO.dll_Ordinal_1377]
mov dword [esi + 0x1c], eax
call dword [sym.imp.MSO.dll_Ordinal_1378]
mov dword [esi + 0x20], eax
call dword [sym.imp.MSO.dll_Ordinal_1376]
mov dword [esi + 0x24], eax
call dword [sym.imp.MSO.dll_Ordinal_1709]
push dword [esi + 0x1c]
mov dword [esi + 0x28], eax
call dword [sym.imp.MSO.dll_Ordinal_7927]
test eax, eax
setne al
push 0x110
mov byte [esi + 0x30], al
lea eax, [ebp - 0x120]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.kernel32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 5
jne 0x33d79583
cmp dword [ebp - 0x11c], 0
jne 0x33d79583
xor eax, eax
inc eax
jmp 0x33d79585
xor eax, eax
push 0x26
mov byte [esi + 0x34], al
call fcn.33da5ee5
mov dword [ebp - 0x128], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.33d791a1
or dword [ebp - 4], 0xffffffff
push eax
lea ecx, [esi + 4]
call fcn.33da5ee5
call fcn.33dcf890
ret 8
Function at 0x33d7aa9d
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push 0x448
mov eax, 0x33ddc4bd
call fcn.33dcf80d
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x438], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
mov edi, 0xff
push eax
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x218], 0x100
mov dword [ebp - 0x214], esi
mov word [ebp - 0x210], si
mov dword [ebp - 0x44c], edi
call fcn.33da5ee5
mov byte [ebp - 4], 1
mov eax, dword [eax]
lea ecx, [ebp - 0x44c]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
mov bl, al
neg bl
sbb bl, bl
inc bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x440]
call fcn.33dca5b9
test bl, bl
je 0x33d7ab4a
or dword [ebp - 4], 0xffffffff
push esi
call fcn.33da5ee5
xor eax, eax
call fcn.33dcf890
ret 4
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x424], 0x100
mov dword [ebp - 0x420], esi
mov word [ebp - 0x41c], si
mov dword [ebp - 0x430], edi
call fcn.33da5ee5
mov byte [ebp - 4], 2
mov eax, dword [eax]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea ecx, [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push eax
lea eax, [ebp - 0x434]
push eax
push esi
push dword [ebp - 0x21c]
push esi
call ebx
mov dword [ebp - 0x43c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x448]
call fcn.33dca5b9
cmp dword [ebp - 0x43c], esi
jne 0x33d7abdd
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x33d7ab36
push dword [ebp - 0x434]
call fcn.33da5ee5
push eax
lea ecx, [ebp - 0x438]
call fcn.33da5ee5
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x430], edi
call fcn.33da5ee5
mov byte [ebp - 4], 3
mov eax, dword [eax]
mov edi, dword [ebp - 0x438]
lea ecx, [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push eax
lea eax, [ebp - 0x434]
push eax
push edi
push dword [ebp - 0x21c]
push esi
call ebx
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x448]
call fcn.33dca5b9
cmp ebx, esi
jne 0x33d7ac57
or dword [ebp - 4], 0xffffffff
push edi
jmp 0x33d7ab3b
lea eax, [ebp - 0x42c]
push eax
push edi
mov dword [ebp - 0x42c], esi
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
jne 0x33d7ac80
or dword [ebp - 4], 0xffffffff
push edi
call fcn.33da5ee5
mov eax, esi
jmp 0x33d7ab42
push dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x450]
call fcn.33da5ee5
push dword [ebp - 0x42c]
call dword [sym.imp.kernel32.dll_LocalFree]
xor esi, esi
inc esi
jmp 0x33d7ac6f

Function at 0x33d8175f
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
mov esi, 0x33e131c4
xor edi, edi
xor eax, eax
lea ebx, [edi + 0x33e15c38]
push ebx
push eax
push eax
push dword [esi - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x33d817a1
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x104
lea ecx, [edi + 0x33e15210]
push ecx
push eax
call fcn.33da5ee5
mov dword [esi], 1
add esi, 8
add edi, 0x208
cmp esi, 0x33e131ec
jl 0x33d81769
pop edi
pop esi
pop ebx
ret
Function at 0x33d8f696
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
cmp word [eax], 0
je 0x33d8f6b0
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov ecx, esi
pop esi
jmp fcn.33d5a0f6
pop esi
ret

Function at 0x33d98cc8
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x33de1e7d
call fcn.33dcf7a4
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
call fcn.33d45f0e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edi], ebx
call fcn.33d98604
test al, al
jne 0x33d98d1d
push 0xd4
push 3
push 0x1005c
call fcn.33da5ee5
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 0x80004005
jmp 0x33d98daa
mov esi, dword [ebp + 0xc]
cmp dword [esi + 4], ebx
jne 0x33d98d40
cmp byte [esi + 0xd], bl
jne 0x33d98d40
push ebx
push 0x776d7074
call dword [sym.imp.MSO.dll_Ordinal_6848]
push 0x80004005
call fcn.33dcc9de
push 0x1c
call fcn.33da5ee5
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 1
push esi
mov ecx, eax
call fcn.33d902ab
mov esi, eax
mov byte [ebp - 4], bl
mov dword [ebp + 8], esi
mov byte [ebp - 4], 2
push esi
call fcn.33da5ee5
push dword [esi]
call fcn.33da5ee5
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push 0x33d98c6f
push ebx
push ebx
mov dword [esi], ebx
call dword [sym.imp.kernel32.dll_CreateThread]
cmp eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], eax
mov dword [edi], eax
jne 0x33d98d98
push ebx
push 0x776d7075
jmp 0x33d98d30
mov dword [ebp + 8], ebx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
call fcn.33dcf87c
ret 8

Function at 0x33d9ef27
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x814
mov eax, 0x33de34cc
call fcn.33dcf80d
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
push edi
push edi
push 0x80
push 3
mov dword [ebx], edi
call fcn.33d7adb7
mov ecx, eax
call fcn.33da5ee5
push eax
push 1
push 0x80000000
push esi
call dword [sym.imp.MSO.dll_Ordinal_403]
mov esi, eax
mov dword [ebp - 0x820], esi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x33d9f00e
cmp esi, 0xffffffff
je 0x33d9f00e
mov dword [ebp - 0x81c], edi
xor eax, eax
lea edi, [ebp - 0x818]
stosd dword es:[edi], eax
lea eax, [ebp - 0x81c]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetFileSizeEx]
push 0x7ff
xor edi, edi
lea eax, [ebp - 0x80f]
push edi
push eax
mov byte [ebp - 0x810], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x814]
push eax
push 0x800
lea eax, [ebp - 0x810]
push eax
push esi
mov dword [ebp - 0x814], edi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x33d9efe6
or dword [ebp - 4], 0xffffffff
jmp 0x33d9f016
push dword [ebp - 0x81c]
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.33da5ee5
mov dword [ebx], eax
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x33d9f01f
or dword [ebp - 4], 0xffffffff
cmp esi, edi
je 0x33d9f01d
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
xor al, al
call fcn.33dcf890
ret 8
Function at 0x33d9f3e5
Capabilities:
Copy file

Disassembly:
push 0x20
mov eax, 0x33de35a8
call fcn.33dcf7a4
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
push dword [ebp + 8]
call fcn.33d9f027
test al, al
jne 0x33d9f413
mov eax, 0x80004005
jmp 0x33d9f530
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x33e12d4c]
mov dword [ebp - 0x20], ebx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x28], edi
xor edi, edi
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x1c], si
mov dword [ebp - 0x16], edi
mov dword [ebp - 0x12], edi
mov dword [ebp + 0x14], edi
mov dword [ebp - 4], edi
and si, 0x414
cmp si, 0x414
je 0x33d9f46d
push 0x14
call fcn.33da5ee5
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x2c]
mov ecx, eax
call fcn.33d78767
mov byte [ebp - 4], 0
push eax
lea ecx, [ebp + 0x14]
call fcn.33da5ee5
push dword [ebp - 0x2c]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
push dword [ebp + 0x18]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ebp + 0xb]
inc bl
call fcn.33da5ee5
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test bl, bl
mov esi, eax
je 0x33d9f4a7
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x1a], edi
jne 0x33d9f4d2
cmp esi, edi
jne 0x33d9f4f9
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xb]
call fcn.33d57c47
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x14]
cmp ecx, edi
je 0x33d9f4ce
push 1
call fcn.33da5ee5
xor eax, eax
jmp 0x33d9f530
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xb]
call fcn.33d57c47
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x14]
cmp ecx, edi
je 0x33d9f409
push 1
call fcn.33da5ee5
jmp 0x33d9f409
jle 0x33d9f507
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x33d9f510
mov esi, 0x80004005
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xb]
call fcn.33d57c47
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x14]
cmp ecx, edi
je 0x33d9f52e
push 1
call fcn.33da5ee5
mov eax, esi
call fcn.33dcf87c
ret 0x14