joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406b00
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push ebx
push esi
push edi
lea edi, [ebp - 0x38c]
mov ecx, 0xe3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x244]
push ecx
call fcn.0041cd30
add esp, 8
push 0x429444
lea eax, [ebp - 0x244]
push eax
call fcn.0041cd40
add esp, 8
mov esi, esp
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp esi, esp
call fcn.0041df73
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
je 0x406c34
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x34c]
push ecx
call fcn.0041cd30
add esp, 8
push 0x42d458
lea eax, [ebp - 0x34c]
push eax
call fcn.0041cd40
add esp, 8
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x34c]
push ecx
call fcn.0041cd40
add esp, 8
push 0x429440
lea eax, [ebp - 0x114]
push eax
call fcn.0041df90
add esp, 8
test eax, eax
je 0x406c0f
push 0x42943c
lea eax, [ebp - 0x114]
push eax
call fcn.0041df90
add esp, 8
test eax, eax
je 0x406c0f
mov eax, dword [ebp - 0x140]
and eax, 0x10
test eax, eax
je 0x406c00
lea eax, [ebp - 0x34c]
push eax
call fcn.00406b00
add esp, 4
jmp 0x406c0f
lea eax, [ebp - 0x34c]
push eax
call fcn.00406930
add esp, 4
mov esi, esp
lea eax, [ebp - 0x140]
push eax
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp esi, esp
call fcn.0041df73
test eax, eax
jne 0x406b75
mov esi, esp
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, esp
call fcn.0041df73
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp esi, esp
call fcn.0041df73
pop edi
pop esi
pop ebx
add esp, 0x38c
cmp ebp, esp
call fcn.0041df73
mov esp, ebp
pop ebp
ret
Function at 0x408400
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x40842e
push esi
call fcn.0040b2e8
cmp dword [esi + 0x40], 0
pop ecx
je 0x408427
xor eax, eax
mov dword [esi + 0x10], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4084a0
mov eax, dword [esi + 0x1b0]
cmp dword [eax + 0x10], 0
je 0x408492
mov eax, dword [esi + 8]
test eax, eax
je 0x40844f
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b0]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x40848e
cmp eax, 2
je 0x408492
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x408444
cmp eax, 3
je 0x408473
cmp eax, 1
jne 0x408444
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
cmp dword [eax + 4], ecx
jl 0x408444
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x408444
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x4084be
cmp eax, 0xcc
je 0x4084be
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
push esi
call fcn.004084c7
pop ecx
pop esi
ret
Function at 0x4128db
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x412944
push dword [esi + 8]
lea ecx, [ebp - 8]
call fcn.0041437a
mov ecx, esi
call fcn.0041227f
test al, al
jne 0x41293c
lea ecx, [ebp - 4]
call fcn.0041435b
lea ecx, [ebp - 8]
call fcn.0041478d
push eax
lea eax, [ebp - 4]
push str.There_is_something_wrong_with__s.__It_may_be_an_empty_or_damaged_archive.
push eax
call fcn.004146f8
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.0041478d
push eax
push str.FATAL_ERROR_IN_ZIP
call fcn.00414186
pop ecx
pop ecx
push 0xffffffffffffffff
call fcn.0041e113
lea ecx, [ebp - 8]
call fcn.00414435
pop esi
leave
ret

Function at 0x412d92
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
mov eax, dword [esp + 4]
je 0x412dbe
mov ecx, dword [esp + 8]
push esi
push edi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
mov esi, dword [esi*4 + 0x42f758]
shr eax, 8
xor eax, esi
inc ecx
dec edx
jne 0x412da4
pop edi
pop esi
ret

Function at 0x414ca1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0041cd30
lea eax, [ebp - 0x104]
push eax
call fcn.00414d23
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
jne 0x414d1e
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.0041ce20
test eax, eax
pop ecx
pop ecx
jne 0x414d06
lea eax, [ebp - 0x104]
push 0x2f
push eax
call fcn.0041ce20
test eax, eax
pop ecx
pop ecx
je 0x414d1a
and byte [eax], 0
push 0
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
je 0x414cde
jmp 0x414cb1
xor al, al
jmp 0x414d20
mov al, 1
pop esi
leave
ret

Function at 0x414de9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x414dfb
xor al, al
ret
and eax, 1
dec al
neg al
sbb eax, eax
inc eax
ret

Function at 0x414e06
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x414e2d
and eax, 0xfffffffe
cmp byte [esp + 8], 0
je 0x414e22
or eax, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x41d7ef
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b6f8
push 0x421b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x437540], eax
movzx ecx, ah
mov dword [0x43754c], ecx
and eax, 0xff
mov dword [0x437548], eax
shl eax, 8
add eax, ecx
mov dword [0x437544], eax
movzx eax, word [0x437542]
mov dword [0x437540], eax
push 1
call fcn.0042080a
pop ecx
test eax, eax
jne 0x41d85d
push 0x1c
call fcn.0041d91f
pop ecx
call fcn.00420449
test eax, eax
jne 0x41d86e
push 0x10
call fcn.0041d91f
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00422741
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x438c38], eax
call fcn.0042260f
mov dword [0x437530], eax
call fcn.004223ca
call fcn.00422311
call fcn.0041e0e6
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004222b3
mov dword [ebp - 0x60], eax
test byte [ebp - 0x30], 1
je 0x41d8bd
movzx eax, word [ebp - 0x2c]
jmp 0x41d8c0
push 0xa
pop eax
push eax
push dword [ebp - 0x60]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x64], eax
push eax
call fcn.0041e113
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.0042213f
pop ecx
pop ecx
ret

Function at 0x41e135
Capabilities:
Terminate process

Disassembly:
push edi
call fcn.0041e1d9
xor edi, edi
inc edi
cmp dword [0x43757c], edi
jne 0x41e157
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0xc], 0
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x437578], edi
mov byte [0x437574], bl
jne 0x41e1ab
mov eax, dword [0x438c34]
push esi
test eax, eax
je 0x41e199
mov ecx, dword [0x438c30]
lea esi, [ecx - 4]
cmp esi, eax
jb 0x41e199
mov eax, dword [esi]
test eax, eax
je 0x41e18e
call eax
sub esi, 4
cmp esi, dword [0x438c34]
jae 0x41e186
push 0x42d094
push 0x42d08c
call fcn.0041e1eb
pop ecx
pop ecx
pop esi
push 0x42d09c
push 0x42d098
call fcn.0041e1eb
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x41e1c7
pop edi
jmp fcn.0041e1e2
push dword [esp + 8]
mov dword [0x43757c], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4204d3
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x431ed0]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x420530
push 0x74
push 1
call fcn.0041ef03
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x420528
push esi
push dword [0x431ed0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x420528
push esi
call fcn.004204c0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x420530
push 0x10
call fcn.0041d8fa
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret

Function at 0x422935
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, dword [eax*8 + 0x434300]
je 0x422952
inc eax
cmp eax, 0x12
jb 0x422943
push esi
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x434300]
jne 0x422a80
mov eax, dword [0x437538]
cmp eax, 1
je 0x422a5a
test eax, eax
jne 0x422983
cmp dword [0x431ad4], 1
je 0x422a5a
cmp ecx, 0xfc
je 0x422a80
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4229ba
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041cd30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041ccb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4229fd
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041ccb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42b708
push edi
call fcn.0041d260
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041cd30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041cd40
lea eax, [ebp - 0xa0]
push 0x42b704
push eax
call fcn.0041cd40
push dword [esi + 0x434304]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041cd40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00422cff
add esp, 0x2c
pop edi
jmp 0x422a80
lea eax, [ebp + 8]
lea esi, [esi + 0x434304]
push 0
push eax
push dword [esi]
call fcn.0041ccb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4230ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x423290
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x437ae0]
shl esi, 2
mov eax, dword [edi]
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x423290
test cl, 0x48
je 0x423130
mov al, byte [eax + 5]
cmp al, 0xa
je 0x423130
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [edi]
push dword [ebp + 0x10]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x423182
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x42316a
call fcn.0041e7ca
mov dword [eax], 9
call fcn.0041e7d3
mov dword [eax], esi
jmp 0x42317a
cmp eax, 0x6d
je 0x423290
push eax
call fcn.0041e75c
pop ecx
or eax, 0xffffffff
jmp 0x423292
mov eax, dword [edi]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
lea ecx, [eax + esi + 4]
mov al, byte [ecx]
test al, al
jns 0x42328b
test edx, edx
je 0x4231a5
cmp byte [ebx], 0xa
jne 0x4231a5
or al, 4
jmp 0x4231a7
and al, 0xfb
mov byte [ecx], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp + 0x10], eax
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], ecx
jae 0x423285
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x423275
cmp al, 0xd
je 0x4231db
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x423267
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x4231f5
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x4231f0
add dword [ebp + 0x10], 2
jmp 0x423249
mov dword [ebp + 0x10], eax
jmp 0x423263
lea eax, [ebp - 0xc]
push 0
push eax
inc dword [ebp + 0x10]
lea eax, [ebp - 1]
push 1
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42321d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x423263
cmp dword [ebp - 0xc], 0
je 0x423263
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x42323e
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x423249
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x423266
cmp ebx, dword [ebp + 0xc]
jne 0x42324e
cmp byte [ebp - 1], 0xa
jne 0x42324e
mov byte [ebx], 0xa
jmp 0x423266
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00422f18
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x423267
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x4231bf
jmp 0x423285
mov eax, dword [edi]
lea esi, [eax + esi + 4]
mov al, byte [esi]
test al, 0x40
jne 0x423285
or al, 2
mov byte [esi], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x423292
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424619
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
jne 0x424639
xor eax, eax
jmp 0x4247a2
mov eax, dword [ebp + 8]
sar eax, 5
lea ebx, [eax*4 + 0x437ae0]
mov eax, dword [ebp + 8]
and eax, 0x1f
lea esi, [eax + eax*8]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x424669
push 2
push edi
push dword [ebp + 8]
call fcn.00422f18
add esp, 0xc
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x42473b
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], eax
mov dword [ebp + 8], edi
jbe 0x424776
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x418]
sub ecx, dword [ebp + 0xc]
mov dword [ebp - 4], edi
cmp ecx, dword [ebp + 0x10]
jae 0x4246c4
mov edx, dword [ebp - 8]
inc dword [ebp - 8]
inc ecx
mov dl, byte [edx]
cmp dl, 0xa
jne 0x4246b5
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 4]
mov byte [eax], dl
inc eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x400
jl 0x424698
mov edi, eax
lea eax, [ebp - 0x418]
sub edi, eax
lea eax, [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0x418]
push edi
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424704
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp eax, edi
jl 0x42470d
mov eax, dword [ebp - 8]
xor edi, edi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jb 0x424689
jmp 0x42470f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x42479f
cmp dword [ebp + 8], edi
je 0x424776
push 5
pop esi
cmp dword [ebp + 8], esi
jne 0x424768
call fcn.0041e7ca
mov dword [eax], 9
call fcn.0041e7d3
mov dword [eax], esi
jmp 0x424771
lea ecx, [ebp - 0x14]
push edi
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42475d
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], edi
mov dword [ebp - 0xc], eax
jmp 0x42470f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x42470f
push dword [ebp + 8]
call fcn.0041e75c
pop ecx
or eax, 0xffffffff
jmp 0x4247a2
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x42478b
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x424632
call fcn.0041e7ca
mov dword [eax], 0x1c
call fcn.0041e7d3
mov dword [eax], edi
jmp 0x424771
sub eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x425c31
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
push edi
xor edi, edi
push edi
push 0x80
push 4
push edi
push 3
push 0x1f03ff
push str.C:_Program_Files_Gold_Miner_crtlog.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, edi
je 0x425caf
push 2
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x804]
push dword [ebp + 8]
push eax
call fcn.0041ed01
add esp, 0xc
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret

Function at 0x425cb3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov ebx, eax
push esi
push 0x80
push 4
push esi
push 3
push 0x1f03ff
push str.C:_Program_Files_Gold_Miner_crtlog.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push esi
lea eax, [ebp - 4]
push esi
push eax
push 0x400
push ebx
push esi
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 4]
lea eax, [ebp - 0x808]
push ebx
push str.Win32__d:__s_r_n
push eax
call fcn.0041cec8
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, esi
je 0x425d5d
push 2
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x808]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10733c8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10733d2
pushal
call 0x10733d8
pop ebp
sub ebp, 0x10
sub ebp, 0xc733c8
jmp 0x10733ee
mov eax, 0xc733c8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d1
mov edx, 0xa0bbf851
xor byte [eax], dl
inc eax
dec ecx
jne 0x1073405
jmp 0x1073418
ficomp dword [edx + ebx*8 + 0x51516dd8]
push ecx
rcl byte [eax + 0x515151a9]
push edx
pushfd
jmp 0x52588586
Function at 0x100023c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x100023db

Function at 0x1000574d
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x10005767
Function at 0x10009695
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x100096ae
mov eax, dword [ebp - 4]
add eax, 0x13
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 0x545
cmp dword [ebp - 4], eax
ja 0x1000978a
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1930
ja 0x10009701
cmp dword [ebp - 8], 0x1930
je 0x10009772
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x18e4
je 0x10009731
sub dword [ebp - 0xc], 0x13
je 0x1000972c
sub dword [ebp - 0xc], 0x13
je 0x10009724
sub dword [ebp - 0xc], 0x13
je 0x10009778
jmp 0x10009785
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
sub dword [ebp - 0x10], 0x516a
je 0x10009768
sub dword [ebp - 0x10], 0x13
je 0x10009754
sub dword [ebp - 0x10], 0x13
je 0x1000974e
sub dword [ebp - 0x10], 0x13
je 0x10009763
jmp 0x10009785
mov ecx, dword [ebp + 8]
add edx, 8
jmp 0x10009785
pop edi
mov edx, dword [esi]
jmp 0x10009785
or dword [edx + 0x69], eax
sbb dh, bh
push esi
push edi
push dword [0x1005d798]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 7
lea esi, [eax + 0x9128]
jmp 0x10009785
mov eax, esi
pop esi
pop ebp
jmp 0x10009785
test byte [ebp + 8], 1
je 0x1000974e
push esi
call fcn.100095ea
pop ecx
jmp 0x10009785
ret 4
push esi
mov esi, ecx
call fcn.100328c5
jmp 0x10009785
pop ebp
ret 4
call fcn.10036ab6
add esi, 4
dec edi
jne 0x10009736
pop edi
pop esi
jmp 0x100096a5
pop edi
pop esi
leave
ret

Function at 0x100121e2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
jmp 0x100121fe
Function at 0x10016de3
Capabilities:
Get common file path
Set current directory
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb58
mov eax, dword [ebp + 0xc]
lea edx, [eax + 0xfbe]
mov ecx, eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x88], edx
cmp eax, edx
ja 0x1001788f
push edi
push 0x41
pop edx
push ebx
xor edi, edi
push esi
Function at 0x10028b28
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x10028b42
mov eax, dword [ebp - 8]
add eax, 0x2e
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
add eax, 0x10e4
cmp dword [ebp - 8], eax
ja 0x10028cc9
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2274
ja 0x10028baf
cmp dword [ebp - 0xc], 0x2274
je 0x10028c6a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
sub dword [ebp - 0x10], 0x218e
je 0x10028c94
sub dword [ebp - 0x10], 0x2e
je 0x10028cbe
sub dword [ebp - 0x10], 0x2e
je 0x10028c47
sub dword [ebp - 0x10], 0x2e
je 0x10028c5a
sub dword [ebp - 0x10], 0x2e
je 0x10028c86
jmp 0x10028cc4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], 0x22a2
je 0x10028c81
sub dword [ebp - 0x14], 0x5160
je 0x10028be0
sub dword [ebp - 0x14], 0x2e
je 0x10028caa
sub dword [ebp - 0x14], 0x2e
je 0x10028c1d
jmp 0x10028cc4
push 0x74
pop eax
mov word [0x1005db5c], ax
mov eax, 0x6568
mov word [0x1005db5d], ax
push 0x6d
pop eax
mov word [0x1005db5f], ax
push 0x63
pop eax
mov word [0x1005db60], ax
push 0x74
pop eax
mov word [0x1005db61], ax
push 0x72
pop eax
mov word [0x1005db62], ax
jmp 0x10028cc4
push 0x64
pop eax
mov word [0x1005db65], ax
mov eax, 0x6c6c
mov word [0x1005db66], ax
mov byte [0x1005db68], 0
mov dword [ebp - 4], 0x1005db5c
mov eax, dword [ebp - 4]
jmp 0x10028ccc
je 0x10028c1d
push ecx
mov bl, byte [edi + 0x14]
mov eax, dword [edi + 0x10]
call fcn.10027e1b
mov eax, dword [edi + 8]
jmp 0x10028cc4
add eax, dword [0x1005c874]
mov dword [0x1005c87c], eax
mov ecx, dword [edi + 4]
jmp 0x10028cc4
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 4]
mov ecx, dword [edi + 0xc]
mov edi, dword [0x1005c884]
call fcn.1003255f
pop ecx
jmp 0x10028cc4
jmp 0x10028caa
push edi
push esi
call fcn.100046d7
pop esi
pop edi
mov bl, byte [edi + 0x14]
jmp 0x10028cc4
mov dword [0x1005c86c], edi
mov edi, eax
call fcn.1002ff66
mov ecx, dword [edi + 0x13]
jecxz 0x10028cf0
mov edi, ecx
jmp 0x10028cc4
push 0x6c
pop eax
mov word [0x1005db63], ax
push 0x2e
pop eax
mov word [0x1005db64], ax
jmp 0x10028cc4
mov ecx, dword [edi]
cmp byte [edi + 0x15], 0
jmp 0x10028b39
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
or byte [0xd71], al

Function at 0x10028cd1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
jmp 0x10028cee
Function at 0x100291dc
Capabilities:
Get file size

Disassembly:
into
test al, 0
add byte [ecx + 0x59], bl
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x10029224
mov eax, dword [ebp - 8]
mov dword [ebp - 0x98], eax
push dword [ebp - 0x98]
call fcn.100351b3
pop ecx
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
jmp 0x1002939f
push 0x4930
push 0
call fcn.1000978e
pop ecx
pop ecx
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xc0], eax
push 0x966
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xb8]
call fcn.10005f96
add esp, 0xc
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 4], eax
jmp 0x10029397
jmp fcn.10028ce5
pop edi
pop esi
pop ebx
leave
ret