joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10073542
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10096847
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x100ae210]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
push 0x1000c9f4
lea eax, [esp + 0x14]
push eax
call fcn.1005833e
and dword [esp + 0x58], 0
lea eax, [esp + 0x10]
push eax
push 0x100173dc
mov eax, 0x246c
call fcn.10082130
mov edi, esp
lea esi, [ebx + 0x10]
mov dword [esp + 0x2490], esp
call fcn.10077630
lea edi, [esp + 0x2490]
call fcn.1002c2a5
push 0x10016a98
lea ecx, [esp + 0x24]
push ecx
mov edi, eax
mov byte [esp + 0x68], 1
call fcn.10058cd5
lea ecx, [esp + 0x1c]
push ecx
mov edi, eax
mov byte [esp + 0x64], 2
call fcn.10058c7a
mov byte [esp + 0x5c], 3
push dword [eax]
mov edi, dword [ebx + 8]
push 0x1000ca50
lea eax, [esp + 0x30]
push eax
call fcn.1002391d
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
mov byte [esp + 0x58], 7
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.10078f0e
mov eax, dword [ebx + 0x2480]
mov ebx, dword [ebx + 0xc]
push 0xe
push 4
push 2
push eax
call fcn.1006adda
mov esi, dword [esp + 0x20]
mov eax, dword [ebp + 8]
lea ecx, [esi - 8]
mov dword [esi + 0x2488], eax
call fcn.1007504b
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x100736b1
mov ebx, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x1007367b
cmp eax, 0xffffffff
je 0x10073679
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
xor eax, eax
push eax
push eax
push eax
lea eax, [esp + 0x3c]
push eax
call ebx
test eax, eax
jne 0x1007365e
lea eax, [esi + 0x24c0]
call fcn.10051ee8
cmp byte [esi + 4], 0
je 0x100736c8
mov eax, dword [esi + 0x24b0]
mov edx, dword [esi - 8]
push eax
lea ecx, [esi - 8]
call dword [edx + 0x38]
mov edi, 0x80004004
jmp 0x100736c3
mov eax, dword [esi + 0x24b0]
mov edx, dword [esi - 8]
push eax
lea ecx, [esi - 8]
call dword [edx + 0x38]
mov edi, ebx
call fcn.100751b8
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x5c], 0
call fcn.1002395e
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.10078f0e
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10074f63
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
test eax, eax
jns 0x10074f8a
xor al, al
jmp 0x1007503a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
test eax, eax
js 0x10074f83
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
test eax, eax
js 0x10074f83
push edi
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.1007e770
xor eax, eax
push edi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.1007e770
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
push 0
push 0x10017bcc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [esi + 0x24b8]
mov edx, dword [esi]
lea ecx, [ebp - 0x414]
push ecx
push 0x10017bd4
push eax
mov ecx, esi
call dword [edx + 0x44]
pop edi
test eax, eax
js 0x10074f83
mov eax, dword [esi + 0x24b8]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x38]
test eax, eax
setns al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b091
leave
ret
Function at 0x100759f8
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x10094a39
call fcn.10086e1a
xor ebx, ebx
push ebx
push 0x100b6088
mov esi, 0x100b5fa8
push esi
push ebx
push edi
call fcn.100868b5
mov edx, dword [eax]
add esp, 0x14
push dword [ebp + 0xc]
mov ecx, eax
call dword [edx + 4]
test al, al
jne 0x10075a41
push 0x38
push 0x10018000
mov eax, dword [ebp + 0x14]
call fcn.1005ff21
xor eax, eax
inc eax
jmp 0x10075b50
push ebx
push 0x100b5fc8
push esi
push ebx
push edi
mov byte [ebp + 0xf], bl
call fcn.100868b5
add esp, 0x14
cmp eax, ebx
je 0x10075a64
cmp dword [eax + 0xf4], 4
sete byte [ebp + 0xf]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10023e77
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.10024486
mov esi, dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
push esi
push dword [ebp + 8]
push eax
push edi
call fcn.10072b01
mov byte [ebp + 0x13], al
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10078f0e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100241a9
cmp byte [ebp + 0x13], bl
je 0x10075af6
cmp byte [ebp + 0x18], bl
je 0x10075acc
push 0x22
push 0x10018078
jmp 0x10075a31
cmp dword [ebp + 8], 4
je 0x10075aea
cmp byte [ebp + 0xf], bl
jne 0x10075aea
mov eax, dword [ebp + 0x14]
push 0x21
push 0x100180f0
call fcn.1005ff21
push 2
jmp 0x10075b4f
push 0x14
push 0x100180c0
jmp 0x10075a31
push edi
call fcn.10075be8
test al, al
je 0x10075b13
mov eax, dword [ebp + 0x14]
push 0x13
push 0x10018134
call fcn.1005ff21
push 3
jmp 0x10075b4f
push 0x10018160
lea eax, [ebp + 0x18]
push eax
call fcn.1005833e
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0x18]
push dword [eax - 0xc]
push eax
mov eax, dword [ebp + 0x14]
call fcn.1005ff21
push dword [ebp + 0x18]
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp + 0x18]
add eax, 0xfffffff0
call fcn.10078f0e
push 5
pop eax
call fcn.10086f06
ret 0x14
Function at 0x1007646d
Capabilities:
Get file size

Disassembly:
push 0x484
mov eax, 0x100904dc
call fcn.10086e8d
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x480], eax
push 0x5c
pop eax
mov word [ebp - 0x1c], ax
xor eax, eax
mov dword [ebp - 0x478], 0x10018d38
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
push 0x10015e48
lea eax, [ebp - 0x47c]
push eax
call fcn.10058c7a
push dword [eax]
lea edi, [ebp - 0x478]
call fcn.1003410a
lea ebx, [eax - 1]
mov eax, dword [ebp - 0x47c]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
call fcn.10078f0e
inc bl
je 0x100765f9
xor eax, eax
cmp dword [ebp - 0x14], eax
je 0x100764f2
mov eax, dword [ebp - 0x474]
shr eax, 4
and eax, 1
cmp eax, 1
je 0x100765a2
lea esi, [ebp - 0x48c]
lea edi, [ebp - 0x478]
call fcn.10033fec
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x47c], ebx
mov dword [ebp - 0x488], ebx
mov dword [ebp - 0x484], ebx
push ebx
push 0x80
push 3
push 1
mov byte [ebp - 4], 2
mov eax, dword [esi]
push SysReAllocStringLen
push eax
lea edi, [ebp - 0x488]
call fcn.1002809d
cmp eax, ebx
jge 0x10076565
push dword [esi]
mov edi, dword [ebp - 0x480]
mov esi, dword [edi + 4]
push 0x10018530
push 1
call fcn.100239ad
add esp, 0xc
mov esi, ebx
jmp 0x1007657a
push ebx
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp - 0x480]
mov esi, eax
cmp dword [ebp - 0x488], ebx
je 0x10076594
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x488], ebx
add dword [edi], esi
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x48c]
jmp 0x100765dd
lea esi, [ebp - 0x478]
call fcn.100340b0
cmp eax, 1
je 0x100765e5
lea esi, [ebp - 0x490]
lea edi, [ebp - 0x478]
call fcn.10033fec
push dword [ebp - 0x480]
mov byte [ebp - 4], 3
push eax
call fcn.1007646d
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x490]
add eax, 0xfffffff0
call fcn.10078f0e
lea esi, [ebp - 0x478]
call fcn.100341e0
cmp eax, 1
je 0x100764df
lea eax, [ebp - 0x478]
mov dword [ebp - 0x478], 0x10018d38
call fcn.1003420d
call fcn.10086f1f
ret 8

Function at 0x100778df
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10077938
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1007792a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x10077926
cmp edi, eax
jae 0x1007792a
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x10077918
cmp edi, eax
jb 0x1007792e
xor eax, eax
jmp 0x10077937
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x100781d3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 8]
push 0
push 0x10010b34
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007823b
cmp dword [ebp + 8], 1
je 0x10078213
cmp dword [ebp + 8], 2
je 0x10078213
push 0xd
pop eax
jmp 0x1007823b
mov eax, dword [ebp - 4]
test edi, edi
je 0x10078235
test eax, eax
je 0x10078230
test al, 1
jne 0x1007820e
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x10078235
jmp 0x1007820e
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 4

Function at 0x1007b091
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100ae210]
jne 0x1007b09b
repz ret
jmp fcn.1007e628
Function at 0x10083be9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1007d203
and dword [ebp - 0x14], 0
cmp dword [0x100b837c], 0
mov dword [ebp - 0x18], eax
jne 0x10083c9c
push 0x10003634
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10083d44
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10003628
push ebx
call edi
test eax, eax
je 0x10083d44
mov esi, dword [fcn.10001634]
push eax
call esi
push 0x10003618
push ebx
mov dword [0x100b837c], eax
call edi
push eax
call esi
push 0x10003604
push ebx
mov dword [0x100b8380], eax
call edi
push eax
call esi
push 0x100035e8
push ebx
mov dword [0x100b8384], eax
call edi
push eax
call esi
mov dword [0x100b838c], eax
test eax, eax
je 0x10083c9c
push 0x100035d0
push ebx
call edi
push eax
call esi
mov dword [0x100b8388], eax
mov eax, dword [0x100b8388]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.10001630]
cmp eax, ecx
je 0x10083cf5
cmp dword [0x100b838c], ecx
je 0x10083cf5
push eax
call esi
push dword [0x100b838c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10083cf5
test ebx, ebx
je 0x10083cf5
call edi
test eax, eax
je 0x10083cec
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10083cec
test byte [ebp - 8], 1
jne 0x10083cf5
or dword [ebp + 0x10], 0x200000
jmp 0x10083d28
mov eax, dword [0x100b8380]
cmp eax, dword [ebp - 0x18]
je 0x10083d28
push eax
call esi
test eax, eax
je 0x10083d28
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10083d28
mov eax, dword [0x100b8384]
cmp eax, dword [ebp - 0x18]
je 0x10083d28
push eax
call esi
test eax, eax
je 0x10083d28
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100b837c]
call esi
test eax, eax
je 0x10083d44
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10083d46
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007b091
leave
ret

Function at 0x10085850
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4
Function at 0x100864d0
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
cmp edi, 8
mov dword [ebp - 0x50], eax
ja 0x10086505
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.1007e770
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.100865d0
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.100863c0
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.100865d0
xor eax, eax
push 0x40
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push eax
add esi, 0x28
push esi
call fcn.1007e770
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007b091
mov esp, ebp
pop ebp
ret 8
Function at 0x41b1aa
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1040
call fcn.0041c630
push ebx
push esi
mov esi, dword [esp + 0x1050]
xor ebx, ebx
cmp word [esi], bx
je 0x41b3e2
push esi
call fcn.00421845
pop ecx
cmp eax, 0x7f6
jae 0x41b3e2
push edi
push 0x3c
pop edi
push edi
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0041d5e0
add esp, 0xc
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 0x1c0
cmp byte [esp + 0x1058], bl
je 0x41b20a
mov dword [esp + 0x14], 0x5c0
movzx ecx, word [esi]
lea edx, [esi + 2]
push 0x22
pop edi
cmp cx, di
je 0x41b21a
mov edx, esi
mov dword [esp + 0x20], edx
mov eax, ebx
push ebp
test cx, cx
je 0x41b264
push 0x20
mov ecx, esi
pop ebp
cmp word [ecx], di
jne 0x41b245
jmp 0x41b238
cmp word [esi + eax*2], di
je 0x41b241
inc eax
cmp word [esi + eax*2], bx
jne 0x41b232
jmp 0x41b245
mov word [esi + eax*2], bp
cmp word [esi + eax*2], bp
je 0x41b3b9
cmp word [esi + eax*2 + 2], 0x2f
je 0x41b3b3
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x41b22b
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41b271
cmp word [eax], bx
jne 0x41b28b
cmp byte [esp + 0x105c], bl
jne 0x41b28b
cmp word [0x44a11a], bx
je 0x41b28b
mov dword [esp + 0x28], 0x44a11a
push edx
mov dword [esp + 0x34], 1
call fcn.0040ad74
mov esi, eax
test esi, esi
je 0x41b2b6
push str..inf
push esi
call fcn.004106e6
test eax, eax
jne 0x41b2b6
mov dword [esp + 0x20], 0x43167c
push dword [esp + 0x24]
call fcn.00409b05
test al, al
je 0x41b2de
push 0x800
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x2c]
call fcn.0040aafd
lea eax, [esp + 0x50]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41b3e0
mov edi, dword [esp + 0x1054]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x449110], bl
jne 0x41b317
cmp byte [esp + 0x105c], bl
jne 0x41b317
cmp byte [0x4557fe], bl
je 0x41b376
test edi, edi
je 0x41b32c
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41b32c
push ebx
push edi
call ebp
mov bl, 1
push 0x7d0
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [esp + 0x4c]
call fcn.0041b638
cmp byte [0x4557fe], 0
je 0x41b376
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x41b376
mov eax, dword [esp + 0x10]
add eax, 0x3e8
cmp eax, dword [0x455800]
jbe 0x41b376
mov dword [0x455800], eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x41b393
push str..exe
push esi
call fcn.004106e6
test eax, eax
je 0x41b3cc
cmp byte [0x449110], 0
mov al, byte [esp + 0x105c]
je 0x41b3d3
test al, al
jne 0x41b3d3
mov dword [0x455804], 0x1b58
jmp 0x41b3d3
cmp word [esi + eax*2], bp
jne 0x41b3bf
xor ecx, ecx
mov word [esi + eax*2], cx
inc eax
lea eax, [esi + eax*2]
mov dword [esp + 0x28], eax
jmp 0x41b268
mov al, byte [esp + 0x105c]
test bl, bl
je 0x41b3e0
test al, al
je 0x41b3e0
push 1
push edi
call ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1040
ret 0xc
Function at 0x40107e
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x4246b0
push 0x67
push edi
call esi
push 0x64
push 0x4245e8
push 0x6d
push edi
call esi
mov eax, edi
call fcn.0040120b
push ebx
mov esi, 0x4251b8
push esi
call fcn.00408d34
call fcn.00402e17
push 0x41dc20
push esi
mov dword [0x4230a0], eax
call fcn.00408d50
add esp, 0x10
test eax, eax
je 0x401104
call fcn.0040185a
test eax, eax
je 0x401104
call fcn.004030dd
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.0040127c
test eax, eax
pop ecx
jne 0x401126
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00408c4c
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor esi, esi
push 0x206
lea eax, [esp + 0x16]
push esi
push eax
mov word [esp + 0x1c], si
call fcn.00408c60
mov ecx, dword [0x424e00]
add esp, 0xc
cmp ecx, esi
jbe 0x401172
cmp word [0x424e04], si
jbe 0x401172
mov esi, str.218.54.31.226
call fcn.00402db3
mov ax, word [0x424e04]
mov word [0x42364c], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov esi, 0x3e8
mov ecx, esi
div ecx
xor edx, edx
mov ebx, 0x4253c8
div ecx
push edx
push str.Temp7_X.exe
push ebx
call fcn.00402844
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004025f6
lea edi, [esp + 0x10]
call fcn.00408355
push 0x41dc40
mov esi, 0x104
mov eax, edi
push esi
push eax
call fcn.00408d82
add esp, 0xc
push ebx
mov eax, edi
push esi
push eax
call fcn.00408d82
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401201
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor eax, eax
push eax
push 0x41ddcc
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00402391
jmp 0x4010f7
Function at 0x4017a9
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0x41dcbc
push dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00409339
add esp, 0xc
test eax, eax
je 0x4017d6
xor eax, eax
jmp 0x401856
push esi
push 2
push edi
push dword [ebp - 4]
call fcn.00409410
push dword [ebp - 4]
call fcn.0040962d
push edi
push edi
push dword [ebp - 4]
mov esi, eax
call fcn.00409410
lea eax, [esi + ebx]
push eax
mov dword [ebp - 8], eax
call fcn.004096ea
push dword [ebp - 4]
mov edi, eax
push 1
push esi
push edi
call fcn.00409a0a
push dword [ebp - 4]
call fcn.00409a98
push ebx
lea ebx, [edi + esi]
call fcn.0040306b
push 0x41dcc4
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00409339
add esp, 0x44
test eax, eax
pop esi
jne 0x4017cf
push dword [ebp - 4]
push 1
push dword [ebp - 8]
push edi
call fcn.00409c2e
push dword [ebp - 4]
call fcn.00409a98
xor eax, eax
add esp, 0x14
inc eax
pop edi
pop ebx
leave
ret
Function at 0x40210f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 7
xor edx, edx
mov esi, ecx
pop ecx
xor eax, eax
mov word [ebp - 0x24], dx
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
push 0x68
stosw word es:[edi], ax
push edx
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x94], edx
call fcn.00408c60
push esi
lea eax, [ebp - 0x90]
push 0x20
push eax
call fcn.00409195
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea esi, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
call fcn.00402d4d
mov eax, esi
push eax
lea eax, [ebp - 0x4e]
push 0x10
push eax
call fcn.00409195
add esp, 0x24
xor eax, eax
not byte [ebp + eax - 0x90]
inc eax
cmp eax, 0x68
jb 0x402180
push 0x41dcc4
push ebx
call fcn.00409326
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4021c2
push esi
xor edi, edi
push 0x68
inc edi
lea eax, [ebp - 0x90]
push edi
push eax
call fcn.00409c2e
push esi
mov dword [ebp - 0x94], edi
call fcn.00409a98
add esp, 0x14
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x94]
pop edi
xor ecx, ebp
pop esi
call fcn.00408c4c
leave
ret

Function at 0x4021d6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4021ff
push dword [ebp + 8]
call fcn.00402eb3
cmp eax, dword [ebp + 0x10]
pop ecx
jne 0x4021ff
inc ebx
jmp 0x40226f
mov edi, 0x200000
push edi
call fcn.004096ea
pop ecx
mov esi, eax
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
lea edi, [ebp - 4]
call fcn.00404f24
add esp, 0xc
test eax, eax
je 0x402268
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00408dfc
pop ecx
push 0x32
mov eax, 0xc8
call fcn.0040285f
mov edi, dword [ebp - 4]
pop ecx
push eax
lea ebx, [edi + esi]
mov dword [ebp + 0x10], eax
call fcn.0040306b
add edi, dword [ebp + 0x10]
pop ecx
push edi
push esi
push dword [ebp + 8]
call fcn.00408b90
add esp, 0xc
mov ebx, eax
dec ebx
neg ebx
sbb ebx, ebx
inc ebx
push esi
call fcn.0040b3eb
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret