joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3478c44b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
push edi
mov edi, dword [esp + 0x44]
mov ebx, dword [edi + 0xc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x64]
push 0
mov dword [esp + 0x34], eax
mov eax, dword [0x347efae8]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x78]
push ebx
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x90]
push ebp
mov dword [esp + 0x18], edx
call ecx
test eax, eax
jl 0x3478c65a
mov eax, dword [edi + 0x64]
mov ecx, dword [0x347efae8]
push esi
push 0
push 0
push 4
lea edx, [esp + 0x78]
push edx
mov edx, dword [ecx + 0x8c]
push eax
push ebx
push ebp
call edx
mov esi, eax
test esi, esi
jl 0x3478c646
mov ecx, dword [edi + 0x68]
mov edx, dword [0x347efae8]
push 0
push 0
push 0x10
lea eax, [esp + 0x28]
push eax
mov eax, dword [edx + 0x8c]
push ecx
push ebx
push ebp
call eax
mov esi, eax
test esi, esi
jl 0x3478c646
mov edx, dword [edi + 0x6c]
mov eax, dword [0x347efae8]
push 0
push 0
push 0x10
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [eax + 0x8c]
push edx
push ebx
push ebp
call ecx
mov esi, eax
test esi, esi
jl 0x3478c646
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0x100]
lea edx, [esp + 0x14]
push edx
push ebp
call ecx
push eax
call fcn.347e05f9
test eax, eax
jne 0x3478c56a
mov esi, 0xffffb1a1
jmp 0x3478c646
fldz
fcom qword [esp + 0x70]
fnstsw ax
test ah, 0x44
jp 0x3478c57d
fstp qword [esp + 0x14]
jmp 0x3478c57f
fstp st(0)
mov eax, dword [edi + 0x74]
mov ecx, dword [0x347efae8]
push 0
push 0
push 8
lea edx, [esp + 0x20]
push edx
mov edx, dword [ecx + 0x8c]
push eax
push ebx
push ebp
call edx
mov esi, eax
test esi, esi
jl 0x3478c646
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 0x70]
push 0
push 0
push eax
mov eax, dword [0x347efae8]
push ecx
mov ecx, dword [eax + 0x8c]
push edx
push ebx
push ebp
call ecx
mov esi, eax
test esi, esi
jl 0x3478c646
mov edx, dword [0x347ed1c4]
imul edx, edx, 0x3e8
mov eax, 0x10624dd3
mul edx
xor edi, edi
shr edx, 5
je 0x3478c642
mov edi, edi
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0x94]
push 0
push 0
push 0
push ebx
push ebp
call ecx
mov esi, eax
cmp esi, 0xfffffbae
je 0x3478c61a
cmp esi, 0xfffffbaf
je 0x3478c61a
cmp esi, 0xfffffbb2
jne 0x3478c642
push 0x1f4
call dword [sym.imp.kernel32.dll_Sleep]
mov edx, dword [0x347ed1c4]
imul edx, edx, 0x3e8
mov eax, 0x10624dd3
mul edx
add edi, 1
shr edx, 5
cmp edi, edx
jb 0x3478c5eb
test esi, esi
jge 0x3478c657
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0x90]
push 3
push ebx
push ebp
call ecx
mov eax, esi
pop esi
mov ecx, dword [esp + 0x38]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x30
ret 0x3c
Function at 0x347aaeb8
Capabilities:
Get disk information

Disassembly:
sub esp, 0xc
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x20]
push 4
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.MSO.dll_Ordinal_6877]
lea ecx, [esp + 0xc]
push ecx
call sub.kernel32.dll_GetDriveTypeW
xor edx, edx
cmp eax, 4
setne dl
mov ecx, esi
lea ebx, [ecx + 2]
mov eax, edx
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x347aaef8
sub ecx, ebx
sar ecx, 1
cmp ecx, 3
jb 0x347aaf25
add esi, 6
mov dword [edi], esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.347ea89f
add esp, 0xc
ret 8
mov ecx, dword [esp + 0x14]
mov dword [edi], 0
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0xc
ret 8
Function at 0x347ab86b
Capabilities:
Get hostname

Disassembly:
sub esp, 0x6ec
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x6e8], eax
mov eax, dword [esp + 0x6f4]
push ebp
mov ebp, dword [esp + 0x6f4]
push ebp
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x32
call fcn.347777d4
test eax, eax
jne 0x347ab8bc
pop ebp
mov ecx, dword [esp + 0x6e8]
xor ecx, esp
call fcn.347ea89f
add esp, 0x6ec
ret 0xc
push ebx
push esi
push edi
lea edi, [ebp + 4]
push 0x5c
push edi
call dword [sym.imp.msvcr80.dll_wcschr]
mov ebx, dword [sym.imp.MSO.dll_Ordinal_6877]
mov esi, eax
add esp, 8
test esi, esi
je 0x347ab8ee
push 0x32
lea ecx, [esp + 0x1c]
push ecx
push edi
mov word [esi], 0
call ebx
mov word [esi], 0x5c
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x80]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x347ab938
lea eax, [esp + 0x18]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x347ab90b
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x84]
push edx
call fcn.34776d37
add esp, 0xc
test eax, eax
jne 0x347aba2c
mov esi, dword [sym.imp.msvcr80.dll_wcschr]
push 0x5c
push edi
call esi
xor edi, edi
add esp, 8
cmp eax, edi
je 0x347aba25
add eax, 2
push 0x5c
push eax
call esi
add esp, 8
mov esi, eax
cmp esi, edi
push 0x104
je 0x347ab98e
lea eax, [esp + 0x4f4]
push eax
lea ecx, [esi + 2]
push ecx
mov word [esi], di
call ebx
push 0x104
lea edx, [esp + 0x2ec]
push edx
push ebp
call ebx
mov word [esi], 0x5c
jmp 0x347ab9a1
lea eax, [esp + 0x2ec]
push eax
push ebp
call ebx
mov word [esp + 0x4f0], di
push 0x104
lea ecx, [esp + 0xe4]
push ecx
lea edx, [esp + 0x2f0]
push edx
call fcn.347ab7f1
test eax, eax
je 0x347aba1c
lea eax, [esp + 0xe0]
push eax
call fcn.34777459
test eax, eax
je 0x347aba1c
push 0x104
lea ecx, [esp + 0xe4]
push ecx
call fcn.347774ac
mov esi, dword [esp + 0x708]
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0x4f0]
push edx
lea eax, [esp + 0xe4]
push eax
push 0x347721e0
push esi
push ebx
call fcn.3478258a
add esp, 0x14
cmp esi, edi
je 0x347aba15
mov word [ebx + esi*2 - 2], di
mov eax, 1
jmp 0x347aba2e
mov ecx, dword [esp + 0x10]
mov word [ecx], di
jmp 0x347aba2c
mov edx, dword [esp + 0x10]
mov word [edx], di
xor eax, eax
mov ecx, dword [esp + 0x6f8]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.347ea89f
add esp, 0x6ec
ret 0xc
Function at 0x347aba49
Capabilities:
Get hostname

Disassembly:
sub esp, 0x48c
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x488], eax
mov eax, dword [esp + 0x494]
push ebx
mov ebx, dword [esp + 0x4a4]
push ebp
mov ebp, dword [esp + 0x498]
push esi
mov esi, dword [esp + 0x4a8]
push edi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
xor edi, edi
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x32
call sub.kernel32.dll_GetComputerNameW
cmp dword [esi], edi
jne 0x347abad7
push 0x1000
call sub.MSO.dll_Ordinal_815
cmp eax, edi
mov dword [esi], eax
jne 0x347abab9
xor eax, eax
jmp 0x347abbc1
call fcn.3477734d
cmp ax, 1
push ebx
jne 0x347abacf
mov eax, dword [esi]
push eax
call fcn.347ab143
jmp 0x347abad7
mov ecx, dword [esi]
push ecx
call fcn.347ab54a
cmp eax, edi
je 0x347abbbd
cmp dword [esi], edi
je 0x347abbbd
cmp dword [ebx], edi
jbe 0x347abbbd
mov eax, dword [esi]
mov ecx, dword [eax + edi*4]
push 0x105
lea edx, [esp + 0x290]
push edx
add ecx, 0x209
push ecx
call fcn.347772e0
test eax, eax
je 0x347abab2
mov eax, dword [esi]
mov ecx, dword [eax + edi*4]
push 0x105
lea edx, [esp + 0x84]
push edx
push ecx
call fcn.347772e0
test eax, eax
je 0x347abab2
push 1
push ebp
lea edx, [esp + 0x294]
push edx
call fcn.3477767d
test eax, eax
je 0x347abb4a
add edi, 1
cmp edi, dword [ebx]
jb 0x347abaef
jmp 0x347abbbd
lea eax, [esp + 0x1c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x347abb51
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x80]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x347abb6c
sub eax, esi
mov esi, dword [esp + 0x4a8]
sar eax, 1
lea eax, [eax + edx + 3]
cmp eax, esi
ja 0x347abbbd
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x347721ec
push esi
push edi
call fcn.3478258a
add esp, 0x14
test esi, esi
je 0x347abbb5
mov word [edi + esi*2 - 2], 0
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x498]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x48c
ret 0x14
Function at 0x347b8162
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100b0
call fcn.347eae3e
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x100ac], eax
mov eax, dword [esp + 0x100bc]
test eax, eax
push ebx
mov ebx, dword [esp + 0x100c4]
push esi
mov ecx, 0x30
push edi
mov edi, dword [esp + 0x100c0]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0xffffffff
mov dword [ebx], 0
jne 0x347b830b
mov ebx, dword [esp + 0x100c4]
mov edx, dword [0x347efae8]
push 1
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 1
lea eax, [esp + 0x3c]
push ebx
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 0xb0]
push edi
call eax
mov esi, eax
test esi, esi
jl 0x347b8369
mov ecx, dword [esp + 0x2c]
mov edx, dword [0x347efae8]
mov eax, dword [edx + 0x84]
push 0
push 0x80000000
push ecx
push edi
call eax
mov esi, eax
test esi, esi
jl 0x347b82f7
mov eax, dword [esp + 0x38]
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x38]
push 0x80
lea edx, [esp + 0x68]
push edx
mov edx, dword [0x347efae8]
push eax
mov eax, dword [edx + 0x88]
push ecx
push edi
call eax
mov esi, eax
test esi, esi
jl 0x347b8369
mov eax, dword [esp + 0xc]
cmp eax, 0x80
jb 0x347b825a
mov eax, 0x80
lea ecx, [esp + 0x58]
push ecx
mov word [esp + eax + 0x5c], 0
call fcn.347bd55c
test eax, eax
jne 0x347b82d5
lea edx, [esp + 0x58]
push edx
call fcn.347bd5eb
test eax, eax
jne 0x347b82d5
push eax
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x347efae8]
push 0xffdc
lea edx, [esp + 0xf0]
push edx
mov edx, dword [ecx + 0x140]
push 0x3477156c
push 0
lea eax, [esp + 0x78]
push eax
push 0x34771260
push ebx
push edi
call edx
mov esi, eax
test esi, esi
je 0x347b82ff
cmp esi, 0x3ec
je 0x347b82d5
cmp esi, 0xfffff1f0
je 0x347b82d5
test esi, esi
jl 0x347b8369
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x347efae8]
mov edx, dword [ecx + 0x84]
push 0
push 1
push eax
push edi
call edx
mov esi, eax
test esi, esi
jge 0x347b8214
cmp esi, 0xfffff9bd
jmp 0x347b8365
mov eax, dword [esp + 0x10]
mov dword [eax], 1
jmp 0x347b8369
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x100d4]
push 0xffdc
lea ecx, [esp + 0xf0]
push ecx
push 0x3477156c
push 0
push eax
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0x140]
push 0x34771260
push edx
push edi
call ecx
mov esi, eax
test esi, esi
jne 0x347b8357
mov dword [ebx], 1
jmp 0x347b8369
cmp esi, 0x3ec
je 0x347b8367
cmp esi, 0xfffff1f0
jne 0x347b8369
xor esi, esi
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x347b837f
mov edx, dword [0x347efae8]
push eax
mov eax, dword [edx + 0x68]
push edi
call eax
mov ecx, dword [esp + 0x100b8]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x100b0
ret 0x10
Function at 0x347c054e
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_Sleep]
xor esi, esi
push ebp
push ebx
call sub.kernel32.dll_MoveFileW
test eax, eax
jne 0x347c0588
push 0x3e8
call edi
add esi, 1
cmp esi, 3
jl 0x347c0562
call fcn.347c02fe
pop edi
pop esi
pop ebp
pop ebx
ret 8
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x347c05a5
push ebp
call sub.kernel32.dll_DeleteFileW
pop edi
pop esi
pop ebp
mov eax, 0xfffffbf8
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x347c0633
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x347c065b
call fcn.347c02fe
ret 0x10
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
xor eax, eax
ret 0x10

Function at 0x347c0722
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push 0x208
lea ecx, [esp + 4]
push ecx
push eax
call fcn.34777236
lea edx, [esp]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x347c0777
call fcn.347c02fe
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.347ea89f
add esp, 0x20c
ret 4
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor eax, eax
call fcn.347ea89f
add esp, 0x20c
ret 4
Function at 0x347c52d4
Capabilities:
Create thread
Suspend thread

Disassembly:
sub esp, 0x2c
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x28], eax
cmp dword [0x347ed53c], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
je 0x347c5311
mov eax, 0xffffb0af
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.347ea89f
add esp, 0x2c
ret 8
push ebx
mov ebx, dword [sym.imp.kernel32.dll_GetTickCount]
push ebp
mov ebp, dword [sym.imp.MSO.dll_Ordinal_1955]
push esi
push edi
mov edi, dword [sym.imp.MSO.dll_Ordinal_6877]
push 0x104
push 0x347ef8e0
push 0x34774efc
call edi
call ebx
push 0xa
push eax
push 0xb
lea edx, [esp + 0x2c]
push edx
call ebp
push 0x104
push 0x347ef8e0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.MSO.dll_Ordinal_6873]
lea ecx, [esp + 0x10]
push ecx
push 0
push 1
push 0x347ef8e0
call fcn.347cebc7
mov esi, eax
cmp esi, 0xffffb192
je 0x347c5327
xor ebp, ebp
cmp esi, ebp
jl 0x347c549a
mov edx, dword [esp + 0x18]
push 0x100
push 0x347ed338
push edx
call edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push ebp
mov dword [0x347ed538], ebp
mov dword [0x347ed570], ebp
mov ecx, dword [edi]
push ecx
push 0x347c524a
push ebp
push ebp
call dword [sym.imp.kernel32.dll_CreateThread]
cmp eax, ebp
mov dword [0x347ed53c], eax
jne 0x347c53d6
mov edx, dword [esp + 0x10]
push edx
call fcn.347cea6c
mov esi, 0xfffffc0d
jmp 0x347c549a
mov eax, dword [0x347ed1d0]
cmp eax, 0xffffffff
je 0x347c53e5
lea ebx, [eax + eax*4]
jmp 0x347c53e8
or ebx, 0xffffffff
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0x18]
push eax
push ecx
push ebp
push 0xe
push edx
call fcn.347db604
mov esi, eax
cmp esi, 0xfffffbdf
je 0x347c5475
nop
push 0xc8
push ebp
lea eax, [esp + 0x18]
push eax
call fcn.347cf241
test eax, eax
jge 0x347c5448
cmp ebx, 0xffffffff
jle 0x347c5428
sub ebx, 1
cmp ebx, 0xffffffff
je 0x347c5470
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ecx
push edx
push ebp
push 0xe
push eax
call fcn.347db604
mov esi, eax
cmp esi, 0xfffffbdf
jne 0x347c5407
jmp 0x347c5475
mov ecx, dword [esp + 0x10]
mov esi, dword [0x347ed570]
push ecx
call fcn.347cea6c
mov edx, dword [0x347ed538]
mov dword [edi + 0x10], edx
mov dword [0x347ed538], ebp
mov word [0x347ed338], bp
jmp 0x347c549a
mov esi, 0xffffb0af
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_SetEvent
mov ecx, dword [esp + 0x10]
push ecx
call fcn.347cea6c
mov edx, dword [0x347ed53c]
push edx
mov dword [esp + 0x14], ebp
call dword [sym.imp.kernel32.dll_SuspendThread]
mov ecx, dword [esp + 0x38]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x2c
ret 8
Function at 0x347c5718
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
lea eax, [esi + 0x10]
push eax
call fcn.3477fa89
lea ecx, [esi + 8]
push ecx
call fcn.3477fa89
lea edx, [esi + 4]
push edx
call fcn.3477fa89
push esi
call fcn.3477fa89
mov eax, dword [0x347ed53c]
test eax, eax
je 0x347c5765
push 0
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [0x347ed53c]
push eax
call fcn.347cea6c
mov dword [0x347ed53c], 0
push 0x624
push 0
push esi
call sub.msvcr80.dll_memset
add esp, 0xc
call fcn.3477f8c4
pop esi
ret 4
Function at 0x347cedc0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x108
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push ebx
push esi
mov esi, dword [esp + 0x120]
push edi
mov edi, dword [esp + 0x120]
push 0x104
lea ecx, [esp + 0x10]
push ecx
push eax
xor ebx, ebx
call fcn.347772fe
test eax, eax
jne 0x347cee09
mov eax, 0xfffffc02
jmp 0x347cee5e
lea edx, [esp + 0xc]
push edx
push 0
push 4
mov dword [esi], ebx
call dword [sym.imp.kernel32.dll_OpenFileMappingA]
test eax, eax
mov dword [edi], eax
jne 0x347cee29
call fcn.347ce91a
mov ebx, eax
jmp 0x347cee5c
mov ecx, dword [esp + 0x11c]
push ecx
push 0
push 0
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
test eax, eax
mov dword [esi], eax
jne 0x347cee5c
mov eax, dword [edi]
test eax, eax
mov ebx, 0xfffffc0d
je 0x347cee56
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi], 0
mov eax, ebx
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x108
ret 0x10
Function at 0x347dabb7
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x347ed568], 0
je 0x347dac6e
call fcn.347c90c2
mov eax, dword [0x347ed53c]
test eax, eax
je 0x347dabf0
push 0
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [0x347ed53c]
push eax
call fcn.347cea6c
mov dword [0x347ed53c], 0
mov ecx, dword [0x347ed568]
push esi
push edi
add ecx, 0x5c
push ecx
call fcn.347d9e09
mov edx, dword [0x347ed568]
add edx, 0x2c
push edx
call fcn.347d9e97
mov eax, dword [0x347ed568]
mov eax, dword [eax + 0x40]
or edi, 0xffffffff
cmp eax, edi
je 0x347dac2e
mov ecx, dword [0x347efae8]
mov edx, dword [ecx + 0x204]
push eax
call edx
mov esi, dword [0x347ed568]
push 0x17b4
add esi, 0x2c
push 0
push esi
call sub.msvcr80.dll_memset
mov word [esi + 0x64], 0xff
mov dword [esi + 0x18], 0x20
add esp, 0xc
mov dword [esi + 0x14], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], 0
mov dword [esi + 0x68], edi
mov dword [esi + 0x74], edi
call fcn.347ca139
pop edi
pop esi
xor eax, eax
ret

Function at 0x347db4ab
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x420]
push edi
mov edi, dword [esp + 0x428]
lea eax, [esp + 0x14]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jne 0x347db4ee
call fcn.347c02fe
jmp 0x347db5e9
mov ebx, dword [sym.imp.MSO.dll_Ordinal_6873]
push 0x104
lea ecx, [esp + 0x18]
push ecx
push edi
call ebx
lea edx, [esp + 0x10]
push edx
push 0x40
lea eax, [esp + 0x1c]
push eax
call fcn.347c04d4
test eax, eax
mov ebp, dword [sym.imp.MSO.dll_Ordinal_6877]
jl 0x347db52b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.347c0706
jmp 0x347db5d7
cmp dword [0x347ed580], 0
jne 0x347db5a4
cmp dword [0x347ed27c], 0
jne 0x347db5a4
push 0xff
lea edx, [esp + 0x220]
push edx
lea eax, [esi + 0x21e]
push eax
call ebp
push 0xff
lea ecx, [esp + 0x220]
push ecx
push 0x34771814
call ebx
push 0xff
lea edx, [esp + 0x220]
push edx
push edi
call ebx
mov edx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x220]
push ecx
push edx
call fcn.34780252
test eax, eax
jl 0x347db5e9
mov ecx, dword [esi + 4]
lea eax, [esp + 0x21c]
push eax
push ecx
call fcn.347801d7
jmp 0x347db5d7
mov eax, dword [esi + 0x10]
lea edx, [esi + 0x21e]
push edx
push eax
call fcn.3477fd5d
test eax, eax
jl 0x347db5e9
mov edx, dword [esi + 0x10]
push 2
lea ecx, [esp + 0x18]
push ecx
push edi
push edx
call fcn.3477ff9e
test eax, eax
jl 0x347db5e9
mov eax, dword [esi + 0x10]
push edi
push eax
call fcn.34780073
mov ecx, dword [esp + 0x42c]
push ecx
push edi
lea edx, [esp + 0x1c]
push edx
call ebp
xor eax, eax
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x410
ret 0xc
Function at 0x347dc949
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor esi, esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ebx, dword [esp + 0x20]
mov ebp, eax
add esi, 1
push esi
push ebp
push 0x34775b58
push 0x34775c40
push 0x104
push 0x347eea60
call fcn.3478258a
add esp, 0x18
push ebx
push 0
push 1
push 0x347eea60
call fcn.347cebc7
mov edi, eax
cmp edi, 0xffffb192
jne 0x347dc9a5
cmp esi, 0x1e
jb 0x347dc95c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
test edi, edi
jl 0x347dc99b
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0
push ecx
push 0x347db61a
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
mov edx, dword [esp + 0x1c]
mov dword [edx], eax
jne 0x347dc99b
mov eax, dword [ebx]
push eax
call fcn.347cea6c
pop edi
pop esi
pop ebp
mov dword [ebx], 0
mov eax, 0xfffffc0d
pop ebx
pop ecx
ret 0xc
Function at 0x347e14b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x794
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x790], eax
mov eax, dword [esp + 0x7a0]
push ebx
push esi
push edi
mov edi, dword [esp + 0x7a4]
mov ecx, 0x3c
push 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
xor ebx, ebx
push ebx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x7b4]
push eax
mov eax, dword [0x347efae8]
push edx
mov dword [esp + 0x40], 0xffffffff
mov ecx, dword [eax + 0xb8]
push edi
mov dword [esp + 0x28], 1
call ecx
mov esi, eax
cmp esi, ebx
jl 0x347e161a
mov edx, dword [esp + 0x2c]
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0x84]
push ebp
push ebx
push 0x80000000
push edx
push edi
call ecx
mov esi, eax
cmp esi, ebx
jl 0x347e160f
mov ebp, dword [esp + 0x7b4]
cmp dword [esp + 0x14], ebx
je 0x347e160f
mov ecx, dword [esp + 0x3c]
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x3c]
push 4
lea eax, [esp + 0x20]
push eax
mov eax, dword [0x347efae8]
push ecx
push edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
mov ecx, dword [eax + 0x88]
push edi
call ecx
mov esi, eax
cmp esi, ebx
jl 0x347e1619
test dword [esp + 0x10], 0x80000000
jne 0x347e15ef
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x34]
push ecx
push edi
call fcn.347e1271
mov esi, eax
cmp esi, ebx
jl 0x347e1619
mov edx, dword [esp + 0x79c]
mov ecx, dword [esp + 0x268]
push ebx
push edx
lea eax, [esp + 0x274]
push eax
mov eax, dword [0x347efae8]
push ecx
mov ecx, dword [eax + 0x48]
lea edx, [esp + 0x78]
push edx
push ebp
push edi
call ecx
mov esi, eax
cmp esi, ebx
jge 0x347e1552
jmp 0x347e1619
mov edx, dword [esp + 0x30]
mov eax, dword [0x347efae8]
mov ecx, dword [eax + 0x84]
push ebx
push 1
push edx
push edi
call ecx
mov esi, eax
cmp esi, ebx
jge 0x347e1552
cmp esi, 0xfffff9bd
jne 0x347e1619
xor esi, esi
pop ebp
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
je 0x347e1630
mov edx, dword [0x347efae8]
push eax
mov eax, dword [edx + 0x68]
push edi
call eax
mov ecx, dword [esp + 0x79c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x794
ret 0x10