joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4849e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x803f20
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x803e48]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x484a5b
push 0x4c
push 1
call fcn.00499585
mov esi, eax
add esp, 8
test esi, esi
jne 0x484a23
push 0x803f20
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x803e48]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x7f92e4]
inc eax
lea edx, [esi + 0xc]
mov dword [0x7f92e4], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.00488520
add esp, 8
mov byte [esi + 0x3c], 1
push 0x803f20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x484ee0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.0049915d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.004a2d7c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x484fda
call fcn.0049915d
cmp dword [eax], 0
je 0x484f27
call fcn.0049915d
mov ebp, dword [eax]
jmp 0x484f2a
or ebp, 0xffffffff
call fcn.00484a70
test esi, esi
mov dword [eax], ebp
jne 0x484f3f
call fcn.0049915d
cmp dword [eax], 4
je 0x484f8f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x484f72
cmp esi, 0xffffffff
je 0x484fb4
test al, 6
je 0x484f72
call fcn.00484a70
mov ecx, dword [eax]
push ecx
push ebx
call fcn.00488550
add esp, 4
push eax
push 0x24
push 9
call fcn.004852c0
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x484fd2
test al, 6
je 0x484f80
test ah, 2
je 0x484fd2
test esi, esi
jbe 0x484fde
test ah, 2
je 0x484fde
add dword [esp + 0x18], esi
sub edi, esi
call fcn.0049915d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.004a2d7c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x484fda
jmp 0x484f14
call fcn.00484a70
mov eax, dword [eax]
push eax
push ebx
call fcn.00488550
add esp, 4
push eax
push 0x24
push 2
call fcn.004852c0
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x484feb
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x484ff4
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x499997
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4999b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004990ea
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4999da
test byte [esp + 8], 2
je 0x4999da
call fcn.0049915d
mov dword [eax], 0xd
call fcn.00499166
mov dword [eax], 5
jmp 0x4999b3
xor eax, eax
ret
Function at 0x4ad10b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ad143
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ab198
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ab170
jmp 0x4ad14f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ae7fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ae83f
call fcn.004b462b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ae83f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ae836
xor eax, eax
jmp 0x4ae847
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ae84d
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b4b5b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b4b89
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b4ba7
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b4ac1
jmp 0x4b4ba7
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b4ba7
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b4ac1
test edi, edi
mov eax, edi
jne 0x4b4b91
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x845058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8451a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x84507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84506a
add dl, dl
jne 0x845089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8450dc
xor eax, eax
add dl, dl
jne 0x845096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84517d
add dl, dl
jne 0x8450a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8450d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x845075
mov eax, 1
add dl, dl
jne 0x8450ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8450e1
sub eax, ebx
mov ebx, 1
jne 0x845128
mov ecx, 1
add dl, dl
jne 0x84510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x845119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x845105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x84513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x84514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x845136
cmp eax, 0x7d00
jae 0x84516d
cmp eax, 0x500
jb 0x845168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
cmp eax, 0x7f
ja 0x845170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x84519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x845075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x49ad73f9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5b897a07
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x300023ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3003fd00]
jne 0x300e723c
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x30123ea8], eax
mov dword [0x30123ea4], ecx
mov dword [0x30123ea0], edx
mov dword [0x30123e9c], ebx
mov dword [0x30123e98], esi
mov dword [0x30123e94], edi
mov word [0x30123ec0], ss
mov word [0x30123eb4], cs
mov word [0x30123e90], ds
mov word [0x30123e8c], es
mov word [0x30123e88], fs
mov word [0x30123e84], gs
pushfd
pop dword [0x30123eb8]
mov eax, dword [ebp]
mov dword [0x30123eac], eax
mov eax, dword [ebp + 4]
mov dword [0x30123eb0], eax
lea eax, [ebp + 8]
mov dword [0x30123ebc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x30123df8], 0x10001
mov eax, dword [0x30123eb0]
mov dword [0x30123dac], eax
mov dword [0x30123da0], 0xc0000409
mov dword [0x30123da4], 1
mov eax, dword [0x3003fd00]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3011907c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x30123df0], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x300e7340
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x30123df0], 0
jne 0x300e732c
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x300026e7
Capabilities:
Execute anti-debugging instructions
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x3003fd00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp dword [0x3011d32c], ebx
mov dword [ebp - 0x108], ebx
jne 0x300028b9
lea eax, [ebp - 0x108]
push eax
push 0x20019
push ebx
push 0x300028c8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x300028b9
push 0xff
lea eax, [ebp - 0x103]
push ebx
push eax
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], 1
mov byte [ebp - 0x104], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x114], 0x100
call fcn.30002958
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x300028b9
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [0x3011d340], eax
je 0x300028b9
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x3000294c
push eax
call esi
push 0x30002938
push dword [0x3011d340]
mov dword [0x3011d32c], eax
call esi
push 0x30002928
push dword [0x3011d340]
mov dword [0x3011d334], eax
call esi
push 0x30002910
push dword [0x3011d340]
mov dword [0x3011d330], eax
call esi
push 0x300028f4
push dword [0x3011d340]
mov dword [0x3011d338], eax
call esi
mov dword [0x3011d33c], eax
mov eax, dword [0x3011d32c]
cmp eax, ebx
pop esi
je 0x300028b9
cmp dword [0x3011d334], ebx
je 0x300028b9
cmp dword [0x3011d330], ebx
je 0x300028b9
push dword [ebp + 8]
call eax
cpuid
rdtsc
cpuid
rdtsc
cpuid
rdtsc
cmp dword [ebp + 0xc], 0
jne 0x30062c20
push 8
call fcn.30002985
push 9
call fcn.30002985
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.30002958
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
push 4
call dword [0x3011d334]
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push 5
call dword [0x3011d334]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.300023ac
leave
ret 8
mov eax, dword [0x3011d334]
test eax, eax
je 0x30002870
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
push 0x221
call eax
jmp 0x30002870
Function at 0x30075233
Capabilities:
Create process on windows

Disassembly:
push 0x268
mov eax, 0x300ec692
call fcn.30005a2f
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], ebx
mov esi, 0x3007538c
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.MSO.dll_Ordinal_6061]
mov ecx, 0x104
cmp eax, ecx
jbe 0x30075284
push ebx
push 0x7a7a7471
call dword [sym.imp.MSO.dll_Ordinal_6848]
mov esi, 0x8000ffff
jmp 0x30075364
push ecx
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.MSO.dll_Ordinal_6330]
test eax, eax
push ebx
jne 0x3007529f
push 0x7a7a7472
jmp 0x30075274
push ebx
push ebx
push edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSO.dll_Ordinal_2814]
mov esi, eax
cmp esi, ebx
jl 0x30075364
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xf4]
test eax, eax
jne 0x300752d8
mov esi, 0x80004005
jmp 0x30075364
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push 0x300647bc
push eax
call fcn.30021da3
mov esi, eax
add esp, 0x10
cmp esi, ebx
jl 0x30075364
push 0x44
pop edi
push edi
lea eax, [ebp - 0x274]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x274], edi
xor eax, eax
lea edi, [ebp - 0x230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x274]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x220]
mov word [ebp - 0x244], 0xa
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x300752ce
push dword [ebp - 0x230]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x22c]
call edi
lea eax, [ebp - 0x220]
push eax
mov byte [ebp - 4], bl
call fcn.300060d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.300146f2
mov eax, esi
call fcn.30005a65
ret

Function at 0x30075a09
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov ebx, ecx
jne 0x30075a22
push 0x80004005
call fcn.300ba0cb
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x30075a24
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x300aa992
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], edi
call fcn.30005534
test al, al
je 0x300aa9c6
mov esi, 0x80070057
jmp 0x300aab0f
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x300aa9bc
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x300aa9d8
mov dword [eax], edi
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.3000bfae
mov esi, eax
cmp esi, edi
jl 0x300aab0f
push dword [ebp - 8]
call fcn.300aa6f7
push dword [ebp - 8]
call dword [sym.imp.MSO.dll_Ordinal_3060]
cmp dword [0x3011fbc0], edi
mov ebx, eax
jne 0x300aaa58
push 0xf0000000
push 1
push edi
push edi
push 0x3011fbc0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x300aaa3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x300aab09
and eax, 0xffff
or eax, 0x80070000
jmp 0x300aab09
push edi
push fcn.300aa6db
push 0x3011bdd4
call fcn.30004f0f
mov esi, eax
cmp esi, edi
jl 0x300aab0f
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x8004
push dword [0x3011fbc0]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x300aaa21
push edi
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x300aaa21
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push 2
push dword [ebp - 4]
call esi
test eax, eax
je 0x300aaa21
push dword [ebp - 0xc]
call fcn.30002bc4
mov ebx, eax
cmp ebx, edi
pop ecx
mov dword [ebp - 0x10], ebx
jne 0x300aaab5
mov esi, 0x8007000e
jmp 0x300aab0f
push dword [ebp - 0xc]
push edi
push ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
push 2
push dword [ebp - 4]
call esi
test eax, eax
je 0x300aaa21
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x300aaae2
mov ecx, dword [ebx]
mov dword [eax], ecx
push dword [ebx + 4]
lea eax, [ebp - 0x14]
push dword [ebx]
push 0x300aab4c
push eax
call fcn.3007143e
mov esi, eax
add esp, 0x10
cmp esi, edi
jl 0x300aab0f
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.30011dbe
mov esi, eax
cmp esi, edi
jge 0x300aab15
push edi
call fcn.300aa6db
cmp dword [ebp - 4], edi
je 0x300aab23
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x10], edi
je 0x300aab31
push dword [ebp - 0x10]
call fcn.300093df
pop ecx
lea eax, [ebp - 8]
push eax
call fcn.300060d5
lea eax, [ebp - 0x14]
push eax
call fcn.30011e23
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x300ab5ac
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x3003fd00]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x260], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x250]
push ebx
push eax
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x254], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
mov dword [ebp - 0x258], ebx
call fcn.30005534
test al, al
je 0x300ab60c
mov esi, 0x80070057
jmp 0x300ab7e5
cmp edi, ebx
je 0x300ab602
mov dword [edi], ebx
mov ebx, dword [ebp + 0xc]
shr ebx, 0x10
cmp bx, 3
mov edi, 0x3011fbc4
jne 0x300ab631
push edi
call fcn.30005534
test al, al
je 0x300ab74c
and dword [ebp - 0x25c], 0
push esi
call dword [sym.imp.MSO.dll_Ordinal_3061]
cmp word [esi + eax*2 - 2], 0x5c
jne 0x300ab66f
push 0x300ab808
push esi
lea ecx, [ebp - 0x25c]
call fcn.3009d1f2
mov esi, eax
test esi, esi
jge 0x300ab68d
lea eax, [ebp - 0x25c]
push eax
call fcn.300060d5
jmp 0x300ab7e5
push 0x301190cc
push 0x300ab808
push 0x3003cf3c
push esi
lea eax, [ebp - 0x25c]
push eax
call fcn.3009d038
jmp 0x300ab658
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x260], eax
je 0x300ab740
test byte [ebp - 0x254], 0x10
je 0x300ab6e2
push 0x30065c54
lea eax, [ebp - 0x228]
push eax
call fcn.30004d7a
test eax, eax
jne 0x300ab6e2
push 0x30065c4c
lea eax, [ebp - 0x228]
push eax
call fcn.30004d7a
test eax, eax
je 0x300ab6fb
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x300ab740
jmp 0x300ab6af
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.30011d17
mov esi, eax
test esi, esi
jge 0x300ab725
lea eax, [ebp - 0x25c]
push eax
call fcn.300060d5
jmp 0x300ab7d0
cmp bx, 3
jne 0x300ab740
lea eax, [ebp - 0x228]
push eax
push 0x11
push edi
call fcn.300aa7d5
mov esi, eax
test esi, esi
jl 0x300ab714
lea eax, [ebp - 0x25c]
push eax
call fcn.300060d5
push dword [ebp - 0x258]
call fcn.30005534
test al, al
je 0x300ab7bd
lea eax, [ebp - 0x258]
push eax
call fcn.300ab018
test eax, eax
jge 0x300ab796
push 0
push 0x30336467
call dword [sym.imp.MSO.dll_Ordinal_6848]
lea eax, [ebp - 0x258]
push eax
call fcn.30011e23
lea eax, [ebp - 0x258]
push eax
call fcn.300aacbc
mov esi, eax
test esi, esi
jl 0x300ab7d0
cmp bx, 3
jne 0x300ab7bd
push dword [ebp - 0x258]
call dword [sym.imp.MSO.dll_Ordinal_3061]
push eax
push dword [ebp - 0x258]
push 0x11
push edi
call fcn.3000dd6b
mov esi, eax
test esi, esi
jl 0x300ab7d0
push dword [ebp - 0x264]
lea ecx, [ebp - 0x258]
call fcn.30011dbe
mov esi, eax
cmp dword [ebp - 0x260], 0xffffffff
je 0x300ab7e5
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x258]
push eax
call fcn.30011e23
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.300023ac
leave
ret 0xc
Function at 0x300ad3e6
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov ebx, 0x2000
xor esi, esi
mov dword [ebp - 0xc], edi
call fcn.30005534
test al, al
je 0x300ad414
mov edi, 0x80070057
jmp 0x300ad569
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x300ad40a
mov dword [eax], edi
mov dword [ebp - 4], ebx
call fcn.300058b3
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, edi
jne 0x300ad43e
mov edi, 0x8007000e
jmp 0x300ad569
lea eax, [ebp - 4]
push eax
push esi
push edi
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
call edi
test eax, eax
mov dword [ebp - 8], eax
jne 0x300ad4b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x300ad4a2
push ebx
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
call fcn.300058b3
push dword [ebp - 4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
jne 0x300ad489
mov edi, 0x8007000e
jmp 0x300ad55a
mov ebx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push esi
push 0
call edi
test eax, eax
mov dword [ebp - 8], eax
jne 0x300ad4b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x300ad4b0
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x300ad55a
push dword [esi + 8]
push dword [ebp + 8]
call fcn.30005632
test eax, eax
jne 0x300ad53d
mov edi, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
push ebx
push 0
push esi
mov dword [ebp - 4], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call edi
test eax, eax
jne 0x300ad52e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x300ad4a2
push ebx
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
call fcn.300058b3
push dword [ebp - 4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x10]
mov esi, eax
test esi, esi
je 0x300ad47f
mov ebx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 8]
call edi
test eax, eax
je 0x300ad49c
push dword [esi + 8]
push dword [ebp + 8]
call fcn.30005632
test eax, eax
je 0x300ad4cc
push dword [esi + 4]
lea eax, [ebp - 0xc]
push eax
call fcn.30011d17
mov edi, eax
test edi, edi
jl 0x300ad55a
push dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
call fcn.30011dbe
cmp dword [ebp - 8], 0
je 0x300ad569
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
call fcn.300058b3
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
lea eax, [ebp - 0xc]
push eax
call fcn.30011e23
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8