joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c9ba
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + reloc.msvcrt.dll___p__fmode]
xor ebx, ebx
cmp eax, 0x10000
jne 0x101c97f
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0101bc9e
jmp 0x101c990
cmp eax, 0x20000
jne 0x101c9e1
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0101c485
test eax, eax
jne 0x101c9e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x101c9e1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [edi + 0x24]
push dword [esi + 0x11c]
push dword [esi + 0x118]
push dword [esi + 0xc4]
push dword [esi + 0xa8]
push dword [esi + 0xd8]
push dword [esi + 0xa0]
push 0xc0007d4f
push 7
push 1
push 2
call fcn.01034ce2
add esp, 0x2c
pop edi
xor eax, eax
test ebx, ebx
pop esi
sete al
pop ebx
pop ebp
ret 0xc

Function at 0x101d1dd
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
je 0x101d1e1
mov dword [esi], DocumentPropertiesW
push dword [ebp + 0x14]
mov edi, dword [ebp + 8]
push ebx
lea eax, [esi + 4]
push eax
push dword [edi + 4]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 8]
push ebx
push eax
push dword [edi + 8]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0xc]
push ebx
push eax
push dword [edi + 0xc]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x10]
push ebx
push eax
push dword [edi + 0x10]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x14]
push ebx
push eax
push dword [edi + 0x14]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x18]
push ebx
push eax
push dword [edi + 0x18]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x1c]
push ebx
push eax
push dword [edi + 0x1c]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push ebx
push eax
push dword [edi + 0x20]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x24]
push ebx
push eax
push dword [edi + 0x24]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x28]
push ebx
push eax
push dword [edi + 0x28]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x2c]
push ebx
push eax
push dword [edi + 0x2c]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x30]
push ebx
push eax
push dword [edi + 0x30]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x34]
push ebx
push eax
push dword [edi + 0x34]
call fcn.01035e47
push dword [ebp + 0x14]
push ebx
lea eax, [esi + 0x38]
push eax
push dword [edi + 0x38]
call fcn.01035e47
push dword [ebp + 0x14]
lea eax, [esi + 0x3c]
push ebx
push eax
push dword [edi + 0x3c]
call fcn.01035e47
push dword [ebp + 0x14]
add esi, 0x40
push ebx
push esi
push dword [edi + 0x40]
call fcn.01035e47
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x101d5f7
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2c]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x101d506
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
jmp 0x101d508
xor eax, eax
add dword [ebp - 4], eax
mov eax, dword [esi + 0x1c]
cmp eax, 0x20
je 0x101d518
cmp eax, 8
jne 0x101d532
mov eax, dword [esi + 0x34]
cmp eax, edi
je 0x101d52d
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
jmp 0x101d52f
xor eax, eax
add dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
push edi
lea eax, [esi + 0x38]
push eax
call fcn.0101d115
lea eax, [ebp - 4]
push eax
push edi
push edi
lea eax, [esi + 0x78]
push eax
call fcn.0101d166
lea eax, [ebp - 4]
push eax
push edi
push edi
lea eax, [esi + 0x9c]
push eax
call fcn.0101d1c9
mov eax, dword [esi + 0xf4]
cmp eax, edi
je 0x101d57a
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
jmp 0x101d57c
xor eax, eax
add dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
push edi
lea eax, reloc.msvcrt.dll___p__fmode
push eax
call fcn.0101d1c9
mov eax, dword [esi + 0xf8]
cmp eax, edi
je 0x101d5a5
push eax
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add dword [ebp - 4], eax
mov ecx, dword [esi + reloc.msvcrt.dll___p__fmode]
cmp ecx, edi
jbe 0x101d5ca
mov eax, dword [esi + reloc.msvcrt.dll___p__fmode]
add eax, 0x54
mov edx, dword [eax]
mov edi, dword [ebp - 4]
lea edx, [edi + edx + 0x58]
add eax, 0x58
dec ecx
mov dword [ebp - 4], edx
jne 0x101d5b8
push ebx
lea ebx, reloc.msvcrt.dll___p__fmode
mov edi, dword [ebx]
jmp 0x101d5f7
mov eax, edi
mov edi, dword [edi]
add dword [ebp - 4], 0x10
mov eax, dword [eax + 8]
test eax, eax
je 0x101d5f2
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
jmp 0x101d5f4
xor eax, eax
add dword [ebp - 4], eax
cmp edi, ebx
jne 0x101d5d5
cmp dword [esi + 0x1c], 8
pop ebx
jne 0x101d61b
push 1
lea eax, [ebp + 8]
push eax
push dword [esi + 0x5e8]
call fcn.01021bdc
mov eax, dword [ebp - 4]
add eax, dword [ebp + 8]
jmp 0x101d61e
mov eax, dword [ebp - 4]
mov esi, dword [esi + reloc.msvcrt.dll___p__fmode]
test esi, esi
je 0x101d62a
add eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x101db90
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [reloc.msvcrt.dll___p__fmode]
push edi
mov edi, 0x1040304
cmp eax, edi
je 0x101dbfa
xor ecx, ecx
cmp dword [esi + reloc.msvcrt.dll___p__fmode], ecx
jne 0x101dbfa
cmp eax, edi
mov edx, dword [esi + 0x58]
mov dword [ebp - 0x34], edx
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x2c], edx
mov edx, dword [esi + 0x14]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
je 0x101dbe6
push ebx
mov dword [ebp - 0xc], ecx
jmp 0x101db9c
mov eax, dword [ebp - 4]
mov ebx, eax
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0101cd0f
test eax, eax
pop ecx
pop ecx
jl 0x101dbcf
cmp dword [ebp - 4], edi
jne 0x101db99
jmp 0x101dbe0
mov eax, dword [ebx + 4]
and dword [ebp - 4], 0
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [ebx + 4], esi
cmp dword [ebp - 4], edi
pop ebx
jne 0x101dc08
mov eax, dword [reloc.msvcrt.dll___p__fmode]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [eax], esi
mov dword [reloc.msvcrt.dll___p__fmode], esi
jmp 0x101dc08
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [eax + 4], esi
mov dword [reloc.msvcrt.dll___p__fmode], esi
xor eax, eax
inc eax
pop edi
leave
ret
Function at 0x101ec6b
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x104030c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
call fcn.0101d635
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x101ec5f
cmp dword [esi + 0x28], ebx
jbe 0x101eba0
push 4
mov ecx, esi
call fcn.0101e64b
jmp 0x101ec5f
cmp dword [esi + 0x24], ebx
mov eax, dword [esi + 0x18]
mov dword [ebp - 4], eax
jne 0x101ec5f
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov dword [esi], ebx
mov dword [esi + 4], ebx
push dword [0x10402fc]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
call fcn.0101ddd7
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x101ebdd
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x1c], 8
jne 0x101ec2c
mov eax, dword [esi + 0x2c]
cmp eax, ebx
je 0x101ebf1
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + reloc.msvcrt.dll___p__fmode]
cmp eax, ebx
je 0x101ec02
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ebx, reloc.msvcrt.dll___p__fmode
mov eax, dword [ebx]
test eax, eax
je 0x101ec2c
mov edi, dword [eax]
test edi, edi
je 0x101ec27
cmp edi, ebx
je 0x101ec27
mov eax, edi
push dword [eax + 8]
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x101ec14
mov edi, 0x104030c
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x101ec3d
push dword [ebp + 8]
push 1
call fcn.0102969c
push 1
push esi
call fcn.0101e96e
cmp dword [ebp + 0xc], ebx
je 0x101ec55
push dword [ebp - 4]
push 0x17
push ebx
call fcn.010284c5
push 0x1040300
call fcn.0101ccec
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 8
Function at 0x101f9a7
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x104030c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
call fcn.0101d635
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x101f96c
cmp dword [esi + 0x24], ebx
ja 0x101f96c
cmp dword [esi + 0x28], ebx
jbe 0x101f972
push 4
mov ecx, esi
call fcn.0101e64b
push edi
jmp 0x101f9f5
push dword [0x10402fc]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
cmp dword [ebp + 0xc], ebx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov dword [esi], ebx
mov dword [esi + 4], ebx
je 0x101f99a
push 1
push esi
call fcn.0101f204
mov eax, dword [esi + 0x2c]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x101f9aa
push eax
call edi
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x101f9b4
push eax
call edi
mov eax, dword [esi + 0x80]
cmp eax, ebx
je 0x101f9c9
cmp dword [esi + 0x84], ebx
jne 0x101f9c9
push eax
call edi
push 0x1040300
call fcn.0101ccec
cmp dword [ebp + 0x10], ebx
je 0x101f9e3
push dword [esi + 0x18]
push 0x17
push ebx
call fcn.010284c5
push 1
push esi
call fcn.0101efc2
call fcn.0101ddd7
push 0x104030c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret 0xc
Function at 0x101fb69
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0101ce6d
test eax, eax
mov esi, dword [ebp - 4]
je 0x101fad9
push esi
call fcn.0101cf0d
test eax, eax
je 0x101fad9
push 0
push 0
push dword [esi + 0xe4]
lea eax, [esi + 0x6c]
push dword [esi + 0xe0]
push eax
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x88]
push eax
push dword [esi + 0x28]
push 0x1040304
call fcn.0101f55c
mov edi, eax
test edi, edi
jne 0x101fae0
xor edi, edi
jmp 0x101fb8c
mov eax, dword [esi + 0x24]
push dword [ebp + 8]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0xd4]
mov dword [edi + 0xec], eax
call fcn.01035adb
mov dword [edi + 0x2c], eax
mov eax, dword [esi + reloc.msvcrt.dll___p__fmode]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
mov eax, dword [esi + reloc.msvcrt.dll___p__fmode]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
mov eax, dword [esi + reloc.msvcrt.dll___p__fmode]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
mov eax, dword [esi + reloc.msvcrt.dll___p__fmode]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
mov eax, dword [esi + reloc.msvcrt.dll___p__fmode]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
lea eax, reloc.msvcrt.dll___p__fmode
push eax
lea eax, reloc.msvcrt.dll___p__fmode
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0xf0]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
mov eax, dword [esi + 0xf4]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
mov eax, dword [esi + 0xe8]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
mov eax, dword [esi + 0xec]
mov dword [edi + reloc.msvcrt.dll___p__fmode], eax
xor edi, edi
inc edi
push esi
call fcn.01035abf
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x1020044
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [reloc.msvcrt.dll___p__fmode]
and dword [ebp - reloc.msvcrt.dll___p__fmode], 0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov edi, 0x1040378
push edi
mov dword [ebp - 4], eax
lea eax, reloc.msvcrt.dll___p__fmode
push 0x1002c4c
push eax
call esi
add esp, 0xc
lea eax, reloc.msvcrt.dll___p__fmode
push eax
lea eax, reloc.msvcrt.dll___p__fmode
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, reloc.msvcrt.dll___p__fmode
jne 0x1020031
xor eax, eax
inc eax
jmp 0x1020088
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push edi
lea eax, reloc.msvcrt.dll___p__fmode
push 0x1001a58
push eax
call esi
add esp, 0x10
lea eax, reloc.msvcrt.dll___p__fmode
push eax
call fcn.0101fc62
test eax, eax
jne 0x1020064
mov dword [ebp - reloc.msvcrt.dll___p__fmode], 1
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1020031
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp dword [ebp - reloc.msvcrt.dll___p__fmode], eax
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01031d91
leave
ret
Function at 0x10272eb
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0
push esi
mov edi, ecx
call fcn.01026801
push dword [ebp + 0x14]
mov ebx, eax
mov eax, dword [reloc.msvcrt.dll___p__fmode]
mov dword [ebx], eax
mov eax, dword [reloc.msvcrt.dll___p__fmode]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
push eax
call fcn.01010574
inc dword [edi + 0xc]
cmp esi, dword [edi + 4]
je 0x1027347
mov eax, dword [ebp + 0xc]
cmp eax, dword [reloc.msvcrt.dll___p__fmode]
jne 0x1027347
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, dword [esi + 0xc]
jb 0x1027347
mov dword [esi + 8], ebx
mov eax, dword [edi + 4]
cmp esi, dword [eax + 8]
jne 0x102735e
mov dword [eax + 8], ebx
jmp 0x102735e
mov dword [esi], ebx
mov eax, dword [edi + 4]
cmp esi, eax
jne 0x1027358
mov dword [eax + 4], ebx
mov eax, dword [edi + 4]
jmp 0x1027342
cmp esi, dword [eax]
jne 0x102735e
mov dword [eax], ebx
mov eax, dword [edi + 4]
cmp ebx, dword [eax + 4]
mov esi, ebx
je 0x102741c
mov eax, dword [esi + 4]
cmp dword [eax + 0x10], 0
jne 0x102741c
mov edx, dword [eax + 4]
mov ecx, dword [edx]
cmp eax, ecx
jne 0x10273db
mov ecx, dword [edx + 8]
cmp dword [ecx + 0x10], 0
jne 0x10273a9
mov edx, dword [esi + 4]
xor eax, eax
inc eax
mov dword [edx + 0x10], eax
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
and dword [eax + 0x10], 0
mov eax, dword [esi + 4]
mov esi, dword [eax + 4]
jmp 0x1027410
cmp esi, dword [eax + 8]
jne 0x10273b8
mov esi, eax
push esi
mov ecx, edi
call fcn.0102646e
mov eax, dword [esi + 4]
mov dword [eax + 0x10], 1
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
and dword [eax + 0x10], 0
mov eax, dword [esi + 4]
push dword [eax + 4]
mov ecx, edi
call fcn.010264bc
jmp 0x1027410
cmp dword [ecx + 0x10], 0
je 0x102738b
cmp esi, dword [eax]
jne 0x10273ef
mov esi, eax
push esi
mov ecx, edi
call fcn.010264bc
mov eax, dword [esi + 4]
mov dword [eax + 0x10], 1
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
and dword [eax + 0x10], 0
mov eax, dword [esi + 4]
push dword [eax + 4]
mov ecx, edi
call fcn.0102646e
mov eax, dword [edi + 4]
cmp esi, dword [eax + 4]
jne 0x102736c
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
pop ebp
ret 0x10

Function at 0x10276ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push eax
push ecx
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.0102760a
push dword [esi + 4]
call fcn.0103228c
and dword [esi + 4], 0
and dword [esi + 0xc], 0
pop ecx
lea ecx, [ebp - 4]
xor esi, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
dec dword [reloc.msvcrt.dll___p__fmode]
jne 0x1027730
mov esi, dword [reloc.msvcrt.dll___p__fmode]
and dword [reloc.msvcrt.dll___p__fmode], 0
lea ecx, [ebp - 4]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
test esi, esi
je 0x1027744
push esi
call fcn.0103228c
pop ecx
pop esi
leave
ret
Function at 0x10281ea
Capabilities:
Get file size

Disassembly:
mov eax, dword [reloc.msvcrt.dll___p__fmode]
push ebx
xor ebx, ebx
test eax, eax
jne 0x10281fd
push esi
mov esi, 0x55f0
push eax
jmp 0x10281ce
mov dword [eax], esi
push dword [0x104171c]
push 0x20000
push 0
call fcn.01032560
mov edx, eax
mov eax, dword [reloc.msvcrt.dll___p__fmode]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax]
jbe 0x10281eb
test edx, edx
je 0x10281c3
cmp edx, 0x8000004d
je 0x10281c3
cmp edx, 0x80000044
jne 0x10281eb
mov esi, ebx
inc ebx
test esi, esi
jne 0x10281eb
lea esi, [ecx + 1]
push eax
call fcn.01035abf
and dword [reloc.msvcrt.dll___p__fmode], 0
push esi
call fcn.01035a36
test eax, eax
mov dword [reloc.msvcrt.dll___p__fmode], eax
jne 0x102818d
jmp 0x10281fc
test edx, edx
je 0x10281fc
push eax
call fcn.01035abf
xor eax, eax
mov dword [reloc.msvcrt.dll___p__fmode], eax
pop esi
xor ecx, ecx
test eax, eax
setne cl
pop ebx
mov eax, ecx
ret

Function at 0x10282a0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [reloc.msvcrt.dll___p__fmode]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
xor esi, esi
mov edi, 0x2b8
push 0x200
lea eax, reloc.msvcrt.dll___p__fmode
push eax
push dword [esi + 0x103fbe0]
push dword [ebp - 0x408]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10282bb
lea eax, reloc.msvcrt.dll___p__fmode
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
call fcn.01035a36
cmp eax, ebx
mov dword [esi + reloc.msvcrt.dll___p__fmode], eax
je 0x10282af
lea ecx, reloc.msvcrt.dll___p__fmode
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
add esi, 0xc
cmp esi, edi
pop ecx
pop ecx
jb 0x1028244
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01031d91
leave
ret
mov dword [ebp - reloc.msvcrt.dll___p__fmode], reloc.ADVAPI32.dll_RevertToSelf
jmp 0x10282c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - reloc.msvcrt.dll___p__fmode], eax
lea esi, reloc.msvcrt.dll___p__fmode
push dword [esi]
call fcn.01035abf
and dword [esi], 0
add ebx, 0xc
cmp ebx, edi
jb 0x10282c7
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10282a2
Function at 0x102875f
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [reloc.msvcrt.dll___p__fmode]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x20]
mov dword [ebp - 4], eax
push 0x100
lea eax, reloc.msvcrt.dll___p__fmode
push eax
lea eax, [edi + 0x28]
push eax
call fcn.01035be6
push reloc.ADVAPI32.dll_RegCreateKeyW
lea eax, [ebp - 0x84]
push eax
push dword [edi + 0x46c]
call dword [sym.imp.msvcrt.dll__ltow]
mov eax, dword [edi + reloc.msvcrt.dll___p__fmode]
add esp, 0xc
cmp eax, 9
jne 0x10286c4
mov eax, dword [edi + 8]
push dword [eax + 0x24]
lea eax, reloc.msvcrt.dll___p__fmode
push eax
lea eax, [ebp - 0x84]
push eax
push dword [edi + 0x460]
add edi, 0x38
push edi
push dword [esi + 0x118]
push dword [esi + 0xc4]
push dword [esi + 0xa8]
push dword [esi + 0xd8]
push dword [esi + 0xa0]
push 0x40007d09
push reloc.ADVAPI32.dll_RegCreateKeyW
push 3
push 2
call fcn.01034ce2
add esp, 0x38
jmp 0x1028807
cmp eax, 8
jne 0x10286d6
push 3
pop ecx
mov eax, 0x40007d1d
jmp 0x10287d1
mov eax, dword [edi + reloc.msvcrt.dll___p__fmode]
cmp eax, 0xb
ja 0x102877b
je 0x1028760
dec eax
je 0x1028745
sub eax, 7
je 0x1028724
dec eax
je 0x1028706
dec eax
jne 0x1028807
xor ecx, ecx
inc ecx
mov eax, 0xc0007d60
jmp 0x10287d1
mov eax, dword [ebp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
neg eax
sbb eax, eax
and eax, 0xc0000001
add eax, 0xc0007d0c
jmp 0x10287d1
mov eax, dword [ebp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
neg eax
sbb eax, eax
and eax, 0xc0000001
add eax, 0xc0007d0a
lea ecx, [ecx + ecx + 1]
jmp 0x10287d1
mov eax, dword [ebp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
neg eax
sbb eax, eax
and eax, 0xc0000001
add eax, 0xc0007d10
jmp 0x10287d1
mov eax, dword [ebp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
neg eax
sbb eax, eax
and eax, 0xc0000001
add eax, 0xc0007d1f
jmp 0x10287d1
sub eax, 0xc
je 0x10287b8
dec eax
je 0x10287ae
dec eax
je 0x10287a4
dec eax
jne 0x1028807
mov eax, dword [ebp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
neg eax
sbb eax, eax
and eax, 0xc0000001
add eax, 0xc0007d0e
jmp 0x10287d1
xor ecx, ecx
inc ecx
mov eax, 0xc0007d5e
jmp 0x10287d1
xor ecx, ecx
inc ecx
mov eax, 0xc0007d5f
jmp 0x10287d1
mov eax, dword [ebp + 0xc]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
neg eax
sbb eax, eax
and eax, 0xc0000001
add eax, 0xc0007d1b
mov edx, dword [edi + 8]
push dword [edx + 0x24]
add edi, 0x38
push edi
push dword [esi + 0x118]
push dword [esi + 0xc4]
push dword [esi + 0xa8]
push dword [esi + 0xd8]
push dword [esi + 0xa0]
push eax
push 7
push ecx
push 2
call fcn.01034ce2
add esp, 0x2c
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01031d91
leave
ret 8
Function at 0x1028b92
Capabilities:
Create thread

Disassembly:
push 0x18
push 0x1004538
call fcn.01032098
mov esi, 0x1044
push esi
call fcn.01035a36
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x1028b48
push 8
pop esi
jmp 0x1028b8f
mov dword [edi], DocumentPropertiesW
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x20]
push ecx
push esi
push edi
push dword [ebp + 8]
call dword [eax + 0x888]
mov esi, eax
mov dword [ebp - 0x24], esi
or dword [ebp - 4], 0xffffffff
jmp 0x1028b8f
test esi, esi
jne 0x1028b9a
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
jmp 0x1028ba0
push edi
call fcn.01035abf
mov eax, esi
call fcn.010320d3
ret 0xc
Function at 0x102e0c1
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x103a6cb
call fcn.01032268
sub esp, 0x28
push ebx
push esi
push edi
mov esi, ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x28], 0
call fcn.0102726d
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 1
mov byte [ebp - 4], 1
jne 0x102e0ef
mov eax, dword [esi + 8]
cmp eax, dword [ebp + 0xc]
jne 0x102e114
xor edi, edi
cmp edi, dword [ebp + 0xc]
jae 0x102e151
mov eax, dword [ebp + 8]
lea esi, [eax + edi*4]
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.010276ba
cmp byte [eax + 4], 0
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
jne 0x102e127
or dword [ebp - 4], reloc.msvcrt.dll___p__fmode
lea ecx, [ebp - 0x30]
call fcn.010276e4
mov eax, 0x1b5b
jmp 0x102e161
push dword [esi]
call fcn.0102d54f
test eax, eax
jne 0x102e143
or dword [ebp - 4], reloc.msvcrt.dll___p__fmode
lea ecx, [ebp - 0x30]
call fcn.010276e4
push 0x14
pop eax
jmp 0x102e161
inc edi
jmp 0x102e0f1
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.010276e4
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc