joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016066
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100a52b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov esi, ecx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x10016090
push eax
jmp 0x100160e0
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x100160d7
cmp dword [esi + 0x18], 8
jb 0x100160b4
mov eax, dword [esi + 4]
jmp 0x100160b7
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.1006aadf
pop ecx
pop ecx
test eax, eax
je 0x100160f6
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100160a9
test edi, edi
je 0x100160e6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10069957
leave
ret
mov esi, dword [ebp - 0x228]
test edi, edi
je 0x10016107
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x100160e8

Function at 0x100163a3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084f92
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2030
call fcn.10076990
mov eax, dword [0x100a52b4]
xor eax, esp
mov dword [esp + 0x202c], eax
push esi
push edi
mov eax, dword [0x100a52b4]
xor eax, esp
push eax
lea eax, [esp + 0x2040]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
call fcn.10063468
and dword [esp + 0x2048], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea esi, [esp + 0x14]
call fcn.100150e1
mov esi, dword [esp + 0x20]
cmp esi, dword [esp + 0x24]
jbe 0x10016417
call fcn.1006a565
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x20], esi
jbe 0x10016432
call fcn.1006a565
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10016440
cmp eax, dword [esp + 0x14]
je 0x10016445
call fcn.1006a565
cmp dword [esp + 0x10], esi
je 0x100164e1
lea esi, [esp + 0xc]
call fcn.1001081f
mov esi, dword [eax]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001649f
push 0x2000
lea eax, [esp + 0x38]
push 0
push eax
call fcn.1006c610
add esp, 0xc
push 0x1000
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x34]
push str.SearchSettings64FE4559D7_F7D6_4905_99B3_9BB1DDA607C5
push eax
call fcn.1006aadf
pop ecx
pop ecx
test eax, eax
je 0x100164b1
lea edi, [esp + 0x2c]
lea esi, [esp + 0xc]
call fcn.10010343
jmp 0x10016423
mov edi, esi
lea esi, [esp + 0x14]
call fcn.100102e8
mov eax, edi
mov ecx, dword [esp + 0x2040]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x202c]
xor ecx, esp
call fcn.10069957
mov esp, ebp
pop ebp
ret
xor edi, edi
jmp 0x100164b3
Function at 0x100179df
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
xor edi, edi
cmp dword [0x100a9828], edi
je 0x100179f6
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x100a9820], edi
jne 0x10017a3c
cmp dword [0x100a9828], edi
jne 0x10017a0f
call fcn.100177be
test eax, eax
je 0x10017a41
mov eax, dword [0x100a9810]
mov esi, dword [0x100a814c]
cmp eax, edi
jne 0x10017a31
push str.ActivateActCtx
call fcn.10017a67
cmp eax, edi
je 0x10017a41
mov dword [0x100a9810], eax
push dword [esp + 0xc]
push esi
call eax
cmp eax, edi
je 0x10017a41
xor edi, edi
inc edi
jmp 0x10017a60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x10017a56
cmp eax, 0x7e
je 0x10017a56
cmp eax, 0x78
jne 0x10017a60
xor eax, eax
inc eax
mov dword [0x100a9820], eax
mov edi, eax
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x10017a67
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
push ebp
push esi
push edi
xor edi, edi
mov ebp, SysReAllocString
cmp dword [0x100a980c], edi
jne 0x10017aab
call ebx
test ebp, eax
je 0x10017aa1
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x100a9808], eax
mov dword [0x100a980c], 1
mov eax, dword [0x100a9808]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10017ac7
push dword [esp + 0x14]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x10017b02
mov eax, dword [0x100a9804]
test eax, eax
jne 0x10017af9
call ebx
test ebp, eax
je 0x10017ae4
push dword [0x10094074]
call dword [0x10094070]
jmp 0x10017af0
push dword [0x1009406c]
call dword [0x10094068]
test eax, eax
je 0x10017b02
mov dword [0x100a9804], eax
push dword [esp + 0x14]
push eax
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x10017e15
Capabilities:
Write file on windows

Disassembly:
push 0xc4
mov eax, 0x10084523
call fcn.1006cda6
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, ecx
cmp dword [eax + 0x14], edi
jne 0x10017e39
xor eax, eax
inc eax
call fcn.1006ce29
ret
cmp dword [esi + 0x14], edi
jne 0x10017e43
push 8
pop eax
jmp 0x10017e33
cmp dword [eax + 0x18], 8
jb 0x10017e4e
mov eax, dword [eax + 4]
jmp 0x10017e51
add eax, 4
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10017e72
push 9
jmp 0x10017e40
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.10011892
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.100188c3
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
dec eax
je 0x10017ef0
dec eax
je 0x10017eb1
push 5
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.100118ae
mov eax, esi
jmp 0x10017e33
push str...
lea ecx, [ebp - 0x2c]
call fcn.10010474
cmp dword [esi + 0x18], 8
jb 0x10017ec9
mov edx, dword [esi + 4]
jmp 0x10017ecc
lea edx, [esi + 4]
lea ecx, [ebp - 0x4c]
call fcn.10018b0d
push 0xffffffffffffffff
push edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.10014394
push edi
push 1
lea ecx, [ebp - 0x4c]
call fcn.100118ae
jmp 0x10017f45
cmp dword [esi + 0x18], 8
jb 0x10017efb
mov esi, dword [esi + 4]
jmp 0x10017efe
add esi, 4
lea eax, [ebp - 0xcc]
push 3
mov dword [ebp - 0xd0], eax
push esi
lea eax, [ebp - 0xd0]
push eax
call fcn.1001898c
mov byte [ebp - 4], 2
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x2c]
call fcn.10010474
lea eax, [ebp - 0xcc]
cmp dword [ebp - 0xd0], eax
je 0x10017f45
push dword [ebp - 0xd0]
call fcn.10069966
pop ecx
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], edi
jae 0x10017f54
lea eax, [ebp - 0x28]
push edi
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10017f6f
push 0xa
jmp 0x10017e9a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x10017f82
push 6
pop esi
jmp 0x10017ea2
xor esi, esi
jmp 0x10017ea2
Function at 0x10017f89
Capabilities:
Create directory

Disassembly:
push 0x2c
mov eax, 0x100863cc
call fcn.1006cd3d
cmp dword [ebx + 0x18], 8
jb 0x10017fa5
lea esi, [ebx + 4]
mov eax, dword [esi]
mov dword [ebp - 0x18], esi
jmp 0x10017fad
lea eax, [ebx + 4]
mov dword [ebp - 0x18], eax
mov esi, eax
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100114f6
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebx + 0x14], edi
je 0x100180c3
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x100180c3
push edi
push 0x1008bf40
push ebx
call fcn.100101a4
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x1001807c
push dword [ebp - 0x14]
lea esi, [ebp - 0x38]
push 0
push ebx
call fcn.1001021d
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 8
jb 0x1001800b
mov eax, dword [eax + 4]
jmp 0x1001800e
add eax, 4
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100114f6
lea eax, [ebp - 0x1c]
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.10010030
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.100112f1
push 0
push 1
lea esi, [ebp - 0x38]
mov byte [ebp - 4], 0
call fcn.10001673
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1001805d
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100180d6
mov eax, dword [ebp - 0x14]
inc eax
push eax
push 0x1008bf40
push ebx
call fcn.100101a4
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x10017fee
mov esi, dword [ebp - 0x18]
cmp dword [ebx + 0x18], 8
jb 0x10018084
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x1c]
push eax
call fcn.100114f6
lea eax, [ebp - 0x1c]
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.10010030
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.100112f1
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x100180c3
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100180d6
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.100112f1
xor eax, eax
call fcn.1006ce15
ret
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.100112f1
push 7
pop eax
jmp 0x100180d0

Function at 0x10018149
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x10018157
mov eax, dword [esi]
jmp 0x10018159
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10018179
cmp dword [edi + 0x18], 8
jb 0x1001816c
mov esi, dword [esi]
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x1001817d
Capabilities:
Get file attributes
Set file attributes

Disassembly:
cmp dword [edi + 0x18], 8
push esi
lea esi, [edi + 4]
jb 0x1001818b
mov eax, dword [esi]
jmp 0x1001818d
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [edi + 0x18], 8
jb 0x1001819c
mov esi, dword [esi]
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop esi
ret
Function at 0x100181a9
Capabilities:
Delete file

Disassembly:
push edi
push 0x1008ad00
mov edi, eax
call fcn.1001024b
test eax, eax
jne 0x100181bc
pop edi
ret
call fcn.1001817d
cmp dword [edi + 0x18], 8
jb 0x100181cc
mov edi, dword [edi + 4]
jmp 0x100181cf
add edi, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop edi
ret

Function at 0x10018243
Capabilities:
Copy file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
push edi
mov edi, eax
jb 0x10018288
cmp dword [edi + 0x14], 1
jb 0x10018288
call fcn.1001817d
cmp dword [edi + 0x18], 8
jb 0x10018265
mov edi, dword [edi + 4]
jmp 0x10018268
add edi, 4
cmp dword [esi + 0x18], 8
jb 0x10018273
mov esi, dword [esi + 4]
jmp 0x10018276
add esi, 4
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
neg eax
jmp 0x1001828a
xor eax, eax
pop edi
pop esi
ret

Function at 0x1001828d
Capabilities:
Enumerate files on windows

Disassembly:
push 0x29c
mov eax, 0x10084f5f
call fcn.1006cda6
mov edi, edx
mov eax, edi
mov esi, ecx
mov dword [ebp - 0x28c], edi
call fcn.100125cb
cmp dword [esi + 0x18], 8
jb 0x100182b8
mov esi, dword [esi + 4]
jmp 0x100182bb
add esi, 4
lea eax, [ebp - 0x284]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x288], eax
cmp eax, 0xffffffff
jne 0x100182dc
xor eax, eax
call fcn.1006ce29
ret
lea eax, [ebp - 0x258]
push eax
lea esi, [ebp - 0x30]
call fcn.10001236
and dword [ebp - 4], 0
mov ebx, 0x1008b5d8
push ebx
mov eax, esi
call fcn.1001024b
test eax, eax
je 0x1001833d
push 0x10094108
mov eax, esi
call fcn.1001024b
test eax, eax
je 0x1001833d
lea eax, [ebp - 0x258]
push eax
lea esi, [ebp - 0x2a8]
call fcn.10001236
mov eax, esi
push eax
mov eax, edi
mov byte [ebp - 4], 1
call fcn.10012564
push 0
push 1
mov byte [ebp - 4], 0
call fcn.10001673
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x100183ad
test byte [ebp - 0x284], 0x10
je 0x100183ad
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1000164e
push ebx
lea eax, [ebp - 0x30]
call fcn.1001024b
test eax, eax
je 0x100183ad
push 0x10094108
lea eax, [ebp - 0x30]
call fcn.1001024b
test eax, eax
je 0x100183ad
lea eax, [ebp - 0x258]
push eax
lea esi, [ebp - 0x2a8]
call fcn.10001236
mov eax, esi
push eax
mov eax, dword [ebp - 0x28c]
mov byte [ebp - 4], 2
call fcn.10012564
push 0
push 1
mov byte [ebp - 4], 0
call fcn.10001673
lea eax, [ebp - 0x284]
push eax
push dword [ebp - 0x288]
call edi
test eax, eax
jne 0x10018345
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x288]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
cmp esi, 0x12
je 0x100183ee
push 0
push 1
lea esi, [ebp - 0x30]
call fcn.10001673
mov eax, edi
jmp 0x100182d6
inc edi
jmp 0x100183db
Function at 0x100187a4
Capabilities:
Check if file exists

Disassembly:
cmp dword [eax + 0x14], 0
jne 0x100187ad
xor eax, eax
ret
cmp dword [eax + 0x18], 8
jb 0x100187b8
mov eax, dword [eax + 4]
jmp 0x100187bb
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
ret

Function at 0x100187c3
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
cmp dword [eax + 0x18], 8
push edi
jb 0x100187d9
mov eax, dword [eax + 4]
jmp 0x100187dc
add eax, 4
push ebx
push 0x2000000
push 3
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10018841
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x1001883a
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x1001883a
xor ebx, ebx
inc ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x10018848
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x100a52b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1008ad00
push edi
mov esi, ecx
call fcn.1000164e
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.1006c610
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x1001888a
mov esi, dword [esi + 4]
jmp 0x1001888d
add esi, 4
lea eax, [ebp - 0x804]
push eax
push 0
push str.crx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop esi
test eax, eax
je 0x100188b7
lea eax, [ebp - 0x804]
push eax
push edi
call fcn.1000164e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069957
leave
ret
Function at 0x1001a4f2
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.10076990
mov eax, dword [0x100a52b4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x3c
push 0
push esi
mov edi, ecx
call fcn.1006c610
lea eax, [ebp - 0x2004]
mov dword [esi + 0x10], eax
mov eax, 0x1000
lea ecx, [ebp - 0x4004]
mov dword [esi], 0x3c
mov dword [esi + 0x14], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x14]
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x1001a54a
mov edi, dword [edi + 4]
jmp 0x1001a54d
add edi, 4
push esi
push 0
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
pop edi
call fcn.10069957
leave
ret

Function at 0x1001b650
Capabilities:
Clear file content

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push esi
call fcn.1001b618
test eax, eax
jl 0x1001b679
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1001b677
call fcn.100069a7
jmp 0x1001b679
xor eax, eax
ret 8
Function at 0x10026187
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x100261b0
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x10090518]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x10026190
pop esi
ret

Function at 0x10026969
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
and dword [esp], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x20]
push edi
test eax, eax
je 0x100269ac
cdq
mov edi, eax
add eax, dword [ebp + 0xc]
mov ebx, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push ebx
sub eax, 1
push edi
sbb ecx, 0
push ecx
push eax
call fcn.10075010
push ebx
push edi
push edx
push eax
call fcn.10075180
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10026794
pop ecx
pop ecx
test eax, eax
je 0x100269c9
push 0x7e4b
mov edi, str.winTruncate1
jmp 0x100269e9
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100269fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
push 0x7e4e
mov edi, str.winTruncate2
mov ecx, dword [esi + 0x1c]
push 0x60a
call fcn.100266ef
pop ecx
mov dword [esp + 0x10], eax
pop ecx
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10026a43
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10026a87
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10026a87
mov ecx, dword [esi + 0x1c]
push 0x7ea0
push 0x70a
mov edi, str.winFileSize
mov dword [esi + 0x10], eax
call fcn.100266ef
pop ecx
pop ecx
jmp 0x10026aa7
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.10075180
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x10027530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x100a52b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100a96f8]
push ebx
push esi
test eax, eax
je 0x1002756a
push eax
push 0x100968dc
lea eax, [ebp - 0x110]
push eax
push 0xe6
call fcn.10024c7c
add esp, 0x10
jmp 0x100275e2
call fcn.1002644f
mov esi, 0xe6
test eax, eax
je 0x100275aa
lea eax, [ebp - 0x318]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x318]
push eax
call fcn.100264fc
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x100275c6
push 7
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10069957
leave
ret
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x218]
push eax
call fcn.100265bd
jmp 0x10027592
push ebx
push 0x100968dc
lea eax, [ebp - 0x110]
push eax
push esi
call fcn.10024c7c
push ebx
call fcn.10069966
add esp, 0x14
mov ecx, str.etilqs_
call fcn.10025420
lea ecx, [ebp - 0x110]
mov edx, eax
call fcn.10025420
lea eax, [edx + eax + 0x11]
cmp eax, 0x105
jl 0x10027609
xor eax, eax
inc eax
jmp 0x1002759c
lea ecx, [ebp - 0x110]
call fcn.10025420
test eax, eax
jbe 0x10027622
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x10027622
dec eax
jne 0x10027619
mov byte [ebp + eax - 0x110], 0
lea eax, [ebp - 0x110]
push eax
push str._setilqs_
push edi
push 0xf4
call fcn.10024c7c
mov ecx, edi
call fcn.10025420
mov esi, eax
lea eax, [edi + esi]
push eax
push 0xf
call fcn.10024e7b
add esp, 0x18
push 0xf
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x1002765b
mov byte [edi + esi], cl
xor eax, eax
jmp 0x1002759c

Function at 0x10027861
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x18]
xor ebp, ebp
xor ebx, ebx
call fcn.100274f9
mov esi, eax
pop ecx
test esi, esi
jne 0x10027881
push 7
pop eax
jmp 0x1002791d
call fcn.1002644f
test eax, eax
je 0x100278bc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100278ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x100278ee
inc ebp
cmp ebp, 5
jge 0x100278ee
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002788a
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100278de
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x100278ee
inc ebp
cmp ebp, 5
jge 0x100278ee
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100278bc
push esi
call fcn.10069966
pop ecx
cmp edi, 0xffffffff
jne 0x10027903
cmp ebx, 2
jne 0x10027903
xor eax, eax
jmp 0x1002791d
mov ecx, dword [esp + 0x18]
push 0x83f7
push 0xa0a
mov edi, str.winDelete
call fcn.100266ef
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10027ae8
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100a52b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
lea ecx, [ebp - 0x110]
push ecx
push 0x104
push eax
push dword [ebp + 8]
mov dword [ebp - 0x118], 0x200
call fcn.100279f5
add esp, 0x10
test eax, eax
jne 0x10027bc9
lea eax, [ebp - 0x110]
push eax
call fcn.100274f9
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
je 0x10027bbf
call fcn.1002644f
test eax, eax
mov eax, esi
je 0x10027b83
cmp word [esi], bx
je 0x10027b64
cmp word [eax], 0x5c
je 0x10027b5f
inc eax
inc eax
cmp word [eax], bx
jne 0x10027b50
jmp 0x10027b64
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10027bb2
cmp byte [esi], bl
je 0x10027b95
cmp byte [eax], 0x5c
je 0x10027b93
inc eax
cmp byte [eax], bl
jne 0x10027b87
jmp 0x10027b95
mov byte [eax], bl
lea eax, [ebp - 0x114]
push eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.10069966
pop ecx
cmp edi, ebx
jne 0x10027bc9
mov dword [ebp - 0x118], 0x200
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x118]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10069957
leave
ret