joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21008529
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x21008556
push 2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x210085db
mov edx, dword [ebp - 4]
push edx
call fcn.21006b09
add esp, 4
test eax, eax
je 0x2100856e
jmp 0x21008547
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jl 0x2100857b
mov eax, dword [ebp - 8]
jmp 0x210085de
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
lea eax, [edx + edx + 2]
push eax
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x210085ac
mov eax, dword [ebp - 8]
jmp 0x210085de
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax + edx*4], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x21008547
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x21008959
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x104
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [ebp + 0x10]
and edx, 1
test edx, edx
jne 0x21008993
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.2104bee0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.210089ae
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x21008bf8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jne 0x21008c08
xor eax, eax
jmp 0x21008c82
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x21008c1f
xor eax, eax
jmp 0x21008c82
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + ecx + 2]
push edx
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x21008c42
xor eax, eax
jmp 0x21008c82
mov ecx, dword [ebp - 0xc]
add ecx, 1
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.2105aabf
add esp, 8
and eax, 0xffff
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.2106e0a6
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x2100c7ea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
shl eax, 1
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x2100c81c
xor eax, eax
jmp 0x2100c82e
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
or ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov dword [edx], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x2100c8b5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
call fcn.2105e7d8
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebp
ret
Function at 0x2100daf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
je 0x2100db1f
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
cmp dword [ebp + 0x18], 0
je 0x2100db2e
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
cmp dword [0x2109c234], 0
je 0x2100db3e
mov dword [ebp + 0xc], 0
mov dword [ebp - 8], 0
mov word [ebp - 0x208], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [ebp + 0xc], 0
je 0x2100db7d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ax, word [edx]
test eax, eax
je 0x2100db7d
mov dword [ebp - 0x214], 0
jmp 0x2100db87
mov dword [ebp - 0x214], 1
cmp dword [ebp - 0x214], 0
jne 0x2100dba5
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
call fcn.21054263
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x2100dbc3
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
test ecx, ecx
je 0x2100dbc3
mov dword [ebp - 0x218], 0
jmp 0x2100dbcd
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x218], 0
jne 0x2100dbe5
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x208]
and eax, 0xffff
test eax, eax
je 0x2100dc46
cmp dword [ebp + 0x18], 0
jne 0x2100dc20
push 0xfa
lea ecx, [ebp - 0x208]
push ecx
call fcn.21058ab6
add esp, 8
mov dword [ebp - 0x210], eax
jmp 0x2100dc46
push 0xfa
lea edx, [ebp - 0x208]
push edx
call fcn.21058b4f
add esp, 8
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0
setne al
mov dword [ebp - 0x210], eax
cmp dword [ebp + 0x14], 0
je 0x2100dc57
cmp dword [ebp - 4], 0
je 0x2100dc57
jmp 0x2100dce4
cmp dword [ebp + 0x18], 0
je 0x2100dc65
cmp dword [ebp - 8], 0
je 0x2100dc65
jmp 0x2100dce4
cmp dword [ebp - 4], 0
je 0x2100dc73
cmp dword [ebp + 0x18], 0
jne 0x2100dc73
jmp 0x2100dce4
cmp dword [ebp - 0x210], 0
je 0x2100dc84
cmp dword [ebp + 0x14], 0
jne 0x2100dc84
jmp 0x2100dce4
cmp dword [ebp + 0x10], 0
je 0x2100dc98
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x20c]
jbe 0x2100dc9c
xor eax, eax
jmp 0x2100dd05
mov ecx, dword [ebp - 0x208]
and ecx, 0xffff
test ecx, ecx
je 0x2100dcbe
push 0xfa
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
call fcn.2105c104
add esp, 0xc
test eax, eax
jne 0x2100dcdf
xor eax, eax
jmp 0x2100dd05
jmp 0x2100dba5
cmp dword [ebp + 0x14], 0
je 0x2100dcf2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp + 0x18], 0
je 0x2100dd00
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x2100e01c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jne 0x2100e02c
xor eax, eax
jmp 0x2100e093
mov dword [ebp - 0x10], 0
push 4
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.2105e440
add esp, 0xc
push 4
lea edx, [ebp + 0x10]
push edx
lea eax, [ebp - 8]
push eax
call fcn.2105e440
add esp, 0xc
push 4
lea ecx, [ebp + 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.2105e440
add esp, 0xc
push 0
lea eax, [ebp - 0x14]
push eax
push 0xc
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x2100e085
jmp 0x2100e091
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
jmp 0x2100e093
jmp 0x2100e08c
mov esp, ebp
pop ebp
ret

Function at 0x2100e097
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jne 0x2100e0aa
xor eax, eax
jmp 0x2100e148
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x14]
add eax, 4
push eax
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jne 0x2100e0da
xor eax, eax
jmp 0x2100e148
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
cmp dword [ebp + 0x14], 0
je 0x2100e0ff
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
call fcn.2105e440
add esp, 0xc
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
add ecx, 4
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
jne 0x2100e128
jmp 0x2100e146
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.2106e0a6
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x2100e148
jmp 0x2100e12f
mov esp, ebp
pop ebp
ret
Function at 0x2100f782
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [0x2109a564]
call fcn.21030bc6
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret 4

Function at 0x2100fc2e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov dword [ebp - 0x314], ecx
mov eax, dword [ebp - 0x314]
cmp dword [eax + 0x60], 0
je 0x2100fcef
push 0
push 0x2109c540
push 0xc8
lea ecx, [ebp - 0x310]
push ecx
call fcn.21003492
add esp, 0x10
lea edx, [ebp - 0x310]
push edx
call fcn.2105e7d8
add esp, 4
lea eax, [ebp + eax*2 - 0x30e]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
mov word [ecx], 0x432
mov edx, dword [ebp - 0x10c]
add edx, 2
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
mov ecx, dword [0x2109bbd0]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10c]
add edx, 4
mov dword [ebp - 0x10c], edx
push 0
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x10c]
lea edx, [ebp - 0x310]
sub ecx, edx
push ecx
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp - 0x314]
mov edx, dword [ecx + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x2100fd72
push 0
push 0
push 0x2109c540
push 0xc8
lea eax, [ebp - 0x108]
push eax
call fcn.2100338d
add esp, 0x14
lea ecx, [ebp - 0x108]
push ecx
call fcn.2105ed30
add esp, 4
lea edx, [ebp + eax - 0x107]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov word [eax], 0x432
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x2109bbd0]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x108]
sub eax, ecx
push eax
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret
Function at 0x2100fe14
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21079eb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x20]
call fcn.2106d7d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
call fcn.2102ab8b
add esp, 4
push 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.210357c6
add esp, 0xc
test eax, eax
jne 0x2100fe8f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x20]
call fcn.2106d9fe
lea eax, [ebp - 0x20]
push eax
call fcn.2102c683
add esp, 4
mov dword [ebp - 0x24], eax
push 0
lea ecx, [ebp - 0x28]
push ecx
push 4
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.2106d803
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x2100fec7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov dword [ebp - 0xe4], ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0xd8]
add ecx, 4
mov dword [ebp - 0xe0], ecx
push 0x41
lea edx, [ebp - 0xcc]
push edx
call fcn.2102a70b
add esp, 8
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jne 0x2100ff19
mov eax, dword [ebp - 0xe0]
mov byte [eax], 0
jmp 0x2100ff35
push 0
push 0
lea ecx, [ebp - 0xcc]
push ecx
push 0x41
mov edx, dword [ebp - 0xe0]
push edx
call fcn.2100338d
add esp, 0x14
mov eax, dword [ebp - 0xe0]
push eax
call fcn.2105ed30
add esp, 4
mov ecx, dword [ebp - 0xe0]
lea edx, [ecx + eax + 1]
lea eax, [ebp - 0x48]
sub edx, eax
mov dword [ebp - 0xd0], edx
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xe4]
add ecx, 0x5c
call fcn.2106e590
mov edx, dword [ebp - 0xd8]
mov dword [edx], 1
push 0
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0xd0]
push ecx
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0xe4]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret 4
Function at 0x2100ffa1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0x128], ecx
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
add ecx, 4
mov dword [ebp - 0x124], ecx
push 0x41
lea edx, [ebp - 0x110]
push edx
call fcn.2102a70b
add esp, 8
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jne 0x2100fff8
mov eax, dword [ebp - 0x124]
mov word [eax], 0
jmp 0x21010012
push 0
lea ecx, [ebp - 0x110]
push ecx
push 0x41
mov edx, dword [ebp - 0x124]
push edx
call fcn.21003492
add esp, 0x10
mov eax, dword [ebp - 0x124]
push eax
call fcn.2105e7d8
add esp, 4
mov ecx, dword [ebp - 0x124]
lea edx, [ecx + eax*2 + 2]
lea eax, [ebp - 0x8c]
sub edx, eax
mov dword [ebp - 0x114], edx
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x128]
add ecx, 0x5c
call fcn.2106e569
mov edx, dword [ebp - 0x11c]
mov dword [edx], 1
push 0
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x8c]
push edx
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret 4

Function at 0x210101d2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.2102c605
add esp, 4
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 8]
push ecx
push 4
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret 4

Function at 0x21010209
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21079ecb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x2c], ecx
cmp dword [ebp + 8], 0
jne 0x2101023c
push 0
call fcn.2102c683
add esp, 4
mov dword [ebp - 0x10], eax
jmp 0x21010279
lea ecx, [ebp - 0x28]
call fcn.2106d7d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.21038bc8
add esp, 8
lea edx, [ebp - 0x28]
push edx
call fcn.2102c683
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.2106d803
push 0
lea eax, [ebp - 0x14]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x21010590
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21079f34
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
mov dword [ebp - 0x228], ecx
push 0x230
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x21c], 0
je 0x210105ea
mov ecx, dword [ebp - 0x21c]
call fcn.21030a40
mov dword [ebp - 0x22c], eax
jmp 0x210105f4
mov dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x218], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x218]
mov dword [0x2109a564], ecx
cmp dword [0x2109a564], 0
jne 0x21010623
xor eax, eax
jmp 0x210106f9
mov ecx, dword [0x2109a564]
call fcn.21031ef5
lea edx, [ebp - 0x214]
push edx
call fcn.2105aa54
add esp, 4
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x2109b218
push str._s_service
lea ecx, [ebp - 0x214]
push ecx
call fcn.2105e37e
add esp, 0xc
push 0x294
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x224], 0
je 0x210106a5
push 0x2107d9f0
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0x224]
call fcn.2100ef16
mov dword [ebp - 0x230], eax
jmp 0x210106af
mov dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x220]
mov dword [ecx + 0xc], edx
cmp dword [ebp - 0x220], 0
jne 0x210106de
xor eax, eax
jmp 0x210106f9
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax + 0xc]
call fcn.21054ad6
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x21013ad3
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0xffffffff
jne 0x21013b14
call fcn.21013303
push eax
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
push 0x2726
call fcn.21012222
add esp, 0xc
xor eax, eax
jmp 0x21013b19
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x210142de
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x210142f4
mov eax, 1
jmp 0x21014336
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x21014331
call fcn.21013303
push eax
mov edx, dword [ebp - 8]
add edx, 8
push edx
push 0x2727
call fcn.21012222
add esp, 0xc
xor eax, eax
jmp 0x21014336
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x210145bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x210145d3
mov eax, 1
jmp 0x21014615
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x21014610
call fcn.21013303
push eax
mov edx, dword [ebp - 8]
add edx, 8
push edx
push 0x271c
call fcn.21012222
add esp, 0xc
xor eax, eax
jmp 0x21014615
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x21014b73
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x21014b9c
push 0x2108bbdc
call fcn.210123d5
add esp, 4
xor eax, eax
jmp 0x21014ba1
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x210154d6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.210153c3
add esp, 0x10
pop ebp
ret
Function at 0x210162e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x21016309
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
test ecx, ecx
je 0x21016309
mov dword [ebp - 8], 0
jmp 0x21016310
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
je 0x2101631a
xor eax, eax
jmp 0x21016337
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x21016331
xor eax, eax
jmp 0x21016337
mov eax, dword [ebp - 4]
and eax, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x21016395
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x210163af
mov eax, 1
jmp 0x210163dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x210163c3
mov eax, 1
jmp 0x210163dc
cmp dword [ebp + 0xc], 0
jne 0x210163da
mov ecx, dword [ebp + 8]
push ecx
push 0x2722
call fcn.21012222
add esp, 8
xor eax, eax
pop ebp
ret

Function at 0x21016416
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.21014f29
add esp, 8
test eax, eax
jne 0x21016433
mov eax, 1
jmp 0x2101647a
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x21016478
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x2101647a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x2101660f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.2101666b
add esp, 8
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x21016664
cmp dword [ebp + 0x14], 0
jne 0x21016660
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.210150b5
add esp, 4
push eax
push 0x2723
call fcn.21012222
add esp, 0xc
xor eax, eax
jmp 0x21016669
mov eax, 1
pop ebp
ret
Function at 0x2101666b
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x210166bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jne 0x210166a2
mov eax, 1
jmp 0x210166ef
cmp dword [ebp + 0xc], 0
jne 0x210166b9
mov edx, dword [ebp + 8]
push edx
push 0x2721
call fcn.21012222
add esp, 8
xor eax, eax
jmp 0x210166ef
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.21014f29
add esp, 8
test eax, eax
je 0x210166ea
cmp dword [ebp + 0xc], 0
jne 0x210166e6
mov ecx, dword [ebp + 8]
push ecx
push 0x2721
call fcn.21012222
add esp, 8
xor eax, eax
jmp 0x210166ef
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x21016742
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push edi
mov word [ebp - 0x208], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [ebp + 8], 0
jne 0x21016782
lea eax, [ebp - 0x208]
push eax
push 0x104
call fcn.2102a240
add esp, 8
jmp 0x2101679c
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x208]
push edx
call fcn.21003492
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov word [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push str.FPP
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret