joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d6c8
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40d663
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40d681
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
sal bh, cl
mov ch, 0x54
invalid
invalid
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40d6df
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40d6c6
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40d6cf
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40d6d9
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40d6bb
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40d645
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40d72c
dec eax
je 0x40d723
sub eax, 3
je 0x40d71a
mov dword [ebp - 4], 0x40
jmp 0x40d749
mov dword [ebp - 4], 4
jmp 0x40d72f
mov dword [ebp - 4], 0x20
jmp 0x40d72f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40d77b
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40d6fb
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040cf8c
mov dword [0xff9a7903], eax
jne 0x40d786
push 1
push esi
call edi
mov eax, esi
jmp 0x40d787
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1b2b6515
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x5a08642d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10056e7
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1021480], 0
push esi
push edi
mov esi, 0x1021480
jne 0x10057ae
mov edi, 0x104
push edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1005737
push 0x1001400
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1005845
push 0x10013f8
lea eax, [ebp - 0x120]
push eax
push 0x10013f0
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.010056ac
add esp, 0x14
test eax, eax
jns 0x1005763
push 0x10013cc
jmp 0x100572c
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100578a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100578a
push 0x100139c
jmp 0x100572c
push 0x1001388
push 0x1001384
lea eax, [ebp - 0x120]
push eax
push 0x100137c
push edi
push esi
call fcn.010056ac
add esp, 0x18
test eax, eax
js 0x100575c
push 0x1001378
push esi
call fcn.0100e291
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10057cb
push 0x100134c
jmp 0x100572c
lea eax, [ebp - 0x1c]
push eax
call fcn.0100e197
lea eax, [ebp - 0x10]
push eax
call fcn.0100e0c7
pop ecx
pop ecx
lea eax, [ebp - 0x10]
test ebx, ebx
je 0x100580c
push ebx
push 0x1001340
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1001330
lea eax, [ebp - 0x47c]
push 0x258
push eax
call fcn.010056ac
add esp, 0x1c
jmp 0x100582f
push 0x1001340
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x100131c
lea eax, [ebp - 0x47c]
push 0x258
push eax
call fcn.010056ac
add esp, 0x18
lea eax, [ebp - 0x47c]
push esi
push eax
call fcn.0100ded4
push esi
call fcn.0100de53
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100e2ad
leave
ret
Function at 0x10058a3
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1021588], 0
push esi
push edi
mov esi, 0x1021588
jne 0x100596a
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10058f3
push 0x1001400
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1005997
push 0x10013f8
lea eax, [ebp - 0x108]
push eax
push 0x10013f0
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.010056ac
add esp, 0x14
test eax, eax
jns 0x100591f
push 0x10013cc
jmp 0x10058e8
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1005946
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1005946
push 0x100139c
jmp 0x10058e8
push 0x1001430
push 0x1001384
lea eax, [ebp - 0x108]
push eax
push 0x100137c
push edi
push esi
call fcn.010056ac
add esp, 0x18
test eax, eax
js 0x1005918
push 0x1001378
push esi
call fcn.0100e291
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1005987
push 0x100134c
jmp 0x10058e8
push esi
push ebx
call fcn.0100ded4
push esi
call fcn.0100de53
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100e2ad
leave
ret

Function at 0x1005ecb
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 4]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x1005f1b
push esi
call fcn.01005e25
test eax, eax
jne 0x1005f0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x10018c0
call fcn.01005858
add esp, 0xc
jmp 0x1005f17
push esi
push 0x1001878
call fcn.01005858
pop ecx
pop ecx
xor eax, eax
jmp 0x1005f90
push edi
call fcn.0100e334
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x1005f48
push 0x1001858
push ebx
push ebx
push 0x1001840
push 0x158
push 0x1001780
call fcn.010059aa
add esp, 0x18
jmp 0x1005f17
push edi
push ebx
push esi
call fcn.0100e370
add esp, 0xc
push esi
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1005f8e
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001828
push 0x1001840
push 0x161
push 0x1001780
call fcn.010059aa
push esi
call fcn.0100e324
add esp, 0x1c
jmp 0x1005f17
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1006155
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [section..data]
cmp eax, 0xffffffff
je 0x1006182
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x100621e
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100620d
cmp dword [ebp - 0x94], 5
jb 0x100620d
push edi
push 0x10019d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100620c
push esi
push 0x10019b8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100620b
and dword [ebp - 0x9c], 0
push 0
push 4
lea eax, [ebp - 0x9c]
push eax
push 0x1a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x1006204
cmp dword [ebp - 0x9c], 0
je 0x1006204
mov dword [section..data], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x100621e
xor eax, eax
mov dword [section..data], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x10069de
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
xor edi, edi
cmp eax, edi
je 0x1006a06
push edi
push edi
push 0x46b
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1006973
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x138], eax
cmp eax, edi
jne 0x1006a4b
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b04
push 0x1001af0
push 0x2ad
push 0x10019f8
call fcn.010059aa
add esp, 0x18
xor eax, eax
jmp 0x1006a4e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x1006b8b
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006bee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1006be6
cmp eax, 2
je 0x1006be6
push 0
push eax
push 0x1001b3c
push 0x1001b2c
push 0x115
push 0x1001780
call fcn.010059aa
add esp, 0x18
xor eax, eax
jmp 0x1006ca6
xor eax, eax
inc eax
jmp 0x1006ca6
push ebx
push esi
xor ebx, ebx
push edi
test al, 0x10
je 0x1006c71
mov esi, 0x104
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.01006a97
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.0100e302
pop ecx
pop ecx
mov byte [ebp + eax - 0x10b], bl
lea eax, [ebp - 0x10c]
push 0x14
mov dword [ebp - 0x124], eax
pop eax
mov word [ebp - 0x11c], ax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], 3
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x116], ebx
mov dword [ebp - 0x112], 0x1001ac3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x1006c79
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
cmp esi, ebx
jne 0x1006ca2
push edi
push 0x1001b14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1001b2c
push 0x12e
push 0x1001780
call fcn.010059aa
add esp, 0x1c
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100e2ad
leave
ret 4

Function at 0x1006e86
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020004]
cmp eax, 0xffffffff
je 0x1006eb3
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1006f4b
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1006f36
push 0x1001c40
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01006ad3
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.01006d63
test eax, eax
je 0x1006f41
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01005f9f
test eax, eax
je 0x1006f2f
cmp dword [ebp - 0x134], 0x50001
jne 0x1006f41
mov eax, dword [ebp - 0x130]
shr eax, 0x10
mov ecx, 0xa28
cmp ax, cx
jne 0x1006f41
xor eax, eax
inc eax
mov dword [0x1020004], eax
jmp 0x1006f4a
push 0x1001c08
jmp 0x1006f3b
push 0x1001bd0
call fcn.01005858
pop ecx
and dword [0x1020004], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret
Function at 0x1006f5c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020008]
cmp eax, 0xffffffff
je 0x1006f89
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x100700e
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1006ff9
push 0x1001c40
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01006ad3
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.01006d63
test eax, eax
je 0x1007004
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01005f9f
test eax, eax
je 0x1006ff2
cmp dword [ebp - 0x134], 0x50002
jne 0x1007004
xor eax, eax
inc eax
mov dword [0x1020008], eax
jmp 0x100700d
push 0x1001c8c
jmp 0x1006ffe
push 0x1001c50
call fcn.01005858
pop ecx
and dword [0x1020008], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x100701f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102000c]
cmp eax, 0xffffffff
je 0x100704c
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10070d3
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10070bd
lea eax, [ebp - 0x108]
push eax
mov esi, 0x1001c40
push esi
call fcn.01006d63
test eax, eax
je 0x10070c8
push esi
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.01006ad3
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01005f9f
test eax, eax
je 0x10070b6
cmp dword [ebp - 0x134], 0x60000
jb 0x10070c8
xor eax, eax
inc eax
mov dword [0x102000c], eax
jmp 0x10070d1
push 0x1001d00
jmp 0x10070c2
push 0x1001cc8
call fcn.01005858
pop ecx
and dword [0x102000c], 0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x1007100
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x1007159
cmp dword [ebp - 0x94], 5
jne 0x1007159
cmp dword [ebp - 0x90], 1
jne 0x1007159
call fcn.01006f5c
test eax, eax
jne 0x1007159
call fcn.0100701f
test eax, eax
je 0x1007162
call fcn.01006e86
test eax, eax
je 0x100716e
call fcn.01006155
test eax, eax
jne 0x100716e
inc eax
jmp 0x1007170
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x1020010], eax
call fcn.0100e2ad
leave
ret
Function at 0x1007186
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020014]
cmp eax, 0xffffffff
je 0x10071b0
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1007212
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10071f4
cmp dword [ebp - 0x94], 5
jne 0x10071f4
cmp dword [ebp - 0x90], 1
jne 0x10071f4
call fcn.01006f5c
test eax, eax
jne 0x10071f4
call fcn.0100701f
test eax, eax
je 0x10071fd
call fcn.01006e86
test eax, eax
je 0x100720b
call fcn.01006155
test eax, eax
je 0x100720b
xor eax, eax
inc eax
jmp 0x100720d
xor eax, eax
mov dword [0x1020014], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x1007223
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020018]
cmp eax, 0xffffffff
je 0x100724d
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x100729b
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100727f
cmp dword [ebp - 0x94], 5
jne 0x100727f
cmp dword [ebp - 0x90], 2
je 0x1007288
call fcn.01006f5c
test eax, eax
je 0x1007294
call fcn.01006155
test eax, eax
jne 0x1007294
inc eax
jmp 0x1007296
xor eax, eax
mov dword [0x1020018], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x10072ac
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102001c]
cmp eax, 0xffffffff
je 0x10072d6
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1007326
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x1007308
cmp dword [ebp - 0x94], 5
jne 0x1007308
cmp dword [ebp - 0x90], 2
je 0x1007311
call fcn.01006f5c
test eax, eax
je 0x100731f
call fcn.01006155
test eax, eax
je 0x100731f
xor eax, eax
inc eax
jmp 0x1007321
xor eax, eax
mov dword [0x102001c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x1007337
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020020]
cmp eax, 0xffffffff
je 0x1007361
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10073a6
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100739f
cmp dword [ebp - 0x94], 5
jne 0x100739f
cmp dword [ebp - 0x90], 0
jne 0x100739f
call fcn.010070e4
test eax, eax
jne 0x100739f
inc eax
jmp 0x10073a1
xor eax, eax
mov dword [0x1020020], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret
Function at 0x1007437
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020028]
cmp eax, 0xffffffff
je 0x1007461
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10074b9
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x10074b2
cmp dword [ebp - 0x94], 4
jne 0x10074b2
cmp dword [ebp - 0x90], 0xa
jne 0x10074b2
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
je 0x10074b2
call fcn.010070e4
test eax, eax
jne 0x10074b2
inc eax
jmp 0x10074b4
xor eax, eax
mov dword [0x1020028], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x10074ca
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102002c]
cmp eax, 0xffffffff
je 0x10074f4
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x100755a
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x1007553
cmp dword [ebp - 0x94], 4
jne 0x1007553
cmp dword [ebp - 0x90], 0xa
jne 0x1007553
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
je 0x1007553
mov eax, 0x8ae
cmp word [ebp - 0x8c], ax
jb 0x1007553
call fcn.010070e4
test eax, eax
jne 0x1007553
inc eax
jmp 0x1007555
xor eax, eax
mov dword [0x102002c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x100756b
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020030]
cmp eax, 0xffffffff
je 0x1007595
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10075f6
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x10075ef
cmp dword [ebp - 0x94], 4
jne 0x10075ef
cmp dword [ebp - 0x90], 0x5a
je 0x10075e3
cmp dword [ebp - 0x90], 0xa
jne 0x10075ef
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
jne 0x10075ef
call fcn.010070e4
test eax, eax
jne 0x10075ef
inc eax
jmp 0x10075f1
xor eax, eax
mov dword [0x1020030], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret
Function at 0x1007623
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x1001e34
push esi
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x250], esi
call fcn.01006cba
test eax, eax
je 0x10077c2
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x24c], eax
cmp eax, 0xffffffff
je 0x10077e3
push edi
xor ebx, ebx
mov edi, 0x1001e20
mov esi, 0x1001dec
push 0x1001de8
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1007798
push 0x1001de4
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1007798
lea eax, [ebp - 0x21c]
push eax
push 0x1001384
push dword [ebp - 0x250]
lea eax, [ebp - 0x108]
push eax
call fcn.01006d0d
test eax, eax
jne 0x1007702
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x250]
push 0x1001dbc
push ebx
push ebx
push edi
push 0x250
jmp 0x100778f
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1007732
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b3c
push edi
push 0x257
push esi
call fcn.010059aa
add esp, 0x18
jmp 0x1007798
test al, 0x10
lea eax, [ebp - 0x108]
push eax
je 0x1007744
call fcn.01007623
jmp 0x1007798
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1007798
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x100777a
cmp eax, 0x21
je 0x100777a
cmp eax, 5
je 0x100777a
push eax
lea eax, [ebp - 0x108]
push eax
push 0x1001d94
push ebx
push ebx
push edi
push 0x265
jmp 0x100778f
push eax
lea eax, [ebp - 0x108]
push eax
push 0x1001d60
push ebx
push ebx
push edi
push 0x261
push esi
call fcn.010059aa
add esp, 0x20
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100768d
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
jmp 0x10077e3
push esi
push 0x1001d38
xor ebx, ebx
push ebx
push ebx
push 0x1001e20
push 0x26f
push 0x1001dec
call fcn.010059aa
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e2ad
leave
ret 4