joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049270
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100899c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ad708]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
test edi, edi
je 0x100492a8
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x18]
mov dword [ebp - 4], 0
test eax, eax
jne 0x100492dc
lea eax, [edi + 0x1c]
push eax
push 0
push edi
push 0x10043b80
push 0
push 0
call fcn.1006ecd2
add esp, 0x18
mov dword [edi + 0x18], eax
test eax, eax
jne 0x100492dc
xor bl, bl
jmp 0x100493eb
mov eax, dword [ebp + 8]
push 0x38
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
call fcn.1002f272
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
test esi, esi
je 0x10049333
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
mov dword [esi + 4], 1
mov dword [esi + 8], 1
mov dword [esi], vtable.std::_Ref_count_obj_class_std::function_void____cdecl___void___.0
mov dword [eax], vtable.._AV___Func_impl_no_alloc_V___Binder_U_Unforced_std__P8MessageLoopWnd_lds__AEXXZPAV34__std__X__V_std__.0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ebx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x24], eax
jmp 0x10049335
xor esi, esi
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
test esi, esi
je 0x10049346
lock inc dword [esi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [edi + 0x30]
lea ebx, [edi + 0x20]
mov ecx, dword [ebx + 8]
inc eax
mov byte [ebp - 4], 2
cmp ecx, eax
ja 0x1004936a
push 1
mov ecx, ebx
call fcn.10043d30
mov ecx, dword [ebx + 8]
lea eax, [ecx - 1]
and dword [ebx + 0xc], eax
mov ecx, dword [ebx + 0x10]
add ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
dec eax
and ecx, eax
lea eax, [ecx*4]
mov ecx, dword [ebx + 4]
mov dword [ebp + 8], eax
cmp dword [eax + ecx], 0
jne 0x100493a7
push 0x28
call fcn.1002f272
mov ecx, dword [ebx + 4]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, edx
mov ecx, dword [ebx + 4]
mov eax, dword [eax + ecx]
lea ecx, [esi + 0x10]
mov byte [ebp + 0xb], 1
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_026ed412f7b7b9b3e53cb26aeed68d83___void___.0
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0x24], eax
inc dword [ebx + 0x10]
test esi, esi
je 0x100493e8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x100493e8
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x100493e8
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov bl, byte [ebp + 0xb]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1004d600
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008a068
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100ad708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
push 0x1a
push eax
call fcn.1004dea0
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
je 0x1004d667
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004d6e5
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov ecx, esi
push 1
push eax
call fcn.1004dea0
mov esi, eax
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x1004d6ab
mov ecx, eax
call fcn.10003900
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x1004d6e5
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004d6db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004d7ed
push edx
push ecx
call fcn.1002eba8
add esp, 8
cmp dword [ebp - 0x18], 0
jne 0x1004d710
xor eax, eax
mov dword [edi + 0x10], 0
push eax
mov dword [edi + 0x14], 7
mov ecx, edi
push 0x1008c524
mov word [edi], ax
call fcn.100042a0
jmp 0x1004d7c6
call fcn.1000a7c0
mov ecx, eax
test ecx, ecx
je 0x1004d7f2
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10005bd0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.1000a320
mov edx, dword [ebp - 0x48]
add esp, 8
mov byte [ebp - 4], 1
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004d777
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x44]
xor eax, eax
mov ecx, esi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004d792
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.100042a0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004d7c6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x28]
call fcn.10003900
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ef19
mov esp, ebp
pop ebp
ret 8
call fcn.1005e18e
push 0x80004005
call fcn.10007f60
int3
Function at 0x10050270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008a5c2
mov eax, dword fs:[0]
push eax
sub esp, 0x818
mov eax, dword [0x100ad708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x824], esi
mov dword [ebp - 0x81c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x818], 0
mov word [esi], dx
mov dword [ebp - 4], edx
mov dword [ebp - 0x81c], 1
test ecx, ecx
je 0x100503a0
test eax, eax
je 0x100503a0
test ebx, ebx
je 0x100503a0
lea edx, [ebp - 0x818]
push edx
push 0x20219
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005038f
cmp dword [ebp - 0x818], eax
je 0x100503a0
push 0x802
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.10059fd0
add esp, 0xc
mov dword [ebp - 0x820], 0x800
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x814]
push eax
push 0
push 0xffff
push ebx
push 0
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1005038f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10050371
sub ecx, edx
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.100042a0
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x100503a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ef19
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10078a68
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10078728
Function at 0x1007f350
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x100ad708]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1007f563
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1007f563
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1007f383
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x1007f563
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call fcn.10059fd0
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10059fd0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push str..
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1007f404
test al, 1
je 0x1007f404
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x1007f549
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1007f53d
nop dword [eax]
test byte [ebp - 0x664], 0x10
je 0x1007f4b8
cmp word [ebp - 0x638], 0x2e
jne 0x1007f477
mov ax, word [ebp - 0x636]
test ax, ax
je 0x1007f522
cmp ax, 0x2e
jne 0x1007f477
cmp word [ebp - 0x634], 0
je 0x1007f522
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10059fd0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.1007f350
add esp, 4
jmp 0x1007f520
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10059fd0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1007f50f
test al, 1
je 0x1007f50f
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1007f440
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ef19
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1002ef19
mov esp, ebp
pop ebp
ret
Function at 0x1007f580
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1007f5d8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1007f5d8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1007f5b8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1007f5d8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1007f5d3
test al, 0x10
je 0x1007f5d3
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1007f5d8
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x1007f720
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1318
call fcn.1002f5c0
mov eax, dword [0x100ad708]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1318], eax
cmp dword [esi + 0x10], 0x104
ja 0x1007f8f8
push 0x800
lea eax, [ebp - 0x1304]
push 0
push eax
call fcn.10059fd0
push 0x800
lea eax, [ebp - 0xb04]
push 0
push eax
call fcn.10059fd0
add esp, 0x18
cmp dword [esi + 0x14], 8
jb 0x1007f787
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x1304]
push 0x400
push eax
call fcn.10060a68
add esp, 0xc
test edi, edi
je 0x1007f7b4
cmp word [edi], 0
je 0x1007f7b4
push edi
lea eax, [ebp - 0x1304]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0xfe
lea eax, [ebp - 0x102]
push 0
push eax
call fcn.10059fd0
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor esi, esi
nop dword [eax + eax]
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x1314]
push eax
movups xmmword [ebp - 0x1314], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x200
lea eax, [ebp - 0x304]
push 0
push eax
call fcn.10059fd0
movzx eax, byte [ebp - 0x1305]
push eax
movzx eax, byte [ebp - 0x1306]
push eax
movzx eax, byte [ebp - 0x1307]
push eax
movzx eax, byte [ebp - 0x1308]
push eax
movzx eax, byte [ebp - 0x1309]
push eax
movzx eax, byte [ebp - 0x130a]
push eax
movzx eax, byte [ebp - 0x130b]
push eax
movzx eax, byte [ebp - 0x130c]
push eax
movzx eax, word [ebp - 0x130e]
push eax
movzx eax, word [ebp - 0x1310]
push eax
push dword [ebp - 0x1314]
lea eax, [ebp - 0x304]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.1007f080
lea eax, [ebp - 0x304]
add esp, 0x40
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1007f886
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.10060e17
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x1304]
push eax
lea eax, [ebp - 0xb04]
push eax
call edi
push str..tmp
lea eax, [ebp - 0xb04]
push 0x400
push eax
call fcn.1007b95f
add esp, 0xc
lea eax, [ebp - 0xb04]
push eax
call ebx
test eax, eax
je 0x1007f90b
inc esi
cmp esi, 0xa
jl 0x1007f7e0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ef19
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xb04]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1007f914
mov ecx, dword [ebp - 0x1318]
lea eax, [ebp - 0xb04]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.100042a0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ef19
mov esp, ebp
pop ebp
ret
Function at 0x1007fd00
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1007fd48
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1007fd48
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1007fd38
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1007fd48
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x100808d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b4b8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100ad708]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0x80000
call fcn.1000a7c0
mov ecx, eax
test ecx, ecx
je 0x10080a67
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 0
test edi, edi
js 0x10080a71
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x1008095d
push edi
lea ecx, [ebp - 0x1c]
call fcn.1000b890
mov esi, dword [ebp - 0x1c]
cmp edi, dword [esi - 8]
jg 0x10080a71
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push dword [esi - 8]
mov edi, eax
push esi
call fcn.100612bb
add esp, 8
test eax, eax
js 0x10080a71
cmp eax, dword [esi - 8]
jg 0x10080a71
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
je 0x10080a2e
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
cmp edi, 0xea
jne 0x100809f9
mov eax, dword [ebp - 0x18]
add eax, eax
mov dword [ebp - 0x18], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100809e8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
inc ebx
cmp ebx, 0xa
jl 0x10080914
mov eax, 1
jmp 0x10080a10
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10080a0e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ef19
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + 4]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push esi
call fcn.100806e0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10080a60
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
jmp 0x10080a10
push 0x80004005
call fcn.10007f60
push 0x80070057
call fcn.10007f60
int3
Function at 0x10080a80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100865b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x100ad708]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.1000a7c0
mov ecx, eax
test ecx, ecx
je 0x10080b39
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea eax, [esi + 4]
mov ecx, esi
push eax
call fcn.10080460
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x10080b05
push dword [ebp - 0x14]
push esi
push 7
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10080b24
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10007f60
int3
Function at 0x100819c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b5f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100ad708]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10081a0c
test al, 0x10
je 0x10081a0c
push esi
mov edi, 1
call fcn.1007f330
add esp, 4
jmp 0x10081a13
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10081a3c
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10081a3c
push esi
test edi, edi
jne 0x10081a34
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10081a3c
call fcn.1007f330
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10081aa7
mov ecx, esi
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10081a60
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.100042a0
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 4], 0
call fcn.10052050
lea ecx, [ebp - 0x24]
call fcn.10003900
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10081f00
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x100ad708]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x10081fdb
test ecx, ecx
je 0x10081fdb
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10081fdb
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x10081fdb
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10081fc6
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push dword [ebp - 0x4c4]
call fcn.1007dcc2
add esp, 0xc
test eax, eax
je 0x10081fee
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x10081f70
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ef19
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x4c0]
call fcn.10082820
xor ecx, ecx
test edi, edi
je 0x1008200c
cmp edi, 0x7fffffff
jbe 0x10082011
mov ecx, 0x80070057
test ecx, ecx
js 0x10082047
mov eax, dword [ebp - 0x4c0]
mov esi, edi
test edi, edi
je 0x1008202f
cmp word [eax], 0
je 0x1008202f
add eax, 2
sub esi, 1
jne 0x10082021
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x10082049
xor esi, esi
test ecx, ecx
js 0x1008209a
mov eax, dword [ebp - 0x4c0]
mov edx, edi
lea ecx, [eax + esi*2]
sub edx, esi
je 0x1008208d
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7ffffffe
add esi, eax
lea eax, [ebx + ebx]
sub eax, ecx
add edi, eax
test esi, esi
je 0x1008208d
movzx eax, word [edi + ecx]
test ax, ax
je 0x1008208d
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x10082074
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ef19
mov esp, ebp
pop ebp
ret