joyce8/EMBER2024-capa huggingface dataset:
Function at 0x74071026
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7407107f
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x74071026
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x74071035
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x74476cd8
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x74071086
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.74057efc
cmp eax, dword [ebp + 0xc]
pop eax
je 0x74071125
add edi, 4
add eax, 2
dec ecx
jne 0x7407106b
call 0x740710d2
loope 0x740710c8
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x74071122
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x74071133
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x740710e6
cmp eax, ecx
ja 0x740710e6
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x74071170
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x74071166
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.740583db
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x74071035
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x7407107f
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x74071026
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x74071035
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x74476cd8
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x74071086
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.74057efc
cmp eax, dword [ebp + 0xc]
pop eax
je 0x74071125
add edi, 4
add eax, 2
dec ecx
jne 0x7407106b
call 0x740710d2
loope 0x740710c8
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x74071122
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x74071133
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x740710e6
cmp eax, ecx
ja 0x740710e6
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x74071170
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x74071166
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.740583db
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10006b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10244190
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x102de06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.100392af
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10021595
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1001a2bb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001bcb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001a2dd
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1001a2df
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1001a363
jg 0x1001a2f4
test esi, esi
je 0x1001a363
test ecx, ecx
jl 0x1001a33d
jg 0x1001a2fe
test eax, eax
je 0x1001a33d
cmp edi, ecx
jg 0x1001a312
jl 0x1001a308
cmp esi, eax
jae 0x1001a312
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.100aa670
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1001a340
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1001a363
jg 0x1001a34a
test esi, esi
je 0x1001a363
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1001a363
push eax
push esi
push 1
push edx
call fcn.100bf3e7
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001a380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1001a3ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001bba0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001a3cd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x1001a3cf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x1001a46e
jg 0x1001a3ec
test esi, esi
je 0x1001a46e
test ecx, ecx
jl 0x1001a439
jg 0x1001a3f6
test eax, eax
je 0x1001a439
cmp ebx, ecx
jg 0x1001a40a
jl 0x1001a400
cmp esi, eax
jae 0x1001a40a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.100aa670
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x1001a440
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x1001a46e
jg 0x1001a44a
test esi, esi
je 0x1001a46e
cmp dword [edi + 0x4c], 0
je 0x1001a46e
mov ecx, edi
call fcn.1001aec0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.100bf628
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001a7f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001a820
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10039266
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001a85c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001a85c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10039266
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1001a924
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001a884
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov edx, dword [esi + 0x38]
test edx, edx
jne 0x1001a8b7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.100bfa6f
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10039266
mov esp, ebp
pop ebp
ret 4
mov cl, bl
mov byte [ebp - 0x25], cl
mov edi, dword [edx]
cmp edi, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x1001a93a
lea eax, [ebp - 0x25]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov edx, dword [esi + 0x4c]
call fcn.1001ba40
or ecx, 0xffffffff
test al, al
pop edi
cmovne ecx, ebx
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10039266
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001a914
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100bf3e7
add esp, 0x10
cmp edi, eax
jne 0x1001a924
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1001a847
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039266
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov ecx, edx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edi + 0x1c]
test eax, eax
js 0x1001a924
cmp eax, 1
jle 0x1001a8f7
cmp eax, 3
jne 0x1001a924
mov cl, byte [ebp - 0x25]
jmp 0x1001a8d2
Function at 0x1001af80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1001b017
cmp byte [esi + 0x3d], 0
je 0x1001b017
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1001afd0
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx]
cmp edx, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x1001b029
lea edi, [ebp - 0x24]
xor eax, eax
mov dword [ebp - 0x28], edi
sub eax, 0
je 0x1001afe2
sub eax, 1
je 0x1001afe6
sub eax, 2
je 0x1001b017
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10039266
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001b000
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100bf3e7
add esp, 0x10
cmp edi, eax
jne 0x1001afd0
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10039266
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10039266
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
mov edi, dword [ebp - 0x28]
jmp 0x1001afc1
Function at 0x1001fb60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10246230
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 9
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.WinAssist
mov word [ecx], ax
call fcn.100088f0
mov dword [ebp - 4], 0
push 0
push dword [0x102ee68c]
call fcn.100024c0
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.10047818
call fcn.1001ffa0
mov ecx, eax
call fcn.1001ee10
push 0x102c455c
push 0x102c4570
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.100483f4
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call fcn.10002580
mov ecx, eax
call fcn.1003ae27
push 0x102c56bc
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.10004090
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1001fc49
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001fc42
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1001fc7f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001fc75
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001fc9e
push edx
push ecx
call fcn.10039277
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10039266
mov esp, ebp
pop ebp
ret
call fcn.100b535e
int3
Function at 0x10042bd0
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x10248430
call fcn.10039bd9
mov edi, ecx
lea eax, [ebp - 0x230]
push eax
call fcn.10042675
and dword [ebp - 4], 0
lea esi, [edi + 4]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10042c02
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x10252e08
call fcn.10004090
push 0x10252e0c
mov ecx, esi
call fcn.10004090
push 0x102c45d8
mov ecx, esi
call fcn.10004090
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.10004020
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10042c57
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10042cef
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100aa4a0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10042549
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10042cae
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.10004090
push 0x102c45d8
mov ecx, esi
call fcn.10004090
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.10004020
cmp dword [esi + 0x14], 8
jb 0x10042cf7
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [edi + 0x1c]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10042d0f
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x10252e08
call fcn.10004090
push 0x10252e0c
mov ecx, esi
call fcn.10004090
push 0x102c45d8
mov ecx, esi
call fcn.10004090
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.100426d4
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1000cc90
lea ecx, [ebp - 0x248]
call fcn.100094a0
lea ecx, [ebp - 0x230]
call fcn.100094a0
call fcn.10039b83
ret
Function at 0x100442eb
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x102485f3
call fcn.10039bd9
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x1004430c
push dword [esi + 0x1c]
call fcn.100d70ae
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.100436ee
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.100cd9d0
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x10044390
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.100436ee
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.100436ee
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.100094a0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.100094a0
sub edi, 1
jns 0x1004433a
mov ecx, esi
call fcn.100441ca
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.100094a0
call fcn.10039b83
ret

Function at 0x100443a9
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x102485f3
call fcn.10039bd9
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x100443ca
push dword [esi + 0x1c]
call fcn.100d70ae
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.100436ee
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.100cd9d0
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x1004444e
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.100436ee
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.100436ee
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.100094a0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.100094a0
sub edi, 1
jns 0x100443f8
mov ecx, esi
call fcn.10044261
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.100094a0
call fcn.10039b83
ret
Function at 0x100452e1
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push esi
push edi
push dword [ebp + 8]
xor esi, esi
push 0x104
push eax
call fcn.100467ea
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x102530c0
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1004546d
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10046780
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [ebp - 0x45c], 0x10
je 0x1004542a
mov ecx, 0x102c4dd4
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100453aa
test dx, dx
je 0x100453a6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100453aa
add eax, 4
add ecx, 4
test dx, dx
jne 0x10045384
xor eax, eax
jmp 0x100453af
sbb eax, eax
or eax, 1
test eax, eax
je 0x10045450
mov ecx, 0x102c4c18
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100453e8
test dx, dx
je 0x100453e4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100453e8
add eax, 4
add ecx, 4
test dx, dx
jne 0x100453c2
xor eax, eax
jmp 0x100453ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x10045450
cmp byte [ebp + 0xc], 0
je 0x1004540c
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call fcn.100452e1
add esp, 0xc
add esi, eax
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10045446
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1004544d
inc esi
jmp 0x10045450
mov byte [ebx], 1
lea eax, [ebp - 0x45c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10045344
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039266
leave
ret
Function at 0x100462b4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [eax + 0x10], ebx
je 0x100463c5
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], ebx
je 0x100463c4
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x100462e3
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
test eax, eax
je 0x100463c4
push 0x102ebf84
push eax
call fcn.1013f907
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x100463c4
cmp dword [esi + 0x14], 0x10
jb 0x10046318
mov esi, dword [esi]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, dword [ebp - 4]
test eax, eax
je 0x100463b2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100463b2
mov eax, dword [ebp - 0x10]
push 0x102ebf84
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 8], ecx
call fcn.1013f907
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100463b2
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x1004637b
mov eax, dword [eax]
push eax
push dword [ebp - 8]
push str.StringFileInfo_08lx_s
push 0x80
push edi
call fcn.1000eb10
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x100463b0
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
call fcn.10008210
mov bl, 1
push esi
call fcn.100396e1
pop ecx
test edi, edi
je 0x100463c4
push edi
call fcn.100396e1
pop ecx
pop esi
pop edi
mov al, bl
pop ebx
leave
ret