joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101415e
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x104
mov esi, 0x1035938
push esi
push 0x1002d70
mov ebx, ecx
mov dword [0x1035930], eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0xc]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call edi
push 0x1002d4c
push esi
call edi
push 0x400
xor eax, eax
push 0x1035b68
push 0x516
push eax
mov dword [0x1035b40], eax
mov dword [0x1035934], eax
mov dword [0x1035b44], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb
call esi
push 0xc
mov dword [0x1035b4c], eax
call esi
push 0x31
mov dword [0x1035b50], eax
call esi
push 0x32
mov dword [0x1035b54], eax
call esi
pop edi
mov dword [0x1035b58], eax
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x10146f3
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push 0x24c
lea eax, [ebp - 0x458]
push esi
push eax
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], esi
call fcn.0101bc52
xor eax, eax
add esp, 0xc
cmp ax, word [ebx]
jne 0x10146e3
mov eax, dword [section..data]
cmp eax, section..data
je 0x1014873
test byte [eax + 0x1c], 1
je 0x1014873
push 0x1002d04
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x1014873
push 0x1002dd0
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x101471d
mov eax, dword [section..data]
cmp eax, section..data
je 0x1014873
test byte [eax + 0x1c], 1
je 0x1014873
push 0x1002d04
push 0x25
jmp 0x10146d3
push edi
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x101476a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1014872
test byte [eax + 0x1c], 1
je 0x1014872
push 0x1002d04
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x1014872
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
lea eax, [ebp - 0x430]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101477f
sub eax, edx
sar eax, 1
je 0x1014850
lea eax, [ebp - 0x430]
push reloc.USER32.dll_SetParent
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1014850
lea eax, [ebp - 0x430]
push reloc.USER32.dll_SetParent
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1014850
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
cmp dword [ebp + 0xc], 0
jne 0x10147e4
push reloc.USER32.dll_SetParent
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1014850
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0x460]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
jne 0x1014828
mov eax, dword [section..data]
cmp eax, section..data
je 0x1014850
test byte [eax + 0x1c], 1
je 0x1014850
push 0x1002d04
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x1014850
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
lea eax, [ebp - 0x20c]
je 0x1014849
push 1
push eax
call fcn.0101466e
jmp 0x1014850
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x45c]
push eax
push edi
call esi
test eax, eax
jne 0x1014776
xor esi, esi
push edi
inc esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [ebp - 0x460]
pop edi
cmp dword [ebp + 0xc], 0
je 0x1014882
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101bc5d
leave
ret 8
Function at 0x101522e
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
cmp edx, dword [ecx]
jne 0x1015248
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 4]
jne 0x1015248
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 8]
jne 0x1015248
mov eax, dword [eax + 0xc]
cmp eax, dword [ecx + 0xc]
jne 0x1015248
xor eax, eax
inc eax
jmp 0x101524a
xor eax, eax
pop ebp
ret 8

Function at 0x10157ec
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp + 8], eax
test eax, eax
jne 0x1015792
mov eax, dword [section..data]
cmp eax, section..data
je 0x101586b
test byte [eax + 0x1c], 1
je 0x101586b
push 0x1002de4
push 0x35
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x101586b
push ebx
xor ebx, ebx
inc ebx
cmp dword [ebp - 4], ebx
jle 0x1015861
push esi
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ebx*4]
mov eax, ecx
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10157b2
sub eax, edi
sar eax, 1
cmp eax, 2
jb 0x1015817
movzx eax, word [ecx]
cmp ax, 0x2d
je 0x10157d4
cmp ax, 0x2f
jne 0x1015832
lea edi, [ecx + 2]
push 0x1002f20
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x1015858
push 0x1002f08
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x1015858
push 0x1002ef4
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x1015858
push 0x1002edc
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x1015858
inc ebx
cmp ebx, dword [ebp - 4]
jl 0x10157a7
jmp 0x101585f
mov eax, dword [section..data]
cmp eax, section..data
je 0x101585f
test byte [eax + 0x1c], 1
je 0x101585f
push 0x1002de4
push 0x36
jmp 0x101584b
mov eax, dword [section..data]
cmp eax, section..data
je 0x101585f
test byte [eax + 0x1c], 1
je 0x101585f
push 0x1002de4
push 0x37
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x101585f
mov dword [ebp - 8], 1
pop edi
pop esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x1015fe8
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push esi
mov esi, ecx
jmp 0x1015ff9
push dword [esi]
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esi], eax
mov ecx, esi
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.01015fb9
test eax, eax
jne 0x1015fed
pop esi
ret
Function at 0x1016550
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.01015c5a
mov edi, eax
cmp edi, esi
je 0x101656a
lea ecx, [ebp - 0x214]
call fcn.01015be7
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0101bc5d
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1016588
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.010164f8
cmp eax, esi
jne 0x10165d3
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x1016572
lea ecx, [ebp - 0x214]
call fcn.01015be7
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.01015b61
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.01015be7
mov eax, esi
jmp 0x101655a
Function at 0x10173ca
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov ebx, 0x80004005
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ebx
cmp dword [esi + 0x494], edi
je 0x101750e
mov ecx, dword [esi + 0x6a8]
cmp ecx, edi
je 0x101750e
cmp dword [esi + 0x49c], edi
jne 0x10174d8
call fcn.0101448e
test al, al
je 0x10173ec
mov ecx, dword [esi + 0x6a8]
push edi
push edi
call fcn.01014c03
mov dword [ebp - 4], eax
jmp 0x10173ef
mov dword [ebp - 4], edi
cmp dword [0x1036390], edi
jne 0x10174d8
push 0x1003248
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
push 2
call edi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1017449
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1017449
mov eax, dword [section..data]
cmp eax, section..data
je 0x1017441
test byte [eax + 0x1c], 1
je 0x1017441
push 0x1002de4
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
mov dword [ebp - 4], ebx
jmp 0x10174d6
lea edx, [esi + 0x4a0]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1017454
sub eax, ebx
sar eax, 1
je 0x10174d6
push edx
push 0
push 2
call edi
mov dword [ebp - 8], eax
test eax, eax
jne 0x1017494
mov eax, dword [section..data]
cmp eax, section..data
je 0x10174cf
test byte [eax + 0x1c], 1
je 0x10174cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002de4
push 0x33
jmp 0x10174bf
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x10174d6
mov eax, dword [section..data]
cmp eax, section..data
je 0x10174cf
test byte [eax + 0x1c], 1
je 0x10174cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002de4
push 0x34
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010062be
mov dword [ebp - 4], 0x80004005
xor edi, edi
mov ecx, dword [esi + 0x6a8]
cmp ecx, edi
je 0x10174ef
push 1
call fcn.01016a0f
mov dword [esi + 0x6a8], edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], edi
je 0x10174ff
push dword [ebp - 8]
call esi
cmp dword [ebp - 0xc], edi
je 0x1017509
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp - 4]
jmp 0x1017515
mov ecx, esi
call fcn.01016a35
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1018d59
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [ecx], 0x1003354
mov dword [ecx + 4], 0x100332c
mov dword [ecx + 8], 0xc0000001
call fcn.0101b54a
mov ecx, dword [0x1031644]
mov eax, dword [ecx]
jmp dword [eax + 8]
Function at 0x1019328
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
push 0x424
mov eax, 0x102cf80
call fcn.0101bde7
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x10192c2
call fcn.010156bf
mov esi, eax
jmp 0x10193cb
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x10192db
call fcn.010156bf
jmp 0x10193bd
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
cmp eax, esi
je 0x10192d1
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x420], edi
cmp eax, edi
jae 0x1019341
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1019327
lea ecx, [ebp - 0x418]
call fcn.010163ca
mov esi, 0x8007000e
lea ecx, [ebp - 0x424]
call fcn.010162d9
mov eax, esi
call fcn.0101be52
ret 0x10
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.01017322
mov dword [ebp - 4], 1
jmp 0x101936f
cmp dword [ebp - 0x418], esi
jne 0x101937e
mov esi, 0x8007000e
jmp 0x10193bf
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x10192d1
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.010186de
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x101932c
lea ecx, [ebp - 0x418]
call fcn.010163ca
jmp 0x101932c
Function at 0x101c8b1
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call edi
push esi
call fcn.0101c840
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x101c8d4
xor eax, eax
cmp dword [esi + 0x24], eax
je 0x101c8a5
cmp dword [esi + 0x38], eax
jg 0x101c8a5
cmp dword [esi + 0x3c], eax
jle 0x101c8de
cmp dword [ebp - 4], eax
jne 0x101c8b4
inc dword [esi + 0x5c]
mov dword [ebp - 4], 1
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
call ebx
push 0xffffffffffffffff
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
push esi
call fcn.0101c840
test eax, eax
je 0x101c894
xor edi, edi
xor eax, eax
jmp 0x101c8e3
mov edi, 0x236
cmp dword [ebp - 4], eax
je 0x101c8eb
dec dword [esi + 0x5c]
push esi
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x101df77
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x4c]
or dword [edi + 0x58], 1
test eax, eax
je 0x101df05
cmp dword [edi + 0x40], 0
je 0x101df05
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push dword [edi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
lea esi, [edi + 0x30]
cmp dword [esi], esi
je 0x101df35
push ebx
mov ebx, dword [esi]
mov eax, dword [ebx]
mov dword [esi], eax
mov dword [eax + 4], esi
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esi], esi
jne 0x101df0e
pop ebx
movzx eax, word [edi + 0x38]
pop esi
test ax, ax
je 0x101df4c
push dword [edi + 0x3c]
movzx eax, ax
push eax
call dword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, dword [edi + 0x4c]
test eax, eax
je 0x101df5a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x101df68
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi + 0x40]
test eax, eax
je 0x101df76
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x101ecc6
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
push esi
push edi
lea esi, [ebx + 0x18]
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi], esi
je 0x101ecb8
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov dword [ecx + 4], esi
mov edi, eax
mov dword [eax + 4], eax
mov dword [eax], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x101eccb
push edi
call fcn.0101e904
jmp 0x101ec9b
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x101f9cd
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
mov dword [ebp - 8], 0x10039f4
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], 0x10039e8
mov dword [ebp - 0xc], 5
mov dword [ebp - 0x18], 0x10039d8
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0x10], esi
jbe 0x101f9d4
mov eax, dword [ebp + 0xc]
lea eax, [eax + esi*2]
mov dword [ebp - 0x20], eax
movzx eax, word [eax]
cmp ax, 0x3c
jne 0x101f9a6
lea eax, [ebp - 8]
jmp 0x101f9bd
cmp ax, 0x26
jne 0x101f9b1
lea eax, [ebp - 0x10]
jmp 0x101f9bd
cmp ax, 0x22
lea eax, [ebp - 0x18]
je 0x101f9bd
lea eax, [ebp - 0x20]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 8]
call fcn.0101f8c8
test eax, eax
jne 0x101f9d6
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x101f98f
xor eax, eax
pop esi
leave
ret 0xc

Function at 0x101fb24
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 8]
push eax
call fcn.0101f747
lea eax, [esi + 0x14]
push eax
call fcn.0101f747
add esi, 0x20
push esi
call fcn.0101f747
pop esi
pop ebp
ret 4
Function at 0x101fe50
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
push dword [ebp + 0x18]
mov edi, dword [ebp + 8]
push 0x7fffffff
push edi
call fcn.0101f383
mov esi, eax
xor eax, eax
cmp esi, eax
jl 0x101fed0
test dword [ebp + 0x18], 0x100
push ebx
mov ebx, ecx
mov dword [ebp - 4], edi
mov dword [ebp + 8], ebx
je 0x101fded
cmp dword [ebp + 0x1c], eax
jne 0x101fded
mov dword [ebp + 0x1c], 0x1001920
xor esi, esi
test dword [ebp + 0x18], 0xffffe000
je 0x101fe0c
mov esi, 0x80070057
cmp ecx, eax
je 0x101fe89
xor eax, eax
mov word [edi], ax
jmp 0x101fe89
cmp ecx, eax
jne 0x101fe2d
mov edx, dword [ebp + 0x1c]
cmp word [edx], ax
je 0x101feba
mov esi, edi
neg esi
sbb esi, esi
and esi, 0x23
add esi, 0x80070057
jmp 0x101fe89
push dword [ebp + 0x20]
mov dword [ebp + 8], eax
push dword [ebp + 0x1c]
lea eax, [ebp + 8]
push eax
mov eax, ecx
call fcn.01007ee3
mov ecx, dword [ebp + 8]
mov esi, eax
sub ebx, ecx
lea eax, [edi + ecx*2]
mov dword [ebp - 4], eax
mov dword [ebp + 8], ebx
test esi, esi
jl 0x101fe86
mov ecx, dword [ebp + 0x18]
test ecx, 0x200
je 0x101feba
cmp ebx, 1
jbe 0x101feba
lea edx, [ebx + ebx]
cmp edx, 2
jbe 0x101feba
add edx, 0xfffffffe
push edx
and ecx, 0xff
push ecx
add eax, 2
push eax
call fcn.0101bc52
add esp, 0xc
jmp 0x101feba
mov ecx, dword [ebp + 0xc]
test dword [ebp + 0x18], 0x1c00
je 0x101feae
test ecx, ecx
je 0x101feae
push dword [ebp + 0x18]
lea eax, [ebp - 4]
push eax
lea eax, [ecx + ecx]
push eax
lea ebx, [ebp + 8]
xor ecx, ecx
call fcn.01007f5d
mov ebx, dword [ebp + 8]
test esi, esi
jge 0x101feba
cmp esi, 0x8007007a
jne 0x101fecf
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x101fec6
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x101fecf
mov dword [eax], ebx
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0x1c
Function at 0x101ffab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x208], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x20c], eax
push 0x88
lea eax, [ebp - 0x208]
push eax
call fcn.0101cfa6
mov esi, dword [ebp - 0x208]
mov edi, eax
test edi, edi
jne 0x1020012
or dword [esi], 0xffffffff
or dword [esi + 0x84], 1
push edi
push edi
push 2
push edi
push edi
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x101ff62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x101ff5b
mov eax, 0x54f
mov edi, eax
jmp 0x1020012
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x1036e84
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push eax
push dword [ebp - 0x210]
lea edi, [esi + 4]
push dword [ebp - 0x214]
push dword [0x1030140]
push 0x80
push edi
call fcn.0100c705
add esp, 0x1c
test eax, eax
jl 0x101ff5b
push edi
push dword [0x103013c]
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.0100c705
add esp, 0x10
test eax, eax
jl 0x101ff5b
lea eax, [ebp - 0x204]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101ffd3
push 0
lea ecx, [ebp - 0x218]
push ecx
sub eax, edx
push eax
lea eax, [ebp - 0x204]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1020006
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jmp 0x101ff54
mov eax, dword [ebp - 0x20c]
mov dword [eax], esi
xor esi, esi
xor edi, edi
test esi, esi
je 0x102001c
push esi
call fcn.0101f3b9
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101bc5d
leave
ret 8
Function at 0x1022e2e
Capabilities:
Compare security identifiers
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push 5
push 0xffffffffffffffff
mov dword [esi], ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [edi], ebx
call fcn.0102cc5a
test eax, eax
jne 0x1022e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x1022e68
mov eax, 0x54f
mov esi, eax
jmp 0x1022e94
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 7
push 0xffffffffffffffff
push ebx
call fcn.0102cc5a
test eax, eax
je 0x1022e59
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
mov dword [edi], eax
mov dword [ebp - 8], ebx
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x1022ea1
push dword [ebp - 4]
call fcn.0102cc4e
cmp dword [ebp - 8], ebx
je 0x1022eae
push dword [ebp - 8]
call fcn.0102cc4e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1024f1b
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1024f2b
test esi, esi
je 0x1024f2b
push ebx
xor ebx, ebx
inc ebx
jmp 0x1024f12
cmp ebx, dword [ebp + 0x10]
jae 0x1024f17
mov al, byte [edi]
cmp al, 0x22
je 0x1024f07
mov byte [esi], al
inc esi
inc ebx
cmp dword [ebp + 8], 1
jne 0x1024f07
cmp ebx, dword [ebp + 0x10]
jae 0x1024f07
movzx eax, byte [edi]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x1024f07
mov al, byte [edi + 1]
mov byte [esi], al
inc esi
inc ebx
push edi
push dword [ebp + 8]
call fcn.0102c582
mov edi, eax
cmp byte [edi], 0
jne 0x1024ed8
push dword [ebp + 0xc]
mov byte [esi], 0
push dword [ebp + 8]
call fcn.01024dfc
mov eax, dword [ebp + 0xc]
pop ebx
jmp 0x1024f2d
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1025094
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1388], 0
je 0x10250ec
mov eax, dword [edi + 0x1390]
xor ebx, ebx
inc ebx
cmp eax, ebx
jbe 0x10250ec
shl eax, 2
push eax
call fcn.0101be72
mov esi, eax
pop ecx
test esi, esi
jne 0x1025019
push 4
pop eax
jmp 0x10250fd
mov eax, dword [edi + 0x1388]
test eax, eax
je 0x1025031
mov ecx, esi
mov dword [ecx], eax
mov eax, dword [eax + 0x14]
add ecx, 4
test eax, eax
jne 0x1025025
push 0x1024fb6
push 4
push dword [edi + 0x1390]
push esi
call fcn.0102cbca
mov eax, dword [esi]
mov dword [edi + 0x1388], eax
mov eax, dword [esi]
and dword [eax + 0x10], 0
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [eax + 0x14], ecx
mov eax, dword [edi + 0x1390]
add esp, 0x10
dec eax
mov dword [ebp + 8], ebx
cmp eax, ebx
jbe 0x1025096
mov ecx, dword [ebp + 8]
shl ecx, 2
inc dword [ebp + 8]
lea eax, [ecx + esi]
mov edx, dword [eax]
lea ecx, [esi + ecx + 4]
mov ebx, dword [ecx - 8]
mov dword [edx + 0x10], ebx
mov eax, dword [eax]
mov ecx, dword [ecx]
mov dword [eax + 0x14], ecx
mov eax, dword [edi + 0x1390]
dec eax
cmp dword [ebp + 8], eax
jb 0x102506b
mov eax, dword [ebp + 8]
lea eax, [esi + eax*4]
mov ecx, dword [eax]
mov edx, dword [eax - 4]
mov dword [ecx + 0x10], edx
mov eax, dword [eax]
and dword [eax + 0x14], 0
push edi
call fcn.01023eaa
test eax, eax
jne 0x10250e5
mov ebx, dword [edi + 0x1388]
jmp 0x10250e1
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x10250e5
push dword [eax + 4]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10250de
push edi
push ebx
call fcn.01024f38
mov ebx, eax
jmp 0x10250e1
mov ebx, dword [ebx + 0x14]
test ebx, ebx
jne 0x10250bc
push esi
call fcn.0101be7e
pop ecx
push edi
call fcn.01023eaa
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff7
add eax, 9
pop edi
pop esi
pop ebx
pop ebp
ret 4