joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bce0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162613
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebx + 4], vtable.UnknownErrorBase.0
push 0x1044eb70
mov dword [ebx], vtable.Unknown.1.0
mov dword [ebx + 4], vtable.Unknown.0
mov dword [ebx + 0xc], 1
mov dword [ebx + 8], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], 0
mov dword [ebx + 0x10], vtable.ISpatialReference3.0
mov dword [ebx + 0x14], vtable.IGeographicCoordinateSystem2.0
mov dword [ebx + 0x18], vtable.ICompareCoordinateSystems.0
mov dword [ebx + 0x1c], vtable.IControlPrecision2.0
mov dword [ebx + 0x20], vtable.ISpatialReferenceTolerance.0
mov dword [ebx + 0x24], vtable.IESRISpatialReferenceGEN.0
mov dword [ebx + 0x28], vtable.IClone.0
push 0
push 0
lea esi, [ebx + 0x30]
mov dword [ebx], vtable.GeographicCoordinateSystem.0
mov dword [ebx + 4], vtable.GeographicCoordinateSystem.1.0
mov dword [ebx + 0x10], vtable.GeographicCoordinateSystem.2.0
mov dword [ebx + 0x14], vtable.GeographicCoordinateSystem.3.0
mov dword [ebx + 0x18], vtable.GeographicCoordinateSystem.4.0
mov dword [ebx + 0x1c], vtable.GeographicCoordinateSystem.5.0
mov dword [ebx + 0x20], vtable.GeographicCoordinateSystem.6.0
mov dword [ebx + 0x24], vtable.GeographicCoordinateSystem.7.0
mov dword [ebx + 0x28], vtable.GeographicCoordinateSystem.8.0
mov dword [ebx + 0x2c], vtable.GeographicCoordinateSystem.9.0
push 0
mov dword [esi], 0
call fcn.100163a0
mov byte [ebp - 4], 1
fld qword [0x10448f30]
mov al, byte [ebx + 0x70]
fstp qword [ebx + 0x38]
fld qword [0x10448f30]
mov esi, dword [ebp + 0xc]
fstp qword [ebx + 0x40]
and al, 0xf8
fld qword [0x10448f30]
or al, 8
fstp qword [ebx + 0x48]
fld qword [0x10448f30]
fstp qword [ebx + 0x50]
fld qword [0x10448f30]
fstp qword [ebx + 0x58]
fld qword [0x10448f30]
fstp qword [ebx + 0x60]
fld qword [0x10448f30]
mov byte [ebx + 0x70], al
fstp qword [ebx + 0x68]
lea eax, [ebx + 0x30]
fld qword [0x10448f30]
fstp qword [ebx + 0x78]
fld qword [0x10448f30]
fstp qword [ebx + 0x80]
fld qword [0x10448f30]
fstp qword [ebx + 0x88]
mov dword [ebx + 0x90], esi
call fcn.10016670
fld1
fdiv qword [esi + 0x38]
sub esp, 0x18
lea eax, [ebx + 0x10]
fstp qword [esp + 0x10]
fld qword [esi + 0x20]
fstp qword [esp + 8]
fld qword [esi + 0x18]
fstp qword [esp]
push eax
call fcn.1001cfe0
fld qword [esi + 0x38]
fmul qword [0x1041b158]
mov eax, ebx
fstp qword [ebx + 0x78]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001be90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101625d8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [edi + 4], vtable.UnknownErrorBase.0
push 0x1044eb70
mov dword [edi], vtable.Unknown.1.0
mov dword [edi + 4], vtable.Unknown.0
mov dword [edi + 0xc], 1
mov dword [edi + 8], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], 0
mov dword [edi + 0x10], vtable.ISpatialReference3.0
mov dword [edi + 0x14], vtable.IGeographicCoordinateSystem2.0
mov dword [edi + 0x18], vtable.ICompareCoordinateSystems.0
mov dword [edi + 0x1c], vtable.IControlPrecision2.0
mov dword [edi + 0x20], vtable.ISpatialReferenceTolerance.0
mov dword [edi + 0x24], vtable.IESRISpatialReferenceGEN.0
mov dword [edi + 0x28], vtable.IClone.0
push 0
push 0
lea esi, [edi + 0x30]
mov dword [edi], vtable.GeographicCoordinateSystem.0
mov dword [edi + 4], vtable.GeographicCoordinateSystem.1.0
mov dword [edi + 0x10], vtable.GeographicCoordinateSystem.2.0
mov dword [edi + 0x14], vtable.GeographicCoordinateSystem.3.0
mov dword [edi + 0x18], vtable.GeographicCoordinateSystem.4.0
mov dword [edi + 0x1c], vtable.GeographicCoordinateSystem.5.0
mov dword [edi + 0x20], vtable.GeographicCoordinateSystem.6.0
mov dword [edi + 0x24], vtable.GeographicCoordinateSystem.7.0
mov dword [edi + 0x28], vtable.GeographicCoordinateSystem.8.0
mov dword [edi + 0x2c], vtable.GeographicCoordinateSystem.9.0
push 0
mov dword [esi], 0
call fcn.100163a0
fld qword [0x10448f30]
mov al, byte [edi + 0x70]
fstp qword [edi + 0x38]
fld qword [0x10448f30]
and al, 0xf8
fstp qword [edi + 0x40]
or al, 8
fld qword [0x10448f30]
fstp qword [edi + 0x48]
fld qword [0x10448f30]
fstp qword [edi + 0x50]
fld qword [0x10448f30]
fstp qword [edi + 0x58]
fld qword [0x10448f30]
fstp qword [edi + 0x60]
fld qword [0x10448f30]
mov byte [edi + 0x70], al
fstp qword [edi + 0x68]
mov eax, edi
fld qword [0x10448f30]
fstp qword [edi + 0x78]
fld qword [0x10448f30]
fstp qword [edi + 0x80]
fld qword [0x10448f30]
fstp qword [edi + 0x88]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c8d0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162613
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebx + 4], vtable.UnknownErrorBase.0
push 0x1044eb70
mov dword [ebx], vtable.Unknown.1.0
mov dword [ebx + 4], vtable.Unknown.0
mov dword [ebx + 0xc], 1
mov dword [ebx + 8], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], 0
mov dword [ebx + 0x10], vtable.ISpatialReference3.0
mov dword [ebx + 0x14], vtable.IProjectedCoordinateSystem5.0
mov dword [ebx + 0x18], vtable.ICompareCoordinateSystems.0
mov dword [ebx + 0x1c], vtable.IControlPrecision2.0
mov dword [ebx + 0x20], vtable.ISpatialReferenceTolerance.0
mov dword [ebx + 0x24], vtable.IESRISpatialReferenceGEN.0
mov dword [ebx + 0x28], vtable.IClone.0
push 0
push 0
lea esi, [ebx + 0x30]
mov dword [ebx], vtable.ProjectedCoordinateSystem.0
mov dword [ebx + 4], vtable.ProjectedCoordinateSystem.1.0
mov dword [ebx + 0x10], vtable.ProjectedCoordinateSystem.2.0
mov dword [ebx + 0x14], vtable.ProjectedCoordinateSystem.3.0
mov dword [ebx + 0x18], vtable.ProjectedCoordinateSystem.4.0
mov dword [ebx + 0x1c], vtable.ProjectedCoordinateSystem.5.0
mov dword [ebx + 0x20], vtable.ProjectedCoordinateSystem.6.0
mov dword [ebx + 0x24], vtable.ProjectedCoordinateSystem.7.0
mov dword [ebx + 0x28], vtable.ProjectedCoordinateSystem.8.0
mov dword [ebx + 0x2c], vtable.ProjectedCoordinateSystem.9.0
push 0
mov dword [esi], 0
call fcn.100163a0
mov byte [ebp - 4], 1
fld qword [0x10448f30]
mov al, byte [ebx + 0x70]
fstp qword [ebx + 0x38]
fld qword [0x10448f30]
mov esi, dword [ebp + 0xc]
fstp qword [ebx + 0x40]
and al, 0xf8
fld qword [0x10448f30]
or al, 8
fstp qword [ebx + 0x48]
fld qword [0x10448f30]
fstp qword [ebx + 0x50]
fld qword [0x10448f30]
fstp qword [ebx + 0x58]
fld qword [0x10448f30]
fstp qword [ebx + 0x60]
fld qword [0x10448f30]
mov byte [ebx + 0x70], al
fstp qword [ebx + 0x68]
lea eax, [ebx + 0x30]
fld qword [0x10448f30]
fstp qword [ebx + 0x78]
fld qword [0x10448f30]
fstp qword [ebx + 0x80]
fld qword [0x10448f30]
fstp qword [ebx + 0x88]
mov dword [ebx + 0x90], esi
call fcn.10016670
fld1
fdiv qword [esi + 0x38]
sub esp, 0x18
lea eax, [ebx + 0x10]
fstp qword [esp + 0x10]
fld qword [esi + 0x20]
fstp qword [esp + 8]
fld qword [esi + 0x18]
fstp qword [esp]
push eax
call fcn.1001cfe0
fld qword [esi + 0x38]
fmul qword [0x1041b158]
mov eax, ebx
fstp qword [ebx + 0x78]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001ca80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101625d8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [edi + 4], vtable.UnknownErrorBase.0
push 0x1044eb70
mov dword [edi], vtable.Unknown.1.0
mov dword [edi + 4], vtable.Unknown.0
mov dword [edi + 0xc], 1
mov dword [edi + 8], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], 0
mov dword [edi + 0x10], vtable.ISpatialReference3.0
mov dword [edi + 0x14], vtable.IProjectedCoordinateSystem5.0
mov dword [edi + 0x18], vtable.ICompareCoordinateSystems.0
mov dword [edi + 0x1c], vtable.IControlPrecision2.0
mov dword [edi + 0x20], vtable.ISpatialReferenceTolerance.0
mov dword [edi + 0x24], vtable.IESRISpatialReferenceGEN.0
mov dword [edi + 0x28], vtable.IClone.0
push 0
push 0
lea esi, [edi + 0x30]
mov dword [edi], vtable.ProjectedCoordinateSystem.0
mov dword [edi + 4], vtable.ProjectedCoordinateSystem.1.0
mov dword [edi + 0x10], vtable.ProjectedCoordinateSystem.2.0
mov dword [edi + 0x14], vtable.ProjectedCoordinateSystem.3.0
mov dword [edi + 0x18], vtable.ProjectedCoordinateSystem.4.0
mov dword [edi + 0x1c], vtable.ProjectedCoordinateSystem.5.0
mov dword [edi + 0x20], vtable.ProjectedCoordinateSystem.6.0
mov dword [edi + 0x24], vtable.ProjectedCoordinateSystem.7.0
mov dword [edi + 0x28], vtable.ProjectedCoordinateSystem.8.0
mov dword [edi + 0x2c], vtable.ProjectedCoordinateSystem.9.0
push 0
mov dword [esi], 0
call fcn.100163a0
fld qword [0x10448f30]
mov al, byte [edi + 0x70]
fstp qword [edi + 0x38]
fld qword [0x10448f30]
and al, 0xf8
fstp qword [edi + 0x40]
or al, 8
fld qword [0x10448f30]
fstp qword [edi + 0x48]
fld qword [0x10448f30]
fstp qword [edi + 0x50]
fld qword [0x10448f30]
fstp qword [edi + 0x58]
fld qword [0x10448f30]
fstp qword [edi + 0x60]
fld qword [0x10448f30]
mov byte [edi + 0x70], al
fstp qword [edi + 0x68]
mov eax, edi
fld qword [0x10448f30]
fstp qword [edi + 0x78]
fld qword [0x10448f30]
fstp qword [edi + 0x80]
fld qword [0x10448f30]
fstp qword [edi + 0x88]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1001fe70
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
test ecx, ecx
js 0x1001fe81
mov eax, 0x10
test ecx, 0x40000000
jne 0x1001fe8c
or eax, 0x20
test ecx, 0x20000000
jne 0x1001fe97
or eax, 2
test ecx, 0x10000000
jne 0x1001fea2
or eax, 0x40
test ecx, 0x4000000
jne 0x1001feaf
or eax, 0x80
test ecx, 0x8000000
jne 0x1001febc
or eax, 0x100
test ecx, 0x1000000
jne 0x1001fec9
or eax, 0x200
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push ebx
xor ebx, ebx
cmp word [ebp + 0x10], bx
push esi
mov esi, dword [ebp + 0x18]
setne bl
push esi
mov esi, dword [ebp + 0x14]
push esi
dec ebx
and ebx, 8
or ebx, eax
mov eax, dword [edx + 0x34]
push ebx
push ecx
call eax
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x100217d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
test ecx, ecx
js 0x100217e1
mov eax, 0x10
test ecx, 0x40000000
jne 0x100217ec
or eax, 0x20
test ecx, 0x20000000
jne 0x100217f7
or eax, 2
test ecx, 0x10000000
jne 0x10021802
or eax, 0x40
test ecx, 0x4000000
jne 0x1002180f
or eax, 0x80
test ecx, 0x8000000
jne 0x1002181c
or eax, 0x100
test ecx, 0x1000000
jne 0x10021829
or eax, 0x200
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push esi
mov esi, dword [ebp + 0x10]
push esi
push eax
mov eax, dword [edx + 0x30]
push ecx
call eax
pop esi
pop ebp
ret 0xc

Function at 0x10021ce0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101625b3
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [esi + 4], vtable.UnknownErrorBase.0
push 0x1044eb70
mov dword [esi], vtable.Unknown.1.0
mov dword [esi + 4], vtable.Unknown.0
mov dword [esi + 0xc], 1
mov dword [esi + 8], esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], vtable.IGeometry5.0
mov dword [esi + 0x14], vtable.IRelationalOperator.0
mov dword [esi + 0x18], vtable.IEnvelope2.0
mov dword [esi + 0x1c], vtable.IESRIShape2.0
mov dword [esi + 0x20], vtable.IClone.0
mov dword [esi], vtable.ESRI::Envelope.0
mov dword [esi + 4], vtable.ESRI::Envelope.1.0
mov dword [esi + 0x10], vtable.ESRI::Envelope.2.0
mov dword [esi + 0x14], vtable.ESRI::Envelope.3.0
mov dword [esi + 0x18], vtable.ESRI::Envelope.4.0
mov dword [esi + 0x1c], vtable.ESRI::Envelope.5.0
mov dword [esi + 0x20], vtable.ESRI::Envelope.6.0
fld qword [0x10448f30]
fstp qword [esi + 0x28]
mov dword [esi + 0x68], eax
fldz
fst qword [esi + 0x30]
fst qword [esi + 0x38]
fstp qword [esi + 0x40]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10021dd0
fld qword [0x10448f30]
fst qword [esi + 0x60]
mov eax, esi
fst qword [esi + 0x58]
fst qword [esi + 0x50]
fstp qword [esi + 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10023300
Capabilities:
Delete file

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10023319
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x10023328
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esi]
test esi, esi
je 0x10023347
lea ecx, [esi - 0xc]
test ecx, ecx
je 0x10023347
dec dword [esi - 0xc]
lea eax, [esi - 0xc]
jne 0x10023347
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
pop esi
ret
Function at 0x10023350
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10023369
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x10023378
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp + 0x10]
mov eax, dword [esi]
movzx ecx, bl
neg ecx
push 0
sbb ecx, ecx
and ecx, 0x4000000
push ecx
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push 0
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x100233b2
call fcn.10023ad0
mov dword [esi + 8], eax
xor al, al
pop ebp
ret 0xc
mov dword [esi + 4], eax
mov byte [esi + 0xc], bl
mov dword [esi + 8], 0
mov al, 1
pop ebp
ret 0xc

Function at 0x100233d0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100233e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x100233f5
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret

Function at 0x10023400
Capabilities:
Delete file
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor bl, bl
cmp dword [esi + 4], 0xffffffff
jne 0x10023482
cmp byte [esi + 0xc], bl
je 0x1002341d
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10023472
call fcn.10023ad0
mov dword [esi + 8], eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
neg eax
sbb eax, eax
and eax, 3
add eax, 2
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 4], eax
mov byte [esi + 0xc], 0
mov dword [esi + 8], 0
mov bl, 1
mov edx, dword [esi + 4]
lea ecx, [ebp - 0xc]
push ecx
push edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
mov dword [esi + 8], eax
test bl, bl
je 0x100234d4
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100234c5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x100234d4
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10023900
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1016083b
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x10438fc0]
xor eax, esp
mov dword [esp + 0x678], eax
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, esp
push eax
lea eax, [esp + 0x690]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov al, 1
xor edx, edx
lea ebx, [esp + 0x1c]
mov dword [esp + 0x18], ecx
mov byte [esp + 0x17], al
mov dword [esp + 0x1c], 0xffffffff
mov byte [esp + 0x270], al
call fcn.10023da0
xor ebx, ebx
mov dword [esp + 0x698], ebx
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x10023a84
cmp byte [esp + 0x270], bl
je 0x10023996
mov al, 1
jmp 0x100239a3
lea ecx, [esp + 0x20]
push ecx
push eax
call esi
test eax, eax
setne al
mov byte [esp + 0x270], bl
cmp al, bl
je 0x10023a68
mov eax, dword [esp + 0x20]
and eax, 0x10
je 0x100239da
cmp word [esp + 0x4c], 0x2e
jne 0x100239da
mov cx, word [esp + 0x4e]
cmp cx, bx
je 0x1002397c
cmp cx, 0x2e
jne 0x100239da
cmp word [esp + 0x50], bx
je 0x1002397c
cmp eax, ebx
je 0x10023a24
lea edx, [esp + 0x47a]
push edx
lea eax, [esp + 0x276]
push eax
call edi
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x276]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x272]
push eax
call fcn.10023900
add esp, 4
test al, al
jne 0x1002397c
mov byte [esp + 0x17], bl
jmp 0x1002397c
lea ecx, [esp + 0x47a]
push ecx
lea edx, [esp + 0x276]
push edx
call edi
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x276]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [esp + 0x272]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1002397c
mov byte [esp + 0x17], bl
jmp 0x1002397c
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x10023a84
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x10023a84
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x10023a97
mov bl, byte [esp + 0x17]
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x10023aa7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
mov ecx, dword [esp + 0x690]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.10148524
mov esp, ebp
pop ebp
ret
Function at 0x10023c10
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10163d4b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x10438fc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x218]
push eax
xor edi, edi
push 0x104
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ebx, ebx
push 0x4c
call fcn.101484dd
add eax, 0xc
mov dword [eax - 0xc], 1
mov dword [eax - 8], 0x4c
xor ecx, ecx
mov dword [eax - 4], edi
mov dword [ebp - 0x21c], eax
mov word [eax], cx
mov edx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x228]
push edx
push ebx
push eax
lea ecx, [ebp - 0x218]
push ecx
push str._s_s_d._s
lea edx, [ebp - 0x21c]
mov dword [ebp - 4], edi
call fcn.10016c90
mov esi, dword [ebp - 0x21c]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10023d2e
mov dword [ebp - 4], 0xffffffff
cmp esi, edi
je 0x10023cf6
lea edx, [esi - 0xc]
test edx, edx
je 0x10023cf6
add esi, 0xfffffff4
dec dword [esi]
jne 0x10023cf6
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
inc ebx
jns 0x10023c6f
mov esi, dword [ebp - 0x220]
push edi
mov edi, 0x10198540
mov eax, esi
call fcn.100164f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10148524
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x220]
lea eax, [esi - 0xc]
mov dword [ebx], esi
inc dword [eax]
cmp esi, edi
je 0x10023d52
add esi, 0xfffffff4
je 0x10023d52
dec dword [eax]
jne 0x10023d52
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, ebx
jmp 0x10023d12

Function at 0x100243b0
Capabilities:
Access peb ldr_data
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10163c8e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10438fc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, ebx
mov dword [ebp - 0x38], ebx
call fcn.100174f0
push 0
push 0
lea esi, [ebx + 4]
mov dword [ebp - 4], 0
push 0
mov dword [esi], 0
call fcn.100163a0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
fld qword [0x1041b188]
sub esp, 8
lea esi, [ebx + 0x10]
fstp qword [esp]
mov dword [ebx + 0xc], eax
call fcn.10024d90
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x30]
push ecx
mov word [ebx + 0x30], 0x101
mov byte [ebx + 0x32], 0
mov dword [ebp - 0x34], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea edi, [ebp - 0x30]
lea eax, [ebx + 4]
call fcn.10016670
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10148524
mov esp, ebp
pop ebp
ret
Function at 0x1002b260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016112e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebx + 4], vtable.UnknownErrorBase.0
push 0x1044eb70
mov dword [ebx], vtable.Unknown.1.0
mov dword [ebx + 4], vtable.Unknown.0
mov dword [ebx + 0xc], 1
mov dword [ebx + 8], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebx + 0x10], vtable.IEnumIndex.0
mov dword [ebx], vtable.SimpleEnumerator_struct_IEnumIndex__struct_IIndex___struct__GUID_const_IID_IEnumIndex_.0
mov dword [ebx + 4], vtable.SimpleEnumerator_struct_IEnumIndex__struct_IIndex___struct__GUID_const_IID_IEnumIndex_.1.0
mov dword [ebx + 0x10], vtable.SimpleEnumerator_struct_IEnumIndex__struct_IIndex___struct__GUID_const_IID_IEnumIndex_.2.0
mov dword [ebx + 0x14], eax
mov edi, dword [ebp + 0xc]
mov byte [ebp - 4], 1
lea esi, [ebx + 0x1c]
mov dword [ebx + 0x18], eax
call fcn.1002b490
mov byte [ebp - 4], 2
mov edi, dword [ebx + 0x24]
xor esi, esi
mov dword [ebx + 0x30], 1
test edi, edi
jle 0x1002b313
lea ebx, [ebx]
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
inc esi
cmp esi, edi
jl 0x1002b300
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8