joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012bc0
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1254]
mov eax, 0x1254
call fcn.1003baf0
push 0xfffffffffffffffe
push 0x1004b680
push 0x1003b8cc
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100530a0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x1250], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0x1260]
mov eax, dword [ebp + 0x1264]
xor edx, edx
mov word [ebp + 0x250], dx
push eax
push ecx
push str._s_s
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp]
push eax
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x10012d27
push eax
call dword [sym.imp.kernel32.dll_FindClose]
push 0
lea eax, [ebp + 0x250]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x10012d27
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10033b30
add esp, 4
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x10012d27
mov dword [ebp - 4], 0
push esi
push edi
push 0
lea eax, [ebp + 0x250]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10012d1b
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push str.StringFileInfo040904e4ProductVersion
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10012d1b
mov ecx, dword [ebp + 0x125c]
mov eax, dword [ebp - 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10012cf8
test dx, dx
je 0x10012cf4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10012cf8
add eax, 4
add ecx, 4
test dx, dx
jne 0x10012cd2
xor eax, eax
jmp 0x10012cfd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10012d1b
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x100530a0
call sub.VCRUNTIME140.dll__local_unwind4
add esp, 0xc
mov eax, 1
jmp 0x10012d29
mov dword [ebp - 4], 0xfffffffe
call fcn.10012d4f
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1250]
xor ecx, ebp
call fcn.1003b4ee
lea esp, [ebp + 0x1254]
pop ebp
ret
Function at 0x10016530
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push 0
push 0
push dword [esp + 0x3c]
mov dword [esp + 0x20], 0
push 0
push 0
push edi
push dword [esp + 0x3c]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call fcn.10006260
mov ebp, dword [esp + 0x14]
test eax, eax
jne 0x100165be
mov edx, dword [esp + 0x30]
test edx, edx
jne 0x10016584
lea esi, [edx + 0xd]
jmp 0x100166bd
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10016590
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [esp + 0x3c]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x100166bd
push 0xc
call fcn.10033b30
mov esi, eax
add esp, 4
test esi, esi
je 0x100165f3
push str.CreateKeyNameValuePair:_cannot_create:
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x100166d1
jmp 0x100165f5
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x100166d1
push edi
lea ecx, [esp + 0x10]
call fcn.100032a0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
mov esi, dword [esp + 0xc]
or edi, 0xffffffff
test esi, esi
je 0x10016663
mov eax, edi
lock xadd dword [esi + 8], eax
dec eax
jne 0x10016663
mov eax, dword [esi]
test eax, eax
je 0x10016641
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10016658
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10033b30
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x1001666f
mov eax, dword [esi]
jmp 0x10016671
xor eax, eax
push eax
call fcn.10003ca0
add esp, 4
test esi, esi
je 0x100166bb
lock xadd dword [esi + 8], edi
dec edi
jne 0x100166bb
mov eax, dword [esi]
test eax, eax
je 0x10016699
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100166b0
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10033b30
add esp, 8
xor esi, esi
test ebp, ebp
je 0x100166c8
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x14
ret
push 0x8007000e
call fcn.10033b30
int3
Function at 0x100185d0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor eax, eax
mov word [edi], ax
call fcn.100050f0
test eax, eax
je 0x10018615
call fcn.10033b30
test eax, eax
je 0x10018607
call fcn.10005400
test eax, eax
je 0x10018607
push 0x800
push edi
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
jmp 0x10018621
push 0x800
push edi
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x10018621
push 0x800
push edi
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push 0xc
mov ebx, eax
call fcn.10033b30
mov esi, eax
add esp, 4
test esi, esi
je 0x1001864f
push str.__get_system_dir__
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.10033b30
mov dword [esi], eax
jmp 0x10018651
xor esi, esi
mov dword [esp + 0x18], esi
test esi, esi
je 0x100187d8
push 0xc
call fcn.10033b30
mov esi, eax
add esp, 4
test esi, esi
je 0x1001868e
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x100187d8
jmp 0x10018690
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x100187d8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 8], eax
dec eax
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
jne 0x100186ee
mov eax, dword [esi]
test eax, eax
je 0x100186cc
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100186e3
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10033b30
add esp, 8
push 0xc
call fcn.10033b30
mov esi, eax
add esp, 4
test esi, esi
je 0x1001871a
push 0x1004214c
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.10033b30
mov dword [esi], eax
jmp 0x1001871c
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x100187d8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov eax, edi
lock xadd dword [esi + 8], eax
dec eax
jne 0x10018771
mov eax, dword [esi]
test eax, eax
je 0x1001874f
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10018766
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10033b30
add esp, 8
mov esi, dword [esp + 0x18]
push ecx
mov eax, esp
mov dword [eax], esi
test esi, esi
je 0x10018782
lock inc dword [esi + 8]
test ebx, ebx
setne al
movzx eax, al
push eax
call fcn.100158e0
add esp, 8
test esi, esi
je 0x100187d0
lock xadd dword [esi + 8], edi
dec edi
jne 0x100187d0
mov eax, dword [esi]
test eax, eax
je 0x100187ae
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100187c5
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10033b30
add esp, 8
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
push 0x8007000e
call fcn.10033b30
int3
Function at 0x1002e5c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0x64
push eax
push 0
push 0x2021f
push 0
push 0
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
mov esi, 0x200
push SysReAllocString
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1002e66c
call fcn.10030880
test eax, eax
je 0x1002e641
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push 4
push eax
call fcn.10033b30
mov esi, dword [esp + 0x14]
add esp, 0x10
jmp 0x1002e649
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 0x18]
push eax
push 3
push 0
push str.EnableAutoUpdateCheck
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x214
ret

Function at 0x1002e720
Capabilities:
Delete registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x202
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002e758
push str.EnableAutoUpdateCheck
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x1002e850
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x208], eax
lea eax, [esp]
mov dword [esp + 4], 0x200
push eax
push 0x201
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002e8d4
push esi
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0
push str.ITCONFIG
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1002e8d4
movzx eax, byte [esp + 8]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor eax, eax
xor ecx, esp
call fcn.1003b4ee
add esp, 0x20c
ret
Function at 0x10030780
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push edi
xor edi, edi
mov dword [esp + 8], 0x200
call fcn.1002e850
test al, 0x10
jne 0x100307b1
call fcn.10030a20
test eax, eax
jne 0x100307cc
mov eax, 1
pop edi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1003b4ee
add esp, 0x210
ret
lea eax, [esp + 4]
push eax
push 0x201
push 0
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10030855
push esi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push str.EnableAutoUpdateCheck
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x10030855
mov dword [esp + 0xc], edi
call fcn.10030880
test eax, eax
je 0x10030846
push 4
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.10033b30
mov eax, dword [esp + 0x1c]
add esp, 0x10
jmp 0x1003084a
mov eax, dword [esp + 0x10]
cmp eax, 0x64
mov ecx, 1
cmove edi, ecx
mov ecx, dword [esp + 0x210]
mov eax, edi
pop edi
xor ecx, esp
call fcn.1003b4ee
add esp, 0x210
ret

Function at 0x10030880
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x118]
sub esp, 0x118
push 0xfffffffffffffffe
push 0x1004b6e0
push 0x1003b8cc
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100530a0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x114], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp], 0x114
push pe_nt_image_headers32
push edi
lea eax, [ebp + 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
cmp dword [ebp + 0x10], 2
jne 0x10030936
cmp dword [ebp + 4], 5
jb 0x10030936
mov dword [ebp - 4], edi
push str.Crypt32.dll
call fcn.10003eb0
add esp, 4
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x1003092a
push str.CryptProtectData
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.10030961
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x114]
xor ecx, ebp
call fcn.1003b4ee
lea esp, [ebp + 0x118]
pop ebp
ret
Function at 0x10033b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x10033b3f
pop dword [ebp - 4]
mov eax, 0xc340a587
add eax, 0x4cc295b8
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x3b9a0419
sub dword [ebp - 0x14], 0xed47bece
mov dword [ebp - 0x10], 0x7a9fd5af
sub dword [ebp - 0x10], 0x486c896a
mov dword [ebp - 0xc], 0x9bea8063
add dword [ebp - 0xc], 0xb061c3cb
mov dword [ebp - 8], 0x9798dc20
sub dword [ebp - 8], 0x9798dc20
lea eax, [ebp - 0x14]
push eax
mov eax, 0x774ae5c6
add eax, 0x98b8fab6
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x9f795ff4
sub dword [ebp - 0x14], 0x2b06f69e
mov dword [ebp - 0x10], 0xabd5cc83
add dword [ebp - 0x10], 0x959694f2
mov dword [ebp - 0xc], 0x4458694d
add dword [ebp - 0xc], 0x1f17031f
mov dword [ebp - 8], 0x3704bc98
sub dword [ebp - 8], 0x3704bc98
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xe218dbca
add eax, 0x2deb04ba
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3ee5b
push 0
call eax
mov ecx, 0x4d1a
xor ebx, ebx
add ebx, eax
mov esi, 0x89537f57
add esi, 0x86b392a9
add esi, dword [ebp - 4]
mov edx, 0x74fb2cba
mov edi, dword [esi]
xor edi, edx
mov dword [ebx], edi
add ebx, 0x4baac76e
sub ebx, 0x4baac76a
add esi, 0x53a4521b
sub esi, 0x53a45217
loop 0x10033c57
add eax, 0xae272f2c
sub eax, 0xae2607f1
mov ebx, eax
add eax, 0x6bce2e3e
sub eax, 0x6bce2e39
mov ecx, 0x10000000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403203
pop dword [ebp - 0x10]
mov eax, 0x2de79de7
add eax, 0xd258941c
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x5e5aed66
sub dword [ebp - 0x20], 0x1008a81b
mov dword [ebp - 0x1c], 0x49a08d2
sub dword [ebp - 0x1c], 0xd266bc8d
mov dword [ebp - 0x18], 0xe8603e42
sub dword [ebp - 0x18], 0x9c13fa14
mov dword [ebp - 0x14], 0x11c3f2d3
add dword [ebp - 0x14], 0xee3c0d2d
lea eax, [ebp - 0x20]
push eax
mov eax, 0x70da6df2
add eax, 0x8f66129a
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x38262880
add dword [ebp - 0x20], 0x3c4c40d6
mov dword [ebp - 0x1c], 0xd1d057f7
sub dword [ebp - 0x1c], 0x9063f682
mov dword [ebp - 0x18], 0xbceeb931
add dword [ebp - 0x18], 0xa680b33b
mov dword [ebp - 0x14], 0xafee4dfc
sub dword [ebp - 0x14], 0xafee4dfc
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x66fa535e
add eax, 0x99462d76
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x362f1
push 0
call eax
mov ecx, 0x465c
mov esi, eax
mov edi, 0xb21ac8b6
add edi, 0x4e26474a
add edi, dword [ebp - 0x10]
mov edx, 0xffb2c2e6
add edx, 0xf9bf4125
sub dword [ebp - 4], 0x5d764cb3
mov ebx, dword [edi]
add dword [ebp - 4], esi
xor ebx, edx
mov dword [ebp - 8], 0x461fa3
mov dword [esi], ebx
add dword [ebp - 4], 0x73a87f73
add esi, 4
add edi, 0xe6b9d745
add edi, 0x194628bf
loop 0x40331f
add eax, 0x63c20447
sub eax, 0x63c0f804
xor ebx, ebx
add ebx, eax
add eax, 0x84d312fe
add eax, 0x7b2ced07
mov ecx, 0x60b538b1
sub ecx, 0x607538b1
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1001f5b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001f78
push 0
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
jmp 0x1001f7b
and eax, 0x10
ret 4

Function at 0x100264f
Capabilities:
Shutdown system

Disassembly:
test byte [esp + 4], 2
jne 0x1002660
call fcn.01002623
cmp eax, 2
jne 0x100269e
test byte [esp + 4], 4
jne 0x1002683
push 4
push 0x40
push 0
push 0x1001251
push 0x522
push 0
call fcn.01008545
cmp eax, 6
jne 0x100269e
cmp word [0x100aa64], 0
jne 0x1002699
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x100269e
call fcn.01008545
ret 4

Function at 0x1002b44
Capabilities:
Create directory

Disassembly:
push edi
mov edi, dword [esp + 8]
mov cl, byte [edi]
test cl, cl
je 0x1002ba9
push ebx
push esi
lea esi, [edi + 1]
mov al, byte [esi]
xor ebx, ebx
cmp al, 0x3a
jne 0x1002b67
cmp byte [edi + 2], 0x5c
jne 0x1002b67
lea esi, [edi + 3]
jmp 0x1002ba2
cmp cl, 0x5c
jne 0x1002ba2
cmp al, cl
jne 0x1002ba2
push 2
lea esi, [edi + 2]
pop ebx
jmp 0x1002ba2
cmp byte [esi], 0x5c
jne 0x1002b99
cmp byte [esi - 1], 0x3a
je 0x1002b99
test ebx, ebx
je 0x1002b8a
dec ebx
jmp 0x1002b99
and byte [esi], 0
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
cmp byte [esi], 0
jne 0x1002b78
pop esi
pop ebx
pop edi
ret 4

Function at 0x1002ebf
Capabilities:
Delete file
Set current directory
Set file attributes

Disassembly:
sub esp, 0x104
push ebp
push esi
mov esi, dword [0x100ac40]
xor ebp, ebp
cmp esi, ebp
push edi
mov edi, esi
je 0x1002f13
push ebx
mov ebx, dword [sym.imp.kernel32.dll_LocalFree]
cmp dword [0x100b884], ebp
jne 0x1002f02
cmp dword [0x100b490], ebp
jne 0x1002f02
push 0x80
push dword [esi]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push dword [esi]
call dword [sym.imp.kernel32.dll_DeleteFileA]
push dword [edi]
mov esi, dword [esi + 4]
call ebx
push edi
call ebx
cmp esi, ebp
mov edi, esi
jne 0x1002edd
pop ebx
cmp dword [0x100b880], ebp
je 0x1002f63
cmp dword [0x100b884], ebp
jne 0x1002f63
cmp dword [0x100b490], ebp
jne 0x1002f63
push 0x100ac44
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
test byte [0x100b494], 0x20
je 0x1002f4e
lea eax, [esp + 0xc]
push eax
call fcn.01005bf7
push 0x1001284
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0xc]
push eax
call fcn.01008545
cmp word [0x100aa64], 1
je 0x1002f7a
cmp dword [0x100b880], ebp
je 0x1002f7a
call fcn.01008545
pop edi
pop esi
mov dword [0x100b880], ebp
pop ebp
add esp, 0x104
ret
Function at 0x1002f8a
Capabilities:
Check if file exists
Create directory
Delete directory
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x118]
push edi
xor edi, edi
xor ebp, ebp
push edi
lea eax, [esp + 0x14]
push 0x1001348
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esp + 0x118]
inc edi
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.01005bb8
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.kernel32.dll_CreateDirectoryA]
je 0x1003025
cmp edi, 0x190
jl 0x1002f9f
push esi
push 0
push 0x1001344
push dword [esp + 0x124]
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x1003016
xor ebp, ebp
push esi
inc ebp
call dword [sym.imp.kernel32.dll_DeleteFileA]
push 0
push esi
call ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x104
ret 8
xor ebp, ebp
push ebp
push esi
call ebx
test eax, eax
je 0x1002fee
xor eax, eax
inc eax
mov dword [0x100b880], eax
mov ebp, eax
jmp 0x1003016

Function at 0x1003e8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push ebx
call dword [sym.imp.kernel32.dll_lstrlenA]
add eax, 0x14
push eax
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x1003ecc
push ebp
push 0x10
push ebp
push ebp
push 0x4b5
push ebp
call fcn.01008545
call fcn.01003573
mov dword [0x100aa5c], eax
xor eax, eax
jmp 0x1003f33
push edi
push ebx
push esi
call dword [sym.imp.kernel32.dll_lstrcpyA]
push 0x10013c4
push esi
call fcn.01005bb8
push ebp
push 0x4000080
push 1
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_LocalFree]
cmp edi, 0xffffffff
je 0x1003f26
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1003f26
test al, 0x10
je 0x1003f26
xor eax, eax
mov dword [0x100aa5c], ebp
inc eax
jmp 0x1003f32
call fcn.01003573
mov dword [0x100aa5c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1004835
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebx, ebx
inc ebx
push esi
mov edi, ebx
call fcn.01005c50
test eax, eax
jne 0x100484f
mov eax, ebx
jmp 0x10048aa
cmp dword [0x100ac3c], 0
jne 0x100489c
test byte [0x100b898], bl
jne 0x100489c
push 6
push 0
push 0x1003869
push dword [0x100aa4c]
mov dword [0x100ae64], esi
push 0x7d3
push dword [0x100b4a4]
call fcn.01008545
sub eax, 6
je 0x100489a
dec eax
je 0x10048b0
sub eax, 0x832
jne 0x100489c
mov dword [0x100ac3c], ebx
mov edi, ebx
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
xor edi, edi
jmp 0x10048a8

Function at 0x1005ae4
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1005b0b
inc esi
mov al, byte [esi]
test al, al
je 0x1005b04
cmp al, 0x22
jne 0x1005af9
cmp byte [esi], 0x22
jne 0x1005b1c
jmp 0x1005b1b
cmp al, 0x20
jle 0x1005b1c
inc esi
cmp byte [esi], 0x20
jg 0x1005b0f
jmp 0x1005b1c
cmp al, 0x20
jg 0x1005b22
inc esi
mov al, byte [esi]
test al, al
jne 0x1005b17
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1005b3c
movzx eax, word [ebp - 0x14]
jmp 0x1005b3f
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x1005c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005c63
xor eax, eax
jmp 0x1005c6b
shr eax, 4
not eax
and eax, 1
ret 4