joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2100b6bb
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21047fec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp + 0xc], 0
lea ecx, [ebp - 0x30]
call fcn.2102c17e
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x2100b6ff
lea ecx, [ebp - 0x30]
call fcn.2102c1f7
mov dword [ebp - 0x40], eax
jmp 0x2100b706
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x2100b733
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.21006010
mov eax, dword [ebp - 0x34]
jmp 0x2100b785
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x2100b75b
mov dword [ebp - 0x38], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.21006010
mov eax, dword [ebp - 0x38]
jmp 0x2100b785
mov edx, dword [ebp + 8]
push edx
push 0x2722
call fcn.2100a398
add esp, 8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.21006010
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x2100b795
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.21004240
test eax, eax
je 0x2100b7aa
xor eax, eax
jmp 0x2100b7c7
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x2100b7c1
xor eax, eax
jmp 0x2100b7c7
mov eax, dword [ebp - 4]
and eax, 0x10
mov esp, ebp
pop ebp
ret 4

Function at 0x2100b7fc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.2100a9d3
test eax, eax
jne 0x2100b816
mov eax, 1
jmp 0x2100b85d
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x2100b85b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x2100b85d
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x2100b9b3
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.2100ba0b
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x2100ba02
cmp dword [ebp + 0x14], 0
jne 0x2100b9fe
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.2100ab40
push eax
push 0x2723
call fcn.2100a398
add esp, 0xc
xor eax, eax
jmp 0x2100ba07
mov eax, 1
pop ebp
ret 0x10
Function at 0x2100ba0b
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0x80
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x2100ba58
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x2100ba3d
mov eax, 1
jmp 0x2100ba5d
cmp dword [ebp + 0xc], 0
jne 0x2100ba54
mov edx, dword [ebp + 8]
push edx
push 0x2721
call fcn.2100a398
add esp, 8
xor eax, eax
jmp 0x2100ba5d
mov eax, 1
pop ebp
ret 8

Function at 0x2100baa6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp + 8], 0
jne 0x2100bae3
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x2100baf6
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.2102ffc0
add esp, 8
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push str.FPP
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.21030110
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x2100c29f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0xffffffff
jne 0x2100c2e2
call fcn.2100a816
push eax
mov ecx, dword [ebp - 4]
call fcn.2100c164
push eax
push 0x2726
call fcn.2100a398
add esp, 0xc
xor eax, eax
jmp 0x2100c2e7
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x2100c4f9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x2100c50f
mov eax, 1
jmp 0x2100c553
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x2100c54e
call fcn.2100a816
push eax
mov ecx, dword [ebp - 8]
call fcn.2100c164
push eax
push 0x271c
call fcn.2100a398
add esp, 0xc
xor eax, eax
jmp 0x2100c553
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x2100c559
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x2100c56f
mov eax, 1
jmp 0x2100c5b3
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x2100c5ae
call fcn.2100a816
push eax
mov ecx, dword [ebp - 8]
call fcn.2100c164
push eax
push 0x2727
call fcn.2100a398
add esp, 0xc
xor eax, eax
jmp 0x2100c5b3
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x2100d07b
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x2104a9ec
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [ebp + 8], 0
je 0x2100d0ad
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x2100d0b6
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x2104a9ec
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esp, ebp
pop ebp
ret

Function at 0x2100d1e4
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0
jmp 0x2100d218
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ecx]
jge 0x2100d321
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0x114]
call fcn.2100d433
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x2100d24f
jmp 0x2100d209
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x10c]
push edx
mov ecx, dword [ebp - 0x114]
call fcn.2100d4ae
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.2100ac73
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x118], ecx
cmp dword [ebp - 0x118], 0
je 0x2100d28f
cmp dword [ebp - 0x118], 2
je 0x2100d2a8
jmp 0x2100d2d8
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.2100a9d3
test eax, eax
je 0x2100d2a6
jmp 0x2100d209
jmp 0x2100d2d8
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.2100a9d3
test eax, eax
je 0x2100d2d8
push 0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call fcn.2100c97d
test eax, eax
je 0x2100d2d8
jmp 0x2100d209
push 1
lea eax, [ebp - 0x104]
push eax
call fcn.2100ba0b
push 0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x110]
add ecx, eax
mov dword [ebp - 0x110], ecx
push 0x80
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x2100d209
mov eax, dword [ebp - 0x110]
mov esp, ebp
pop ebp
ret 8
Function at 0x2100d32d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x2100d34f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx]
jge 0x2100d39f
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.2100d433
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2100d370
jmp 0x2100d346
cmp dword [ebp + 8], 0
je 0x2100d38b
push 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.2100ba0b
mov edx, dword [ebp - 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
jmp 0x2100d39d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0xc], ecx
jmp 0x2100d346
mov ecx, dword [ebp - 0x10]
call fcn.2100d3b0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x2100e180
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x210480a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
lea ecx, [ebp - 0x44]
call fcn.210233b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [0x21053ac4]
push ecx
push 0x80000002
lea edx, [ebp - 0x44]
push edx
call fcn.210234e7
add esp, 0xc
test eax, eax
je 0x2100e1e4
push 0
push 0x104
mov eax, dword [ebp + 8]
push eax
push str.Common_Programs
lea ecx, [ebp - 0x44]
call fcn.21023cb0
mov ecx, dword [ebp + 8]
push ecx
call fcn.21030110
add esp, 4
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.21023435
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x2100e47d
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21048108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
lea ecx, [ebp - 0x44]
call fcn.210233b0
mov dword [ebp - 4], 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
lea eax, [ebp - 0x44]
push eax
call fcn.210234e7
add esp, 0xc
test eax, eax
je 0x2100e518
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x44]
call fcn.21023e94
mov dword [ebp - 0x4c], eax
jmp 0x2100e4e1
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x44]
call fcn.21023f01
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x2100e518
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.21030490
add esp, 8
test eax, eax
jne 0x2100e516
mov dword [ebp - 0x50], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.21023435
mov eax, dword [ebp - 0x50]
jmp 0x2100e531
jmp 0x2100e4d2
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.21023435
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x2100e5f7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x10c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x2100e630
jmp 0x2100e6db
lea edx, [ebp - 0x108]
push edx
push 0
call fcn.21007f89
lea eax, [ebp - 0x108]
push eax
call fcn.21030110
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
push 0
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x2100e671
jmp 0x2100e6d9
lea eax, [ebp - 0x108]
push eax
push 0
call fcn.210133e0
lea ecx, [ebp - 0x108]
push ecx
call fcn.21030110
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x108]
push edx
push 1
push 0
push str.Path
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x2100e6b5
jmp 0x2100e6d7
mov dword [ebp - 4], 1
cmp dword [ebp - 0x10c], 0
je 0x2100e6d2
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
jmp 0x2100e6dd
jmp 0x2100e6bc
jmp 0x2100e6bc
jmp 0x2100e6bc
mov esp, ebp
pop ebp
ret 4
Function at 0x2100fb11
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21048245
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
lea ecx, [ebp - 0x7c]
call fcn.210233b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.210250f0
mov byte [ebp - 4], 1
mov dword [ebp - 0xa8], 0
mov eax, dword [0x21053be4]
push eax
mov ecx, dword [0x210544bc]
push ecx
push 0x21053dac
push 0x80000002
lea edx, [ebp - 0x7c]
push edx
call fcn.21023575
add esp, 0x14
test eax, eax
jne 0x2100fbab
mov dword [ebp - 0x1b4], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.210106e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.21023435
mov eax, dword [ebp - 0x1b4]
jmp 0x2100fd6c
lea ecx, [ebp - 0x44]
call fcn.2100d190
test eax, eax
jne 0x2100fbe7
mov dword [ebp - 0x1b8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.210106e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.21023435
mov eax, dword [ebp - 0x1b8]
jmp 0x2100fd6c
push 0
lea ecx, [ebp - 0xa0]
call fcn.210230d2
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.2102324d
mov dword [ebp - 0xa4], eax
jmp 0x2100fc20
lea ecx, [ebp - 0xa0]
call fcn.2102327e
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x2100fcd9
push 0x2105adf8
mov ecx, dword [ebp - 0xa4]
mov edx, dword [ecx + 4]
push edx
call fcn.21030490
add esp, 8
test eax, eax
je 0x2100fc4a
jmp 0x2100fc0f
mov eax, dword [ebp - 0xa4]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1b0], ecx
jmp 0x2100fc7a
mov edx, dword [ebp - 0x1b0]
push edx
call fcn.21030110
add esp, 4
mov ecx, dword [ebp - 0x1b0]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x1b0], edx
mov eax, dword [ebp - 0x1b0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x2100fcd4
mov edx, dword [ebp - 0x1b0]
push edx
call fcn.2100f0ee
test eax, eax
jne 0x2100fc99
jmp 0x2100fc5b
lea eax, [ebp - 0x1ac]
push eax
mov ecx, dword [ebp - 0x1b0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.2100ac73
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x7c]
push edx
call fcn.2100feb9
mov ecx, dword [ebp - 0xa8]
add ecx, eax
mov dword [ebp - 0xa8], ecx
jmp 0x2100fc5b
jmp 0x2100fc0f
cmp dword [0x2105b320], 0
je 0x2100fd30
push 0x104
lea edx, [ebp - 0x1ac]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x1ac]
push eax
mov ecx, dword [str.fppr232.dll]
push ecx
lea edx, [ebp - 0x1ac]
push edx
call fcn.2100ac73
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x7c]
push edx
call fcn.2100feb9
mov ecx, dword [ebp - 0xa8]
add ecx, eax
mov dword [ebp - 0xa8], ecx
mov edx, dword [ebp - 0xa8]
mov dword [ebp - 0x1bc], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa0]
call fcn.21010730
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.210106e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.21023435
mov eax, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x21012070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x2104aa08
push 0x104
call fcn.2103d925
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
push 0x104
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
call fcn.2103d925
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov dword [edx + 8], eax
push 0x104
call fcn.2103d925
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0xc], edx
cmp dword [0x2105b324], 0
je 0x210120fc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
mov byte [ecx], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
mov byte [eax], 0
jmp 0x2101216b
lea ecx, [ebp - 4]
push ecx
push 0x104
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
push eax
push 1
mov ecx, dword [0x21054414]
push ecx
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 8]
push eax
push 0x210540d0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
call fcn.2100ac73
lea eax, [ebp - 4]
push eax
push 0x104
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
push edx
push 1
mov eax, dword [0x21054414]
push eax
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
push edx
push 0x210540d4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.2100ac73
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp - 0x14]
add edx, 0x10
push edx
push 0x2104c950
push 1
push 0
push 0x2104c940
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x210121aa
jmp 0x210121c7
mov eax, dword [ebp - 0x14]
add eax, 0x14
push eax
push 0x2104c970
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
push edx
call dword [eax]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x21017288
Capabilities:
Delete directory
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21048710
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
lea ecx, [ebp - 0x44]
call fcn.210233b0
mov dword [ebp - 4], 0
mov eax, dword [0x210544bc]
push eax
push str._sDelete
push 0x80000002
lea ecx, [ebp - 0x44]
push ecx
call fcn.2102352e
add esp, 0x10
test eax, eax
je 0x210173f1
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x44]
call fcn.21023fd5
mov dword [ebp - 0x48], eax
jmp 0x210172f6
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x44]
call fcn.21024042
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x210173e7
push 3
push 0x21054c88
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.21031160
add esp, 0xc
test eax, eax
jne 0x21017365
mov edx, dword [ebp - 0x4c]
push edx
call fcn.21030110
add esp, 4
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x50]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
jne 0x2101733f
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x50]
mov byte [edx - 1], 0
push 1
mov eax, dword [ebp - 0x4c]
push eax
call fcn.2100bb27
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.2100b795
test eax, eax
jne 0x21017363
mov edx, dword [ebp - 0x48]
push edx
lea ecx, [ebp - 0x44]
call fcn.210244fa
jmp 0x210173e2
push 0xa
push str.IfEmptyDir
mov eax, dword [ebp - 0x48]
push eax
call fcn.21031160
add esp, 0xc
test eax, eax
jne 0x210173bc
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.21030110
add esp, 4
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x4c]
add edx, dword [ebp - 0x50]
movsx eax, byte [edx - 1]
cmp eax, 0x5c
jne 0x210173a4
mov ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x50]
mov byte [ecx - 1], 0
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
call fcn.210244fa
jmp 0x210173e2
push 1
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.2100ba0b
push 0
mov edx, dword [ebp - 0x4c]
push edx
call fcn.2100a9d3
test eax, eax
jne 0x210173e2
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
call fcn.210244fa
jmp 0x210172e7
push 2
lea ecx, [ebp - 0x44]
call fcn.2102370b
mov ecx, dword [0x210544bc]
push ecx
push str._sRename
push 0x80000002
lea edx, [ebp - 0x44]
push edx
call fcn.2102352e
add esp, 0x10
test eax, eax
je 0x21017478
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x44]
call fcn.21023fd5
mov dword [ebp - 0x48], eax
jmp 0x21017432
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x44]
call fcn.21024042
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x2101746e
push 0
mov edx, dword [ebp - 0x48]
push edx
call fcn.2100a9d3
test eax, eax
je 0x21017460
push 1
mov eax, dword [ebp - 0x54]
push eax
call fcn.2100ba0b
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
call fcn.210244fa
jmp 0x21017423
push 2
lea ecx, [ebp - 0x44]
call fcn.2102370b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.21023435
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x2101872e
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 8]
call fcn.210186db
cmp dword [ebp + 0xc], 0
jne 0x2101876c
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x2101878a
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
cmp dword [edx], 0xffffffff
jne 0x21018797
jmp 0x21018842
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0xffffffff
jne 0x210187b9
jmp 0x21018840
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
and ecx, 2
add ecx, 2
push ecx
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
jne 0x210187ec
jmp 0x2101883e
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0xf001b
add eax, 4
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
jne 0x21018820
jmp 0x2101883c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x21018837
mov ecx, dword [ebp - 8]
call fcn.210186db
mov eax, dword [ebp - 4]
jmp 0x21018844
jmp 0x21018829
jmp 0x21018829
jmp 0x21018829
jmp 0x21018829
mov esp, ebp
pop ebp
ret 8

Function at 0x21018860
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret 4