joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20014090
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x20019943
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call sym.drprov.dll_NPEnumResource
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x2001a760
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.200196d0
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x200140f7
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.2000d460
jmp 0x200140f9
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x200066c0
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.2000ab10
push 1
push ebx
push ebx
push esi
push 0x200025f0
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.2000ab10
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x200156f0
Capabilities:
Copy file

Disassembly:
sub esp, 0x210
mov eax, 0x100
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x20015711
add esp, 0x210
ret
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
lea ecx, [esp + 0x114]
push edx
push ecx
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c]
push edx
push ecx
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x20015741
add esp, 0x210
ret
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x20015757
add esp, 0x210
ret
push esi
push 0x2002167c
call dword [0x2001a2a8]
mov esi, eax
push 0x20021664
push esi
call dword [0x2001a1e8]
test eax, eax
je 0x20015781
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
push ecx
push edx
call eax
push esi
call dword [0x2001a2f0]
mov eax, dword [esp + 4]
pop esi
add esp, 0x210
ret
Function at 0x20015f80
Capabilities:
Open clipboard
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001a770
push 0x200196dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 1
mov dword [ebp - 4], ebx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
je 0x2001605e
lea ecx, [ebp - 0x38]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.USER32.dll_GetDC]
test eax, eax
je 0x2001605e
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
mov edi, eax
add edi, 0x10
mov dword [ebp - 0x2c], edi
push edi
push 8
call dword [0x2001a1fc]
push eax
call dword [0x2001a204]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x2001605e
push 2
push edi
push esi
call dword [0x2001a038]
test eax, eax
je 0x2001605e
mov ecx, dword [ebp - 0x38]
push ecx
push 0x10000000
push 2
push esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
test eax, eax
je 0x2001605e
push ebx
push esi
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 4], 0xffffffff
call fcn.2001609c
cmp dword [ebp - 0x24], ebx
jne 0x200160ab
cmp esi, ebx
je 0x20016082
push esi
push ebx
call dword [0x2001a1fc]
push eax
call dword [0x2001a1f8]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6620146b
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable
Set environment variable
Terminate process

Disassembly:
mov eax, 0x6621b3ad
call fcn.6620d084
sub esp, 0x3bc
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0x110]
call fcn.66203100
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 4], edi
je 0x662014af
push 0x104
lea eax, [ebp - 0x3c8]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.6620d5a0
xor ecx, ecx
xor edx, edx
inc edx
movzx ebx, cl
test eax, eax
lea eax, [ebp - 0x3c8]
push ecx
cmovne ebx, edx
cmp dword [esi + 4], ecx
push ecx
push ecx
cmove eax, ecx
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.66206580
add esp, 0x1c
test al, al
je 0x662015fb
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.6620d510
add esp, 0xc
mov dword [ebp - 0x60], esi
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea ecx, [ebp - 0x1c0]
push 0xffffffffffffffff
push esi
call fcn.66203100
mov byte [ebp - 4], 1
test bl, bl
jne 0x6620157c
movzx eax, word [esi]
push 0x22
pop ecx
cmp ax, cx
jne 0x6620155c
jmp 0x6620153e
cmp cx, ax
je 0x6620154b
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x66201539
jmp 0x66201561
add esi, 2
jmp 0x66201561
cmp ax, 0x20
je 0x66201561
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x66201550
push esi
push dword [ebp - 0x110]
lea eax, [ebp - 0x1c0]
push str.__ls__ls
push eax
call fcn.662045c0
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
push str.TS_SOURCE
call esi
push edi
push str.TS_ORIGIN
call esi
test bl, bl
je 0x662015bf
push dword [ebp - 0x110]
push str.TS_UPDATED_DATFILE
call esi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x1c0]
push dword [ebp + 0xc]
jmp 0x662015dc
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x1c0]
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x662015ed
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], bl
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x6620161b
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x6621b3c2
call fcn.6620d084
sub esp, 0xb0
push ebx
push esi
lea ecx, [ebp - 0xbc]
call fcn.662031a0
mov ecx, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.66203cc0
push ebx
lea eax, [ebp - 0xbc]
mov esi, str.TS_UPDATED_DATFILE
push eax
push esi
call fcn.66203d90
add esp, 0xc
test eax, eax
js 0x66201679
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xbc]
push eax
call fcn.66203f30
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x66201da0
Capabilities:
Create process on windows
Create process suspended
Delete file
Set environment variable

Disassembly:
mov eax, 0x6621b4b8
call fcn.6620d084
sub esp, 0x314
push ebx
lea ecx, [ebp - 0x270]
call fcn.662031a0
xor ebx, ebx
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 4], ebx
call fcn.662031a0
lea eax, [ebp - 0x1c0]
mov byte [ebp - 4], 1
push str.TS_UPDATE_THINREG
push eax
call fcn.662045c0
push ebx
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x1c0]
call fcn.66203d90
add esp, 0x14
test eax, eax
jne 0x66201f2b
push esi
push edi
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0xcc]
call fcn.66202f60
push ebx
push ebx
push 0xffffffffffffffff
xor edi, edi
mov byte [ebp - 4], 2
push 0x6621c4f0
inc edi
lea ecx, [ebp - 0xcc]
push edi
call fcn.662033b0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xcc]
push ebx
push ebx
push dword [eax + 4]
push dword [eax]
push edi
call fcn.662033b0
push ebx
push ebx
push 0xffffffffffffffff
push str..exe
push edi
lea ecx, [ebp - 0xcc]
call fcn.662033b0
push ebx
push ebx
push 0xffffffffffffffff
push 0x6621c508
push edi
lea ecx, [ebp - 0xcc]
call fcn.662033b0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.6620d510
add esp, 0xc
mov dword [ebp - 0x110], esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xcc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x66201ec6
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
call esi
mov eax, dword [ebp - 0xcc]
push 0x22
pop ecx
cmp word [eax], cx
jne 0x66201f0e
push edi
push ecx
lea ecx, [ebp - 0xcc]
call fcn.66204310
cmp eax, 0xffffffff
je 0x66201f0e
dec eax
lea ecx, [ebp - 0xcc]
push eax
push edi
lea eax, [ebp - 0x320]
push eax
call fcn.6620247a
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x320]
call fcn.66203220
push ebx
push str.TS_UPDATE_THINREG
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 1
call fcn.66203220
pop edi
pop esi
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], bl
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x66201f57
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, 0x6621b4e0
call fcn.6620d084
sub esp, 0x300
push esi
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0xbc]
call fcn.66202f60
lea eax, [ebp - 0x30c]
mov byte [ebp - 4], 2
push eax
push dword [ebp + 0xb8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x2e0]
push eax
push 1
lea ecx, [ebp - 0xbc]
call fcn.662033b0
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xbc]
call fcn.66203f30
lea eax, [ebp - 0x30c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x66201f97
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 1
call fcn.66203220
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb8]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x66202017
Capabilities:
Delete file
Enumerate files on windows
Move file

Disassembly:
mov eax, 0x6621b51e
call fcn.6620d084
sub esp, 0x460
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp + 8]
inc ebx
lea ecx, [ebp - 0xbc]
push eax
mov dword [ebp - 4], ebx
call fcn.66202f60
lea eax, [ebp - 0x46c]
mov byte [ebp - 4], 2
push eax
push dword [ebp + 0xb8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x440]
push eax
push ebx
lea ecx, [ebp - 0xbc]
call fcn.662033b0
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x21c]
call fcn.66202f60
mov esi, dword [ebp - 0xb8]
push 0x6621c4c0
mov byte [ebp - 4], 3
call fcn.6620cda1
pop ecx
sub esi, eax
lea ecx, [ebp - 0xbc]
push esi
lea eax, [ebp - 0x16c]
push eax
call fcn.662043b0
push ebx
push dword [ebp - 0x16c]
mov byte [ebp - 4], 4
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xbc]
call fcn.66203f30
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 3
call fcn.66203220
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.66203220
lea eax, [ebp - 0x46c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x66202058
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], bl
call fcn.66203220
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xb8]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x66202141
Capabilities:
Create process on windows
Create process suspended
Set environment variable
Terminate process

Disassembly:
mov eax, 0x6621b551
call fcn.6620d084
sub esp, 0x368
push ebx
push esi
xor ebx, ebx
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], ebx
call fcn.662031a0
mov esi, str.TS_UPDATE_CMDLINE
mov byte [ebp - 4], 1
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.662045c0
pop ecx
pop ecx
lea ecx, [ebp - 0x114]
call fcn.662031a0
push ebx
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 2
push eax
push dword [ebp - 0x214]
call fcn.66203d90
add esp, 0xc
test eax, eax
js 0x66202205
push 0xffffffffffffffff
push 0x6621c3d8
lea ecx, [ebp - 0x374]
call fcn.66203100
push ebx
push eax
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 3
call fcn.66203670
mov ebx, eax
mov byte [ebp - 4], 2
neg ebx
lea ecx, [ebp - 0x374]
sbb bl, bl
call fcn.66203220
inc bl
je 0x662021fb
xor esi, esi
push esi
push 0x6621c3dc
push str.Your_application_was_updated._____________Please_relaunch_to_use_the_new_version
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.6620d510
add esp, 0xc
mov dword [ebp - 0x64], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.66202f60
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x10]
push 2
push 1
push ebx
push eax
call esi
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push dword [ebp - 0x10]
lea eax, [ebp - 0x164]
push 0x6621c494
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x164]
push eax
push str.TS_PARENT_HANDLE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0x2c4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x662022a5
push ebx
jmp 0x662021f5
lea ecx, [ebp - 0x2c4]
call fcn.66203220
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 1
call fcn.66203220
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], bl
call fcn.66203220
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x662022e9
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x6621b589
call fcn.6620d084
sub esp, 0x168
push esi
push edi
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
or edi, 0xffffffff
push edi
push 0
call fcn.662037e0
push eax
lea ecx, [ebp + 8]
call fcn.66204290
push eax
lea ecx, [ebp + 8]
call fcn.66203cc0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xc4]
call fcn.66202f60
push 0
push 0
push edi
mov esi, 0x6621c540
mov byte [ebp - 4], 1
push esi
push 1
lea ecx, [ebp - 0xc4]
call fcn.662033b0
push 0
push 0
push edi
push str..ase
push 1
lea ecx, [ebp - 0xc4]
call fcn.662033b0
sub esp, 0xb0
lea eax, [ebp - 0xc4]
mov ecx, esp
mov dword [ebp - 0x14], esp
push eax
call fcn.66202f60
sub esp, 0xb0
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.66202f60
mov byte [ebp - 4], 1
call fcn.66201f57
add esp, 0x160
lea eax, [ebp + 8]
lea ecx, [ebp - 0xc4]
push eax
call fcn.66203f30
push 0
push 0
push edi
push esi
push 1
lea ecx, [ebp - 0xc4]
call fcn.662033b0
push 0
push 0
push edi
push str..asd
push 1
lea ecx, [ebp - 0xc4]
call fcn.662033b0
sub esp, 0xb0
lea eax, [ebp - 0xc4]
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.66202f60
sub esp, 0xb0
mov byte [ebp - 4], 3
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.66202f60
mov byte [ebp - 4], 1
call fcn.66201f57
add esp, 0x160
lea ecx, [ebp - 0x174]
call fcn.662031a0
lea eax, [ebp - 0x174]
mov byte [ebp - 4], 4
push str.TS_UPDATE_COMPLETE
push eax
call fcn.662045c0
pop ecx
pop ecx
push dword [ebp + 8]
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 1
call fcn.66203220
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0
call fcn.66203220
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.66203220
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x662024e1
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi + 4], ebx
jne 0x66202500
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
jmp 0x66202578
push esi
mov esi, dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x6620251f
push 1
push dword [esi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x66202570
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x66202558
mov edi, dword [ebp + 0x10]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x96
je 0x66202555
push dword [edi]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x66202533
mov edi, dword [ebp + 8]
push 1
push dword [esi]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x66202575
push esi
mov ecx, edi
call fcn.66203f30
xor eax, eax
inc eax
jmp 0x66202577
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x66204bd0
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6621b79b
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test ebx, ebx
je 0x66204c04
mov byte [ebp + 0xb], 1
cmp esi, 0xffffffff
je 0x66204c08
mov byte [ebp + 0xb], 0
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x84]
call fcn.66207d30
mov dword [ebp - 4], 0
cmp byte [ebp + 0xb], 0
je 0x66204c5d
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x1a4]
push eax
push 0
mov eax, ebx
lea ecx, [ebp - 0x84]
cdq
push edx
push eax
call fcn.66208b10
mov edi, eax
test edi, edi
js 0x66204d78
lea ecx, [ebp - 0x1a4]
call fcn.66208cf0
mov esi, dword [ebp - 0x154]
cmp byte [ebp + 0x20], 0
mov ecx, 4
push 0
push 0x8000000
mov eax, 0x40
mov dword [ebp - 0x14], 0
cmovne eax, ecx
mov dword [ebp - 0x24], esi
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], 0
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
js 0x66204d78
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], 0
push 0x100000
push 2
push eax
push 0
push 0
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test edi, edi
js 0x66204d0b
cmp byte [ebp + 0xb], 0
je 0x66204d16
push dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1a4]
push ebx
push eax
call fcn.66208770
mov edi, eax
add esp, 0x10
test edi, edi
jns 0x66204d3d
push dword [ebp - 0x10]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x66204d78
test ebx, ebx
je 0x66204d3d
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
je 0x66204d31
push dword [ebp - 0x10]
push eax
push ebx
call fcn.6620b550
add esp, 0x10
jmp 0x66204d3d
push ebx
push dword [ebp - 0x10]
call fcn.6620d6b0
add esp, 0xc
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x66204d4f
push dword [ebp - 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x66204d54
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x66204d68
push dword [ebp - 0x10]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x66204d6d
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x66204d76
mov dword [eax], esi
xor edi, edi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.66207f10
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x66205610
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6621b85b
push eax
mov dword fs:[0], esp
sub esp, 0xf0
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x178]
call fcn.66207640
cmp dword [edi + 0x160], 0
jne 0x6620576d
cmp dword [edi + 4], 0
je 0x66205725
lea ecx, [ebp - 0xfc]
call fcn.662031a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xfc]
push eax
push dword [edi]
call fcn.6620aea0
add esp, 8
lea ecx, [ebp - 0xfc]
call fcn.66204340
mov dword [ebp - 0x24], eax
lea ecx, [edi + 0x170]
xor edx, edx
mov dword [ebp - 0x2c], 0x18
cmp byte [edi + 0x18c], dl
mov eax, 0x20
mov dword [ebp - 0x28], 0
cmovne eax, edx
mov dword [ebp - 0x20], 0x40
or eax, 0x40
mov dword [ebp - 0x1c], 0
push eax
push 1
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
push eax
push dword [edi + 0x188]
push ecx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov dword [ebp - 0x10], eax
test eax, eax
jns 0x66205713
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.66203220
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.66203220
push 5
push 0x18
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], 0
push eax
push dword [edi + 0x170]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x48], xmm0
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x66205829
mov eax, dword [ebp - 0x44]
mov dword [edi + 0x168], eax
mov eax, dword [ebp - 0x40]
mov dword [edi + 0x16c], eax
mov ecx, edi
call fcn.662059f0
mov dword [ebp - 0x10], eax
test eax, eax
jns 0x662057a2
lea ecx, [edi + 0x178]
call fcn.66207640
mov ecx, edi
call fcn.66204b40
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [ebp + 8], 0
je 0x662057bc
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [edi + 0x178]
mov ecx, esi
call fcn.66204980
test al, al
je 0x662057a8
cmp byte [ebp + 0xc], 0
je 0x662057a8
mov eax, dword [edi + 0x170]
mov dword [edi + 0x174], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x170], 0
test eax, eax
je 0x662057fc
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.662041e0
jmp 0x6620581c
mov ecx, esi
call fcn.66204960
mov ecx, edi
mov esi, eax
call fcn.66203ec0
push 0
push 0
push 0xffffffffffffffff
push esi
push 1
mov ecx, eax
call fcn.662033b0
push 0
push 0
push 1
mov ecx, edi
call fcn.66205610
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc