joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ada6030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0xd0
mov edi, dword [esp + 0xe0]
mov esi, dword [esp + 0xe4]
mov eax, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esp + 0x18], esi
mov ecx, dword [edi + 0x10]
mov ebx, dword [edi + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x24], edx
mov edx, dword [edi]
movzx edi, byte [edi + 7]
and eax, 0xffffff
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
mov eax, edi
mov dword [esp + 0x28], edx
mov edx, dword [esi + 4]
mov byte [esp + 0x40], al
mov eax, dword [esi]
xor edx, 0x4d
mov dword [esp + 0x34], ebx
xor eax, 0x57504c57
or eax, edx
movzx eax, byte [esp + 0x41]
sete dl
and eax, 0xfffffffe
or eax, edx
and edi, 4
mov byte [esp + 0x41], al
je 0x6ada6150
movzx edx, byte [esi + 0x181]
mov eax, dword [esi + 0x184]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
shl edx, 0xa
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x48]
and eax, 0x3ff
mov dword [esp], ecx
or eax, edx
lea edx, [esp + 0x38]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x40], eax
movzx eax, byte [esp + 0x74]
mov dword [esp + 0x88], edx
and eax, 0xfffffff0
mov dword [esp + 0x8c], edx
mov dword [esp + 0x80], 0
or eax, 1
mov byte [esp + 0x74], al
lea eax, [esp + 0x18]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x88]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x84], 0
mov dword [esp + 4], eax
call fcn.6ada5f90
add esp, 0xd0
pop ebx
pop esi
pop edi
ret
xor eax, eax
xor edx, edx
jmp 0x6ada60b9
Function at 0x6ada6280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov ebp, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov ebx, dword [esp + 0xf8]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x18], ecx
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x24], edx
mov edx, dword [ebp]
movzx ebp, byte [ebp + 7]
and eax, 0xffffff
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], eax
mov eax, ebp
mov dword [esp + 0x28], edx
mov edx, dword [ecx + 4]
mov byte [esp + 0x40], al
mov eax, dword [ecx]
xor edx, 0x4d
mov dword [esp + 0x34], edi
xor eax, 0x57504c57
or eax, edx
movzx eax, byte [esp + 0x41]
sete dl
and eax, 0xfffffffe
or eax, edx
and ebp, 4
mov byte [esp + 0x41], al
je 0x6ada63d0
movzx edx, byte [ecx + 0x181]
mov eax, dword [ecx + 0x184]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
shl edx, 0xa
lea ecx, [esp + 0x48]
mov dword [esp + 8], 0
and eax, 0x3ff
mov dword [esp + 4], 0x6ade342c
or eax, edx
mov dword [esp], ecx
lea edx, [esp + 0x38]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x88]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
movzx eax, byte [esp + 0x74]
mov dword [esp + 0x50], esi
and eax, 0xffffffd0
mov dword [esp + 0x54], edi
or eax, 0x21
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], edx
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov byte [esp + 0x74], al
call fcn.6ada6160
test eax, eax
jne 0x6ada63c0
mov edx, dword [esp + 0x58]
mov dword [ebx], edx
mov edx, dword [esp + 0x5c]
mov dword [ebx + 4], edx
mov edx, dword [esp + 0x60]
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x64]
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0x68]
mov dword [ebx + 0x10], edx
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
xor edx, edx
jmp 0x6ada6312
Function at 0x6ada78d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6adab230
mov eax, dword [esp + 0x70]
mov ebp, dword [eax + 4]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x40], eax
test ebp, ebp
je 0x6ada795f
lea ebx, [esp + 0x30]
jmp 0x6ada793d
je 0x6ada7a30
mov ebp, dword [ebp + 4]
test ebp, ebp
je 0x6ada795f
lea eax, [ebp - 0x14]
mov dword [esp + 8], 0x14
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memcmp
test eax, eax
jns 0x6ada7930
mov ebp, dword [ebp]
test ebp, ebp
jne 0x6ada793d
mov dword [esp], 0x24
call fcn.6adaeec0
mov ebx, eax
test eax, eax
je 0x6ada7a79
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6adaf0b0
mov ebp, eax
test eax, eax
je 0x6ada7a71
mov eax, dword [esp + 0x70]
mov esi, dword [eax]
mov eax, dword [esi + 4]
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 4]
lea eax, [eax*4 + 4]
mov dword [esp + 4], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.6adaef00
test eax, eax
je 0x6ada7a69
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
lea eax, [eax*8 + 8]
mov dword [esp + 4], eax
mov eax, dword [esi + 8]
mov dword [esp], eax
call fcn.6adaef00
test eax, eax
je 0x6ada7a69
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], eax
mov dword [ecx + edx*4], ebp
mov dword [eax + edx*8], edi
mov dword [eax + edx*8 + 4], 0
add edx, 1
mov eax, dword [esp + 0x70]
mov dword [esi + 4], edx
mov edx, ebx
call fcn.6ada7140
test al, al
je 0x6ada7a48
mov eax, dword [ebx]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x18]
test eax, eax
js 0x6ada795f
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x15c
mov dword [esp + 4], str.src_security.c
mov dword [esp], 0x6ade3c6e
call dword [0x6add9074]
mov eax, dword [ebx]
jmp 0x6ada7a28
mov dword [esp], ebp
call fcn.6adaeef0
mov dword [esp], ebx
call fcn.6adaeef0
mov eax, 0xffffffff
jmp 0x6ada7a3b
Function at 0x6adab230
Capabilities:
Hash data using sha1

Disassembly:
push esi
push ebx
sub esp, 0x74
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov esi, dword [esp + 0x80]
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
mov dword [esp + 0x28], 0xc3d2e1f0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0
cmp ebx, 0x3f
ja 0x6adab2a0
test ebx, ebx
jne 0x6adab2be
mov eax, dword [esp + 0x88]
mov dword [esp + 4], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call fcn.6adab0f0
add esp, 0x74
pop ebx
pop esi
ret
mov ecx, ebx
mov edx, esi
lea eax, [esp + 0x18]
shr ecx, 6
call fcn.6ada9e00
mov eax, ebx
and ebx, 0x3f
and eax, 0xffffffc0
add esi, eax
test ebx, ebx
je 0x6adab280
cmp ebx, 4
jb 0x6adab2f0
mov eax, dword [esi + ebx - 4]
mov dword [esp + ebx + 0x28], eax
sub ebx, 1
cmp ebx, 4
jb 0x6adab280
and ebx, 0xfffffffc
xor eax, eax
mov edx, dword [esi + eax]
mov dword [esp + eax + 0x2c], edx
add eax, 4
cmp eax, ebx
jb 0x6adab2d8
jmp 0x6adab280
test ebx, ebx
je 0x6adab280
movzx eax, byte [esi]
mov byte [esp + 0x2c], al
test bl, 2
je 0x6adab280
movzx eax, word [esi + ebx - 2]
mov word [esp + ebx + 0x2a], ax
jmp 0x6adab280

Function at 0x6adac660
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ebp, ebp
push edi
xor edi, edi
push esi
xor esi, esi
push ebx
sub esp, 0x2c
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0x19
jmp 0x6adac682
mov ebp, ebx
sub dword [esp + 0x14], 1
lea edi, [edi + edi + 0x100]
je 0x6add6348
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.6adaef00
mov ebx, eax
test eax, eax
je 0x6add6348
mov dword [esp], 0
call dword [0x6add908c]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, edi
sub eax, esi
mov dword [esp + 8], eax
lea eax, [ebx + esi]
mov dword [esp], eax
call sub.msvcrt.dll_fread
add esi, eax
cmp edi, esi
je 0x6adac680
mov dword [esp], 0
call dword [0x6add908c]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
je 0x6add6366
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Too_much_data_sent_on_stdin_
call fcn.6add55ba
mov dword [esp], ebp
call fcn.6adaeef0
mov eax, 0x18
jmp 0x6adac707
mov dword [esp], str.Error_reading_stdin
call fcn.6add55e2
mov dword [esp], ebx
call fcn.6adaeef0
mov eax, 0x32
jmp 0x6adac707
Function at 0x6adace40
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 8], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6adace20
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x6adace9a
mov dword [ebx], eax
mov eax, 1
add esp, 0x28
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.Failed_to_create_thread
mov dword [esp], eax
call fcn.6add80c9
xor eax, eax
jmp 0x6adace95

Function at 0x6adb0f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
movzx eax, byte [eax + 0x2c]
and eax, 0xf
cmp al, 1
je 0x6adb0f71
mov dword [esp + 8], 0xfb
mov dword [esp + 4], str.src_write.c
mov dword [esp], str.blob__blob_location__BLOB_IN_WIM
call dword [0x6add9074]
mov edx, dword [ebx + 0x30]
mov esi, dword [edx + 8]
mov edi, dword [edx + 0xc]
mov ecx, dword [edx + 0x10]
movzx eax, byte [edx + 0x28]
mov dword [esp + 0x18], esi
mov esi, dword [edx + 0x18]
mov dword [esp + 0x1c], edi
mov edi, dword [edx + 0x1c]
mov dword [esp + 0x20], esi
mov edx, dword [edx + 0x14]
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], ecx
test al, 0x10
je 0x6adb1010
mov edi, dword [ebx + 0x38]
mov ecx, dword [ebx + 8]
mov dword [ebx + 0x78], 0
mov ebp, dword [ebx + 0x3c]
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x68], ecx
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x70], edi
mov edi, dword [ebx + 0xc]
and ecx, 0xff000000
mov dword [ebx + 0x74], ebp
and edi, 0xffffff
mov dword [ebx + 0x54], edx
or ecx, edi
mov dword [ebx + 0x6c], ecx
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov byte [ebx + 0x6f], al
mov dword [ebx + 0x48], esi
mov esi, dword [esp + 0x20]
mov dword [ebx + 0x4c], edi
mov edi, dword [esp + 0x24]
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x58], esi
mov dword [ebx + 0x5c], edi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, edx
mov edx, dword [ebx + 0x6c]
and ecx, 0xffffff
mov dword [ebx + 0x70], esi
mov esi, dword [esp + 0x20]
mov dword [ebx + 0x74], edi
and edx, 0xff000000
mov edi, dword [esp + 0x24]
mov dword [ebx + 0x78], esi
mov esi, dword [esp + 0x2c]
or edx, ecx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x7c], edi
mov dword [ebx + 0x68], esi
mov byte [ebx + 0x6f], al
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6adb6dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x144]
test eax, eax
je 0x6adb6e50
mov esi, dword [ebx + 0x58]
lea eax, [esp + 0x1c]
mov dword [esp + 4], ebx
add ebx, 0x48
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.6ada6030
mov edi, eax
test eax, eax
jne 0x6adb6e3c
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, esi
jne 0x6add6be9
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.6adaeef0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 0x148]
mov edi, 0x2d
mov dword [esp], eax
call fcn.6ad90ee0
test al, al
je 0x6adb6de9
jmp 0x6adb6e3c
mov dword [esp], str.Failed_to_extract_XML_data
mov edi, 0x48
call fcn.6add55e2
jmp 0x6adb6e30
Function at 0x6adbdc60
Capabilities:
Get disk information

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x24c
mov dword [edx], 0
mov byte [ecx], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0x6adead52
mov dword [esp], eax
call sub.msvcrt.dll_wcsncmp
mov edx, eax
lea eax, [esi + 8]
test edx, edx
cmovne eax, esi
movzx ecx, word [eax]
mov edx, ecx
and edx, 0xffffffdf
sub edx, 0x41
cmp dx, 0x19
ja 0x6adbdcb3
cmp word [eax + 2], 0x3a
je 0x6adbdd30
xor edx, edx
xor eax, eax
mov word [esp + 0x2e], dx
lea ebp, [esp + 0x36]
mov dword [esp + 0x1c], 0x105
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
sub esp, 0x20
test eax, eax
je 0x6adbdd4d
mov dword [esp + 4], 0x6adeadb2
mov dword [esp], ebp
call sub.msvcrt.dll_wcsstr
test eax, eax
je 0x6adbdd1d
or dword [ebx], 0xc00000
mov byte [edi], 1
add esp, 0x24c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov word [esp + 0x2e], cx
mov word [esp + 0x34], ax
lea eax, [esp + 0x2e]
mov dword [esp + 0x30], 0x5c003a
jmp 0x6adbdcbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Failed_to_get_volume_information_for___ls_
mov dword [esp], eax
call fcn.6add80a8
jmp 0x6adbdd1d

Function at 0x6adbded0
Capabilities:
Get file attributes

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x5c
mov eax, dword [edx + 0x24]
test byte [ecx + 0xe], 0x10
jne 0x6adbdeee
mov edx, dword [ecx + 0xdc]
mov ebx, ecx
test edx, edx
jne 0x6adbdf00
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
and eax, 0x800
mov dword [esp + 0x10], 4
mov edi, eax
setne al
mov dword [esp + 0xc], 0x28
mov ebp, eax
lea eax, [esp + 0x28]
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ecx + 0x1a8]
mov dword [esp + 4], eax
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
test eax, eax
js 0x6adbdf4d
mov eax, dword [esp + 0x48]
mov edx, ebp
shr eax, 0xb
and eax, 1
cmp dl, al
je 0x6adbdeee
mov eax, ebp
mov dword [esp], esi
movzx ebp, al
lea eax, [esp + 0x26]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0x9c040
mov word [esp + 0x26], bp
call fcn.6adbccd0
mov esi, eax
test eax, eax
jns 0x6adbdeee
mov eax, ebx
call fcn.6adbcf90
test edi, edi
mov ecx, 0x6adeadd4
mov dword [esp], esi
mov edx, eax
mov eax, str.clear
mov dword [esp + 4], str.Cant__s_compression_attribute_on___ls_
cmovne eax, ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call fcn.6add8113
mov eax, 0x39
jmp 0x6adbdef0
Function at 0x6adc14b0
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x98
lea edx, [esp + 0x28]
mov dword [esp + 0x10], 0x12
mov dword [esp + 8], edx
lea edx, [esp + 0x20]
mov dword [esp + 0xc], 0x68
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
test eax, eax
jns 0x6adc14ef
cmp eax, 0x80000005
jne 0x6adc154b
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x60]
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0x3c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x1c], edx
mov edx, dword [esp + 0x6c]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x24], edx
mov edx, dword [esp + 0x5c]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x70]
mov dword [ebx + 0x30], eax
xor eax, eax
add esp, 0x98
pop ebx
ret

Function at 0x6adc1840
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, edx
push ebx
sub esp, 0xb4
lea edx, [esp + 0x30]
mov dword [esp + 0x10], 0x15
mov dword [esp + 8], edx
lea edx, [esp + 0x28]
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
mov ebx, eax
test eax, eax
js 0x6adc1883
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x6adc1890
add esp, 0xb4
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.6ad8d800
mov dword [esi + 0x20], eax
test eax, eax
je 0x6adc18ba
mov eax, dword [esp + 0x30]
mov word [esi + 0x26], ax
add esp, 0xb4
mov eax, ebx
pop ebx
pop esi
ret
mov ebx, 0xc0000017
jmp 0x6adc1883
Function at 0x6adc2520
Capabilities:
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x1058
call fcn.6adc7100
sub esp, eax
mov eax, dword [esp + eax]
mov edi, eax
mov ecx, dword [esp + 0x1070]
mov ebx, dword [esp + 0x1074]
mov eax, dword [esp + 0x1078]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
test byte [eax + 0xa], 4
je 0x6adc2620
mov dword [esp + 0x28], edx
lea ebp, [esp + 0x50]
mov esi, 0x1000
mov ebx, ebp
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 0x16
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
test eax, eax
jns 0x6adc26a0
cmp eax, 0x80000005
jne 0x6adc25c0
add esi, esi
cmp ebx, ebp
je 0x6adc2610
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.6adaef00
test eax, eax
je 0x6adc2700
mov ebx, eax
jmp 0x6adc256c
mov edx, dword [esp + 0x28]
jl 0x6add84db
cmp eax, 0xc0000004
jge 0x6adc2600
cmp eax, 0xc0000002
jl 0x6add84db
xor eax, eax
test dword [edx + 0x24], 0x410
je 0x6adc2631
cmp ebx, ebp
jne 0x6adc2685
add esp, 0x105c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xc00000bb
je 0x6adc25dc
jmp 0x6add84db
mov dword [esp], esi
call fcn.6adaeec0
jmp 0x6adc25b0
xor eax, eax
test dword [edx + 0x24], 0x410
jne 0x6adc25ef
lea ebp, [esp + 0x50]
mov ebx, ebp
mov eax, dword [esp + 0x1078]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x40], 0x3a003a
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], edx
mov edx, 7
mov dword [esp], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x44], 0x440024
mov dword [esp + 0x48], 0x540041
mov dword [esp + 0x4c], 0x41
call fcn.6adc2460
cmp ebx, ebp
je 0x6adc25ef
mov dword [esp], ebx
mov dword [esp + 0x28], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x28]
add esp, 0x105c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x3c]
xor eax, eax
test edx, edx
je 0x6adc25e7
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0x1078]
mov dword [esp + 0x2c], ebp
jmp 0x6adc26c8
mov edx, dword [ebx]
test edx, edx
je 0x6adc2710
add ebx, edx
mov ecx, dword [esp + 0x28]
mov edx, dword [ebx + 4]
mov dword [esp + 0xc], esi
lea eax, [ebx + 0x18]
mov dword [esp + 8], ecx
mov edi, dword [ebx + 8]
shr edx, 1
mov ebp, dword [ebx + 0xc]
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.6adc2460
test eax, eax
je 0x6adc26c0
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
jmp 0x6adc25e7
mov eax, 0x27
jmp 0x6adc25e7
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x2c]
jmp 0x6adc25e7
mov ecx, dword [esp + 0x1078]
mov edx, dword [ecx]
mov edx, dword [edx + 0x80]
mov dword [esp], eax
mov dword [esp + 4], str.__ls_:_Failed_to_query_stream_information
add edx, 8
mov dword [esp + 8], edx
call fcn.6add8113
mov eax, 0x32
jmp 0x6adc25e7
Function at 0x6adc5480
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
lea eax, [esp + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
mov eax, dword [esp + 0x30]
add esp, 0x4c
ret

Function at 0x6adc54a0
Capabilities:
Get memory capacity

Disassembly:
push edi
xor eax, eax
mov ecx, 0xf
push esi
push ebx
sub esp, 0x50
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
sub esp, 4
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edi, edx
cmp ebx, ecx
sbb edi, eax
cmovb eax, edx
cmovb ecx, ebx
xor edi, edi
imul esi, eax, 0x55
mov eax, 0x55
mul ecx
mov ebx, edx
mov ecx, eax
add ebx, esi
mov esi, eax
shrd eax, ebx, 0x14
and esi, 0xfffff
and eax, 0xfffff
add esi, eax
mov eax, ebx
shr eax, 8
and eax, 0xfffff
add esi, eax
mov eax, ebx
shr eax, 0x1c
add esi, eax
mov eax, 0x51eb851f
mul esi
shr edx, 3
lea eax, [edx + edx*4]
mov edx, ebx
lea eax, [eax + eax*4]
sub esi, eax
mov eax, ecx
sub eax, esi
sbb edx, edi
mov edi, 0xc28f5c29
add esp, 0x50
imul ecx, edx, 0xc28f5c29
pop ebx
pop esi
imul edx, eax, 0x8f5c28f5
add ecx, edx
mul edi
pop edi
add edx, ecx
shrd eax, edx, 2
shr edx, 2
ret
Function at 0x6adc5640
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
sub esp, 0xc
test eax, eax
je 0x6adc5678
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 5
je 0x6adc56b0
call ebx
mov esi, eax
call dword [sym.imp.msvcrt.dll__errno]
mov ebx, eax
mov eax, esi
call fcn.6adc4ed0
mov dword [ebx], eax
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
mov ecx, eax
lea eax, [eax + eax + 0x39]
shr eax, 4
shl eax, 4
call fcn.6adc7100
sub esp, eax
mov dword [esp + 8], ecx
lea esi, [esp + 0x1b]
mov eax, dword [ebp + 0xc]
and esi, 0xfffffff0
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.6adc7890
mov dword [esp + 8], 5
mov dword [esp + 4], str..orig
mov dword [esp], eax
call fcn.6adc7890
mov dword [esp + 4], 9
mov dword [esp], eax
mov edi, eax
call fcn.6adaf170
xor eax, eax
mov word [edi + 0x12], ax
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [esp + 4], esi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
je 0x6adc5685
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub esp, 4
test eax, eax
je 0x6adc5781
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edi
sub esp, 8
test eax, eax
jne 0x6adc566b
call fcn.6adc5400
mov eax, dword [ebp + 8]
mov dword [esp], str.Atomic_semantics_not_respected_in_failed_rename____new_file_is_at___ls__
mov dword [esp + 4], eax
call fcn.6add5634
mov eax, 1
jmp 0x6adc566d
call fcn.6adc5400
mov dword [esp + 4], esi
mov dword [esp], str.Failed_to_delete_original_file__moved_to___ls__
call fcn.6add5634
jmp 0x6adc5745