joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b0f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 4], eax
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, ecx
push edi
mov edi, dword [esp + 0x18]
mov dword [ebx], 0
cmp dword [ebp], 0xffffffff
jne 0x1001b12d
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10081b94
add esp, 8
ret 0xc
push esi
mov esi, dword [esp + 0x20]
mov ecx, 0x100000
jmp 0x1001b140
cmp esi, 0x100000
mov dword [esp + 0x10], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
setne al
add dword [ebx], ecx
test al, al
je 0x1001b19a
test ecx, ecx
je 0x1001b183
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x1001b140
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10081b94
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x14]
xor al, al
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.10081b94
add esp, 8
ret 0xc

Function at 0x1001b470
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x1001b49e
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10081b94
add esp, 8
ret 4
push esi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001b4d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001b4d9
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10081b94
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, esi
mov dword [edi], eax
mov al, 1
adc ecx, 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
pop esi
pop edi
xor ecx, esp
call fcn.10081b94
add esp, 8
ret 4
Function at 0x1001d690
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x10085294
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.10003100
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.10003100
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.10003100
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.10003100
mov byte [esp + 0x18], 3
lea ecx, [edi + 0x70]
movzx eax, byte [esi + 0x60]
mov byte [edi + 0x60], al
movzx eax, byte [esi + 0x61]
mov byte [edi + 0x61], al
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x70]
push eax
call fcn.10003100
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1001ef90
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10087095
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, edx
mov dword [esp + 0x1c], ebx
mov edi, ecx
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x17]
push eax
mov ecx, esi
mov byte [esp + 0x1b], 3
call fcn.10022ea0
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 1
push eax
mov ecx, esi
call fcn.10022ea0
mov eax, ebx
mov ecx, esi
sar eax, 0x18
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push eax
call fcn.10022ea0
mov eax, ebx
mov ecx, esi
sar eax, 0x10
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push eax
call fcn.10022ea0
mov eax, ebx
mov ecx, esi
sar eax, 8
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push eax
call fcn.10022ea0
lea eax, [esp + 0x17]
mov byte [esp + 0x17], bl
push eax
mov ecx, esi
call fcn.10022ea0
mov dword [esp + 0x18], 0
test ebx, ebx
je 0x1001f11b
mov eax, dword [esi + 4]
cmp edi, eax
jae 0x1001f0b8
mov ebx, dword [esi]
cmp ebx, edi
ja 0x1001f0b8
mov edx, dword [esi + 8]
mov ebp, edi
sub ebp, ebx
cmp eax, edx
jne 0x1001f098
mov ecx, edx
sub ecx, eax
cmp ecx, 1
jae 0x1001f098
mov ecx, ebx
sub ecx, eax
dec ecx
cmp ecx, 1
jb 0x1001f12f
sub eax, ebx
sub edx, ebx
mov ebx, edx
or ecx, 0xffffffff
shr ebx, 1
inc eax
sub ecx, ebx
cmp ecx, edx
jae 0x1001f089
xor edx, edx
jmp 0x1001f08b
add edx, ebx
cmp edx, eax
mov ecx, esi
cmovb edx, eax
push edx
call fcn.10023b70
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x28], 0
test ecx, ecx
je 0x1001f0ae
mov al, byte [eax + ebp]
mov byte [ecx], al
mov dword [esp + 0x28], 0xffffffff
jmp 0x1001f104
mov edx, dword [esi + 8]
cmp eax, edx
jne 0x1001f0f9
mov ecx, edx
sub ecx, eax
cmp ecx, 1
jae 0x1001f0f9
mov ebx, dword [esi]
mov ecx, ebx
sub ecx, eax
dec ecx
cmp ecx, 1
jb 0x1001f12f
sub eax, ebx
sub edx, ebx
mov ebx, edx
or ecx, 0xffffffff
shr ebx, 1
inc eax
sub ecx, ebx
cmp ecx, edx
jae 0x1001f0ea
xor edx, edx
jmp 0x1001f0ec
add edx, ebx
cmp edx, eax
mov ecx, esi
cmovb edx, eax
push edx
call fcn.10023b70
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1001f104
mov al, byte [edi]
mov byte [ecx], al
mov ecx, dword [esp + 0x18]
inc edi
inc dword [esi + 4]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [esp + 0x1c]
jb 0x1001f044
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x1001f980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100871c8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov byte [esp + 0x48], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x48], 2
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x48], 3
lea ecx, [esp + 0x14]
call fcn.1001ead0
xorps xmm0, xmm0
mov dword [esp + 0x10], 0
movq qword [esp + 8], xmm0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x48], 4
lea edx, [esp + 8]
lea ecx, [esp + 0x14]
call fcn.1001f400
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 8]
sub esi, eax
mov byte [esp + 0x48], 3
test eax, eax
je 0x1001fa92
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.10021ce0
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10081b94
add esp, 0x44
ret
Function at 0x10021ad0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10087451
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
xor eax, eax
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], 1
cmp dword [edi + 0x10], eax
je 0x10021be3
push 0x26
push str.47FF0D24_E0A5_4163_8546_DE7217D2F141
mov ecx, esi
call fcn.10003000
xor eax, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x38], 1
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.10014f90
lea ecx, [esp + 0x14]
call fcn.1000a4e0
push 1
push 0x10095128
mov ecx, esi
call fcn.100067e0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.10006720
mov byte [esp + 0x38], 0
cmp dword [esp + 0x28], 8
jb 0x10021bcc
push dword [esp + 0x14]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10081b94
add esp, 0x30
ret 8
Function at 0x100298c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
mov esi, ecx
push 0x20a
push eax
mov word [esp + 0xc], ax
lea eax, [esp + 0xe]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [esp + 4]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x10029937
xor eax, eax
mov ecx, esi
mov word [esp + 0x20e], ax
lea eax, [esp + 4]
push eax
call fcn.100049d0
mov al, 1
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10081b94
add esp, 0x210
ret
mov ecx, dword [esp + 0x210]
xor al, al
pop esi
xor ecx, esp
call fcn.10081b94
add esp, 0x210
ret

Function at 0x10029950
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10087758
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and edi, 0xffffb1af
cmp dword [esi + 0x14], 8
jb 0x10029995
mov eax, dword [esi]
jmp 0x10029997
mov eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push eax
call ebx
test eax, eax
je 0x100299ac
mov al, 1
jmp 0x10029a37
xor eax, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x38], eax
lea edx, [esp + 0x14]
mov ecx, esi
call fcn.1002abc0
test al, al
je 0x10029a00
cmp dword [esp + 0x28], 8
lea eax, [esp + 0x14]
push edi
cmovae eax, dword [esp + 0x18]
push eax
call ebx
test eax, eax
je 0x10029a00
mov bl, 1
jmp 0x10029a02
xor bl, bl
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x10029a1e
push dword [esp + 0x14]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov word [esp + 0x14], ax
mov al, bl
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10081b94
add esp, 0x2c
ret
Function at 0x10029a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x10088418
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x10029a9c
mov eax, dword [esi]
jmp 0x10029a9e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10029b34
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.1002abc0
test al, al
je 0x10029b01
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x10029b1d
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10081b94
add esp, 0x28
ret
Function at 0x10029b60
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x10088450
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
jb 0x10029b9e
mov eax, dword [edi]
jmp 0x10029ba0
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x10029ba8
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x10029bbb
mov al, 1
jmp 0x10029d29
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov byte [esp + 0xf], 0
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
mov dword [esp + 0x50], eax
lea edx, [esp + 0x2c]
mov ecx, esi
call fcn.1002abc0
movzx ecx, byte [esp + 0xf]
test al, al
mov edx, 1
mov dword [esp + 0x24], 0
cmovne ecx, edx
mov dword [esp + 0x28], 0
xor eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov byte [esp + 0x50], dl
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.1002abc0
test al, al
jne 0x10029c49
cmp byte [esp + 0x10], al
je 0x10029cc6
cmp dword [esp + 0x28], 8
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
cmovae ecx, dword [esp + 0x14]
cmp dword [esp + 0x40], 8
push ecx
cmovae eax, dword [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x10029cc6
mov byte [esp + 0x50], 0
cmp dword [esp + 0x28], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x10029c8c
push dword [esp + 0x14]
call esi
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x10029cbb
push dword [esp + 0x2c]
call esi
add esp, 4
xor eax, eax
mov word [esp + 0x2c], ax
mov al, 1
jmp 0x10029d19
mov byte [esp + 0x50], 0
cmp dword [esp + 0x28], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x10029ce1
push dword [esp + 0x14]
call esi
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x10029d10
push dword [esp + 0x2c]
call esi
add esp, 4
xor eax, eax
mov word [esp + 0x2c], ax
xor al, al
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 7
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10081b94
add esp, 0x48
ret
Function at 0x10029d50
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x10088498
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x10029d90
mov eax, dword [esi]
jmp 0x10029d92
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x10029d9a
mov ecx, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0xb
push eax
push ecx
call ebx
test eax, eax
je 0x10029db1
mov al, 1
jmp 0x10029f92
xor eax, eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
mov dword [esp + 0x70], eax
lea edx, [esp + 0x4c]
mov ecx, edi
call fcn.1002abc0
movzx ecx, byte [esp + 0x17]
test al, al
mov edx, 1
mov dword [esp + 0x44], 0
cmovne ecx, edx
mov dword [esp + 0x48], 0
xor eax, eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov byte [esp + 0x70], dl
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.1002abc0
mov ebp, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
test al, al
jne 0x10029e46
cmp byte [esp + 0x18], 0
je 0x10029e73
cmp dword [esp + 0x48], 8
lea ecx, [esp + 0x34]
push 0xb
cmovae ecx, dword [esp + 0x38]
lea eax, [esp + 0x50]
cmp dword [esp + 0x64], 8
push ecx
cmovae eax, dword [esp + 0x54]
push eax
call ebx
test eax, eax
je 0x10029e73
mov bl, 1
jmp 0x10029f35
mov ecx, esi
call fcn.10029a60
cmp eax, 0xffffffff
je 0x10029f33
xor eax, eax
mov dword [esp + 0x2c], 0
push 0xffffffffffffffff
push eax
mov dword [esp + 0x38], 0
lea ecx, [esp + 0x24]
push esi
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
call fcn.10003100
mov byte [esp + 0x70], 2
lea ecx, [esp + 0x1c]
call fcn.1002a830
test al, al
je 0x10029f07
lea edx, [esp + 0x1c]
mov ecx, esi
call fcn.10029b60
test al, al
je 0x10029f07
mov edx, esi
mov ecx, edi
call fcn.10029b60
lea ecx, [esp + 0x1c]
test al, al
je 0x10029f00
call fcn.1002a1c0
mov byte [esp + 0x70], 1
lea ecx, [esp + 0x1c]
call fcn.10002a80
mov bl, 1
jmp 0x10029f35
mov edx, esi
call fcn.10029b60
mov byte [esp + 0x70], 1
cmp dword [esp + 0x30], 8
jb 0x10029f1c
push dword [esp + 0x1c]
call ebp
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
xor bl, bl
mov byte [esp + 0x70], 0
cmp dword [esp + 0x48], 8
jb 0x10029f4a
push dword [esp + 0x34]
call ebp
add esp, 4
xor eax, eax
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
mov dword [esp + 0x70], 0xffffffff
cmp dword [esp + 0x60], 8
jb 0x10029f79
push dword [esp + 0x4c]
call ebp
add esp, 4
xor eax, eax
mov dword [esp + 0x60], 7
mov word [esp + 0x4c], ax
mov al, bl
mov dword [esp + 0x5c], 0
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.10081b94
add esp, 0x60
ret
Function at 0x10029fc0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x10088418
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x10029ffc
mov eax, dword [esi]
jmp 0x10029ffe
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1002a010
mov al, 1
jmp 0x1002a09e
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.1002abc0
test al, al
je 0x1002a067
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
cmovae eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1002a067
mov bl, 1
jmp 0x1002a069
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x1002a085
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10081b94
add esp, 0x28
ret

Function at 0x1002a0c0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x10088418
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x1002a0fc
mov eax, dword [esi]
jmp 0x1002a0fe
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1002a112
mov al, 1
jmp 0x1002a1a2
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.1002abc0
test al, al
je 0x1002a16b
cmp dword [esp + 0x20], 8
lea eax, [esp + 0xc]
push 0
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1002a16b
mov bl, 1
jmp 0x1002a16d
xor bl, bl
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x1002a189
push dword [esp + 0xc]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov word [esp + 0xc], ax
mov al, bl
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10081b94
add esp, 0x28
ret