joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c2fd8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100c3022
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100c2fc9
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100c2fd8
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x104c8c7b
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100c3029
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.100a9e9f
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100c30c8
add edi, 4
add eax, 2
dec ecx
jne 0x100c300e
call 0x100c3075
loope 0x100c306b
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100c30c5
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100c30d6
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100c3089
cmp eax, ecx
ja 0x100c3089
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100c3113
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100c3109
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.100aa37e
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x401029
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x427f20]
and dword [ebp - 8], 0
mov dword [ebp - 0x24], eax
mov eax, dword [0x427f24]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
call fcn.00401022
mov eax, dword [0x427f28]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x427f2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [0x24459f4]
mov ecx, esi
shl ecx, 4
add ecx, dword [ebp - 0x18]
cmp eax, 0xfa9
jne 0x40109c
mov dword [0x24459f0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010aa
and dword [0x244547c], 0
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
add edx, esi
xor eax, edx
xor eax, ecx
sub edi, eax
cmp dword [0x24459f4], 0xc
mov dword [0x24459ec], 0xf4ea3dee
mov dword [ebp - 4], eax
jne 0x4010f1
lea eax, [ebp - 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov eax, edi
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 0x61c88647
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x24]
add ecx, edi
xor eax, ecx
xor eax, dword [ebp - 4]
sub esi, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
jne 0x401073
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
leave
ret

Function at 0x40112f
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x24459f4]
mov ecx, dword [0x2445480]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4011ea
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x24459f4], 0x959
jne 0x4011d9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.zewaxuwawazuwuyuvivi
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push str.ozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401029
add ebx, 8
dec edi
jne 0x401157
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4014a1
Capabilities:
Clear file content
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
xor esi, esi
cmp dword [0x24459f4], 0x400
push edi
jne 0x4014fe
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.004016d6
push esi
push esi
call fcn.0040180c
push esi
call fcn.00401e21
push esi
push esi
call fcn.00401c6c
push esi
call fcn.00401eb7
push esi
push esi
call fcn.00401710
add esp, 0x24
xor edi, edi
cmp edi, 0x16d2a
jge 0x401516
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e82fe
jg 0x40153b
inc edi
cmp edi, 0x3011b
jl 0x401500
mov eax, dword [0x42836c]
mov dword [0x24459f4], eax
call fcn.004011ed
mov edi, 0x2ec37
cmp dword [0x24459f4], 0x51f
jne 0x401569
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x40154f
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x40725a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427cfc]
jne 0x407264
repz ret
jmp fcn.00409062
Function at 0x40827d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x427cfc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040567a
and dword [ebp - 0x14], 0
cmp dword [0x432fb4], 0
mov dword [ebp - 0x18], eax
jne 0x408330
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4083d8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4083d8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x432fb4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x432fb8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x432fbc], eax
call edi
push eax
call esi
mov dword [0x432fc4], eax
test eax, eax
je 0x408330
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x432fc0], eax
mov eax, dword [0x432fc0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408389
cmp dword [0x432fc4], ecx
je 0x408389
push eax
call esi
push dword [0x432fc4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408389
test ebx, ebx
je 0x408389
call edi
test eax, eax
je 0x408380
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408380
test byte [ebp - 8], 1
jne 0x408389
or dword [ebp + 0x10], 0x200000
jmp 0x4083bc
mov eax, dword [0x432fb8]
cmp eax, dword [ebp - 0x18]
je 0x4083bc
push eax
call esi
test eax, eax
je 0x4083bc
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4083bc
mov eax, dword [0x432fbc]
cmp eax, dword [ebp - 0x18]
je 0x4083bc
push eax
call esi
test eax, eax
je 0x4083bc
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x432fb4]
call esi
test eax, eax
je 0x4083d8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4083da
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040725a
leave
ret
Function at 0x1000cf40
Capabilities:
Modify service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100ab06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x1000d02d
push 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x1000d011
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1000cfdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x1000cfdc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push edi
call ebx
test eax, eax
je 0x1000d009
nop
cmp dword [ebp - 0x1c], 2
jne 0x1000d009
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push edi
call ebx
test eax, eax
jne 0x1000cff0
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
Function at 0x1000d040
Capabilities:
Modify service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100ab06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
test ebx, ebx
je 0x1000d10b
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1000d0ef
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call edi
test eax, eax
je 0x1000d0e7
cmp dword [ebp - 0x1c], 1
je 0x1000d0e7
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1000d0e7
cmp dword [ebp - 0x1c], 3
jne 0x1000d0e7
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call ebx
lea eax, [ebp - 0x20]
push eax
push esi
call edi
cmp dword [ebp - 0x1c], 3
je 0x1000d0d3
mov ebx, dword [ebp - 0x24]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
Function at 0x1000d310
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x100ab06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf003f
xor esi, esi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push esi
push esi
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x1000d458
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x220]
push esi
push 2
push 0x10
push 0xf01ff
push dword [ebp - 0x224]
push dword [ebp - 0x210]
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
test esi, esi
jne 0x1000d3cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x1000d3cb
push 0xf01ff
push dword [ebp - 0x210]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1000d458
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSetServices_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push reloc.WS2_32.dll_bind
call dword [0x10088794]
mov edx, dword [ebp - 0x21c]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x21c], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000d410
sub ecx, dword [ebp - 0x21c]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push 1
push 0
push str.Description
push dword [ebp - 0x214]
call dword [0x100887b0]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
mov ecx, 1
cmovne ebx, ecx
mov dword [ebp - 0x218], ebx
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x1000d469
push eax
call dword [0x10088790]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x1000d476
push esi
call ebx
test edi, edi
je 0x1000d47d
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
Function at 0x1000dc80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
test ebx, ebx
je 0x1000dca3
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x1000dc9e
mov eax, dword [ebx]
jmp 0x1000dca0
mov eax, ebx
mov byte [eax], 0
mov ecx, 0x100aeab8
call fcn.10012920
test al, al
je 0x1000dcb8
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.10011650
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x1000dccf
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x10000
call fcn.1001f05c
push edi
push 0x10000
mov esi, eax
mov dword [ebp - 8], 0
push 1
push esi
call fcn.10068cfc
mov edi, eax
add esp, 0x14
test edi, edi
je 0x1000dd46
mov eax, dword [ebp + 8]
nop dword [eax]
test ebx, ebx
je 0x1000dd1c
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.1000b1f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x1000dd5c
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.10068cfc
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x1000dd00
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.100681c2
add esp, 4
test eax, eax
jne 0x1000dd5f
mov byte [ebp - 1], 1
jmp 0x1000dd63
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.1006844a
add esp, 4
test esi, esi
je 0x1000dd79
push esi
call fcn.1001f057
add esp, 4
mov al, byte [ebp - 1]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010af0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f0
mov eax, dword [0x100ab06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov esi, edx
xor ebx, ebx
push esi
sub esp, 8
mov dword [ebp - 0x2ec], esi
mov dword [ebp - 0x2e8], ebx
push ecx
lea ecx, [ebp - 0x2e4]
call fcn.10014f60
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.100150d0
cmp dword [ebp - 0x10], ebx
je 0x10010c3b
nop
cmp byte [ebp - 0x2e4], 0
jne 0x10010b7a
test bl, 1
je 0x10010b62
and ebx, 0xfffffffe
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x2e8], ebx
call fcn.10015bd0
push 0x250
lea eax, [ebp - 0x5ec]
push 0
push eax
call fcn.10060f70
add esp, 0xc
jmp 0x10010b93
mov ecx, 0x94
lea esi, [ebp - 0x2e0]
lea edi, [ebp - 0x5ec]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x2ec]
mov ebx, dword [ebp - 0x5ec]
test bl, 1
je 0x10010bb6
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x20]
mov eax, ebx
cmovae ecx, dword [ebp - 0x20]
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
shr ebx, 4
test bl, 1
je 0x10010be9
push 1
mov edx, esi
lea ecx, [ebp - 0x20]
call fcn.10010af0
add esp, 4
test al, al
je 0x10010c97
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10010bfb
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10010c97
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2e4]
call fcn.100150d0
lea ecx, [ebp - 0x20]
cmp ecx, eax
je 0x10010c23
push 0xffffffffffffffff
push 0
push eax
call fcn.1000abc0
lea ecx, [ebp - 0x38]
call fcn.1000a380
cmp dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x2e8]
jne 0x10010b40
lea ecx, [ebp - 0x20]
call fcn.1000a380
mov bl, 1
mov eax, dword [ebp - 0x90]
cmp eax, 0xffffffff
je 0x10010c57
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x54]
call fcn.10015590
push dword [ebp - 0x54]
call fcn.1001ecd5
add esp, 4
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x6c]
call fcn.1000a380
lea ecx, [ebp - 0x8c]
call fcn.1000a380
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.1000a380
xor bl, bl
jmp 0x10010c45
Function at 0x10010d50
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x100ab06c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x10010d8c
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
cmp eax, 0x104
jae 0x10010ed2
lea eax, [esp + 0x14]
push eax
call fcn.10012430
push 2
sub esp, 8
mov ecx, eax
call fcn.10010a20
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.1000a380
cmp esi, 0xffffffff
je 0x10010e0c
lea eax, [esp + 0x2c]
mov ecx, edi
push eax
call fcn.10012430
mov esi, eax
lea eax, [esp + 0x14]
push ecx
push eax
mov ecx, edi
call fcn.10012280
mov edx, esi
mov ecx, eax
call fcn.10010af0
add esp, 4
lea ecx, [esp + 0x14]
mov bl, al
call fcn.1000a380
lea ecx, [esp + 0x2c]
call fcn.1000a380
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x14], 8
jb 0x10010e16
mov eax, dword [edi]
jmp 0x10010e18
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10010d78
test bl, 1
je 0x10010e50
cmp dword [edi + 0x14], 8
jb 0x10010e39
mov ecx, dword [edi]
jmp 0x10010e3b
mov ecx, edi
mov eax, ebx
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10010ed2
test bl, 0x10
jne 0x10010e7c
cmp dword [edi + 0x14], 8
jb 0x10010e5d
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
push 0x100a4f80
lea ecx, [esp + 0x18]
call fcn.1000a410
push ecx
lea edx, [esp + 0x18]
mov ecx, edi
call fcn.10010af0
add esp, 4
lea ecx, [esp + 0x14]
test al, al
setne bl
call fcn.1000a380
test bl, bl
je 0x10010ed2
cmp dword [edi + 0x14], 8
jb 0x10010eb3
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x44]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
Function at 0x10011300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1001130e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x10011320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x10011328
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001133b
shr eax, 4
and eax, 1
ret
xor al, al
ret

Function at 0x10011340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x248
mov eax, dword [0x100ab06c]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x34]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x100113fa
lea eax, [esp + 8]
push eax
sub esp, 8
lea eax, [esp + 0x44]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x44], 0
jne 0x10011397
xor ecx, ecx
jmp 0x100113af
lea ecx, [esp + 0x44]
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100113a0
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [esp + 0x2c]
call fcn.10011ce0
mov ecx, eax
call fcn.100128a0
cmp esi, eax
je 0x100113d2
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.1000abc0
lea ecx, [esp + 8]
call fcn.1000a380
lea ecx, [esp + 0x20]
call fcn.1000a380
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x24c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
Function at 0x10011410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x100ab06c]
xor eax, esp
mov dword [esp + 0x224], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x1c]
push edi
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x100114bf
cmp word [esp + 0x20], 0
je 0x100114bf
sub esp, 8
lea eax, [esp + 0x28]
mov edx, esp
mov dword [edx], eax
cmp word [esp + 0x28], 0
jne 0x10011483
xor ecx, ecx
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.10011ce0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x28]
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011490
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
mov ecx, esi
call fcn.10011ce0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 8]
call fcn.1000a470
lea eax, [esp + 8]
push eax
call fcn.10011340
add esp, 4
mov ecx, esi
test al, al
je 0x100114e7
lea eax, [esp + 8]
push eax
call fcn.1000a490
jmp 0x100114fe
sub esp, 8
mov eax, esp
mov dword [eax], 0x100a4f84
mov dword [eax + 4], 3
call fcn.10011ce0
lea ecx, [esp + 8]
call fcn.1000a380
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret