joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012d60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10121054
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
push 0x48
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
call fcn.100f4579
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
xor eax, eax
mov dword [esp + 0x88], eax
cmp edi, eax
je 0x10012df7
push esi
lea esi, [esp + 0x44]
call fcn.10032260
add esp, 4
mov ecx, dword [ebp + 0xc]
push eax
push ecx
mov byte [esp + 0x90], 1
mov ebx, 1
push edi
mov dword [esp + 0x20], ebx
call fcn.100349f0
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov edx, eax
mov dword [esp + 0x18], edx
test bl, 1
je 0x10012e1a
cmp dword [esp + 0x58], 0x10
jb 0x10012e1a
mov eax, dword [esp + 0x44]
push eax
call fcn.100f4085
add esp, 4
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
mov ecx, dword [ebp + 0xc]
mov ebx, dword [esp + 0x1c]
push 1
push ecx
push ebx
mov ecx, esi
lea edi, [esp + 0x30]
mov dword [esp + 0x94], 3
call fcn.10012f80
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x94], 4
call fcn.100057a0
mov esi, 0x10
mov byte [esp + 0x88], 3
cmp dword [esp + 0x3c], esi
jb 0x10012e86
mov edx, dword [esp + 0x28]
push edx
call fcn.100f4085
add esp, 4
cmp dword [esp + 0x70], 0
jbe 0x10012edb
mov eax, dword [esp + 0x60]
cmp dword [esp + 0x74], esi
jae 0x10012e9b
lea eax, [esp + 0x60]
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x10012ec2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10012ecd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x10012edb
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x60]
call fcn.10034b70
mov esi, dword [ebx + 0x14]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
call fcn.10040f40
mov ecx, dword [esp + 0x1c]
mov edi, eax
call fcn.10040ea0
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x14]
mov dword [eax], edi
cmp dword [esi + 0x24], 0
je 0x10012f1f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10010f40
mov ecx, dword [esp + 0x24]
push eax
call fcn.10010fb0
jmp 0x10012f42
lea eax, [esp + 0x5c]
call fcn.100320c0
test al, al
je 0x10012f42
cmp dword [esp + 0x74], 0x10
mov eax, dword [esp + 0x60]
jae 0x10012f3b
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x74], 0x10
jb 0x10012f56
mov edx, dword [esp + 0x60]
push edx
call fcn.100f4085
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.100f30a6
mov esp, ebp
pop ebp
ret 8
Function at 0x10012f80
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x1011f8c1
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x8c]
xor ebx, ebx
mov dword [esp + 0x84], ebx
push 0xffffffffffffffff
mov dword [esp + 0x14], ebx
add eax, 0x1c
push ebx
mov esi, ecx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
lea ebp, [edi + 4]
push eax
mov ecx, edi
mov dword [esp + 0x20], edi
mov byte [ebp], bl
call fcn.100057a0
mov dword [esp + 0x84], ebx
mov dword [esp + 0x10], 1
cmp byte [esp + 0x94], bl
je 0x10013023
push edi
call fcn.10032350
add esp, 4
test al, al
jne 0x10013023
cmp dword [edi + 0x18], 0x10
jb 0x10013019
mov eax, dword [ebp]
jmp 0x1001301b
mov eax, ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x3f
lea eax, [esp + 0x39]
push ebx
push eax
mov byte [esp + 0x40], bl
call fcn.100f8db0
mov edx, dword [esp + 0x9c]
push 0xa
push 0x40
lea ecx, [esp + 0x48]
push ecx
push edx
call fcn.100f3531
add esp, 0x1c
push 1
push 0x1013af20
mov ecx, edi
call fcn.10006400
lea eax, [esp + 0x34]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10013062
sub eax, edx
push eax
lea eax, [esp + 0x38]
push eax
mov ecx, edi
call fcn.10006400
cmp byte [esp + 0x94], bl
je 0x100130a3
push edi
call fcn.10032350
add esp, 4
test al, al
jne 0x100130a3
cmp dword [edi + 0x18], 0x10
jb 0x10013099
mov eax, dword [ebp]
jmp 0x1001309b
mov eax, ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 1
push 0x1013af20
mov ecx, edi
call fcn.10006400
push esi
lea esi, [esp + 0x1c]
call fcn.10032260
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov dword [esp + 0x90], 1
call fcn.10006300
mov esi, 0x10
mov byte [esp + 0x84], bl
cmp dword [esp + 0x30], esi
jb 0x100130f3
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.100f4085
add esp, 4
cmp byte [esp + 0x94], bl
je 0x10013119
push edi
call fcn.10032350
add esp, 4
test al, al
jne 0x10013119
cmp dword [edi + 0x18], esi
jb 0x10013111
mov ebp, dword [ebp]
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 1
push 0x1013af20
mov ecx, edi
call fcn.10006400
push 0xe
push str.DataDict.proto
mov ecx, edi
call fcn.10006400
mov eax, edi
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100f30a6
add esp, 0x78
ret 0xc
Function at 0x10013160
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x10121f40
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5c]
push esi
mov edi, ecx
push ebp
push edi
call fcn.10012ba0
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x100131b5
push ebp
push edi
mov ecx, esi
call fcn.10012d60
jmp 0x1001325d
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], eax
mov byte [esp + 0x30], al
push 1
push ebp
push edi
mov ecx, esi
lea edi, [esp + 0x1c]
mov dword [esp + 0x60], eax
call fcn.10012f80
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x60], 1
call fcn.100057a0
mov edi, 0x10
mov byte [esp + 0x54], 0
cmp dword [esp + 0x28], edi
jb 0x10013208
mov eax, dword [esp + 0x14]
push eax
call fcn.100f4085
add esp, 4
lea eax, [esp + 0x2c]
call fcn.100320c0
test al, al
je 0x1001324a
push ebx
lea ecx, [esp + 0x30]
call fcn.10034b70
cmp dword [ebx + 0x24], 0
je 0x10013235
push ebp
call fcn.10010f40
push eax
mov ecx, esi
call fcn.10010fb0
jmp 0x1001324a
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x44], edi
jae 0x10013243
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x44], edi
jb 0x1001325d
mov ecx, dword [esp + 0x30]
push ecx
call fcn.100f4085
add esp, 4
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100f30a6
add esp, 0x48
ret 4
Function at 0x10013280
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x101221f9
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x88]
mov ebx, dword [esp + 0x84]
push 0
push ebp
push ebx
lea edi, [esp + 0x44]
mov esi, ecx
mov dword [esp + 0x24], 0
call fcn.10012f80
xor edi, edi
mov dword [esp + 0x7c], edi
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x18], 1
cmp ecx, edi
jbe 0x1001332a
cmp dword [eax + 0x18], 0x10
jb 0x100132f7
mov eax, dword [eax + 4]
jmp 0x100132fa
add eax, 4
push edi
push 0x80
push 3
push edi
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x1001331f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10013342
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x10013342
call fcn.10010220
push eax
mov ecx, esi
mov edx, ebp
call fcn.10010520
mov byte [esp + 0x17], 1
test al, al
jne 0x10013347
mov byte [esp + 0x17], 0
mov dword [esp + 0x7c], 0xffffffff
cmp dword [esp + 0x50], 0x10
jb 0x10013363
mov eax, dword [esp + 0x3c]
push eax
call fcn.100f4085
add esp, 4
cmp byte [esp + 0x17], 0
push ebp
je 0x10013409
call fcn.10010220
push eax
mov ecx, esi
call fcn.10010700
test al, al
jne 0x10013410
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], edi
mov byte [esp + 0x58], al
push ebp
mov dword [esp + 0x80], 1
call fcn.10010220
push eax
mov ecx, esi
lea edi, [esp + 0x24]
call fcn.10010290
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x88], 2
call fcn.100057a0
mov esi, 0x10
cmp dword [esp + 0x34], esi
jb 0x100133df
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100f4085
add esp, 4
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x6c], esi
jae 0x100133ed
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x6c], esi
jb 0x10013410
mov edx, dword [esp + 0x58]
push edx
call fcn.100f4085
add esp, 4
jmp 0x10013410
mov ecx, ebx
call fcn.10013160
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100f30a6
add esp, 0x6c
ret 8
Function at 0x10014d10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1011f748
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 0
mov byte [esp + 8], 0
push 0xffffffffffffffff
push 0
add eax, 0x20
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call fcn.100057a0
push 1
push 0x1013af20
lea ecx, [esp + 0xc]
call fcn.10006400
push 0x10
push 0x1013e004
lea ecx, [esp + 0xc]
call fcn.10006400
cmp dword [esp + 0x18], 0
jbe 0x10014dee
cmp dword [esp + 0x1c], 0x10
mov eax, dword [esp + 8]
jae 0x10014da6
lea eax, [esp + 8]
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x10014dcd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10014dd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x10014dee
cmp dword [esp + 0x1c], 0x10
mov eax, dword [esp + 8]
jae 0x10014de7
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x1c], 0x10
jb 0x10014e02
mov eax, dword [esp + 8]
push eax
call fcn.100f4085
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100f30a6
add esp, 0x2c
ret 4

Function at 0x10014e20
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
lea edi, [esi + 0x94]
push edi
call ebp
mov ebx, dword [esi + 0x90]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jbe 0x10014e94
mov eax, dword [0x10163088]
test eax, eax
je 0x10014e94
call eax
test al, al
je 0x10014e94
cmp dword [esi + 0xac], 0
jne 0x10014e94
lea edi, [esi + 0xb0]
push edi
call ebp
cmp dword [esi + 0xac], 0
jne 0x10014e8d
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x10015230
push 0
push 0
call fcn.100f3d5f
add esp, 0x18
mov dword [esi + 0xac], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10015240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1011f704
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0xc], 0x10163930
mov dword [0x10163948], 0xf
mov dword [0x10163944], ebx
mov byte [0x10163934], bl
push 0x1016394c
mov dword [esp + 0x144], ebx
call fcn.100168b0
push 0x1016396c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x104
lea eax, [esp + 0x31]
push ebx
mov byte [esp + 0x148], 2
push eax
mov byte [esp + 0x38], bl
call fcn.100f8db0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x30]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x2c]
lea edx, [eax + 1]
jmp 0x100152f0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100152f0
sub eax, edx
push eax
lea edx, [esp + 0x30]
push edx
mov ecx, 0x10163930
call fcn.10004290
push 1
push 0xffffffffffffffff
lea eax, [esp + 0x10]
push eax
mov ecx, 0x10163930
mov byte [esp + 0x14], 0x5c
call fcn.100082e0
inc eax
push eax
push ebx
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x10163930
call fcn.100043c0
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x10163930
mov byte [esp + 0x14c], 3
call fcn.100057a0
mov byte [esp + 0x140], 2
cmp dword [esp + 0x28], 0x10
jb 0x10015365
mov edx, dword [esp + 0x14]
push edx
call fcn.100f4085
add esp, 4
push 8
push 0x1013dfa0
mov ecx, 0x10163930
call fcn.10006400
mov eax, 0x10163930
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.100f30a6
add esp, 0x13c
ret
Function at 0x10015750
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10123c76
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x188], eax
push ebx
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
mov esi, ecx
push esi
mov dword [esp + 0x18], esi
call fcn.10032350
add esp, 4
test al, al
je 0x100158fd
xor ebx, ebx
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.100057a0
push 1
push 0x1013af20
lea ecx, [esp + 0x24]
mov dword [esp + 0x1b0], ebx
call fcn.10006400
push 1
push 0x1013af9c
lea ecx, [esp + 0x24]
call fcn.10006400
mov eax, dword [esp + 0x20]
mov edi, 0x10
cmp dword [esp + 0x34], edi
jae 0x10015800
lea eax, [esp + 0x20]
lea ecx, [esp + 0x54]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, 0xffffffff
jne 0x10015830
cmp dword [esp + 0x34], edi
jb 0x100158fd
mov edx, dword [esp + 0x20]
push edx
jmp 0x100158f5
cmp byte [esp + 0x80], 0x2e
je 0x100158cf
test byte [esp + 0x54], 0x10
je 0x100158cf
lea eax, [esp + 0x80]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10015863
sub eax, edx
push eax
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x40]
call fcn.10004290
mov byte [esp + 0x1a8], 1
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x50], edi
jae 0x10015894
lea eax, [esp + 0x3c]
push eax
call fcn.100f39b6
add esp, 4
cmp eax, ebx
jle 0x100158b5
mov esi, dword [esp + 0x14]
mov edi, eax
call fcn.10015930
mov esi, dword [esp + 0x18]
mov edi, 0x10
mov byte [esp + 0x1a8], bl
cmp dword [esp + 0x50], edi
jb 0x100158cf
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100f4085
add esp, 4
lea edx, [esp + 0x54]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10015830
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x34], edi
jb 0x100158fd
mov eax, dword [esp + 0x20]
push eax
call fcn.100f4085
add esp, 4
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x188]
xor ecx, esp
call fcn.100f30a6
mov esp, ebp
pop ebp
ret
Function at 0x10015930
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x10123c26
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push ebp
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x1b0]
mov dword fs:[0], eax
xor eax, eax
xor ebx, ebx
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [esp + 0x20]
mov byte [esp + 0x198], bl
mov dword [esp + 0x199], eax
mov dword [esp + 0x19d], eax
mov dword [esp + 0x1a1], eax
mov dword [esp + 0x1a5], eax
mov dword [esp + 0x1a9], eax
mov dword [esp + 0x1ad], eax
mov dword [esp + 0x1b1], eax
mov word [esp + 0x1b5], ax
mov byte [esp + 0x1b7], al
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.100057a0
push 1
push 0x1013af20
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c0], ebx
call fcn.10006400
push 0xa
push 0x20
lea eax, [esp + 0x194]
push eax
push edi
call fcn.100f3531
lea eax, [esp + 0x19c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10015a07
sub eax, edx
push eax
lea ecx, [esp + 0x190]
push ecx
lea ecx, [esp + 0x1c]
call fcn.10006400
push 2
push 0x1013afe0
lea ecx, [esp + 0x1c]
call fcn.10006400
mov eax, dword [esp + 0x18]
mov ebp, 0x10
cmp dword [esp + 0x2c], ebp
jae 0x10015a45
lea eax, [esp + 0x18]
lea edx, [esp + 0x4c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x10015a6e
cmp dword [esp + 0x2c], ebp
jb 0x10015b0c
mov eax, dword [esp + 0x18]
push eax
jmp 0x10015b04
cmp byte [esp + 0x78], 0x2e
je 0x10015ada
test byte [esp + 0x4c], 0x10
je 0x10015ada
lea eax, [esp + 0x78]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10015a93
sub eax, edx
push eax
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x38]
call fcn.10004290
lea edx, [esp + 0x30]
push edx
push edi
mov ecx, esi
mov byte [esp + 0x1c0], 1
call fcn.10015b40
mov byte [esp + 0x1b8], bl
cmp dword [esp + 0x48], ebp
jb 0x10015ada
mov eax, dword [esp + 0x34]
push eax
call fcn.100f4085
add esp, 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x4c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10015a6e
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x2c], ebp
jb 0x10015b0c
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100f4085
add esp, 4
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.100f30a6
add esp, 0x1b0
ret
Function at 0x10017610
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x10120300
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor esi, esi
cmp dword [edi], esi
jne 0x100177c5
push 0xffffffffffffffff
lea eax, [edi + 0x7c]
push esi
push eax
lea ecx, [esp + 0x24]
mov dword [edi], 1
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], esi
mov byte [esp + 0x28], 0
call fcn.100057a0
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
cmp dword [esp + 0x30], ebp
jae 0x10017685
lea eax, [esp + 0x1c]
push eax
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x60], esi
mov dword [esp + 0x10], ecx
cmp eax, esi
je 0x100176b8
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100176b8
mov bl, 1
jmp 0x100176ba
xor bl, bl
mov byte [esp + 0x14], bl
lea esi, [edi + 0x44]
mov eax, esi
mov byte [esp + 0x60], 1
call fcn.100320c0
test al, al
jne 0x100176de
test bl, bl
je 0x1001779b
jmp 0x1001778c
test bl, bl
je 0x1001779b
push str._cpy
lea ebx, [edi + 0x60]
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.10008390
mov ecx, dword [esp + 0x48]
add esp, 0xc
cmp dword [esp + 0x50], ebp
jae 0x1001770a
lea ecx, [esp + 0x3c]
cmp dword [esi + 0x18], ebp
jb 0x10017714
mov eax, dword [esi + 4]
jmp 0x10017717
lea eax, [esi + 4]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [esi + 0x18], ebp
jb 0x1001772b
mov esi, dword [esi + 4]
jmp 0x1001772e
add esi, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
test eax, eax
jne 0x10017754
mov eax, dword [esp + 0x3c]
mov dword [edi], 4
cmp dword [esp + 0x50], ebp
jae 0x1001774f
lea eax, [esp + 0x3c]
push eax
call esi
jmp 0x10017779
cmp dword [ebx + 0x18], ebp
jb 0x1001775e
mov eax, dword [ebx + 4]
jmp 0x10017761
lea eax, [ebx + 4]
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x50], ebp
jae 0x1001776f
lea ecx, [esp + 0x3c]
push eax
push ecx
call fcn.100f4a53
add esp, 8
cmp dword [esp + 0x50], ebp
jb 0x1001778c
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100f4085
add esp, 4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100177b2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100177b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x34], 0
cmp dword [esp + 0x30], ebp
jb 0x100177c5
mov edx, dword [esp + 0x1c]
push edx
call fcn.100f4085
add esp, 4
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.100f30a6
add esp, 0x54
ret
Function at 0x10018d10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10121e17
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x1013e098
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.10018ee0
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.100067a0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x10162060]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x10019540
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x194], eax
xor eax, eax
push 0x18e
push eax
lea ecx, [esp + 0xa]
push ecx
mov dword [esi], vtable.nsSocket::CBlockingSocket.0
mov dword [esi + 4], 0xffffffff
mov word [esp + 0xc], ax
call fcn.100f8db0
add esp, 0xc
lea edx, [esp]
push edx
push 2
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [esp + 0x194]
xor ecx, esp
mov eax, esi
call fcn.100f30a6
mov esp, ebp
pop ebp
ret