joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100997ab
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1009988b
xor ebx, ebx
cmp word [esi], bx
je 0x1009988b
mov ecx, 0x1000a7d4
mov eax, esi
mov di, word [eax]
cmp di, word [ecx]
jne 0x100997f8
test di, di
je 0x100997f4
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x100997f8
add eax, 4
add ecx, 4
test di, di
jne 0x100997d2
mov eax, ebx
jmp 0x100997fd
sbb eax, eax
or eax, 1
test eax, eax
je 0x1009988b
mov ecx, 0x1000a7dc
mov eax, esi
mov di, word [eax]
cmp di, word [ecx]
jne 0x10099832
test di, di
je 0x1009982e
mov di, word [eax + 2]
cmp di, word [ecx + 2]
jne 0x10099832
add eax, 4
add ecx, 4
test di, di
jne 0x1009980c
mov eax, ebx
jmp 0x10099837
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1009985d
push 2
lea eax, [ebp - 4]
push eax
push 0x2000000b
push dword [edx + 8]
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
je 0x100998a3
mov esi, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
push ebx
lea ecx, [ebp - 0x30]
call fcn.1006a040
push ecx
push ecx
mov eax, esp
lea ecx, [ebp - 0x30]
push 1
push 0xa
pop edx
mov dword [eax], esi
mov dword [eax + 4], ebx
call fcn.1006923b
add esp, 0xc
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.1006a0b0
jmp 0x10099856
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
push dword [edx + 8]
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
jne 0x100998a7
xor eax, eax
jmp 0x10099858
mov esi, dword [ebp - 4]
test esi, esi
jne 0x10099856
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetACP]
jmp 0x10099858
Function at 0x100998df
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, ecx
mov dword [ebp - 0x10], edx
push ebx
mov dword [ebp - 8], eax
and eax, 0x3ff
push esi
or eax, 0x400
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x101042e0]
mov esi, eax
call fcn.100290c0
mov ecx, dword [0x101042e4]
mov ebx, eax
cmp ecx, 0xffffffff
je 0x1009994a
call fcn.100290c0
mov edi, eax
test edi, edi
je 0x10099944
cmp edi, 0xffffffff
jne 0x100999aa
xor eax, eax
mov ebx, eax
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test ebx, ebx
je 0x10099a0b
jmp 0x100999b7
mov ecx, dword [0x101042e4]
or edx, 0xffffffff
call fcn.1003b000
test eax, eax
je 0x1009992f
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [0x101042e4]
test edi, edi
jne 0x10099980
xor edx, edx
call fcn.1003b000
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x1009992f
mov edx, edi
call fcn.1003b000
test eax, eax
jne 0x1009999a
mov ecx, dword [0x101042e4]
xor edx, edx
call fcn.1003b000
jmp 0x10099977
mov ecx, edi
call fcn.1003e545
xor eax, eax
push eax
call sym.ucrtbase.dll__free_base
pop ecx
imul ebx, ebx, 0x364
add ebx, edi
jmp 0x10099933
push 2
lea eax, [ebp - 0xc]
push eax
push 0x20000001
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
test eax, eax
je 0x10099a04
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
je 0x100999ff
cmp dword [ebp - 0x10], 0
je 0x100999ff
mov ecx, dword [ebx + 0x50]
xor edi, edi
mov esi, ecx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x100999e7
sub esi, edx
sar esi, 1
call fcn.1009909a
cmp eax, esi
je 0x10099a04
xor eax, eax
inc eax
jmp 0x10099a06
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
call sym.ucrtbase.dll_abort
int3
Function at 0x1009aec8
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
test eax, eax
jne 0x1009aee2
push 3
jmp 0x1009aef9
test esi, esi
je 0x1009aeed
push esi
call dword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
call fcn.1009851f
push 4
cmp eax, 1
jne 0x1009af3b
pop edi
call fcn.100984ac
cmp eax, 2
jne 0x1009af37
call fcn.100982de
test al, al
je 0x1009af37
call fcn.100983c6
test al, al
jne 0x1009af2b
mov eax, dword [ebp + 8]
or eax, 0x200000
xor ecx, ecx
push eax
mov edx, esi
push ebx
call fcn.1009821d
jmp 0x1009af3c
call fcn.10098358
push dword [ebp + 8]
mov ecx, eax
jmp 0x1009af21
mov eax, edi
jmp 0x1009af3c
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1009b590
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push esi
push 0x17
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1009b5a4
push 5
pop ecx
int 0x29
push ecx
mov esi, 0xc0000417
push 2
mov edx, esi
pop ecx
call fcn.100785d8
pop ecx
push esi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
pop esi
ret
Function at 0x1009e0a5
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x101042d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, edx
mov dword [ebp - 0x260], ecx
jmp 0x1009e0dc
movzx eax, word [edi]
push eax
call fcn.1009e32d
test al, al
jne 0x1009e0e0
sub edi, 2
cmp edi, ebx
jne 0x1009e0cc
movzx edx, word [edi]
cmp edx, 0x3a
jne 0x1009e102
lea eax, [ebx + 2]
cmp edi, eax
je 0x1009e102
push ecx
push 0
xor edx, edx
mov ecx, ebx
call fcn.1009dd9b
pop ecx
pop ecx
jmp 0x1009e2a8
push edx
call fcn.1009e32d
xor ecx, ecx
test al, al
je 0x1009e115
sub edi, ebx
sar edi, 1
inc edi
jmp 0x1009e117
mov edi, ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x284], ecx
push eax
push ecx
push ebx
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0x274], ecx
mov byte [ebp - 0x270], cl
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileExW]
mov esi, eax
mov dword [ebp - 0x264], esi
cmp esi, 0xffffffff
jne 0x1009e175
mov eax, dword [ebp - 0x260]
xor edx, edx
push eax
push 0
mov ecx, ebx
call fcn.1009dd9b
pop ecx
pop ecx
mov esi, eax
jmp 0x1009e237
mov ecx, dword [ebp - 0x260]
push 0x2e
pop edx
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
mov dword [ebp - 0x268], eax
xor eax, eax
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
mov byte [ebp - 0x288], al
cmp word [ebp - 0x230], dx
jne 0x1009e1d6
cmp word [ebp - 0x22e], ax
je 0x1009e1f5
cmp word [ebp - 0x22e], dx
jne 0x1009e1d6
cmp word [ebp - 0x22c], ax
je 0x1009e1f5
push ecx
push edi
mov edx, ebx
lea ecx, [ebp - 0x230]
call fcn.1009dd9b
mov dword [ebp - 0x26c], eax
pop ecx
pop ecx
test eax, eax
jne 0x1009e281
lea ecx, [ebp - 0x29c]
call fcn.100978b6
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
mov ecx, dword [ebp - 0x260]
push 0x2e
pop edx
test eax, eax
jne 0x1009e18c
mov eax, ecx
mov ecx, dword [ebp - 0x268]
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sar eax, 2
cmp ecx, eax
jne 0x1009e251
xor esi, esi
lea ecx, [ebp - 0x264]
call fcn.1009e2bd
lea ecx, [ebp - 0x284]
call fcn.100978b6
mov eax, esi
jmp 0x1009e2a8
push 0x1009d600
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call sym.ucrtbase.dll_qsort
add esp, 0x10
lea ecx, [ebp - 0x264]
call fcn.1009e2bd
lea ecx, [ebp - 0x284]
call fcn.100978b6
xor eax, eax
jmp 0x1009e2a8
lea ecx, [ebp - 0x29c]
call fcn.100978b6
lea ecx, [ebp - 0x264]
call fcn.1009e2bd
lea ecx, [ebp - 0x284]
call fcn.100978b6
mov eax, dword [ebp - 0x26c]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10068820
leave
ret
Function at 0x100a0cfb
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101042d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x20a
lea eax, [ebp - 0x210]
mov edi, edx
push 0
push eax
mov esi, ecx
call sym.ucrtbase.dll__o_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
test eax, eax
je 0x100a0d6b
call fcn.10042cb0
push 0
push ecx
neg eax
lea ecx, [ebp - 0x210]
push esi
sbb eax, eax
push edi
push 0xffffffffffffffff
push ecx
lea ecx, [eax + 1]
call fcn.1002d9e9
add esp, 0x18
test eax, eax
je 0x100a0d6b
dec eax
jmp 0x100a0d6d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10068820
leave
ret

Function at 0x100ae290
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
call fcn.100ae18e
mov ebx, eax
test ebx, ebx
je 0x100ae346
push ebx
push 0x104
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
test eax, eax
je 0x100ae341
cmp eax, 0xee
ja 0x100ae341
lea esi, [ebx + eax*2]
sub edi, 0
je 0x100ae2e2
sub edi, 1
je 0x100ae2de
sub edi, 1
jne 0x100ae2eb
push 0x78
jmp 0x100ae2e4
push 0x77
jmp 0x100ae2e4
push 0x76
pop eax
mov word [esi], ax
add esi, 2
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
xor edi, edi
mov ecx, esi
push edi
sub ecx, ebx
mov edx, 0x104
push 0x24
sar ecx, 1
sub edx, ecx
mov ecx, esi
push edi
push eax
call fcn.1003f6ab
add esp, 0x10
test eax, eax
jne 0x100ae34f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x100ae318
sub ecx, edx
sar ecx, 1
push 0x2e
pop eax
push 0x30
mov word [esi + ecx*2], ax
pop eax
mov word [esi + ecx*2 + 2], ax
xor eax, eax
mov word [esi + ecx*2 + 4], ax
mov al, 1
jmp 0x100ae348
xor eax, eax
mov word [ebx], ax
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push edi
push edi
push edi
push edi
call sym.ucrtbase.dll__invoke_watson
int3

Function at 0x100af014
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
mov eax, dword [eax + 0xc]
push ebx
push esi
nop
test al, 8
je 0x100af02d
mov al, 1
jmp 0x100af092
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x100af042
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x100af090
mov eax, dword [eax + 0x10]
nop
push eax
call sym.ucrtbase.dll__get_osfhandle
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x100af090
xor ebx, ebx
lea eax, [ebp - 0xc]
inc ebx
push ebx
push eax
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointerEx]
test eax, eax
je 0x100af090
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
test eax, eax
je 0x100af090
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x100af08a
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
je 0x100af08c
xor bl, bl
mov al, bl
jmp 0x100af092
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x100ca140
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c76de

Function at 0x100ca160
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c7b2b

Function at 0x100ca180
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c7f83

Function at 0x100ca1a0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c83e4

Function at 0x100ca1c0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c89af

Function at 0x100ca1e0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c8e08

Function at 0x100ca200
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c926d

Function at 0x100ca220
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100c96db

Function at 0x100cf621
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101042d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x1000b4f8
push esi
call sym.ucrtbase.dll_wcspbrk
pop ecx
pop ecx
test eax, eax
jne 0x100cf650
xor al, al
jmp 0x100cf6b6
lea eax, [ebp - 0x214]
xor ebx, ebx
push eax
push ecx
mov edx, esi
mov dword [ebp - 0x214], ebx
lea ecx, [ebp - 0x210]
call fcn.100cf068
mov edx, eax
pop ecx
pop ecx
test edx, edx
je 0x100cf6a9
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100cf67a
sub ecx, edi
sar ecx, 1
cmp ecx, 3
je 0x100cf699
mov ecx, edx
call fcn.100cf585
test al, al
je 0x100cf6a9
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
xor ebx, ebx
inc ebx
cmp eax, ebx
ja 0x100cf6a9
xor ebx, ebx
lea ecx, [ebp - 0x214]
call fcn.100ada37
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10068820
leave
ret
Function at 0x100d26a9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
mov eax, ecx
mov ebx, edx
push esi
sar ecx, 6
mov dword [ebp - 0x24], eax
and eax, 0x3f
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10105340]
mov dword [ebp - 0x14], ecx
push 0xa
pop edx
mov dword [ebp - 0x10], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100d26ee
cmp word [ebx], dx
jne 0x100d26ee
or byte [edi + eax + 0x28], 4
jmp 0x100d26f3
and byte [edi + eax + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, edx
jae 0x100d2850
mov dword [ebp - 0x18], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x1c], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 0xc]
je 0x100d282d
add eax, 2
cmp cx, word [ebp - 0x18]
je 0x100d2737
mov dword [ebp - 8], eax
mov word [esi], cx
jmp 0x100d276d
cmp eax, edx
jae 0x100d2779
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x10]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 8], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 8]
add esi, 2
cmp eax, edx
jb 0x100d270f
jmp 0x100d2850
push 0
lea eax, [ebp - 0x1c]
push eax
push 2
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x100d2829
cmp dword [ebp - 0x1c], 0
je 0x100d2829
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx*4 + 0x10105340]
test byte [edi + ecx + 0x28], 0x48
je 0x100d27eb
mov dx, word [ebp - 8]
lea eax, [esi + 2]
mov dword [ebp - 0x20], eax
cmp dx, word [ebp - 0x10]
jne 0x100d27c9
push 0xa
pop ecx
mov word [esi], cx
jmp 0x100d27e7
push 0xd
pop eax
mov word [esi], ax
movzx eax, dx
shr eax, 8
mov byte [edi + ecx + 0x2a], dl
mov byte [edi + ecx + 0x2b], al
push 0xa
pop eax
mov byte [edi + ecx + 0x2c], al
mov eax, dword [ebp - 0x20]
mov esi, eax
jmp 0x100d2850
push 0xa
pop eax
cmp word [ebp - 8], ax
jne 0x100d27f8
cmp esi, ebx
je 0x100d284a
push 0
lea ecx, [ebp - 0x4c]
call fcn.1006a040
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
xor edx, edx
push 0xffffffffffffffff
push 0xfffffffffffffffe
inc edx
call fcn.100751c2
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.1006a0b0
push 0xa
pop eax
cmp word [ebp - 8], ax
je 0x100d2850
push 0xd
jmp 0x100d2849
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx*4 + 0x10105340]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100d2847
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100d2850
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100d2d7e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1414
call fcn.10068e90
mov eax, dword [0x101042d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [eax*4 + 0x10105340]
push esi
push edi
mov edi, ebx
mov eax, dword [eax + ecx + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x140c], eax
add ecx, edx
xor eax, eax
mov dword [ebp - 0x1414], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x100d2e48
lea esi, [ebp - 0x1404]
cmp edx, ecx
jae 0x100d2dfc
movzx eax, word [edx]
add edx, 2
cmp eax, 0xa
jne 0x100d2def
add dword [ebx + 8], 2
push 0xd
pop edi
mov word [esi], di
add esi, 2
mov word [esi], ax
add esi, 2
lea eax, [ebp - 6]
cmp esi, eax
jb 0x100d2dd3
mov edi, dword [ebp - 0x140c]
lea eax, [ebp - 0x1404]
sub esi, eax
mov dword [ebp - 0x1408], edx
push 0
lea eax, [ebp - 0x1410]
and esi, 0xfffffffe
push eax
push esi
lea eax, [ebp - 0x1404]
push eax
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x100d2e4e
mov eax, dword [ebp - 0x1410]
add dword [ebx + 4], eax
cmp eax, esi
jb 0x100d2e56
mov edx, dword [ebp - 0x1408]
mov ecx, dword [ebp - 0x1414]
cmp edx, ecx
jb 0x100d2dcd
jmp 0x100d2e56
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10068820
leave
ret
Function at 0x100d2e6d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x141c
call fcn.10068e90
mov eax, dword [0x101042d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x141c], edx
sar eax, 6
and ecx, 0x3f
imul ecx, ecx, 0x38
push ebx
push esi
mov eax, dword [eax*4 + 0x10105340]
mov esi, dword [ebp + 8]
push edi
mov edi, esi
mov eax, dword [eax + ecx + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1410], eax
add ecx, edx
xor eax, eax
mov dword [ebp - 0x140c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, edx
cmp edx, ecx
jae 0x100d2f90
mov esi, dword [ebp - 0x140c]
lea eax, [ebp - 0x6b0]
cmp edi, esi
jae 0x100d2efb
movzx ecx, word [edi]
add edi, 2
cmp ecx, 0xa
jne 0x100d2eee
push 0xd
pop edx
mov word [eax], dx
add eax, 2
mov word [eax], cx
add eax, 2
lea ecx, [ebp - 8]
cmp eax, ecx
jb 0x100d2ed6
push 0
push ecx
push 0xd55
lea ecx, [ebp - 0x1408]
push ecx
lea ecx, [ebp - 0x6b0]
sub eax, ecx
sar eax, 1
push eax
mov eax, ecx
mov ecx, 0xfde9
push eax
call fcn.1002d9e9
mov esi, dword [ebp + 8]
add esp, 0x18
mov dword [ebp - 0x1418], eax
test eax, eax
je 0x100d2f88
xor ebx, ebx
test eax, eax
je 0x100d2f6d
push 0
lea ecx, [ebp - 0x1414]
sub eax, ebx
push ecx
push eax
lea eax, [ebp - 0x1408]
add eax, ebx
push eax
push dword [ebp - 0x1410]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x100d2f88
add ebx, dword [ebp - 0x1414]
mov eax, dword [ebp - 0x1418]
cmp ebx, eax
jb 0x100d2f38
mov ecx, dword [ebp - 0x140c]
mov eax, edi
sub eax, dword [ebp - 0x141c]
mov dword [esi + 4], eax
cmp edi, ecx
jb 0x100d2eca
jmp 0x100d2f90
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [esi], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10068820
leave
ret
Function at 0x100d73a0
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100d6359
Function at 0x100eb2be
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x100eb381
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.10042889
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [0x101042e0]
mov esi, eax
call fcn.100290c0
mov ecx, dword [0x101042e4]
xor edi, edi
mov dword [ebp - 4], eax
cmp ecx, 0xffffffff
je 0x100eb3b9
call fcn.100290c0
mov ebx, eax
test ebx, ebx
je 0x100eb3b3
cmp ebx, 0xffffffff
je 0x100eb36a
jmp 0x100eb361
xor edx, edx
call fcn.1003b000
push edi
call sym.ucrtbase.dll__free_base
pop ecx
jmp 0x100eb36a
mov edx, ebx
call fcn.1003b000
test eax, eax
jne 0x100eb352
mov ecx, dword [0x101042e4]
xor edx, edx
call fcn.1003b000
push ebx
jmp 0x100eb32f
mov ecx, ebx
call fcn.1003e545
push 0
call sym.ucrtbase.dll__free_base
pop ecx
imul edi, dword [ebp - 4], 0x364
add edi, ebx
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, 0x101049f4
test edi, edi
je 0x100eb37d
lea eax, [edi + 0x10]
mov eax, dword [eax]
jmp 0x100eb3ac
cmp eax, dword [esi + 0xc]
jbe 0x100eb3a7
inc eax
mov ecx, esi
push eax
call fcn.1004fc72
test eax, eax
jne 0x100eb3ac
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryW]
test eax, eax
je 0x100eb2dd
mov dword [esi + 0x10], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov ecx, dword [0x101042e4]
or edx, 0xffffffff
call fcn.1003b000
test eax, eax
je 0x100eb36a
push 0x364
push 2
call sym.ucrtbase.dll__calloc_base
pop ecx
mov ebx, eax
pop ecx
mov ecx, dword [0x101042e4]
test ebx, ebx
je 0x100eb327
jmp 0x100eb337
Function at 0x100eb8bb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101042d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
movzx eax, word [esi]
cmp eax, 0x5c
je 0x100eb8dd
cmp eax, 0x2f
jne 0x100eb8e3
cmp ax, word [esi + 2]
je 0x100eb929
movsx eax, byte [esi]
push eax
call sym.ucrtbase.dll_toupper
pop ecx
push 0x3d
pop ecx
movzx eax, ax
push 0x3a
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push esi
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x100eb929
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.10042889
or eax, 0xffffffff
jmp 0x100eb92b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10068820
leave
ret

Function at 0x100eb960
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.100eb626