joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a33f4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4a3496
cmp dword [ebx + 0x94], 0
jne 0x4a3490
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4a3340
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4a3490
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4a3456
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4a3490
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00430868
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4a3465
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4a36b4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4e7280]
cmp dword [eax + 0x170], 0
je 0x4a3819
test bl, bl
jne 0x4a3767
cmp dword [esi + 0x9c], 0
jne 0x4a375c
mov eax, esi
call fcn.004a65a4
push eax
push 0x4a35c0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4a372d
mov eax, dword [0x4e7280]
cmp byte [eax + 0xd3], 0
je 0x4a372d
mov eax, dword [esi + 0xd8]
call fcn.00407e50
mov edi, eax
cmp edi, 0
jl 0x4a372d
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a3716
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a375c
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00430868
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a373c
inc dword [esi + 0x9c]
jmp 0x4a3819
cmp dword [esi + 0x9c], 0
jle 0x4a3819
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4a3819
cmp dword [esi + 0x44], 0
je 0x4a37c4
mov eax, dword [0x4e7280]
cmp byte [eax + 0xd3], 0
je 0x4a37c4
mov eax, dword [esi + 0xd8]
call fcn.00407e50
mov edi, eax
cmp edi, 0
jl 0x4a37c4
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a37ad
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a37f3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00430868
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a37d3
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x49693c]
call fcn.00408010
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4a4468
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4a44d3
cmp byte [ebx + 0xd3], 0
jne 0x4a44d3
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406988
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4a44c0
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a44e0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040684c
jmp 0x4a44e0
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040684c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4a5d08
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4a5d76
mov eax, esi
call fcn.0047e410
test al, al
je 0x4a5d76
mov eax, dword [ebx + 0x84]
call fcn.0047e090
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a5d76
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4a5d6a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0047e090
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004750d0
jmp 0x4a5d76
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004a5b40
pop esi
pop ebx
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x799f72e1
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x42f314
nop
mov ecx, 0x12a13f7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10080a0
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 1
push 0x14c
push 0x1001b98
lea ecx, [ebp - 0x2c]
call fcn.0100c063
and dword [ebp - 4], 0
and dword [ebp - 8], 0
mov eax, dword [0x1021360]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, 0x1021360
cmp eax, ebx
je 0x10080fe
test dword [eax + 0x1c], 0x8000000
je 0x10080fe
call esi
push eax
mov eax, dword [0x1021360]
push 0x1001b20
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e17
mov edi, dword [ebp + 8]
mov eax, 0x154
test edi, edi
jne 0x100811a
mov dword [ebp - 0x2c], 0x80070057
mov word [ebp - 0x26], ax
jmp 0x100821b
and dword [ebp - 0x2c], 0
mov ecx, edi
mov word [ebp - 0x28], ax
call fcn.0100e6bb
lea eax, [ebp - 4]
push eax
call esi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp + 8], eax
test eax, eax
jne 0x1008153
call fcn.0100d43e
mov dword [ebp - 0x2c], eax
mov eax, 0x158
mov word [ebp - 0x26], ax
jmp 0x100820c
and dword [ebp - 0x2c], 0
cmp dword [ebp - 4], 2
mov eax, 0x158
mov word [ebp - 0x28], ax
jle 0x1008172
mov dword [ebp - 0x2c], 0x80070057
add eax, 4
jmp 0x100814a
xor esi, esi
inc esi
cmp dword [ebp - 4], esi
jle 0x10081e6
mov eax, dword [ebp + 8]
push 9
push dword [eax + esi*4]
push 0x1001b30
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10081c6
mov eax, dword [ebp + 8]
mov edx, dword [eax + esi*4]
add edx, 0x12
mov ecx, edi
call fcn.0100f210
mov dword [ebp - 0x2c], eax
test eax, eax
mov eax, 0x165
jl 0x100814a
cmp dword [edi + 4], 0
mov word [ebp - 0x28], ax
jne 0x10081c9
mov dword [ebp - 0x2c], 0x80070057
add eax, 4
jmp 0x100814a
inc dword [ebp - 8]
inc esi
cmp esi, dword [ebp - 4]
jl 0x100817a
cmp dword [ebp - 8], 0
jbe 0x10081e6
mov dword [ebp - 0x2c], 0x80070057
mov eax, 0x174
jmp 0x100814a
mov eax, dword [0x1021360]
cmp eax, ebx
je 0x100820c
test dword [eax + 0x1c], 0x8000000
je 0x100820c
push dword [edi]
push 0x1001b20
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e17
cmp dword [ebp + 8], 0
je 0x100821b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.0100c22a
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x100829f
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 1
push 0x91
push 0x1001c04
lea ecx, [ebp - 0x40]
call fcn.0100c063
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
mov dword [ebp - 0x10], 0x1002828
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
cmp dword [ebp + 8], ebx
je 0x1008390
mov ecx, dword [ebp + 8]
call fcn.0100e6bb
mov edx, dword [0x1021368]
mov eax, 0x9a
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x3c], ax
call fcn.0100ee26
mov dword [ebp - 0x40], eax
cmp eax, ebx
mov eax, 0x9d
jl 0x100839c
push dword [ebp - 0x10]
mov word [ebp - 0x3c], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10083b1
test al, 0x10
jne 0x100845f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10083a5
call fcn.0100d43e
mov dword [ebp - 0x40], eax
mov eax, 0xac
mov word [ebp - 0x3a], ax
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x100846a
test dword [eax + 0x1c], 0x2000000
je 0x100846a
push dword [ebp - 0x40]
push dword [ebp - 0x10]
push 0x1001be0
push 0x1001b20
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e84
jmp 0x100846a
mov dword [ebp - 0x40], 0x80070057
mov eax, 0x9a
mov word [ebp - 0x3a], ax
jmp 0x100846a
mov eax, 0xac
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x3c], ax
push ebx
lea eax, [ebp - 4]
push eax
push 1
push dword [0x102136c]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x10083d6
call fcn.0100d43e
mov dword [ebp - 0x40], eax
mov eax, 0xb7
jmp 0x100839c
mov esi, 0xb7
mov eax, esi
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100845f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x1008411
xor eax, eax
cmp eax, ebx
jle 0x100841f
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
cmp ecx, ebx
mov dword [ebp - 0x40], ecx
mov eax, 0xc4
jge 0x100845b
mov word [ebp - 0x3a], ax
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x100846a
test dword [eax + 0x1c], 0x2000000
je 0x100846a
push ecx
push dword [ebp - 0x10]
push 0x1001bd8
push 0x1001b20
push 0xb
jmp 0x1008380
mov word [ebp - 0x3c], ax
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0100e879
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x10]
call fcn.0100e697
lea ecx, [ebp - 0x40]
call fcn.0100c22a
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x10096c6
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
push esi
push edi
push 1
push 0x14e
push 0x1001ebc
lea ecx, [ebp - 0x48]
call fcn.0100c063
xor esi, esi
mov edx, 0x1002828
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x68]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], esi
je 0x1009815
mov ecx, dword [ebp + 0xc]
call fcn.0100e6bb
mov eax, 0x157
mov word [ebp - 0x44], ax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x48], esi
call fcn.0100bdd6
cmp eax, esi
jge 0x1009767
mov ecx, dword [0x1021360]
cmp ecx, 0x1021360
je 0x1009767
test dword [ecx + 0x1c], 0x2000000
je 0x1009767
push eax
push 0x1001cc4
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01009127
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [0x1021a30]
xor eax, eax
cmp word [ebp - 0x6c], si
lea ecx, [ebp - 0x18]
setne al
add eax, 0x97
push eax
call fcn.0100f248
mov dword [ebp - 0x48], eax
cmp eax, esi
mov eax, 0x160
jl 0x1009821
push dword [ebp - 0x18]
mov word [ebp - 0x44], ax
push dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push 0x99
push dword [0x1021a30]
push eax
call fcn.0100f310
add esp, 0x14
mov dword [ebp - 0x48], eax
cmp eax, esi
mov eax, 0x162
jl 0x1009821
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
mov word [ebp - 0x44], ax
call fcn.0100f210
mov dword [ebp - 0x48], eax
cmp eax, esi
mov eax, 0x164
jl 0x1009821
mov word [ebp - 0x44], ax
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0xc]
call fcn.0100e697
lea ecx, [ebp - 0x18]
call fcn.0100e697
lea ecx, [ebp - 0x24]
call fcn.0100e697
lea ecx, [ebp - 0x48]
call fcn.0100c22a
pop edi
mov eax, esi
pop esi
leave
ret 8
mov dword [ebp - 0x48], 0x80070057
mov eax, 0x157
mov word [ebp - 0x42], ax
jmp 0x10097ea
Function at 0x1009dc4
Capabilities:
Inspect load icon resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push 1
push 0xa6
push 0x1001f6c
lea ecx, [ebp - 0x24]
call fcn.0100c063
push 0x1001f44
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov esi, dword [ebp + 8]
push 0
push 1
push eax
mov dword [0x1021a38], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
push 0x16
push dword [0x1021a30]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp + 8], eax
test eax, eax
jne 0x1009e2d
call fcn.0100d43e
mov dword [ebp - 0x24], eax
mov eax, 0xb2
mov word [ebp - 0x1e], ax
jmp 0x1009f2b
and dword [ebp - 0x24], 0
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov ecx, 0xb2
push 1
lea ebx, [ecx - 0x32]
push ebx
push dword [esi + 4]
mov word [ebp - 0x20], cx
call edi
push dword [ebp + 8]
push 0
push ebx
push dword [esi + 4]
call edi
push 1
push dword [esi + 4]
push esi
call fcn.0100982c
mov dword [ebp - 0x24], eax
test eax, eax
lea eax, [ebx + 0x38]
jl 0x1009f17
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0xc80000
push 0
push 0x401
push 0x65
push dword [esi + 4]
mov word [ebp - 0x20], ax
call ebx
push eax
call edi
push 0
push 1
push 0x404
push 0x65
push dword [esi + 4]
call ebx
push eax
call edi
push 0
push 0
push 0x402
push 0x65
push dword [esi + 4]
call ebx
push eax
call edi
xor edi, edi
push edi
push 0x64
push dword [esi + 4]
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea ebx, [esi + 0x24]
mov eax, dword [ebx]
cmp eax, edi
je 0x1009eda
push eax
mov dword [ebx], edi
call fcn.010095c0
push ebx
call fcn.010095f0
mov dword [ebp - 0x24], eax
cmp eax, edi
mov eax, 0xc2
jl 0x1009f17
push edi
push edi
push 0x8003
push dword [esi + 4]
mov word [ebp - 0x20], ax
mov dword [esi], 1
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
jne 0x1009f1d
call fcn.0100d43e
mov dword [ebp - 0x24], eax
mov eax, 0xc7
mov word [ebp - 0x1e], ax
jmp 0x1009f29
mov eax, 0xc7
mov dword [ebp - 0x24], edi
mov word [ebp - 0x20], ax
pop edi
pop ebx
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.0100c22a
mov eax, esi
pop esi
leave
ret 4
Function at 0x100b795
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x101f4d0
call fcn.0100b984
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1021e0c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100b54c
cmp eax, esi
jne 0x100b53f
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100b54f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100b526
xor esi, esi
inc esi
mov eax, dword [0x1021e08]
cmp eax, esi
jne 0x100b562
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100b591
mov eax, dword [0x1021e08]
test eax, eax
jne 0x100b58b
mov dword [0x1021e08], esi
push 0x10013c0
push 0x10013b4
call fcn.0100b48b
pop ecx
pop ecx
test eax, eax
je 0x100b591
jmp 0x100b6b9
mov dword [0x1021a5c], esi
mov eax, dword [0x1021e08]
cmp eax, esi
jne 0x100b5b5
push 0x10013b0
push 0x1001398
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1021e08], 2
test ebx, ebx
jne 0x100b5c1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1021e10], 0
je 0x100b5e5
push 0x1021e10
call fcn.0100b8f9
pop ecx
test eax, eax
je 0x100b5e5
push 0
push 2
push 0
call dword [0x1021e10]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100b641
test al, al
je 0x100b5ff
cmp dword [ebp - 0x1c], 0
jne 0x100b641
mov al, byte [esi]
test al, al
je 0x100b60f
cmp al, 0x20
ja 0x100b60f
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100b5ff
test byte [ebp - 0x3c], 1
je 0x100b61b
movzx eax, word [ebp - 0x38]
jmp 0x100b61e
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1021a58], eax
cmp dword [0x1021a4c], 0
jne 0x100b695
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100b650
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x100b663
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100b5ec
cmp dword [0x1021a5c], 0
jne 0x100b6a4
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1021a58]
jmp 0x100b6c5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100b9c9
ret
call fcn.0100bad1
jmp 0x100b4ec
Function at 0x100c22a
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
cmp eax, edi
jge 0x100c304
push eax
call sub.SPP.dll_SxTracerShouldTrackFailure
mov dword [ebp - 4], eax
mov ecx, 0x1002348
cmp eax, edi
jne 0x100c25e
mov ecx, 0x1002340
cmp dword [esi + 8], edi
jne 0x100c29a
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x100c29a
test dword [eax + 0x1c], 0x2000000
je 0x100c29a
push dword [esi]
movzx edx, word [esi + 6]
push edx
push ecx
movzx ecx, word [esi + 4]
push ecx
push dword [esi + 0x10]
push 0x1002330
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100bfcf
cmp dword [esi + 0x1c], edi
je 0x100c2d6
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
cmp ecx, dword [eax + 0x10]
je 0x100c2d6
mov eax, dword [eax + 0xc]
cmp eax, edi
je 0x100c2b9
push eax
call ebx
mov eax, dword [esi + 0x18]
mov dword [eax + 0xc], edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
mov dword [esi + 0x1c], edi
mov dword [eax + 0x10], ecx
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x100c2e8
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
je 0x100c37f
cmp dword [esi + 8], edi
jne 0x100c2f4
mov ecx, esi
call fcn.0100c159
cmp dword [ebp - 4], edi
je 0x100c37f
call sub.SPP.dll_SxTracerDebuggerBreak
jmp 0x100c37f
movzx eax, word [esi + 0xc]
cmp ax, di
jne 0x100c32e
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x100c37f
test dword [eax + 0x1c], 0x8000000
je 0x100c37f
push dword [esi + 0x10]
push 0x1002330
push 0x10
jmp 0x100c374
cmp ax, 1
jne 0x100c355
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x100c37f
test dword [eax + 0x1c], 0x20000000
je 0x100c37f
push dword [esi + 0x10]
push 0x1002330
push 0x11
jmp 0x100c374
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x100c37f
test dword [eax + 0x1c], 0x20000
je 0x100c37f
push dword [esi + 0x10]
push 0x1002330
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100becd
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x100c3b2
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x14], ecx
mov eax, dword [esi + 0x18]
cmp dword [esi + 0x14], edi
jne 0x100c3ad
mov dword [eax + 8], edi
mov eax, dword [esi + 0x18]
push dword [eax + 0xc]
call ebx
mov eax, dword [esi + 0x18]
mov dword [eax + 0xc], edi
mov eax, dword [esi + 0x18]
mov dword [eax + 0x10], edi
jmp 0x100c3b2
mov ecx, dword [esi]
mov dword [eax + 8], ecx
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x100c3bf
push eax
call ebx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100ced3
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1021360]
cmp eax, 0x1021360
je 0x100cf02
test dword [eax + 0x1c], 0x20000000
je 0x100cf02
push 0x1002358
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009101
push esi
push 1
push 0x1bb
push 0x1002478
lea ecx, [ebp - 0x3c]
call fcn.0100c063
xor esi, esi
mov eax, 0x1002828
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov eax, 0x1c3
cmp dword [ebp + 8], esi
jne 0x100cf4a
mov dword [ebp - 0x3c], 0x80070057
mov word [ebp - 0x36], ax
jmp 0x100d0b3
push ebx
mov ebx, dword [ebp + 0xc]
mov word [ebp - 0x38], ax
mov eax, 0x1c4
cmp ebx, 2
jae 0x100cf6c
mov dword [ebp - 0x3c], 0x80070057
mov word [ebp - 0x36], ax
jmp 0x100d0b2
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x38], ax
call fcn.0100cc7d
mov edi, 0x1002378
push edi
push esi
push dword [ebp + 8]
mov esi, 0x1002450
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.0100ea69
add esp, 0x14
mov dword [ebp - 0x3c], eax
test eax, eax
mov eax, 0x1cb
jl 0x100d0ad
push dword [ebp - 0xc]
mov word [ebp - 0x38], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100cfdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100cfcb
cmp eax, 3
jne 0x100cfdd
and dword [ebp - 0x3c], 0
mov eax, 0x1d3
mov word [ebp - 0x38], ax
jmp 0x100d0b1
push edi
dec ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.0100ea69
add esp, 0x14
mov dword [ebp - 0x3c], eax
test eax, eax
mov eax, 0x1d8
jl 0x100d0ad
push dword [ebp - 0xc]
mov word [ebp - 0x38], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100d08b
push edi
lea ebx, [eax - 1]
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0100ea69
add esp, 0x14
mov dword [ebp - 0x3c], eax
test eax, eax
mov eax, 0x1df
jl 0x100d0ad
push 1
push dword [ebp - 0xc]
mov word [ebp - 0x38], ax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x100d068
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100d05b
cmp eax, 0x20
je 0x100d05b
cmp eax, 5
jne 0x100d097
and dword [ebp - 0x3c], 0
mov eax, 0x1ec
mov word [ebp - 0x38], ax
push dword [ebp - 0xc]
call fcn.0100cb89
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
call fcn.0100f210
mov dword [ebp - 0x3c], eax
test eax, eax
mov eax, 0x1f3
jl 0x100d0ad
mov word [ebp - 0x38], ax
mov eax, ebx
test eax, eax
ja 0x100d00f
jmp 0x100d0b1
test eax, eax
jle 0x100d0a5
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x3c], eax
mov eax, 0x1ec
mov word [ebp - 0x36], ax
pop edi
pop ebx
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xc]
call fcn.0100e697
lea ecx, [ebp - 0x18]
call fcn.0100e697
lea ecx, [ebp - 0x3c]
call fcn.0100c22a
mov eax, esi
pop esi
leave
ret 8