joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001440
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1001e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10001471
xor eax, eax
jmp 0x100014f8
lea eax, [ebp - 0x10]
push eax
push 0x1001725c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10001494
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100014f8
mov dword [ebp - 0x20], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov dword [ebp + ecx - 0x1c], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp + ecx - 0x18], eax
mov eax, 0xc
imul ecx, eax, 0
mov dword [ebp + ecx - 0x14], 2
push 0
push 0
push 0x10
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x100014e9
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100014f8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ff5
mov esp, ebp
pop ebp
ret

Function at 0x10001510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001534
xor eax, eax
jmp 0x10001550
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001750
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1dc
mov eax, dword [0x1001e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x10001778
cmp dword [ebp + 0xc], 0
je 0x10001778
cmp dword [ebp + 0x10], 0
jne 0x1000177f
xor eax, eax
jmp 0x100018cd
mov byte [ebp - 0x10c], 0
push 0x105
push 0
lea eax, [ebp - 0x10b]
push eax
call fcn.100044f0
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.10001170
add esp, 8
push str._PreDB
lea eax, [ebp - 0x10c]
push eax
call fcn.100010e0
add esp, 8
push 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
mov word [ebp - 0x11c], ax
xor eax, eax
mov dword [ebp - 0x11a], eax
mov dword [ebp - 0x116], eax
mov dword [ebp - 0x112], eax
mov word [ebp - 0x10e], ax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov byte [ebp - 0x19c], 0
push 0x7f
push 0
lea eax, [ebp - 0x19b]
push eax
call fcn.100044f0
add esp, 0xc
movzx eax, word [ebp - 0x10e]
push eax
movzx ecx, word [ebp - 0x110]
push ecx
movzx edx, word [ebp - 0x112]
push edx
movzx eax, word [ebp - 0x114]
push eax
movzx ecx, word [ebp - 0x116]
push ecx
movzx edx, word [ebp - 0x11a]
push edx
movzx eax, word [ebp - 0x11c]
cdq
mov ecx, 0x64
idiv ecx
push edx
push str._.2d_.2d_.2d_.2d_.2d_.2d_.4d
lea edx, [ebp - 0x19c]
push edx
call fcn.100010a0
add esp, 0x24
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.100010e0
add esp, 8
push 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x10017298
lea eax, [ebp - 0x10c]
push eax
call fcn.100010e0
add esp, 8
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.100010e0
add esp, 8
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sym.SetupPackageTool.dll_SetupRenameDirectory
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ff5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100018e0
Capabilities:
Copy file
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1001e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x10001900
xor eax, eax
jmp 0x100019ef
cmp dword [ebp + 0xc], 0
jne 0x10001915
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x100019ef
mov dword [ebp - 8], 0
call fcn.10001560
cmp dword [0x1001e7dc], 0
je 0x1000193c
cmp dword [0x1001e7e0], 0
je 0x1000193c
cmp dword [0x1001e7e8], 0
jne 0x10001941
jmp 0x100019ce
mov dword [ebp - 0xc], 0xffffffff
push str.CopyDirectory
push 0
push 0
push 0
push 1
push 0
push 0
call dword [0x1001e7dc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000196a
jmp 0x100019ce
mov eax, dword [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0x100011d0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x1001e7e4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
jne 0x100019a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x1001e7e8]
test eax, eax
jne 0x100019b7
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
jmp 0x100019ef
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x100011d0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileExA]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ff5
mov esp, ebp
pop ebp
ret 8

Function at 0x10001a10
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10001a33
mov eax, 1
jmp 0x10001a53
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x10001a49
mov eax, dword [ebp + 8]
push eax
call fcn.100012f0
add esp, 4
jmp 0x10001a53
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100026c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x1001e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x100026eb
mov eax, dword [ebp - 8]
jmp 0x100027a1
mov dword [ebp - 0x130], 0x128
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.100044f0
add esp, 0xc
mov dword [ebp - 0x134], 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0xffffffff
jne 0x10002732
mov eax, dword [ebp - 8]
jmp 0x100027a1
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x10002791
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.10002bf0
add esp, 8
test eax, eax
jne 0x10002776
mov eax, dword [ebp - 0x128]
mov dword [ebp - 8], eax
jmp 0x10002791
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x138], eax
jmp 0x1000274b
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ff5
mov esp, ebp
pop ebp
ret 4

Function at 0x100027c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100027ea
cmp dword [ebp - 4], 0x104
jle 0x100027ee
xor eax, eax
jmp 0x100027f3
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10002800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10002825
mov dword [ebp - 0x48], 1
jmp 0x1000282c
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002870
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c4
mov eax, dword [0x1001e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x10002893
xor eax, eax
jmp 0x10002a1a
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.100044f0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.10001140
add esp, 8
lea eax, [ebp - 0x108]
push eax
call fcn.10001040
add esp, 4
mov dword [ebp - 0x230], 0x128
push 0x124
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.100044f0
add esp, 0xc
mov dword [ebp - 0x234], 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x1000291b
xor eax, eax
jmp 0x10002a1a
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x10002a08
mov eax, dword [ebp - 0x228]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x100029ea
mov byte [ebp - 0x344], 0
push 0x105
push 0
lea eax, [ebp - 0x343]
push eax
call fcn.100044f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x344]
push eax
push 0
mov ecx, dword [ebp - 0x23c]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0x344]
push eax
call fcn.10001070
add esp, 4
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x344]
push ecx
call fcn.10001710
add esp, 8
lea edx, [ebp - 0x344]
cmp eax, edx
jne 0x100029dd
mov eax, dword [ebp - 0x228]
push eax
call fcn.10001510
add esp, 4
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x238], eax
jmp 0x10002934
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002ff5
mov esp, ebp
pop ebp
ret 4
Function at 0x10002a30
Capabilities:
Delete directory
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x10002a46
xor eax, eax
jmp 0x10002b20
cmp dword [ebp + 0xc], 0
jne 0x10002a5b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x10002b20
call fcn.10001560
cmp dword [0x1001e7dc], 0
je 0x10002a7b
cmp dword [0x1001e7e0], 0
je 0x10002a7b
cmp dword [0x1001e7e8], 0
jne 0x10002a80
jmp 0x10002b09
mov dword [ebp - 4], 0xffffffff
push 0x1001729c
push 0
push 0
push 0
push 1
push 0
push 0
call dword [0x1001e7dc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10002aa9
jmp 0x10002b09
mov eax, dword [ebp - 4]
push eax
push 3
push 0
push 0x100011d0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x1001e7e0]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp - 8], 0
jne 0x10002add
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push eax
call dword [0x1001e7e8]
test eax, eax
jne 0x10002af2
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x10002b20
push 3
push 0
push 0x100011d0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6100ce1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x6100ce77
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x6100ce69
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x6100ce65
cmp esi, eax
jae 0x6100ce69
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x6100ce57
cmp esi, eax
jb 0x6100ce6d
xor eax, eax
jmp 0x6100ce76
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x61012450
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x14
mov eax, 0x6103dd3d
call fcn.6102b2d6
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x610039dc
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x61012574
push 0x610039c4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x6101251b
lea ecx, [ebp - 0x18]
call fcn.6100d83e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d83e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.6100d64a
lea ecx, [ebp - 0x10]
call fcn.6100d64a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
call fcn.610182a8
test al, al
je 0x610124fe
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
je 0x610124fe
push ebx
xor esi, esi
inc esi
push esi
push eax
call edi
test eax, eax
je 0x610124e9
mov dword [ebp - 0x14], esi
jmp 0x610124fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe000023c
jne 0x610124fb
mov dword [ebp - 0x14], ebx
jmp 0x610124fe
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.6100d793
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.6100d793
cmp dword [ebp - 0x1c], ebx
je 0x6101256b
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, 0x80
push ebx
push dword [ebp + 8]
call esi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
test eax, eax
je 0x6101256b
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], 1
call fcn.6101227b
push 0x610039b8
push 0x610039ac
lea ecx, [ebp + 8]
call fcn.61012125
test eax, eax
je 0x6101256b
push ebx
push dword [ebp + 8]
call esi
push dword [ebp + 8]
call edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.6100d793
mov eax, dword [ebp - 0x14]
call fcn.6102b3c2
ret 4

Function at 0x6101753d
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x61048110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x610175a7
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x6101759e
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.6102b2c1
leave
ret
Function at 0x61017625
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x61048110]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
mov edi, 0x270f
call fcn.6102bb20
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x6101770f
cmp dword [ebp - 0x108], 2
jne 0x610176df
cmp dword [ebp - 0x114], 4
ja 0x6101768b
push 2
jmp 0x610176dc
cmp dword [ebp - 0x114], 5
jne 0x610176bb
cmp dword [ebp - 0x110], 0
jne 0x610176a1
push 3
jmp 0x610176dc
cmp dword [ebp - 0x110], 1
jne 0x610176ae
push 4
jmp 0x610176dc
cmp dword [ebp - 0x110], 2
jne 0x6101770f
push 5
jmp 0x610176dc
cmp dword [ebp - 0x114], 6
jne 0x6101770f
cmp dword [ebp - 0x110], 0
jne 0x610176d1
push 6
jmp 0x610176dc
cmp dword [ebp - 0x110], 1
jne 0x6101770f
push 7
pop edi
jmp 0x6101770f
cmp dword [ebp - 0x108], 1
jne 0x6101770f
cmp dword [ebp - 0x114], 4
jne 0x6101770f
cmp dword [ebp - 0x110], 0
je 0x6101770c
cmp dword [ebp - 0x110], 0xa
je 0x6101770c
cmp dword [ebp - 0x110], 0x5a
jne 0x6101770f
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.6102b2c1
leave
ret

Function at 0x610177e2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x610177fb
xor al, al
jmp 0x61017800
shr eax, 4
and al, 1
pop ebp
ret 4

Function at 0x61017809
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x61017822
xor al, al
jmp 0x61017829
shr eax, 4
not al
and al, 1
pop ebp
ret 4

Function at 0x61017832
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x6101784f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x61017855
shr eax, 3
and eax, 2
pop ebp
ret 4
Function at 0x6101785e
Capabilities:
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x61048110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x80
push dword [esi]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x610178dc
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x20c]
push ecx
xor ebx, ebx
push ebx
push 0x61003f74
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x610178d4
mov eax, dword [esi]
push 1
lea ecx, [ebp - 0x20c]
push ecx
push eax
call edi
test eax, eax
je 0x610178d4
push 4
push ebx
lea eax, [ebp - 0x20c]
push eax
jmp 0x610178d9
push 4
push ebx
push dword [esi]
call edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.6102b2c1
leave
ret 4
Function at 0x61018d43
Capabilities:
Create directory

Disassembly:
push 0x20
mov eax, 0x6103eff4
call fcn.6102b2d6
lea ecx, [ebp - 0x10]
call fcn.6100d83e
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
call fcn.6100d869
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
call fcn.610187ab
test eax, eax
je 0x61018d95
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.6100d793
mov al, bl
jmp 0x61018f43
lea eax, [ebp - 0x10]
push eax
call fcn.610177e2
test al, al
je 0x61018da6
mov bl, 1
jmp 0x61018d82
push 0xa
lea ecx, [ebp - 0x2c]
call fcn.6100cfcf
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0xc]
push 3
pop edi
cmp ecx, edi
jl 0x61018e47
test ecx, ecx
jge 0x61018dd3
push 0x80070057
call fcn.6100cd98
movzx eax, word [eax]
push eax
call fcn.6102c9c5
pop ecx
push 0x5c
test eax, eax
mov eax, dword [ebp - 0x10]
pop ebx
je 0x61018e07
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jl 0x61018dc9
movzx edx, word [eax + 2]
cmp dx, 0x3a
jne 0x61018e07
cmp ecx, 2
jl 0x61018dc9
movzx ecx, word [eax + 4]
cmp cx, bx
je 0x61018e58
mov edx, dword [eax - 0xc]
test edx, edx
jl 0x61018dc9
movzx ecx, word [eax]
cmp cx, bx
jne 0x61018e47
cmp edx, 1
jl 0x61018dc9
movzx eax, word [eax + 2]
cmp ax, bx
jne 0x61018e47
push 2
push ebx
lea ecx, [ebp - 0x10]
call fcn.61018038
test eax, eax
jl 0x61018e47
inc eax
push eax
push ebx
lea ecx, [ebp - 0x10]
call fcn.61018038
mov edi, eax
test edi, edi
jl 0x61018e47
inc edi
jns 0x61018e58
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.6100d24f
jmp 0x61018da2
push ebx
lea ecx, [ebp - 0x10]
call fcn.61017b62
mov esi, eax
cmp esi, edi
jg 0x61018e6b
mov esi, edi
jmp 0x61018e6c
inc esi
push esi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.610142d4
mov byte [ebp - 4], 3
push dword [eax]
lea ecx, [ebp - 0x2c]
call fcn.61018d15
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.6100d793
cmp esi, edi
jle 0x61018ecb
dec esi
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.61013eac
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.6100dd8c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
call fcn.6100d793
lea eax, [ebp - 0x10]
push eax
call fcn.610177e2
test al, al
je 0x61018e58
xor esi, esi
cmp dword [ebp - 0x24], esi
je 0x61018e47
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
cmp eax, esi
je 0x61018f29
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.6100d869
mov byte [ebp - 4], 5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
call fcn.6101e793
push eax
lea eax, [ebp + 8]
push eax
call fcn.6101836c
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x61018f4b
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.6100d793
cmp dword [ebp - 0x14], esi
jne 0x61018ee0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.6100d24f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.6100d793
mov al, 1
call fcn.6102b3c2
ret 4
mov byte [ebp - 4], 2
lea ecx, [ebp + 8]
call fcn.6100d793
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.6100d24f
jmp 0x61018d80