joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1049e8b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
inc esi
push esi
push 0x1eae
push 0x1009590
lea ecx, [ebp - 0xe4]
call fcn.01055826
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 4]
and dword [ebp - 0xac], 0
or dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0xc0], eax
xor eax, eax
push 0x9e
push eax
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xa2]
push eax
mov dword [ebp - 0xb0], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 2
pop ebx
lea eax, [ebp - 0xac]
push eax
push esi
push 0x11f9
push edi
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], 4
mov dword [ebp - 0xf8], 8
mov dword [ebp - 0xf4], 0x10
mov dword [ebp - 0xf0], 0x20
mov dword [ebp - 0xec], 0x40
mov dword [ebp - 0xe8], esi
call fcn.010659e5
mov dword [ebp - 0xe4], eax
test eax, eax
mov eax, 0x1ec0
jl 0x104a10d
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
mov word [ebp - 0xe0], ax
lea eax, [ebp - 0xb8]
push eax
push 0x2000100c
mov ebx, 0x400
push ebx
call edi
test eax, eax
jne 0x1049f9f
call fcn.0105d3b8
mov dword [ebp - 0xe4], eax
mov eax, 0x1ec3
jmp 0x104a10d
and dword [ebp - 0xe4], 0
mov eax, 0x1ec3
push 2
mov word [ebp - 0xe0], ax
lea eax, [ebp - 0xb0]
push eax
push 0x20001009
push ebx
call edi
test eax, eax
jne 0x1049fcd
mov dword [ebp - 0xb0], esi
mov eax, dword [ebp - 0xb8]
and dword [ebp - 0xb4], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xa8], eax
jmp 0x1049ff3
mov ebx, 0x400
push 0
push 0x50
lea eax, [ebp - 0xa4]
push eax
mov eax, dword [ebp - 0xa8]
add eax, 7
push eax
push dword [ebp - 0xb0]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
test eax, eax
je 0x104a0f1
and dword [ebp - 0xe4], 0
mov eax, 0x1ed0
mov word [ebp - 0xe0], ax
mov eax, dword [ebp - 0xac]
push dword [eax + 8]
push dword [eax + 4]
call edi
lea ecx, [ebp - 0xa4]
push ecx
push 0xffffffffffffffff
push 0x14a
push eax
call esi
mov dword [ebp - 0xbc], eax
cmp eax, 0xffffffff
mov eax, 0x1ed3
je 0x104a103
and dword [ebp - 0xe4], 0
mov word [ebp - 0xe0], ax
mov eax, dword [ebp - 0xac]
push dword [eax + 8]
push dword [eax + 4]
call edi
mov ecx, dword [ebp - 0xa8]
mov ebx, dword [ebp + ecx*4 - 0x100]
push ebx
push dword [ebp - 0xbc]
push 0x151
push eax
call esi
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
movsx eax, word [eax + 6]
cmp ebx, eax
jne 0x104a0c9
mov eax, dword [ebp - 0xac]
push 0
push dword [ebp - 0xbc]
push 0x14e
push dword [eax + 8]
push dword [eax + 4]
call edi
push eax
call esi
mov eax, dword [ebp - 0xa8]
inc eax
xor edx, edx
push 7
pop ecx
div ecx
inc dword [ebp - 0xb4]
mov dword [ebp - 0xa8], edx
cmp dword [ebp - 0xb4], ecx
jb 0x1049fee
jmp 0x104a114
call fcn.0105d3b8
mov dword [ebp - 0xe4], eax
mov eax, 0x1ed0
jmp 0x104a10d
mov dword [ebp - 0xe4], 0x80004005
mov word [ebp - 0xde], ax
mov esi, dword [ebp - 0xe4]
lea ecx, [ebp - 0xe4]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 4
Function at 0x104c08a
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 1
push 0xf3a
push 0x100980c
lea ecx, [ebp - 0x4c]
call fcn.01055826
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, 0x1010420
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
lea edi, [ebp - 4]
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
cmp dword [esi + 0x14], ebx
jne 0x104c0e7
mov dword [ebp - 0x4c], ebx
mov eax, 0xf43
jmp 0x104c205
mov eax, dword [esi + 0x10]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x104c165
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x240], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x244], eax
mov eax, dword [ebp - 0x10]
push ecx
push eax
mov dword [esi + 0x248], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [esi + 0x24c], ecx
call fcn.0102f0cb
mov dword [ebp - 0x4c], eax
cmp eax, ebx
mov eax, 0xf4c
jge 0x104c142
mov word [ebp - 0x46], ax
jmp 0x104c209
push dword [ebp - 4]
mov word [ebp - 0x48], ax
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call fcn.0102f0cb
mov dword [ebp - 0x4c], eax
cmp eax, ebx
mov eax, 0xf4d
jl 0x104c139
mov word [ebp - 0x48], ax
mov eax, dword [esi + 0x10]
push ebx
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
push ebx
push ebx
push 0xffffffffffffffff
push dword [0x1075620]
push ebx
push eax
push dword [esi + 0x26c]
call fcn.010660a3
mov dword [ebp - 0x4c], eax
cmp eax, ebx
mov eax, 0xf57
jl 0x104c139
push esi
mov word [ebp - 0x48], ax
call fcn.01047a21
mov dword [ebp - 0x4c], eax
cmp eax, ebx
mov eax, 0xf5b
jl 0x104c139
mov word [ebp - 0x48], ax
mov eax, dword [esi + 0x26c]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
push 0x1013
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x104c1e3
call fcn.0105d3b8
mov dword [ebp - 0x4c], eax
mov eax, 0xf5e
jmp 0x104c139
mov eax, 0xf5e
push esi
mov dword [ebp - 0x4c], ebx
mov word [ebp - 0x48], ax
call fcn.0104813f
mov dword [ebp - 0x4c], eax
cmp eax, ebx
mov eax, 0xf60
jl 0x104c139
mov word [ebp - 0x48], ax
mov esi, dword [ebp - 0x4c]
lea ecx, [ebp - 0x1c]
call fcn.010635b3
lea ecx, [ebp - 0x28]
call fcn.010635b3
lea ecx, [ebp - 0x4c]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x1054f75
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1071b08
call fcn.010551ac
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1077aa0
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1054d2c
cmp eax, esi
jne 0x1054d1f
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1054d2f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1054d06
xor esi, esi
inc esi
mov eax, dword [0x1077a9c]
cmp eax, esi
jne 0x1054d42
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1054d71
mov eax, dword [0x1077a9c]
test eax, eax
jne 0x1054d6b
mov dword [0x1077a9c], esi
push 0x10016e8
push 0x10016dc
call fcn.01054c6b
pop ecx
pop ecx
test eax, eax
je 0x1054d71
jmp 0x1054e99
mov dword [0x10776ec], esi
mov eax, dword [0x1077a9c]
cmp eax, esi
jne 0x1054d95
push 0x10016d8
push 0x10016a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1077a9c], 2
test ebx, ebx
jne 0x1054da1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1077aac], 0
je 0x1054dc5
push 0x1077aac
call fcn.01055329
pop ecx
test eax, eax
je 0x1054dc5
push 0
push 2
push 0
call dword [0x1077aac]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1054e21
test al, al
je 0x1054ddf
cmp dword [ebp - 0x1c], 0
jne 0x1054e21
mov al, byte [esi]
test al, al
je 0x1054def
cmp al, 0x20
ja 0x1054def
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1054ddf
test byte [ebp - 0x3c], 1
je 0x1054dfb
movzx eax, word [ebp - 0x38]
jmp 0x1054dfe
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x10776e8], eax
cmp dword [0x10776dc], 0
jne 0x1054e75
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1054e30
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1054e43
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1054dcc
cmp dword [0x10776ec], 0
jne 0x1054e84
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10776e8]
jmp 0x1054ea5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.010551f1
ret
call fcn.01055476
jmp 0x1054ccc
Function at 0x1055a3c
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
cmp eax, edi
jge 0x1055b16
push eax
call sub.SPP.dll_SxTracerShouldTrackFailure
mov dword [ebp - 4], eax
mov ecx, 0x100ee1c
cmp eax, edi
jne 0x1055a70
mov ecx, 0x100ee14
cmp dword [esi + 8], edi
jne 0x1055aac
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x1055aac
test dword [eax + 0x1c], 0x2000000
je 0x1055aac
push dword [esi]
movzx edx, word [esi + 6]
push edx
push ecx
movzx ecx, word [esi + 4]
push ecx
push dword [esi + 0x10]
push 0x100ee04
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105573b
cmp dword [esi + 0x1c], edi
je 0x1055ae8
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
cmp ecx, dword [eax + 0x10]
je 0x1055ae8
mov eax, dword [eax + 0xc]
cmp eax, edi
je 0x1055acb
push eax
call ebx
mov eax, dword [esi + 0x18]
mov dword [eax + 0xc], edi
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [eax + 0xc], ecx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi]
mov dword [esi + 0x1c], edi
mov dword [eax + 0x10], ecx
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x1055afa
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
je 0x1055b91
cmp dword [esi + 8], edi
jne 0x1055b06
mov ecx, esi
call fcn.0105591c
cmp dword [ebp - 4], edi
je 0x1055b91
call sub.SPP.dll_SxTracerDebuggerBreak
jmp 0x1055b91
movzx eax, word [esi + 0xc]
cmp ax, di
jne 0x1055b40
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x1055b91
test dword [eax + 0x1c], 0x8000000
je 0x1055b91
push dword [esi + 0x10]
push 0x100ee04
push 0x10
jmp 0x1055b86
cmp ax, 1
jne 0x1055b67
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x1055b91
test dword [eax + 0x1c], 0x20000000
je 0x1055b91
push dword [esi + 0x10]
push 0x100ee04
push 0x11
jmp 0x1055b86
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x1055b91
test dword [eax + 0x1c], 0x20000
je 0x1055b91
push dword [esi + 0x10]
push 0x100ee04
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0105568f
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x1055bc4
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x14], ecx
mov eax, dword [esi + 0x18]
cmp dword [esi + 0x14], edi
jne 0x1055bbf
mov dword [eax + 8], edi
mov eax, dword [esi + 0x18]
push dword [eax + 0xc]
call ebx
mov eax, dword [esi + 0x18]
mov dword [eax + 0xc], edi
mov eax, dword [esi + 0x18]
mov dword [eax + 0x10], edi
jmp 0x1055bc4
mov ecx, dword [esi]
mov dword [eax + 8], ecx
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x1055bd1
push eax
call ebx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1056fdd
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x14]
push edi
push 1
push 0x13f
push 0x100f1dc
lea ecx, [ebp - 0x48]
call fcn.01055826
xor eax, eax
push 7
mov word [ebp - 0x24], ax
pop ecx
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
mov dword [ebp - 0x58], 0x10
mov dword [ebp - 0x54], 0x1010420
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
mov eax, 0x145
cmp ebx, edi
jne 0x105704b
mov dword [ebp - 0x48], 0x80070057
mov word [ebp - 0x42], ax
jmp 0x10570db
mov word [ebp - 0x44], ax
mov eax, 0x146
cmp esi, edi
je 0x105703b
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x48], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1057080
call fcn.0105d3b8
mov dword [ebp - 0x48], eax
mov eax, 0x148
jmp 0x1057042
mov eax, 0x148
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x54]
push eax
push 2
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x48], edi
push dword [ebp + 0xc]
call fcn.0105e644
mov dword [ebp - 0x48], eax
cmp eax, edi
mov eax, 0x14a
jl 0x1057042
push dword [ebp + 8]
mov word [ebp - 0x44], ax
push esi
push dword [ebp - 0x54]
lea eax, [ebp - 0x24]
push eax
push 0x100f1c4
push ebx
call fcn.01063c3a
add esp, 0x18
mov dword [ebp - 0x48], eax
cmp eax, edi
mov eax, 0x14c
jl 0x1057042
mov word [ebp - 0x44], ax
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x54]
call fcn.010635b3
lea ecx, [ebp - 0x48]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 0x14
Function at 0x1057c43
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push 2
push 0x57
push 0x100f368
lea ecx, [ebp - 0x38]
call fcn.01055826
xor esi, esi
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push 0xc
lea eax, [ebp - 0x14]
push eax
push 5
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntdll.dll_NtQueryKey]
mov ecx, eax
call fcn.0105d4af
cmp eax, esi
mov dword [ebp - 0x38], eax
push 0x5d
jge 0x1057c9c
pop ecx
mov word [ebp - 0x32], cx
jmp 0x1057cf4
pop eax
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 0xc], esi
je 0x1057cae
or eax, 2
jmp 0x1057cb1
and eax, 0xfffffffd
cmp dword [ebp + 0x10], esi
je 0x1057cbb
or eax, 4
jmp 0x1057cbe
and eax, 0xfffffffb
cmp dword [ebp + 0x14], esi
je 0x1057cc8
or eax, 8
jmp 0x1057ccb
and eax, 0xfffffff7
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSetInformationKey]
mov ecx, eax
call fcn.0105d4af
cmp eax, esi
push 0x7c
mov dword [ebp - 0x38], eax
pop ecx
jl 0x1057c96
mov word [ebp - 0x34], cx
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x1057ff3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push 2
push 0x14c
push 0x100f3d0
lea ecx, [ebp - 0x2c]
call fcn.01055826
mov ecx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp ecx, esi
je 0x1058021
mov dword [ecx], esi
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x105802a
mov dword [eax], esi
cmp dword [ebp + 0xc], esi
jne 0x1058044
mov eax, 0x156
mov dword [ebp - 0x2c], 0x80070057
mov word [ebp - 0x26], ax
jmp 0x105816c
mov edx, 0x156
mov word [ebp - 0x28], dx
cmp ecx, esi
jne 0x1058056
lea eax, [edx + 1]
jmp 0x1058034
mov ecx, 0x157
cmp eax, esi
mov word [ebp - 0x28], cx
lea eax, [ecx + 1]
je 0x1058034
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov word [ebp - 0x28], ax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x2c], esi
push dword [ebp + 8]
call ebx
cmp dword [ebp + 0x18], esi
je 0x10580a5
cmp eax, 2
jne 0x10580a5
mov eax, 0x15d
mov dword [ebp - 0x2c], 1
mov word [ebp - 0x28], ax
jmp 0x105816b
cmp eax, esi
jle 0x10580b3
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x2c], eax
cmp eax, esi
mov eax, 0x160
jge 0x10580cf
mov word [ebp - 0x26], ax
mov dword [ebp - 0x24], 1
jmp 0x105816b
push edi
push dword [ebp - 4]
mov word [ebp - 0x28], ax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov edi, eax
mov eax, 0x163
cmp edi, esi
jne 0x10580f5
mov dword [ebp - 0x2c], 0x8007000e
mov word [ebp - 0x26], ax
jmp 0x105815f
push dword [ebp - 4]
mov dword [ebp - 0x2c], esi
push esi
push edi
mov word [ebp - 0x28], ax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
cmp eax, esi
jle 0x1058129
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x2c], eax
cmp eax, esi
mov eax, 0x167
jl 0x10580ef
mov word [ebp - 0x28], ax
inc eax
cmp dword [ebp - 8], 3
je 0x1058149
mov dword [ebp - 0x2c], 0x80070057
jmp 0x10580ef
mov ecx, dword [ebp + 0x14]
mov word [ebp - 0x28], ax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], esi
xor edi, edi
mov dword [ecx], eax
cmp edi, esi
je 0x105816a
push edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
pop ebx
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 0x14
Function at 0x105941d
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 1
push 0x59
push 0x100f708
lea ecx, [ebp - 0x40]
call fcn.01055826
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
push 0x60
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0x1010420
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
pop eax
cmp esi, ebx
jne 0x105946f
mov dword [ebp - 0x40], 0x80070057
mov word [ebp - 0x3a], ax
jmp 0x10595cc
push dword [esi]
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x3c], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10594f9
test al, 0x10
je 0x1059496
push 0x68
mov dword [ebp - 0x40], ebx
pop eax
mov word [ebp - 0x3c], ax
jmp 0x10595cc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10594ef
call fcn.0105d3b8
push 0x72
mov dword [ebp - 0x40], eax
pop eax
mov word [ebp - 0x3a], ax
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x10595cc
test dword [eax + 0x1c], 0x2000000
je 0x10595cc
push dword [ebp - 0x40]
push dword [esi]
push 0x100f6ec
push 0x100f520
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101707f
jmp 0x10595cc
push 0x72
pop eax
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x3c], ax
push ebx
lea eax, [ebp - 4]
push eax
push 1
push 0x100f5a8
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x105951e
call fcn.0105d3b8
push 0x7d
mov dword [ebp - 0x40], eax
pop eax
jmp 0x1059466
push 0x7d
pop eax
push 0xc
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 4]
pop edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
push ecx
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10595a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1059557
xor eax, eax
cmp eax, ebx
jle 0x1059565
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
cmp ecx, ebx
mov dword [ebp - 0x40], ecx
mov eax, 0x8a
jge 0x105948d
mov word [ebp - 0x3a], ax
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x10595cc
test dword [eax + 0x1c], 0x2000000
je 0x10595cc
push ecx
push dword [esi]
push 0x100f6e4
push 0x100f520
push 0xb
jmp 0x10594df
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x10595cc
test dword [eax + 0x1c], 0x8000000
je 0x10595cc
push dword [esi]
push 0x100f520
push edi
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x1c]
call fcn.010635b3
lea ecx, [ebp - 0x40]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x1059786
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 1
push 0xd7
push 0x100f7a8
lea ecx, [ebp - 0x3c]
call fcn.01055826
mov eax, 0x1010420
mov dword [ebp - 0x18], eax
xor esi, esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.010595f6
mov dword [ebp - 0x3c], eax
cmp eax, esi
mov eax, 0xdb
jge 0x10597da
mov word [ebp - 0x36], ax
jmp 0x1059885
push 0x100f684
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x18]
push 0x100f7a0
push eax
call fcn.01063c3a
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp eax, esi
mov eax, 0xdc
jl 0x10597d1
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
mov word [ebp - 0x38], ax
call fcn.01064416
mov dword [ebp - 0x3c], eax
cmp eax, esi
mov eax, 0xdd
jl 0x10597d1
push 1
push dword [ebp - 0xc]
mov word [ebp - 0x38], ax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1059879
call fcn.0105d3b8
mov dword [ebp - 0x3c], eax
mov eax, 0xdf
mov word [ebp - 0x36], ax
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x1059885
test dword [eax + 0x1c], 0x2000000
je 0x1059885
push dword [ebp - 0x3c]
push dword [ebp - 0xc]
push dword [ebp + 8]
push 0x100f758
push 0x100f520
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059162
jmp 0x1059885
mov eax, 0xdf
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x38], ax
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xc]
call fcn.010635b3
lea ecx, [ebp - 0x18]
call fcn.010635b3
lea ecx, [ebp - 0x3c]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 4
Function at 0x10598ac
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 1
push 0xee
push 0x100f7bc
lea ecx, [ebp - 0x3c]
call fcn.01055826
mov eax, 0x1010420
mov dword [ebp - 0x18], eax
xor esi, esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.010596be
mov dword [ebp - 0x3c], eax
cmp eax, esi
mov eax, 0xf2
jge 0x1059900
mov word [ebp - 0x36], ax
jmp 0x10599ab
push 0x100f684
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x18]
push 0x100f7a0
push eax
call fcn.01063c3a
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp eax, esi
mov eax, 0xf3
jl 0x10598f7
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
mov word [ebp - 0x38], ax
call fcn.01064416
mov dword [ebp - 0x3c], eax
cmp eax, esi
mov eax, 0xf4
jl 0x10598f7
push 1
push dword [ebp - 0xc]
mov word [ebp - 0x38], ax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x105999f
call fcn.0105d3b8
mov dword [ebp - 0x3c], eax
mov eax, 0xf6
mov word [ebp - 0x36], ax
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x10599ab
test dword [eax + 0x1c], 0x2000000
je 0x10599ab
push dword [ebp - 0x3c]
push dword [ebp - 0xc]
push dword [ebp + 8]
push 0x100f758
push 0x100f520
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01059162
jmp 0x10599ab
mov eax, 0xf6
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x38], ax
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xc]
call fcn.010635b3
lea ecx, [ebp - 0x18]
call fcn.010635b3
lea ecx, [ebp - 0x3c]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 4