joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410eb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x410ec9
mov eax, dword [edi]
mov ebx, dword [ebp + 0x14]
lea ecx, [ebp + 0x18]
push ecx
push ebx
lea ecx, [ebp + 0xc]
push ecx
push 0xffff
push dword [ebp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, dword [ebp + 0x18]
mov esi, eax
mov ecx, dword [ebp + 0xc]
push 2
pop eax
cmp edx, eax
jae 0x410f00
cmp ecx, 1
je 0x410efe
cmp ecx, eax
jne 0x410f00
mov esi, eax
push esi
call fcn.00410bda
test eax, eax
je 0x410f17
push edi
mov ecx, 0x42c158
call fcn.00410aa7
jmp 0x410f4a
test esi, esi
jne 0x410f44
cmp ecx, 2
je 0x410f25
cmp ecx, 1
jne 0x410f31
shr edx, 1
xor eax, eax
mov word [ebx + edx*2 - 2], ax
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ebp + 0x1c]
push eax
push ecx
call fcn.00410d83
test eax, eax
push 2
pop eax
cmove esi, eax
push edi
call fcn.0041121f
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x410f69
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
or esi, 0xffffffff
test edi, edi
jne 0x410f8f
cmp dword [0x42c46c], edi
je 0x411080
push 2
pop esi
jmp 0x410fa8
cmp edi, 1
jne 0x411080
push ebx
call fcn.00410bb0
test al, al
je 0x411080
xor esi, esi
lea ecx, [ebp + 0xb]
mov dword [ebp - 0xc], esi
call fcn.00410008
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
push eax
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
or eax, esi
jmp 0x41102f
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x410fdd
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push esi
call fcn.00410bda
push dword [ebp - 4]
test eax, eax
je 0x411048
mov eax, dword [ebx + 0xc]
xor esi, esi
mov ecx, 0x42c158
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x42b290], esi
call fcn.00410aa7
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
mov dword [ebp - 4], esi
or eax, dword [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebx + 0xc]
call fcn.0041012d
mov esi, eax
test esi, esi
je 0x410fc9
jmp 0x411078
call fcn.0041121f
test esi, esi
jne 0x411078
movzx ecx, word [ebx + 0x10]
mov eax, ecx
and eax, 0xf
cmp dword [ebp - 0x10], eax
je 0x411095
cmp dword [ebp - 0x10], 3
jne 0x411075
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
jne 0x411075
and cl, 0xf
cmp cl, 4
je 0x411095
push 2
pop esi
lea ecx, [ebp + 0xb]
call fcn.00410041
inc edi
cmp edi, 2
jl 0x410f77
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp + 0xb]
mov dword [eax], 1
call fcn.00410041
xor eax, eax
jmp 0x41108c
Function at 0x401d12
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
cmp edi, 0xacc
jge 0x401d2c
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp edi, 0x45be411
jg 0x401d46
inc edi
cmp edi, 0x3330601
jl 0x401d1e
cmp dword [0x2078894], 0x400
jne 0x401d77
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
push esi
call fcn.004044c1
call fcn.00403f61
push esi
call fcn.0040473f
pop ecx
pop ecx
xor edi, edi
cmp edi, 0x16c76
jge 0x401d89
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5c52
jg 0x401daf
inc edi
cmp edi, 0x3003f
jl 0x401d79
mov eax, dword [0x42b8b4]
mov dword [0x2078894], eax
call fcn.00401a58
mov edi, 0x3078f
cmp dword [0x2078894], 0x51f
jne 0x401ddb
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec edi
jne 0x401dc3
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x402949
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x42471d
call fcn.00424598
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00403706
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.0040474e
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x402991
call fcn.004034ba
mov dword [ebx], eax
call fcn.00403279
mov ecx, eax
call fcn.004011a5
mov eax, ebx
jmp 0x402993
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
pop edi
mov dword [esi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x405299
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a364]
jne 0x4052a3
repz ret
jmp fcn.00409aec
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x63c600c8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x64d4199e
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10004187
Capabilities:
Check if file exists

Disassembly:
push ecx
push ebx
push dword [esp + 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100041b4
mov ebx, dword [esp + 0xc]
push dword [esp + 0x10]
add ebx, 0xe0
call fcn.10005966
push dword [esp + 0x14]
push eax
call fcn.100065fc
pop ebx
pop ecx
ret 0xc
Function at 0x100050a2
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x100741c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x408], ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x100050e8
cmp dword [eax + 0x18], 0x10
jb 0x100050d0
mov eax, dword [eax + 4]
jmp 0x100050d3
add eax, 4
push 0
push ecx
push eax
push dword [esi + 0x78]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x100050e8
xor al, al
jmp 0x10005149
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push 0
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [esi + 0x78]
call sub.WS2_32.dll_recv
test eax, eax
jle 0x10005142
mov byte [ebp + eax - 0x404], 0
test ebx, ebx
je 0x10005123
push ebx
lea eax, [ebp - 0x404]
push eax
call edi
test eax, eax
je 0x100050ef
cmp dword [ebp - 0x408], 0
je 0x10005146
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push eax
call edi
test eax, eax
setne al
jmp 0x10005148
xor al, al
jmp 0x10005148
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003edc1
leave
ret 4

Function at 0x10005157
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x38c]
sub esp, 0x40c
mov eax, dword [0x100741c0]
xor eax, ebp
mov dword [ebp + 0x388], eax
push ebx
mov ebx, ecx
push dword [ebx + 0x74]
call fcn.100048cc
pop ecx
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x100051f0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push 0
lea ecx, [ebp - 0x7c]
push ecx
mov edi, 0x400
push edi
lea ecx, [ebp - 0x78]
push ecx
push eax
jmp 0x100051c6
cmp dword [ebp - 0x7c], 0
jbe 0x100051cc
push 0
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
push dword [ebx + 0x78]
call sub.WS2_32.dll_send
push 0
lea eax, [ebp - 0x7c]
push eax
push edi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call esi
test eax, eax
jne 0x100051a1
pop edi
mov bl, 1
pop esi
lea eax, [ebp - 0x80]
call fcn.10002f69
mov ecx, dword [ebp + 0x388]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.1003edc1
add ebp, 0x38c
leave
ret
xor bl, bl
jmp 0x100051d0
Function at 0x1000534a
Capabilities:
Delete file

Disassembly:
push 0x214
mov eax, 0x1005db17
call fcn.100420aa
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
xor ebx, ebx
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.10045640
add esp, 0xc
push 1
lea ecx, [ebp - 0x21c]
call fcn.10025d76
lea eax, [ebp - 0x21c]
push eax
push dword [esi]
call fcn.1000426c
test al, al
jne 0x100053c0
lea eax, [ebp - 0x21c]
push eax
push str.write_eml_file_failed:_s
call fcn.10029b5d
pop ecx
pop ecx
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
call fcn.1004212d
ret
push 0x7c
call fcn.1003f630
pop ecx
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x100053f9
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [esi + 0x60]
push ecx
lea ecx, [esi + 0x44]
push ecx
lea ecx, [esi + 0x28]
push ecx
movzx ecx, word [esi + 0x24]
push ecx
lea ecx, [esi + 8]
push ecx
push eax
call fcn.100030c8
jmp 0x100053fb
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 4], eax
call fcn.100051f4
mov bl, al
jmp 0x100053ab
Function at 0x10006903
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x1005a6ec
call fcn.100420aa
mov ebx, ecx
cmp dword [ebx + 0x3c], 0
mov dword [ebp - 0x38], ebx
je 0x10006a18
cmp byte [ebx + 0x41], 0
je 0x10006a18
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x1000693b
xor al, al
jmp 0x10006a1a
push 0
push 8
pop edi
lea esi, [ebp - 0x30]
call fcn.100062ba
and dword [ebp - 4], 0
lea eax, [ebx + 0x44]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x30]
call fcn.10011f76
mov esi, eax
call fcn.10006d57
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
call fcn.10011f76
mov esi, eax
call fcn.10006d57
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x34]
push esi
mov esi, dword [ebp - 0x40]
add edi, esi
push edi
push eax
push dword [ebp - 0x3c]
call dword [edx + 0x18]
sub eax, 0
je 0x100069b0
dec eax
je 0x100069b4
dec eax
dec eax
je 0x10006a14
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10001e5b
mov al, bl
jmp 0x10006a1a
mov byte [ebx + 0x41], 0
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x30]
call fcn.10011f76
mov esi, eax
call fcn.10006d57
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x100069f2
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x30]
call fcn.10011f76
mov esi, eax
call fcn.10006d57
push dword [ebx + 0x4c]
push edi
push 1
push eax
call fcn.10040c72
add esp, 0x10
cmp edi, eax
jne 0x1000699e
cmp byte [ebx + 0x41], 0
je 0x10006a14
test edi, edi
jne 0x10006952
push edi
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.10001a79
mov ebx, dword [ebp - 0x38]
jmp 0x10006952
mov bl, 1
jmp 0x100069a0
mov al, 1
call fcn.1004212d
ret

Function at 0x10007aad
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1005982b
call fcn.10042074
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.1003f630
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x10007af7
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
jne 0x10007ae3
mov dword [esi + 0x10], edi
jmp 0x10007af9
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [ecx]
jne 0x10007aef
push esi
jmp 0x10007af0
push edi
call dword [eax]
mov dword [esi + 0x10], eax
jmp 0x10007af9
xor esi, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push 0x10007b39
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.10001b61
mov eax, edi
jmp 0x10007b33
call fcn.10042119
ret
Function at 0x10009dd5
Capabilities:
Resolve dns

Disassembly:
push 0x78
mov eax, 0x1005bb56
call fcn.100420aa
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x4f
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x68]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x6c], ebx
call fcn.10045640
add esp, 0xc
push 2
pop eax
mov word [ebp - 0x5f], ax
push ebx
mov eax, esi
mov dword [ebp - 0x1d], ebx
xor edi, edi
call fcn.10026409
push esi
test eax, eax
je 0x10009e1f
call sub.WS2_32.dll_inet_addr
mov esi, eax
jmp 0x10009e33
call sub.WS2_32.dll_gethostbyname
cmp eax, ebx
je 0x10009ed9
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
cmp dword [ebp - 0x70], ebx
je 0x10009e42
push dword [ebp - 0x70]
call sub.WS2_32.dll_inet_addr
mov edi, eax
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x3d], esi
mov dword [ebp - 0x2d], edi
call dword [sym.imp.nfapi.dll_enum__NF_STATUS___cdecl_nfapi::nf_addRule_struct_nfapi::_NF_RULE___int_]
pop ecx
pop ecx
mov eax, esi
mov ecx, esi
mov edx, 0xff0000
and eax, edx
shr ecx, 0x10
or eax, ecx
mov ebx, esi
mov ecx, 0xff00
and ebx, ecx
shl esi, 0x10
or ebx, esi
shr eax, 8
shl ebx, 8
or eax, ebx
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
test edi, edi
je 0x10009ea8
mov esi, edi
and esi, edx
mov edx, edi
shr edx, 0x10
or esi, edx
mov edx, edi
and edx, ecx
shl edi, 0x10
or edx, edi
shr esi, 8
shl edx, 8
or esi, edx
not esi
or esi, eax
mov dword [ebp - 0x74], esi
mov eax, dword [0x10077c68]
lea esi, [eax + 4]
push esi
mov edi, eax
mov dword [ebp - 0x70], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea eax, [ebp - 0x78]
push eax
lea eax, [edi + 0x3c]
lea ebx, [ebp - 0x84]
call fcn.1000ace9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1004212d
ret
Function at 0x1001f936
Capabilities:
Check if file exists
Delete file
Delete service
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100741c0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x1001f961
call fcn.10027e93
test eax, eax
jne 0x1001f961
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xf003f
push edi
push edi
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x21c], eax
cmp eax, edi
je 0x1001f9a2
push 0x10000
lea esi, [ebp - 0x21c]
call fcn.10027e4b
cmp dword [ebp - 0x21c], edi
je 0x1001f9a2
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
lea eax, [ebp - 0x21c]
call fcn.10027e73
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push edi
push eax
call fcn.10045640
add esp, 0xc
push 0x104
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.drivers_netfilter2.sys
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.100263ab
mov esi, eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001fa1f
push str.delete_netfilter_driver
call fcn.100298ca
pop ecx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.100263e2
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.1003edc1
leave
ret
Function at 0x10021e24
Capabilities:
Delete file

Disassembly:
push 0x10
mov eax, 0x1005b750
call fcn.10042041
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 3
cmp byte [ebx + 0x1d8], 0
je 0x10021e4f
push dword [ebx + 0x1d4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x3e4]
cmp eax, 0xffffffff
je 0x10021e6e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x1da]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebx]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
jmp 0x10021ea5
call fcn.10016265
cmp dword [eax + 0x34], 8
jb 0x10021e93
mov eax, dword [eax + 0x20]
jmp 0x10021e96
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x14]
call fcn.10006a20
lea edi, [ebp - 0x1c]
lea esi, [ebp - 0x14]
call fcn.1001a3e4
lea esi, [ebp - 0x14]
test al, al
je 0x10021e83
mov eax, dword [ebx + 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x10021ef8
lea esi, [ebp - 0x14]
call fcn.10016265
cmp dword [eax + 0x34], 8
jb 0x10021ee6
mov eax, dword [eax + 0x20]
jmp 0x10021ee9
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x14]
call fcn.10006a20
lea edi, [ebp - 0x1c]
call fcn.1001a3e4
test al, al
je 0x10021ed3
lea eax, [ebx + 0x404]
push eax
call fcn.1000ab3c
lea esi, [ebx + 0x60]
call fcn.10008ebf
lea eax, [ebx + 0x40]
push eax
mov byte [ebp - 4], 1
call fcn.1000a787
lea eax, [ebx + 0x20]
push eax
mov byte [ebp - 4], 0
call fcn.10015c9a
or dword [ebp - 4], 0xffffffff
push ebx
call fcn.10015c9a
call fcn.10042119
ret 4
Function at 0x10022632
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005eddd
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100741c0]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
mov eax, dword [0x100741c0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, edx
xor ebx, ebx
cmp dword [ebp + 0xc], 3
mov edi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
jne 0x100226e7
call fcn.10022a70
push ebx
push str.77u_cG9kbHACAAA
push esi
call fcn.100054df
neg eax
sbb eax, eax
inc eax
cmp dword [edi + 0x3e4], 0xffffffff
mov dword [edi + 0x3e8], eax
jne 0x10022799
lea esi, [edi + 0x1da]
push 1
mov ecx, esi
call fcn.10025d76
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x3e4], eax
cmp eax, 0xffffffff
jne 0x100226e7
push 0x100660b0
call fcn.100298ca
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x3e4]
cmp eax, 0xffffffff
je 0x100227e7
cmp dword [ebp + 0xc], 1
jne 0x100227a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [edi + 0x3e8], ebx
je 0x1002271a
lea esi, [edi + 0x1da]
call fcn.1003a28a
or dword [edi + 0x3e4], 0xffffffff
cmp dword [edi + 0x3e8], ebx
je 0x10022760
push dword [esp + 0x14]
lea ecx, [esp + 0x1c]
call fcn.10003019
pop ecx
push eax
push edi
mov dword [esp + 0x68], ebx
call fcn.10015bd1
lea ecx, [edi + 0x1da]
push ecx
push eax
call fcn.100065fc
or dword [esp + 0x60], 0xffffffff
push ebx
push 1
lea esi, [esp + 0x20]
call fcn.10006669
push dword [esp + 0x14]
lea ecx, [esp + 0x1c]
call fcn.10003019
pop ecx
push eax
xor esi, esi
lea eax, [edi + 0x20]
inc esi
push eax
mov dword [esp + 0x68], esi
call fcn.10015bd1
add edi, 0x1da
push edi
push eax
call fcn.100065fc
push ebx
push esi
lea esi, [esp + 0x20]
call fcn.10006669
jmp 0x100227e7
push 0x100660c8
call fcn.10029b5d
pop ecx
jmp 0x100227e7
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x14]
call fcn.1002a0c3
cmp dword [esp + 0x50], 0x10
mov eax, dword [esp + 0x3c]
pop ecx
jae 0x100227c4
lea eax, [esp + 0x38]
push ebx
lea ecx, [esp + 0x14]
push ecx
push dword [esp + 0x50]
push eax
push dword [edi + 0x3e4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push 1
lea ecx, [esp + 0x3c]
call fcn.10001e5b
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.1003edc1
mov esp, ebp
pop ebp
ret 8
Function at 0x1002591c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x100741c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
cmp edi, ebx
je 0x10025a16
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x10025a16
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.10045640
add esp, 0xc
lea esi, [ebp - 0x210]
mov ecx, edi
call fcn.10026264
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10025993
shr eax, 4
not eax
and eax, 1
jmp 0x10025a18
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [ebp - 0x418]
call fcn.10025a26
test eax, eax
je 0x10025a16
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x10000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x100259f8
mov dword [ebp - 0x41c], 1
cmp eax, 0xffffffff
jne 0x100259fe
mov dword [ebp - 0x41c], ebx
lea eax, [ebp - 0x420]
call fcn.10002f69
xor eax, eax
cmp byte [ebp - 0x41c], bl
setne al
jmp 0x10025a18
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003edc1
leave
ret
Function at 0x10025d76
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100741c0]
xor eax, ebp
mov dword [ebp - 8], eax
push edi
mov edi, ecx
test edi, edi
je 0x10025dec
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.10045640
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10025dec
push edi
push 0
push 0
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x10025dec
cmp byte [ebp + 8], 0
je 0x10025de7
call fcn.1002591c
jmp 0x10025dee
xor eax, eax
inc eax
jmp 0x10025dee
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop edi
call fcn.1003edc1
leave
ret 4