joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1021dec0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1021defb
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1021dee2
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1021def3
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1021defd
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1021ded8
xor eax, eax
pop edi
pop esi
ret

Function at 0x1021e130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1021de80
dec eax
or al, ch
in eax, dx
lea eax, [ebp - 0x58]
push eax
call fcn.1021de90
dec dword [ebx + 0x56500c75]
push dword [ebp + 8]
call fcn.1021de45
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1021e16e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
invalid
inc ebp

Function at 0x1021e270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov eax, dword [0xa245c62e]
xor eax, 0x24a345c6
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1021de90
push eax
push esi
push dword [ebp + 8]
call fcn.1021de45
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1021de90
push eax
push esi
push dword [ebp + 8]
call fcn.1021de45
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1021de80
sub ebx, dword [ecx + 0x7c9d88bd]
invalid

Function at 0x1021e680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
call fcn.1021de5e
inc ebx

Function at 0x1021e690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebx
clc
and byte [ebp - 0x354], 0
invalid
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
cld
invalid
invalid
Function at 0x1021edf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [eax]
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
test dword [esi + 0x21fffffc], ebx
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.1021de90
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1021de45
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.1021de80
loopne 0x1021eea8
out dx, al
adc byte [eax + 4], ch
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
jecxz 0x1021eeaa
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
invalid
inc ebp

Function at 0x10221a80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10221aab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10221ad8
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x10221ad6
mov edx, dword [ebp + 0xc]
and edx, 2
je 0x10221ad6
call sym.MSVCR71D.dll__errno
mov dword [eax], 0xd
call sym.MSVCR71D.dll___doserrno
mov dword [eax], 5
or eax, 0xffffffff
jmp 0x10221ad8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10221ae0
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1026a620
push sym.MSVCR71D.dll__except_handler3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffed4
mov eax, dword [0x1027c570]
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x12c], 0xffffffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x10221c8f
mov edx, dword [ebp - 0x1c]
push edx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x104
jle 0x10221c0a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x134]
add eax, 4
and eax, 0xfffffffc
call fcn.10201a90
mov dword [ebp - 0x13c], esp
mov dword [ebp - 0x18], esp
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x10221be7
cmp dword [ebp - 0x134], 0
je 0x10221c0a
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x134]
add eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x10221c8f
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx]
cmp edx, 0x5c
je 0x10221c29
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
cmp ecx, 0x2f
jne 0x10221c46
mov edx, dword [ebp - 0x1c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x1c]
movsx edx, byte [ecx + 1]
cmp eax, edx
jne 0x10221c46
mov dword [ebp - 0x12c], 0
jmp 0x10221c8f
mov byte [ebp - 0x130], 0x3d
mov eax, dword [ebp - 0x1c]
movzx ecx, byte [eax]
push ecx
call sym.MSVCR71D.dll__mbctoupper
add esp, 4
mov byte [ebp - 0x12f], al
mov byte [ebp - 0x12e], 0x3a
mov byte [ebp - 0x12d], 0
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x10221c8f
mov dword [ebp - 0x12c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
cmp dword [ebp - 0x138], 0
je 0x10221cb5
push 2
mov ecx, dword [ebp - 0x1c]
push ecx
call sym.MSVCR71D.dll__free_dbg
add esp, 8
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x148]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x20]
call fcn.1020cd80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10221ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1026a638
push sym.MSVCR71D.dll__except_handler3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffed8
mov eax, dword [0x1027c570]
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x128]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp - 0x134]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x104
jle 0x10221e0a
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x12c]
add eax, 4
and eax, 0xfffffffc
call fcn.10201a90
mov dword [ebp - 0x138], esp
mov dword [ebp - 0x18], esp
mov edx, dword [ebp - 0x138]
mov dword [ebp - 0x134], edx
mov dword [ebp - 4], 0xffffffff
jmp 0x10221de4
cmp dword [ebp - 0x12c], 0
je 0x10221e0a
mov ecx, dword [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x12c]
add edx, 1
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x12c], 0
je 0x10221e41
mov eax, dword [ebp - 0x134]
movzx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x10221e41
mov edx, dword [ebp - 0x134]
movzx eax, byte [edx]
push eax
call sym.MSVCR71D.dll_toupper
add esp, 4
sub eax, 0x40
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x130], 0
je 0x10221e5b
push 2
mov ecx, dword [ebp - 0x134]
push ecx
call sym.MSVCR71D.dll__free_dbg
add esp, 8
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x20]
call fcn.1020cd80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10221e80
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1026a648
push sym.MSVCR71D.dll__except_handler3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff0
push ebx
push esi
push edi
cmp dword [ebp + 8], 1
jl 0x10221eaf
cmp dword [ebp + 8], 0x1f
jle 0x10221eca
call sym.MSVCR71D.dll__errno
mov dword [eax], 0xd
call sym.MSVCR71D.dll___doserrno
mov dword [eax], 0xf
or eax, 0xffffffff
jmp 0x10221f36
push 7
call sym.MSVCR71D.dll__lock
add esp, 4
mov dword [ebp - 4], 0
movsx eax, byte [ebp + 8]
add eax, 0x40
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1f], 0x3a
mov byte [ebp - 0x1e], 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x10221f04
mov dword [ebp - 0x1c], 0
jmp 0x10221f1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
call fcn.10221f28
jmp 0x10221f33
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10221f50
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10221f7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10221fc2
mov ecx, dword [ebp + 0xc]
and ecx, 0x80
je 0x10221f91
mov edx, dword [ebp - 4]
and edx, 0xfffffffe
mov dword [ebp - 4], edx
jmp 0x10221f9a
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x10221fc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10221fc2
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x102221b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x1027c570]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x1022222e
mov eax, dword [ebp + 8]
push eax
call fcn.10222310
add esp, 4
test eax, eax
jne 0x102221f4
call sym.MSVCR71D.dll___doserrno
mov dword [eax], 0xf
call sym.MSVCR71D.dll__errno
mov dword [eax], 0xd
xor eax, eax
jmp 0x102222f5
mov ecx, dword [ebp + 8]
add ecx, 0x40
mov byte [ebp - 4], cl
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x118]
push eax
push 0x104
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov dword [ebp - 0x120], eax
jmp 0x10222246
lea edx, [ebp - 0x118]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x1022226a
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x104
jbe 0x10222271
xor eax, eax
jmp 0x102222f5
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jne 0x102222c8
mov edx, dword [ebp - 0x120]
cmp edx, dword [ebp + 0x10]
jle 0x10222296
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
jmp 0x1022229f
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
push edx
call sym.MSVCR71D.dll_malloc
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x102222c6
call sym.MSVCR71D.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x102222f5
jmp 0x102222e2
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp + 0x10]
jle 0x102222e2
call sym.MSVCR71D.dll__errno
mov dword [eax], 0x22
xor eax, eax
jmp 0x102222f5
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 8]
push edx
call sym.MSVCR71D.dll__mbscpy
add esp, 8
mov ecx, dword [ebp - 0xc]
call fcn.1020cd80
mov esp, ebp
pop ebp
ret
Function at 0x10222370
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1022238f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10222396
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x102223ad
mov ecx, dword [ebp - 4]
push ecx
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x102223af
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x102223c0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x102223dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x102223e4
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x102223fb
mov ecx, dword [ebp - 4]
push ecx
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x102223fd
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10223560
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1022357d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10223584
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x1022359b
mov ecx, dword [ebp - 4]
push ecx
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x1022359d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x102235d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x102235fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10223628
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x10223626
mov edx, dword [ebp + 0xc]
and edx, 2
je 0x10223626
call sym.MSVCR71D.dll__errno
mov dword [eax], 0xd
call sym.MSVCR71D.dll___doserrno
mov dword [eax], 5
or eax, 0xffffffff
jmp 0x10223628
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10223630
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1026a6d0
push sym.MSVCR71D.dll__except_handler3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffdc8
mov eax, dword [0x1027c570]
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x230]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x234], 0xffffffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x102237ef
mov edx, dword [ebp - 0x1c]
push edx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x104
jle 0x1022375f
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x240]
lea eax, [eax + eax + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.10201a90
mov dword [ebp - 0x248], esp
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp - 0x248]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x1022373c
cmp dword [ebp - 0x240], 0
je 0x1022375f
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x240]
add edx, 1
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x102237ef
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x10223782
mov edx, dword [ebp - 0x1c]
movzx eax, word [edx]
cmp eax, 0x2f
jne 0x1022379f
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + 2]
cmp edx, ecx
jne 0x1022379f
mov dword [ebp - 0x234], 0
jmp 0x102237ef
mov word [ebp - 0x23c], 0x3d
mov edx, dword [ebp - 0x1c]
mov ax, word [edx]
push eax
call sym.MSVCR71D.dll_towupper
add esp, 4
mov word [ebp - 0x23a], ax
mov word [ebp - 0x238], 0x3a
mov word [ebp - 0x236], 0
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
je 0x102237ef
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
cmp dword [ebp - 0x244], 0
je 0x10223815
push 2
mov eax, dword [ebp - 0x1c]
push eax
call sym.MSVCR71D.dll__free_dbg
add esp, 8
mov eax, dword [ebp - 0x234]
lea esp, [ebp - 0x254]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x20]
call fcn.1020cd80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10223840
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1022386b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x102238b2
mov ecx, dword [ebp + 0xc]
and ecx, 0x80
je 0x10223881
mov edx, dword [ebp - 4]
and edx, 0xfffffffe
mov dword [ebp - 4], edx
jmp 0x1022388a
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x102238b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x102238b2
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10223aa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1027c570]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x10223b25
mov eax, dword [ebp + 8]
push eax
call fcn.10222310
add esp, 4
test eax, eax
jne 0x10223ae4
call sym.MSVCR71D.dll___doserrno
mov dword [eax], 0xf
call sym.MSVCR71D.dll__errno
mov dword [eax], 0xd
xor eax, eax
jmp 0x10223bee
mov ecx, dword [ebp + 8]
add ecx, 0x40
mov word [ebp - 0xc], cx
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], 0x2e
mov word [ebp - 6], 0
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 0x220], eax
jmp 0x10223b3d
lea edx, [ebp - 0x218]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x10223b61
mov eax, dword [ebp - 0x220]
add eax, 1
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x104
jbe 0x10223b68
xor eax, eax
jmp 0x10223bee
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x10223bc1
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0x10]
jle 0x10223b8d
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
jmp 0x10223b96
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x224], ecx
mov edx, dword [ebp - 0x224]
shl edx, 1
push edx
call sym.MSVCR71D.dll_malloc
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10223bbf
call sym.MSVCR71D.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x10223bee
jmp 0x10223bdb
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp + 0x10]
jle 0x10223bdb
call sym.MSVCR71D.dll__errno
mov dword [eax], 0x22
xor eax, eax
jmp 0x10223bee
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call sym.MSVCR71D.dll_wcscpy
add esp, 8
mov ecx, dword [ebp - 4]
call fcn.1020cd80
mov esp, ebp
pop ebp
ret
Function at 0x10223c00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10223c1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10223c26
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10223c3d
mov ecx, dword [ebp - 4]
push ecx
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10223c3f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10223c50
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10223c6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10223c74
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10223c8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10223c8d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10223cc0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x10223ce1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10223ce8
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10223cff
mov edx, dword [ebp - 4]
push edx
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10223d01
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10223d10
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x10223d2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10223d34
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10223d4b
mov ecx, dword [ebp - 4]
push ecx
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10223d4d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10224ec0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x10224ee1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10224ee8
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x10224eff
mov edx, dword [ebp - 4]
push edx
call fcn.102048f0
add esp, 4
or eax, 0xffffffff
jmp 0x10224f01
xor eax, eax
mov esp, ebp
pop ebp
ret