joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007658
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100da4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x103
lea eax, [ebp - 0x107]
xor ebx, ebx
mov esi, ecx
push edi
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.10090560
add esp, 0xc
lea eax, [ebp - 0x108]
push 1
push 0x23
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push edi
lea eax, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
push ebx
push eax
call fcn.10090560
lea eax, [ebp - 0x108]
push eax
push 0x100bc8a0
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1008bac3
lea eax, [ebp - 0x20c]
push eax
call fcn.10006fa1
add esp, 0x24
lea ecx, [esi + 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10006f28
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008a221
mov esp, ebp
pop ebp
ret

Function at 0x1000770f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
cmp dword [ecx + 0x14], 0x10
jb 0x1000771d
mov ecx, dword [ecx]
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x14], 0x10
jb 0x10007728
mov eax, dword [eax]
push esi
push ecx
push 0x400
mov esi, 0x100e0b30
push esi
push eax
push 0x100cb86c
push 0x100cb87c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call fcn.10006fa1
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
push esi
call fcn.10006f28
xor eax, eax
inc eax
pop esi
pop ebp
ret 0x10
Function at 0x1000b2cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], 1
mov esi, ecx
mov dword [ebp - 0xc], edi
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
movsd qword [ebp - 0x20], xmm0
jmp 0x1000b2f1
inc esi
movsx eax, byte [esi]
push eax
call fcn.1008bfe8
pop ecx
test eax, eax
jne 0x1000b2f0
mov al, byte [esi]
cmp al, 0x2d
jne 0x1000b30b
or dword [ebp - 0x10], 0xffffffff
jmp 0x1000b338
cmp al, 0x2b
jne 0x1000b339
jmp 0x1000b338
movsx eax, byte [esi]
movsd xmm1, qword [ebp - 0x20]
sub eax, 0x30
mulsd xmm1, qword [0x100cd518]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
movaps xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
inc esi
movzx eax, byte [esi]
push eax
call fcn.1008bf92
pop ecx
test eax, eax
jne 0x1000b311
cmp byte [esi], 0x2e
movsd xmm0, qword [0x100cd4f8]
movsd qword [ebp - 0x28], xmm0
jne 0x1000b3b7
movsd qword [ebp - 8], xmm0
jmp 0x1000b399
movsx eax, byte [esi]
movsd xmm1, qword [ebp - 0x20]
sub eax, 0x30
mulsd xmm1, qword [0x100cd518]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm1
movaps xmm1, xmm0
movsd xmm0, qword [ebp - 8]
mulsd xmm0, qword [0x100cd518]
movsd qword [ebp - 0x20], xmm1
movsd qword [ebp - 8], xmm0
inc esi
movzx eax, byte [esi]
push eax
call fcn.1008bf92
pop ecx
test eax, eax
jne 0x1000b360
movsd xmm0, qword [ebp - 0x20]
divsd xmm0, qword [ebp - 8]
movsd qword [ebp - 0x20], xmm0
mov al, byte [esi]
cmp al, 0x65
je 0x1000b3c5
cmp al, 0x45
jne 0x1000b4a7
xor edi, edi
mov dword [ebp - 4], 1
inc esi
mov al, byte [esi]
cmp al, 0x2d
jne 0x1000b3db
or dword [ebp - 4], 0xffffffff
jmp 0x1000b3df
cmp al, 0x2b
jne 0x1000b3e0
inc esi
movzx eax, byte [esi]
push eax
call fcn.1008bf92
pop ecx
test eax, eax
je 0x1000b486
imul ecx, edi, 0xa
movsx edi, byte [esi]
add ecx, 0xffffffd0
add edi, ecx
inc esi
movzx eax, byte [esi]
push eax
call fcn.1008bf92
pop ecx
test eax, eax
jne 0x1000b3f2
movsd xmm0, qword [0x100cd4f8]
cmp edi, 0x40
jl 0x1000b433
mov ecx, edi
shr ecx, 6
imul eax, ecx, 0xffffffc0
add edi, eax
mulsd xmm0, qword [0x100cd618]
dec ecx
jne 0x1000b423
movsd qword [ebp - 0x28], xmm0
cmp edi, 0x10
jl 0x1000b452
mov ecx, edi
shr ecx, 4
imul eax, ecx, 0xfffffff0
add edi, eax
mulsd xmm0, qword [0x100cd600]
dec ecx
jne 0x1000b442
movsd qword [ebp - 0x28], xmm0
cmp edi, 4
jl 0x1000b471
mov ecx, edi
shr ecx, 2
imul eax, ecx, 0xfffffffc
add edi, eax
mulsd xmm0, qword [0x100cd588]
dec ecx
jne 0x1000b461
movsd qword [ebp - 0x28], xmm0
cmp edi, 1
jl 0x1000b486
mulsd xmm0, qword [0x100cd518]
dec edi
jne 0x1000b476
movsd qword [ebp - 0x28], xmm0
cmp dword [ebp - 4], 0
mov edi, dword [ebp - 0xc]
jge 0x1000b49b
movsd xmm0, qword [ebp - 0x20]
divsd xmm0, qword [ebp - 0x28]
jmp 0x1000b4ac
movsd xmm0, qword [ebp - 0x28]
mulsd xmm0, qword [ebp - 0x20]
jmp 0x1000b4ac
movsd xmm0, qword [ebp - 0x20]
cmp dword [ebp - 0x10], 0
jge 0x1000b4ba
xorpd xmm0, xmmword [0x100cd6b0]
sub esi, dword [ebp - 0x14]
movsd qword [edi], xmm0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000c009
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebx
push esi
xor ebx, ebx
call fcn.1000bfcd
mov esi, eax
test esi, esi
jne 0x1000c01d
push 7
pop eax
jmp 0x1000c090
push edi
call fcn.1000bdea
push esi
test eax, eax
je 0x1000c072
jmp 0x1000c047
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1000c07e
mov eax, ebx
inc ebx
cmp eax, 3
jge 0x1000c07e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test edi, edi
je 0x1000c02a
jmp 0x1000c07e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000c07e
mov eax, ebx
inc ebx
cmp eax, 3
jge 0x1000c07e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
test edi, edi
je 0x1000c055
push esi
call fcn.1000af1e
pop ecx
push 0xa
xor ecx, ecx
test edi, edi
pop eax
cmovne eax, ecx
pop edi
pop esi
pop ebx
ret

Function at 0x1000c093
Capabilities:
Get file attributes

Disassembly:
push esi
call fcn.1000bfcd
mov esi, eax
test esi, esi
jne 0x1000c0a4
push 7
pop eax
pop esi
ret
push ebx
call fcn.1000bdea
push esi
test eax, eax
je 0x1000c0b7
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1000c0bd
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
push esi
setne bl
call fcn.1000af1e
pop ecx
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x1000c2eb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x100da4b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100de8c0]
push ebx
push esi
push edi
mov edi, ecx
test eax, eax
je 0x1000c327
push pe_nt_image_headers32
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.1008c350
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x1000c39e
call fcn.1000bdea
mov esi, pe_nt_image_headers32
test eax, eax
je 0x1000c368
lea eax, [ebp - 0x3a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x3a8]
call fcn.1000be9c
mov ebx, eax
test ebx, ebx
jne 0x1000c383
push 7
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008a221
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x274]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x274]
call fcn.1000bf55
jmp 0x1000c34e
push esi
lea eax, [ebp - 0x13c]
push ebx
push eax
call fcn.1008c350
push ebx
mov byte [ebp - 0x24], 0
call fcn.1000af1e
add esp, 0x10
lea ecx, [ebp - 0x13c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c3a7
sub ecx, edx
test ecx, ecx
jle 0x1000c3c6
lea eax, [ebp - 0x13c]
cmp byte [eax + ecx - 1], 0x5c
jne 0x1000c3c6
dec ecx
test ecx, ecx
jg 0x1000c3ba
cmp ecx, 0x136
jae 0x1000c432
mov byte [ebp + ecx - 0x13c], 0
lea eax, [ebp - 0x13c]
push eax
push 0x100bcc0c
push edi
call fcn.1008bae2
mov esi, edi
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000c3f0
sub esi, ecx
push 0xf
pop ecx
lea edx, [edi + esi]
call fcn.1000a6d6
push 0xf
pop ecx
movzx eax, byte [edi + esi]
xor edx, edx
push 0x3e
pop ebx
div ebx
mov al, byte [edx + 0x100c2be0]
mov byte [edi + esi], al
inc esi
dec ecx
jne 0x1000c407
mov byte [edi + esi], cl
mov ecx, edi
call fcn.1000c093
test eax, eax
jne 0x1000c3d6
jmp 0x1000c357
call fcn.1008c5ac
int3

Function at 0x1000c679
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x1000c684
xor eax, eax
pop esi
ret
call fcn.1000bdea
test eax, eax
jne 0x1000c6a3
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000c692
sub ecx, edx
cmp ecx, 0x104
ja 0x1000c680
mov ecx, esi
call fcn.1000bfcd
mov esi, eax
test esi, esi
jne 0x1000c6b5
push 7
pop eax
pop esi
ret
push ebx
call fcn.1000bdea
push esi
test eax, eax
je 0x1000c6c8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1000c6ce
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
mov ebx, eax
call fcn.1000af1e
pop ecx
cmp ebx, 0xffffffff
jne 0x1000c6e0
xor eax, eax
jmp 0x1000c6e9
movsx eax, bl
and eax, 0x10
shr eax, 4
pop ebx
pop esi
ret
Function at 0x1001caf1
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, ecx
test edi, edi
jne 0x1001cafc
xor eax, eax
pop edi
ret
push esi
push 0x44
pop ecx
call fcn.1000aed0
mov esi, eax
test esi, esi
je 0x1001cba5
mov al, byte [edi + 5]
mov byte [esi + 5], al
mov ecx, dword [edi]
call fcn.1001c894
mov dword [esi], eax
mov ecx, dword [edi + 0xc]
call fcn.1001c95d
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
call fcn.1001c7cf
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
call fcn.1001c894
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 0x18]
call fcn.1001c7cf
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
call fcn.1001c894
mov dword [esi + 0x1c], eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov ecx, dword [edi + 0x20]
call fcn.1001caf1
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x28]
call fcn.1001c7cf
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
call fcn.1001c7cf
or ecx, 0xffffffff
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov al, byte [edi + 6]
mov byte [esi + 6], al
mov al, byte [edi + 7]
mov byte [esi + 7], al
xor eax, eax
mov word [esi + 8], ax
mov dword [esi + 0x24], eax
mov eax, esi
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
pop esi
pop edi
ret
Function at 0x10035afe
Capabilities:
Get file attributes

Disassembly:
push 0x160
mov eax, 0x100acb2c
call fcn.10091010
mov eax, dword [ebp + 8]
push 0x100c9278
push ecx
mov dword [ebp - 0x16c], eax
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
and dword [ebp - 0x168], 0
lea eax, [ebp - 0x168]
pop ecx
pop ecx
push eax
push eax
push 0x100c9298
mov esi, 0x100c92a4
push esi
call fcn.10041280
mov ecx, eax
call fcn.100412d7
call fcn.10045657
push dword [ebp - 0x168]
push 0x100c92b0
push eax
call fcn.100448e6
add esp, 0xc
mov byte [ebp - 0x11c], 0
lea eax, [ebp - 0x11b]
push 0x103
push 0
push eax
call fcn.10090560
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x13c], ecx
mov byte [ebp - 0x14c], cl
push 0xf
pop eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], ecx
mov byte [ebp - 0x134], cl
mov edi, ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x168], edi
jle 0x10035ce5
push edi
push 0x100c92e8
lea eax, [ebp - 0x11c]
push 0x104
push eax
call fcn.100360ff
add esp, 0x10
lea ecx, [ebp - 0x164]
push 0x100bc7cc
call fcn.10006fbe
lea eax, [ebp - 0x164]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.10041280
mov ecx, eax
call fcn.100414ad
push 0
push 1
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 1
call fcn.100072c0
push edi
push 0x100c92f4
lea eax, [ebp - 0x11c]
push 0x104
push eax
call fcn.100360ff
add esp, 0x10
lea ecx, [ebp - 0x164]
push 0x100bc7cc
call fcn.10006fbe
lea eax, [ebp - 0x164]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.10041280
mov ecx, eax
call fcn.100414ad
push 0
push 1
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 1
call fcn.100072c0
cmp dword [ebp - 0x13c], 0
je 0x10035cd8
cmp dword [ebp - 0x124], 0
je 0x10035cd8
cmp dword [ebp - 0x120], 0x10
lea eax, [ebp - 0x134]
cmovae eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp - 0x16c]
lea esi, [eax + 1]
neg esi
lea eax, [ebp - 0x14c]
push eax
sbb esi, esi
inc esi
call fcn.1003607f
mov dword [eax], esi
mov esi, 0x100c92a4
inc edi
cmp edi, dword [ebp - 0x168]
jl 0x10035bc4
push 0x100c9300
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x134]
call fcn.100072c0
push 0
push 1
lea ecx, [ebp - 0x14c]
call fcn.100072c0
call fcn.10090fbf
ret 4
Function at 0x10035d1f
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x100da4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0x18], ebx
je 0x10035de8
push 0x124
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], ebx
push ebx
push eax
call fcn.10090560
add esp, 0xc
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10035de8
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x10035ddd
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call fcn.1008ccd5
mov edi, eax
lea eax, [ebp - 0x10c]
push eax
call fcn.1008ccd5
pop ecx
pop ecx
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10035dc6
test cl, cl
je 0x10035dc2
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10035dc6
add eax, 2
add edi, 2
test cl, cl
jne 0x10035da6
mov eax, ebx
jmp 0x10035dcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x10035e09
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10035d85
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp + 8]
call fcn.100072c0
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008a221
mov esp, ebp
pop ebp
ret 0x18
mov bl, 1
jmp 0x10035de8

Function at 0x10035e0d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, 0x100bc7cc
push esi
call fcn.10006fa1
pop ecx
mov ecx, dword [ebp + 0x14]
push eax
push esi
call fcn.10006f28
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 1
mov byte [ebp - 1], bl
cmp dword [eax + 0x14], 0x10
jb 0x10035e45
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10035ef1
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x14], 0x10
jb 0x10035e6e
mov eax, dword [esi]
jmp 0x10035e70
mov eax, esi
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 1]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0xea
jne 0x10035eec
mov eax, dword [ebp - 8]
inc eax
push edi
push eax
call fcn.10075c0e
cmp dword [esi + 0x14], 0x10
mov edi, eax
pop ecx
jb 0x10035eaa
mov esi, dword [esi]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 8]
push edi
mov byte [edi + eax], 0
call fcn.10006fa1
pop ecx
mov ecx, dword [ebp + 0x14]
push eax
push edi
call fcn.10006f28
push edi
call fcn.1008a91f
pop ecx
push dword [ebp - 0xc]
call ebx
pop edi
test eax, eax
jne 0x10035eec
mov al, 1
jmp 0x10035ef3
push dword [ebp - 0xc]
call ebx
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10035fc0
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100da4b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x107]
push edi
mov edi, dword [ebp + 0xc]
push 0x103
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.10090560
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
push eax
push 0
push 0x100bc444
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1003606d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1003606d
lea eax, [ebp - 0x108]
push eax
call fcn.10006fa1
pop ecx
push eax
lea eax, [ebp - 0x108]
mov ecx, edi
push eax
call fcn.10006f28
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1008a221
mov esp, ebp
pop ebp
ret 8

Function at 0x10036dd0
Capabilities:
Enumerate processes

Disassembly:
push 0x1d8
mov eax, 0x100acd3c
call fcn.10091010
mov ebx, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x1e4], eax
call fcn.10047b84
and dword [ebp - 4], 0
call fcn.1004869f
push 0
push 2
mov dword [ebp - 0x7c], eax
or edi, 0xffffffff
mov dword [ebp - 0x1e0], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, edi
jne 0x10036e22
or edi, edi
jmp 0x10036e4c
lea eax, [ebp - 0x1e0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
jmp 0x10036e41
lea eax, [ebp - 0x1e0]
inc edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10036e32
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x78], edi
push eax
call fcn.10035afe
lea eax, [ebp - 0x74]
push eax
call fcn.100486d4
push 0x100db734
lea ecx, [ebp - 0x28]
call fcn.10006ec7
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push eax
push 0x100c9354
push 0x100c92a4
call fcn.10041280
mov ecx, eax
call fcn.100414ad
push 0xffffffffffffffff
xor esi, esi
lea eax, [ebp - 0x28]
push esi
push eax
lea ecx, [ebp - 0xb4]
call fcn.1000721f
lea ecx, [ebp - 0xb8]
call fcn.100475cf
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xb8]
call fcn.10047ac3
push eax
lea ecx, [ebx + 0x40]
call fcn.10003002
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.100072c0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xb8]
call fcn.10047ae0
mov ecx, dword [ebp - 0x1e4]
push eax
call fcn.10003002
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.100072c0
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.100072c0
lea ecx, [ebp - 0xb8]
call fcn.10047c38
call fcn.10090fbf
ret 4
Function at 0x1003ec2b
Capabilities:
Delete file

Disassembly:
push 0x64
mov eax, 0x100ada54
call fcn.10091010
mov esi, ecx
push 0x100bc7cc
lea ecx, [ebp - 0x40]
call fcn.10006fbe
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 4]
cmp dword [eax + 0x64], ebx
je 0x1003edbd
push 0x100bc52c
lea ecx, [ebp - 0x58]
call fcn.10006fbe
push 0x100bc540
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10006fbe
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x80000001
call fcn.10035e0d
mov bl, al
lea ecx, [ebp - 0x28]
push 0
neg bl
push 1
sbb bl, bl
call fcn.100072c0
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.100072c0
inc bl
je 0x1003ecdb
push 0x238
push 0x100ca234
push 0x100ca25c
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
add esp, 0x10
xor ebx, ebx
jmp 0x1003eddc
push 0x100ca29c
lea ecx, [ebp - 0x70]
call fcn.10006fbe
push 0x100ca280
push eax
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
call fcn.10005021
add esp, 0xc
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 4
push ebx
push eax
lea ecx, [ebp - 0x40]
call fcn.10006abd
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.100072c0
push ebx
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], bl
call fcn.100072c0
push 0x242
mov edi, 0x100ca234
push edi
push 0x100ca2a4
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
add esp, 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.10035fc0
cmp dword [ebp - 0x18], ebx
jne 0x1003ed9c
push 0x247
push edi
push 0x100ca2b4
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.100072c0
jmp 0x1003eddc
push 1
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.1003d2dd
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1003ed8f
push 0x253
push 0x100ca234
push 0x100ca2e8
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.100072c0
call fcn.10090fbf
ret
Function at 0x1003eded
Capabilities:
Delete file

Disassembly:
push 0x54
mov eax, 0x100ada99
call fcn.10091010
mov esi, ecx
push 0x100bc7cc
lea ecx, [ebp - 0x44]
call fcn.10006fbe
and dword [ebp - 4], 0
mov eax, dword [esi + 4]
cmp dword [eax + 0x70], 0
je 0x1003ef5b
push 0x100bc52c
lea ecx, [ebp - 0x5c]
call fcn.10006fbe
push 0x100ca308
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.10006fbe
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x80000001
call fcn.10035e0d
mov bl, al
lea ecx, [ebp - 0x2c]
push 0
neg bl
push 1
sbb bl, bl
call fcn.100072c0
push 0
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.100072c0
inc bl
je 0x1003ee8b
push 0x263
push 0x100ca324
push 0x100ca34c
jmp 0x1003ef6a
mov edi, 0x100ca378
push edi
call fcn.10006fa1
pop ecx
push eax
push edi
lea ecx, [ebp - 0x44]
call fcn.10006a1b
sub esp, 0x18
mov ecx, esp
push 0x100ca3a4
call fcn.10006fbe
call fcn.10035d1f
test al, al
je 0x1003ef2d
push 0x26c
push 0x100ca324
push 0x100ca3b4
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
and dword [ebp - 0x1c], 0
add esp, 0x10
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x30], 0x10
lea eax, [ebp - 0x44]
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
call fcn.10035fc0
push 2
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.1003d2dd
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100072c0
jmp 0x1003ef7a
push 0x275
push 0x100ca324
push 0x100ca3d0
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
add esp, 0x10
lea eax, [ebp - 0x44]
mov ecx, esi
push 2
push eax
call fcn.1003d2dd
jmp 0x1003ef7a
push 0x27b
push 0x100ca324
push 0x100ca3e4
push ecx
call fcn.10045657
pop ecx
push eax
call fcn.100448e6
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.100072c0
call fcn.10090fbf
ret