joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c7d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1018f178
push eax
mov eax, dword [0x101fdfb0]
mov dword fs:[0], esp
sub esp, 0x28
test eax, eax
je 0x1004c7f9
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1004c860
lea ecx, [esp + 4]
mov dword [0x101fdfb0], 1
call fcn.1005c240
push ecx
mov dword [esp + 0x34], 0
mov ecx, esp
mov dword [esp + 4], esp
push str.safe_compress_force
call fcn.10076d80
lea ecx, [esp + 8]
call fcn.1005c430
cmp dword [esp + 0x24], 0xf0000001
jne 0x1004c84f
lea ecx, [esp + 4]
call fcn.1005c8b0
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [0x101fdfac], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x30], 0xffffffff
call fcn.1005c390
mov eax, dword [0x101fdfac]
lea edx, [esp + 0x38]
neg eax
sbb eax, eax
push edx
and eax, 4
mov dword [esp + 0x3c], 0
add eax, 2
push eax
call fcn.1004c190
mov ecx, dword [esp + 0x30]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x3c
ret

Function at 0x1004dfc0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1004dfd1
mov eax, 1
pop esi
ret
push str.DtSSLFrame32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x24], eax
jne 0x1004dfe5
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Initialize
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x24]
push str.Finalize
push eax
call edi
mov ecx, dword [esi + 0x24]
push str.SetHostBlockList
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x24]
push str.RegisterCallback
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x24]
push str.UnregisterCallback
push eax
call edi
mov ecx, dword [esi + 0x24]
push str.SendDataFromMemory
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x24]
push str.SendDataFromFileW
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x24]
push str.CloseSSLLinkFromID
push eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x20], eax
test ecx, ecx
pop edi
jne 0x1004e09a
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x1004e09a
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1004e09a
mov ecx, dword [esi + 0x10]
test ecx, ecx
jne 0x1004e09a
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x1004e09a
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x1004e09a
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x1004e09a
test eax, eax
jne 0x1004e09a
mov ecx, esi
call fcn.1004e0b0
xor eax, eax
pop esi
ret
mov eax, 1
mov dword [esi + 0x28], eax
pop esi
ret
Function at 0x10050210
Capabilities:
Get session user name

Disassembly:
sub esp, 0xcc
xor eax, eax
push ebx
mov ebx, dword [esp + 0xd8]
push ebp
mov ebp, dword [esp + 0xd8]
lea ecx, [ebx + ebx]
push esi
mov edx, ecx
push edi
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.1008d710
test eax, eax
je 0x100502d6
push 0x41
push 0
push 1
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov esi, eax
test esi, esi
jne 0x1005026c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push 0x10050370
push esi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea ecx, [esp + 0x14]
push ecx
call fcn.1005f906
add esp, 4
cmp eax, ebx
jb 0x100502b8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xcc
ret
lea edx, [esp + 0x14]
push edx
push ebp
call fcn.1005fecd
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x18], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov esi, eax
test esi, esi
je 0x10050346
lea edx, [esp + 0x14]
push edx
call fcn.1005f906
add esp, 4
cmp eax, ebx
jb 0x10050328
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xcc
ret
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.1005fecd
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x10050358
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret

Function at 0x100507b0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x20c
test edx, edx
push ebp
push edi
je 0x1005086a
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x1005086a
mov ebp, dword [esp + 0x220]
test ebp, ebp
je 0x1005086a
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push edx
call fcn.1005be40
lea ecx, [esp + 0x1c]
push ecx
call fcn.1005f906
add esp, 0x14
test eax, eax
je 0x1005086a
xor edi, edi
push esi
push edi
push edi
push 2
push edi
push edi
lea edx, [esp + 0x24]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1005085e
mov ecx, dword [esp + 0x220]
lea eax, [esp + 0xc]
push edi
push eax
push ebp
push ecx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop esi
pop edi
pop ebp
add esp, 0x20c
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x20c
ret
Function at 0x100518a0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
sub esp, 0x664
push ebp
push esi
mov esi, dword [esp + 0x670]
xor ebp, ebp
cmp esi, ebp
je 0x10051a78
push esi
call fcn.1005f906
add esp, 4
test eax, eax
je 0x10051a78
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x18]
push ebp
push eax
push esi
mov dword [esp + 0x24], ebp
call fcn.1004ec20
add esp, 0x1c
test eax, eax
je 0x10051a78
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x10051a78
test al, 1
je 0x1005190c
and al, 0xfe
push eax
push esi
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [esp + 8]
test al, 0x10
je 0x10051a51
push ebx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46e]
mov word [esp + 0x46c], bp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x46c]
push esi
push ecx
stosw word es:[edi], ax
call fcn.1005fecd
lea edx, [esp + 0x474]
push 0x101c0f3c
push edx
call fcn.1005fea3
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x230]
mov dword [esp + 0x22c], ebp
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x21c]
lea ecx, [esp + 0x46c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10051a28
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea edx, [esp + 0x248]
push 0x101c7418
push edx
call ebp
test eax, eax
je 0x10051a08
lea eax, [esp + 0x248]
push 0x101c7420
push eax
call ebp
test eax, eax
je 0x10051a08
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push esi
push ecx
stosw word es:[edi], ax
call fcn.1005fecd
lea edx, [esp + 0x1c]
push 0x101c0f44
push edx
call fcn.1005fea3
lea eax, [esp + 0x258]
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.1005fea3
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.100518a0
add esp, 0x20
lea eax, [esp + 0x21c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10051991
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebp, ebp
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
cmp eax, ebp
pop ebx
jne 0x10051a7a
cmp dword [esp + 0x674], ebp
je 0x10051a7a
push 4
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
pop ebp
add esp, 0x664
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, ebp
jne 0x10051a7a
cmp dword [esp + 0x674], ebp
je 0x10051a7a
push 4
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop esi
pop ebp
add esp, 0x664
ret
xor eax, eax
pop esi
pop ebp
add esp, 0x664
ret
Function at 0x100521b0
Capabilities:
Get graphical window text

Disassembly:
call fcn.1008d760
test eax, eax
je 0x100521cf
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
je 0x10052250
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x10052250
lea ecx, [esi + esi]
xor eax, eax
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.1017c342
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10052250
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebp, eax
test ebp, ebp
je 0x10052250
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xffffffffffffffff
push ebx
xor ebp, ebp
call fcn.1005bdd0
add esp, 0x10
test eax, eax
je 0x10052250
push esi
call fcn.1005f906
add esp, 4
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x10053f60
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 1
push 0
push 0
push 6
push 1
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x10053fa9
mov eax, dword [0x10201328]
test eax, eax
je 0x10053fa6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CIOCPSocket::Initialize___Create_SOCKET_failed___errno___d__n
push str.IOCPSocket
push 4
push 0x10200a94
call fcn.1008b760
add esp, 0x14
xor eax, eax
ret
mov eax, 1
ret

Function at 0x10053fb0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
mov dword [esp + 6], eax
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
push ecx
mov word [esp + 0x16], ax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], eax
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi]
mov word [esp + 6], ax
xor eax, eax
lea ecx, [esp + 4]
push 0x10
mov dword [esp + 0x10], eax
push ecx
push edx
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_connect]
pop esi
add esp, 0x10
ret 8
Function at 0x10054a20
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1018f6c0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov ecx, ebp
call fcn.10077290
mov esi, dword [esp + 0x24]
push esi
call fcn.1005f906
mov cx, word [esi]
add esp, 4
cmp eax, 1
jl 0x10054b95
cmp cx, 0x5c
je 0x10054b95
cmp cx, 0x2e
jne 0x10054a87
cmp eax, 1
je 0x10054b95
cmp eax, 2
jne 0x10054a87
cmp word [esi + 2], cx
je 0x10054b95
mov edx, dword [0x1019b4e4]
mov dword [esp + 0x28], edx
cmp eax, 3
mov dword [esp + 0x1c], 0
jle 0x10054ac4
cmp word [esi + 2], 0x3a
jne 0x10054ac4
cmp word [esi + 4], 0x5c
jne 0x10054ac4
cmp cx, 0x61
jb 0x10054ab8
cmp cx, 0x7a
jbe 0x10054b19
cmp cx, 0x41
jb 0x10054ac4
cmp cx, 0x5a
jbe 0x10054b19
push 0x105
lea ecx, [esp + 0x2c]
call fcn.100781f0
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.100782c0
test edi, edi
je 0x10054bac
cmp edi, 0x104
ja 0x10054bac
mov eax, dword [esp + 0x28]
mov ecx, dword [eax - 8]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x10054b19
push 0x5c
lea ecx, [esp + 0x2c]
call fcn.100781b0
push 0x101cf960
lea ecx, [esp + 0x14]
call fcn.10076d80
lea ecx, [esp + 0x28]
lea edx, [esp + 0xc]
push ecx
push eax
push edx
mov byte [esp + 0x28], 1
call fcn.10077ac0
push esi
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0x24], 2
push eax
call fcn.10077c90
push eax
mov ecx, ebp
mov byte [esp + 0x20], 3
call fcn.100776b0
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 2
call fcn.10077520
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call fcn.10077520
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 0
call fcn.10077520
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10077520
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x10054d20
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1018f718
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1019b4e4]
push esi
mov dword [esp + 4], eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 0
test esi, esi
je 0x10054d62
lea ecx, [esp + 4]
push ecx
push esi
call fcn.10054990
add esp, 8
test eax, eax
jne 0x10054d65
push esi
jmp 0x10054d6a
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10054da0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1018f738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1019b4e4]
push esi
mov dword [esp + 4], eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 0
test esi, esi
je 0x10054de2
lea ecx, [esp + 4]
push ecx
push esi
call fcn.10054990
add esp, 8
test eax, eax
jne 0x10054dea
mov edx, dword [esp + 0x1c]
push edx
push esi
jmp 0x10054df4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10054eb0
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x1018f780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x1019b4e4]
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
mov dword [esp + 8], eax
mov esi, dword [esp + 0x20]
mov byte [esp + 0x18], 1
test esi, esi
je 0x10054f2c
mov edi, dword [esp + 0x24]
test edi, edi
je 0x10054f2c
lea eax, [esp + 0xc]
push eax
push esi
call fcn.10054990
add esp, 8
test eax, eax
jne 0x10054f10
push esi
lea ecx, [esp + 0x10]
call fcn.100777a0
lea ecx, [esp + 8]
push ecx
push edi
call fcn.10054990
add esp, 8
test eax, eax
jne 0x10054f2c
push edi
lea ecx, [esp + 0xc]
call fcn.100777a0
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.10077520
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x10054f70
Capabilities:
Move file

Disassembly:
push 0xffffffffffffffff
push 0x1018f7a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x1019b4e4]
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
mov dword [esp + 8], eax
mov esi, dword [esp + 0x20]
mov byte [esp + 0x18], 1
test esi, esi
je 0x10054fec
mov edi, dword [esp + 0x24]
test edi, edi
je 0x10054fec
lea eax, [esp + 0xc]
push eax
push esi
call fcn.10054990
add esp, 8
test eax, eax
jne 0x10054fd0
push esi
lea ecx, [esp + 0x10]
call fcn.100777a0
lea ecx, [esp + 8]
push ecx
push edi
call fcn.10054990
add esp, 8
test eax, eax
jne 0x10054fec
push edi
lea ecx, [esp + 0xc]
call fcn.100777a0
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.10077520
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10055040
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x1018f7b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1019b4e4]
push esi
push edi
xor esi, esi
mov dword [esp + 8], eax
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], esi
test edi, edi
je 0x10055086
lea ecx, [esp + 8]
push ecx
push edi
call fcn.10054990
add esp, 8
test eax, eax
je 0x10055086
mov esi, 1
mov eax, dword [0x10201328]
test eax, eax
je 0x100550ae
mov edx, dword [esp + 8]
push edx
push esi
push str.COverlongPathApi::CreateDirectoryW_bChangeToLongPath__d__wstrLongPath__s_
push str.COverlongPathApi
push 0xffffffffffffffff
push 0x10200a94
call fcn.1008b760
add esp, 0x18
test esi, esi
jne 0x100550ba
mov eax, dword [esp + 0x20]
push eax
push edi
jmp 0x100550c4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1005509f
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x1018f7b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1019b4e4]
push esi
push edi
xor esi, esi
mov dword [esp + 8], eax
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], esi
test edi, edi
je 0x10055086
lea ecx, [esp + 8]
push ecx
push edi
call fcn.10054990
add esp, 8
test eax, eax
je 0x10055086
mov esi, 1
mov eax, dword [0x10201328]
test eax, eax
je 0x100550ae
mov edx, dword [esp + 8]
push edx
push esi
push str.COverlongPathApi::CreateDirectoryW_bChangeToLongPath__d__wstrLongPath__s_
push str.COverlongPathApi
push 0xffffffffffffffff
push 0x10200a94
call fcn.1008b760
add esp, 0x18
test esi, esi
jne 0x100550ba
mov eax, dword [esp + 0x20]
push eax
push edi
jmp 0x100550c4
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100550f0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x1018f7d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1019b4e4]
push esi
mov dword [esp + 4], eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 0
test esi, esi
je 0x10055132
lea ecx, [esp + 4]
push ecx
push esi
call fcn.10054990
add esp, 8
test eax, eax
jne 0x10055135
push esi
jmp 0x1005513a
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10055170
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1018f7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1019b4e4]
push esi
mov dword [esp + 4], eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 0
test esi, esi
je 0x100551b2
lea ecx, [esp + 4]
push ecx
push esi
call fcn.10054990
add esp, 8
test eax, eax
jne 0x100551b5
push esi
jmp 0x100551ba
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x10], 0xffffffff
call fcn.10077520
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10057530
Capabilities:
Get common file path

Disassembly:
mov cl, byte [0x101fe2cc]
mov al, 1
sub esp, 0x208
test al, cl
jne 0x10057563
mov dl, cl
push 0x100575c0
or dl, al
mov eax, dword [0x1019b4e4]
mov byte [0x101fe2cc], dl
mov dword [0x101fe2c8], eax
call fcn.1005f4cf
add esp, 4
mov ecx, dword [0x101fe2c8]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x100575b3
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 6]
mov word [esp + 4], 0
lea edx, [esp + 4]
rep stosd dword es:[edi], eax
push edx
push 0x104
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 4]
mov ecx, 0x101fe2c8
push eax
call fcn.100777a0
mov eax, 0x101fe2c8
pop edi
add esp, 0x208
ret
mov eax, 0x101fe2c8
add esp, 0x208
ret

Function at 0x10057890
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1018fa88
push eax
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov eax, dword [ebx]
xor edi, edi
cmp dword [eax - 8], edi
je 0x1005794e
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x1005794e
push eax
lea ecx, [esp + 0x24]
call fcn.10076d80
mov esi, dword [esp + 0x24]
push ebx
mov ecx, esi
mov dword [esp + 0x1c], edi
call fcn.100776b0
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test edi, edi
jne 0x10057902
mov ecx, dword [esp + 0x20]
mov edx, dword [ebx]
push ecx
push edx
push 0x101c41f0
push esi
call fcn.1007a4a0
add esp, 0x10
jmp 0x10057919
mov eax, dword [esp + 0x20]
mov ecx, dword [ebx]
push eax
push edi
push ecx
push 0x101d6328
push esi
call fcn.1007a4a0
add esp, 0x14
mov eax, dword [esi]
push eax
call ebp
cmp eax, 0xffffffff
je 0x1005792c
inc edi
cmp edi, 0x3e8
jb 0x100578e6
xor edx, edx
cmp edi, 0x3e8
setne dl
lea ecx, [esp + 0x20]
mov esi, edx
mov dword [esp + 0x18], 0xffffffff
call fcn.10077520
mov eax, esi
jmp 0x10057950
xor eax, eax
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x100581a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov ecx, 0x101fe328
jmp 0x100581b0
push 0xffffffffffffffff
push 0x1018fb5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov eax, 0x1e
mov dword [esp + 8], esi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
lea ecx, [esi + 0x64]
mov byte [esp + 0x14], 3
call fcn.10083ae0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], 0x11
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], 0xa
mov dword [esi + 0xa0], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret