joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10103614
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cec5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x20], 0
je 0x1010367f
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10103669
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10103667
movzx eax, ax
or eax, 0x80070000
test eax, eax
jne 0x1010367f
mov eax, dword [ebp - 0x14]
test eax, eax
jl 0x1010367f
mov ecx, dword [ebp - 0x18]
jg 0x10103679
test ecx, ecx
jb 0x1010367f
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x58]
mov edx, dword [esi + 0x5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x10108218
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.1003430e
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jg 0x10108245
xor eax, eax
jmp 0x101082f6
cmp esi, ebx
je 0x1010824e
xor eax, eax
mov word [esi], ax
cmp edi, 0x824
jl 0x1010826a
push esi
push 0
push 0x101b1404
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x101082f6
xor eax, eax
push 0x1046
push eax
mov word [ebp - 0x104c], ax
mov dword [ebp - 0x1050], eax
lea eax, [ebp - 0x104a]
push eax
call fcn.10035153
add esp, 0xc
lea eax, [ebp - 0x104c]
push eax
xor eax, eax
push eax
push 0x101b1404
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, eax
test ebx, ebx
je 0x101082f4
lea ecx, [ebp - 0x104c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1050]
jne 0x101082b3
sub ecx, edx
sar ecx, 1
cmp ecx, edi
jl 0x101082e6
mov ecx, 0x304c19e
call fcn.1006fff3
lea eax, [ebp - 0x104c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1010823e
push edi
mov edx, esi
lea ecx, [ebp - 0x104c]
call fcn.1003094c
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033218
leave
ret 0xc

Function at 0x10108566
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10155cbd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov word [edi], ax
test esi, esi
jns 0x101085a7
push eax
push 0x3ca4d4
call fcn.1002a3d0
cmp esi, 0x1a
je 0x101085d4
cmp esi, 0x1c
je 0x101085d4
cmp esi, 0x23
je 0x101085d4
cmp esi, 5
je 0x101085d4
cmp esi, 0x27
je 0x101085d4
cmp esi, 6
je 0x101085d4
cmp esi, 0x10
je 0x101085d4
mov ecx, 0x3ca4d6
call fcn.1006fff3
push ecx
push edi
push esi
mov ecx, 0x102051a0
call fcn.1010849a
test eax, eax
je 0x1010864e
cmp eax, 2
jne 0x101085f1
mov eax, 0x80004005
jmp 0x1010864e
push edi
xor ecx, ecx
mov eax, esi
push ecx
push ecx
or eax, 0x8000
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, eax
test ebx, ebx
js 0x1010864c
mov ecx, edi
call fcn.1008430b
mov dword [ebp + 8], esi
and dword [ebp - 4], 0
push ecx
push 0x102051d4
lea ecx, [ebp - 0x20]
call fcn.1002dd9a
lea eax, [ebp + 8]
mov ecx, 0x102051a0
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.101083b8
push edi
mov ecx, dword [eax]
add ecx, 0xc
call fcn.100278f6
lea ecx, [ebp - 0x20]
call fcn.100303a3
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1010b31b
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1010b328
xor eax, eax
pop ebp
ret 4
pop ebp
Function at 0x1010f92c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10155e14
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
push ecx
xor edi, edi
push ecx
mov dword [ebp - 0x1c], edi
call fcn.100c6143
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1010f971
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
cmp dword [eax], edi
je 0x1010f982
mov ebx, 0x80004005
jmp 0x1010fa5b
cmp byte [esi + 0x30], 0
je 0x1010f978
inc dword [esi + 0x2c]
test byte [esi + 0x2c], 0x3f
jne 0x1010f999
push edi
mov ecx, esi
call fcn.1010f57b
mov dword [ebp - 4], edi
lea ebx, [esi + 0x20]
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x20], ebx
mov dword [ebp + 0x10], edi
cmp eax, dword [esi + 0x28]
je 0x1010f9b5
mov dword [eax], edi
add dword [esi + 0x24], 4
jmp 0x1010f9c1
lea ecx, [ebp + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.100c6f3a
mov ecx, dword [ebx]
mov eax, dword [esi + 0x24]
sub eax, ecx
sar eax, 2
dec eax
or dword [ebp - 4], 0xffffffff
lea eax, [ecx + eax*4]
jmp 0x1010f9f0
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x1010f9fe
mov ebx, 0x8007000e
jmp 0x1010fa5b
lea eax, [ebp - 0x1c]
mov ebx, edi
push eax
push edi
push dword [ebp + 0xc]
push 0x10117aeb
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [ebp + 0xc], ecx
test ecx, ecx
jne 0x1010fa3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1010fa35
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jne 0x1010fa4c
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1010fa48
mov dword [eax], ecx
mov eax, edi
jmp 0x1010fa4f
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1010fa5b
mov ecx, dword [ebp - 0x20]
call fcn.10093ef4
mov ecx, esi
call fcn.100c63b2
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1011472e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x101fe1c0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [edi + 8]
mov dword [esp + 0x14], eax
cmp eax, dword [edx + 4]
jne 0x10114770
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
and ecx, 0x7ff
cmp ecx, dword [edi + 0x14]
jne 0x10114770
mov eax, 1
jmp 0x10114772
xor eax, eax
test eax, eax
je 0x101147a0
mov eax, dword [edi + 8]
inc dword [eax + 8]
test byte [0x10206f00], 0x80
je 0x10114799
mov eax, dword [edi + 8]
mov edx, 0x101b1b08
push dword [eax + 0xc]
push dword [eax + 8]
push edi
call fcn.10111b56
xor eax, eax
jmp 0x1011491a
xor esi, esi
mov byte [esp + 0x28], 0
mov dword [esp + 0x10], esi
mov byte [esp + 0xe], 0
mov ecx, dword [edi + 8]
mov bl, byte [esp + 0xe]
mov ecx, dword [ecx]
nop dword [eax]
mov eax, ecx
mov edx, ecx
and eax, 0x7ff
mov dword [esp + 0x18], eax
cmp eax, 0x7fb
je 0x101147f7
test eax, eax
je 0x101147f7
mov dword [esp + 0x1c], eax
mov byte [esp + 0xf], 0
test bl, bl
jne 0x1011481d
lea eax, [ecx + 0x800]
xor ecx, eax
and ecx, 0x7ff
xor ecx, eax
jmp 0x1011481d
mov eax, dword [edi + 0x14]
xor eax, ecx
mov byte [esp + 0xf], 1
and eax, 0x7ff
xor ecx, eax
test bl, bl
je 0x1011481d
mov eax, ecx
and ecx, 0x7ff
shr eax, 0xb
dec eax
shl eax, 0xb
or ecx, eax
mov esi, dword [edi + 8]
mov eax, edx
lock cmpxchg dword [esi], ecx
mov ecx, eax
cmp ecx, edx
jne 0x101147c0
cmp byte [esp + 0xf], 0
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 8]
jne 0x101148da
mov eax, dword [eax]
and eax, 0xfffff800
cmp eax, 0x28f5800
jb 0x10114855
mov ecx, 0x1c124c
call fcn.1006fff3
cmp ebx, 0xffffffff
je 0x1011488e
cmp byte [esp + 0xe], 0
jne 0x10114873
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [esp + 0x10], esi
test ebx, ebx
jne 0x1011488e
jmp 0x10114877
mov esi, dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, ebx
jae 0x101148af
sub ebx, ecx
mov dword [esp + 0x10], eax
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x12], 1
mov dword [esp + 0x24], ebx
call fcn.10114a9b
jmp 0x101147b0
mov eax, dword [edi + 8]
mov eax, dword [eax]
mov esi, dword [edi + 8]
mov ecx, eax
shr ecx, 0xb
mov edx, eax
dec ecx
and eax, 0x7ff
shl ecx, 0xb
or ecx, eax
mov eax, edx
lock cmpxchg dword [esi], ecx
cmp eax, edx
jne 0x101148b4
mov eax, 0x102
jmp 0x1011491a
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov eax, dword [edi + 8]
mov dword [eax + 8], 1
test byte [0x10206f00], 0x80
je 0x10114908
mov eax, dword [edi + 8]
mov edx, 0x101b1b08
push dword [eax + 0xc]
push dword [eax + 8]
push edi
call fcn.10111b56
xor eax, eax
mov ecx, 0x80
cmp dword [esp + 0x18], 0x7fb
cmove eax, ecx
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10033218
mov esp, ebp
pop ebp
ret 8
Function at 0x1011563c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
test byte [0x10206f00], 0x20
push esi
push edi
mov esi, ecx
je 0x10115671
push dword [ebx + 0xc]
mov edx, 0x101b1c58
push dword [ebx + 8]
call fcn.10117d33
mov ecx, 0x1c135e
call fcn.1006fff3
lea eax, [esi + 8]
mov edi, dword [eax]
mov esi, edi
mov ecx, dword [eax + 4]
mov edx, ecx
shr esi, 0xc
mov dword [ebp - 4], eax
dec esi
and esi, 0x7f
mov dword [ebp - 0x10], edi
mov eax, edi
shl esi, 0xc
and eax, 0xfff80fff
mov dword [ebp - 0x14], ecx
or esi, eax
mov eax, edi
mov edi, dword [ebp - 4]
push ebx
mov ebx, esi
lock cmpxchg8b qword [edi]
mov esi, ebx
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x10]
jne 0x101156be
cmp ecx, dword [ebp - 0x14]
je 0x101156f2
mov edi, dword [ebp - 4]
mov esi, eax
shr esi, 0xc
mov edx, ecx
dec esi
mov dword [ebp - 0x14], eax
shl esi, 0xc
xor esi, eax
mov dword [ebp - 0x10], ecx
and esi, 0x7f000
xor esi, eax
push ebx
mov ebx, esi
lock cmpxchg8b qword [edi]
mov esi, ebx
pop ebx
mov ecx, edx
cmp eax, dword [ebp - 0x14]
jne 0x101156be
cmp ecx, dword [ebp - 0x10]
jne 0x101156be
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc

Function at 0x10119980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cb8f
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x101b54d8
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
push ebx
push ebx
lea eax, [esi + 0x14]
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov dword [esi], 0x101b54a4
mov eax, esi
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
leave
ret 4
Function at 0x10119f20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d1f4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
and dword [ebp - 0x10], 0
cmp byte [esi + 8], 0
je 0x10119f5e
mov ebx, 0x80004005
jmp 0x1011a01d
mov edx, dword [esi + 0x38]
lea ecx, [esi + 0x34]
lea eax, [esi + 0x2c]
mov dword [ebp - 0x14], eax
cmp edx, dword [ecx]
ja 0x10119f8c
lea edx, [edx*4 + 0x14]
mov ecx, eax
call fcn.1006bab9
test al, al
je 0x10119f54
add dword [esi + 0x38], 5
lea edi, [esi + 0x34]
mov dword [ebp - 0x18], edi
jmp 0x10119f92
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.1011a02f
mov ebx, eax
test ebx, ebx
js 0x1011a00f
mov ecx, dword [esi + 0x40]
or ecx, dword [esi + 0x44]
jne 0x10119fb7
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edx
mov edi, dword [ebp - 0x10]
lock inc dword [edi + 0x908]
lea eax, [edi + 0x8f0]
push eax
xor eax, eax
push eax
push edi
push 0x1011a4f1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10119feb
mov ecx, edi
call fcn.1011a245
mov ebx, 0x80004005
jmp 0x1011a012
mov dword [edi + 0x8ec], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 0x34]
push 0x3e
mov eax, dword [eax]
mov dword [eax + ecx*4], edi
xor edi, edi
mov eax, dword [ebp - 0x18]
pop ecx
inc dword [eax]
lea eax, [esi + 0x30]
lock xadd dword [eax], ecx
jmp 0x1011a012
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x1011a01d
mov ecx, edi
call fcn.1011a245
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1011ba3e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cb26
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 8]
mov esi, dword [eax + 0x30]
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
lea eax, [ecx + 4]
push eax
push esi
call edx
xor ecx, ecx
mov edx, 0x80004005
test al, al
cmove ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret 4

Function at 0x1011e031
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
xor edx, edx
and dword [ebp - 0x18], 0
inc edx
push 2
pop eax
push 6
mov word [ebp - 0x26], ax
pop eax
push 0xd
mov word [ebp - 0x1a], ax
pop eax
mov word [ebp - 0x10], ax
xor eax, eax
push 0xc
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x28]
push 3
push eax
mov word [ebp - 0x28], dx
mov dword [ebp - 0x20], ecx
mov word [ebp - 0x1c], dx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10033218
leave
ret
Function at 0x101216fb
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10156196
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
and dword [ebp - 0x418], 0
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x420], esi
test edi, edi
jne 0x10121746
xor eax, eax
jmp 0x10121841
and dword [edi], 0
lea ecx, [ebp - 0x410]
xor ebx, ebx
inc ebx
push ebx
push esi
push edx
call fcn.1002468a
mov ecx, esi
mov dword [ebp - 0x424], eax
and ecx, 0x4000000
mov byte [ebp - 0x411], 0
mov dword [ebp - 0x41c], ecx
test eax, eax
je 0x10121795
push eax
mov eax, esi
shr eax, 0x17
and eax, ebx
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ecx, dword [ebp - 0x41c]
mov dword [edi], eax
mov eax, dword [edi]
test eax, eax
jne 0x10121822
test ecx, ecx
jne 0x1012181e
and dword [ebp - 0x428], eax
lea edx, [ebp - 0x418]
push ebx
mov ecx, esi
call fcn.101227db
test eax, eax
je 0x1012181c
push dword [ebp - 0x424]
mov eax, esi
shr eax, 0x19
and eax, ebx
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, dword [ebp - 0x420]
lea edx, [ebp - 0x418]
mov esi, eax
call fcn.10122a02
cmp esi, 5
jne 0x1012181c
cmp byte [ebp - 0x411], 0
jne 0x1012181c
mov esi, dword [ebp - 0x420]
mov ecx, dword [ebp - 0x41c]
mov eax, dword [ebp - 0x424]
mov byte [ebp - 0x411], bl
jmp 0x10121775
mov eax, dword [edi]
test eax, eax
je 0x10121827
cmp eax, 0xffffffff
jne 0x1012183f
cmp dword [ebp - 0x41c], 0
jne 0x1012183a
mov ecx, 0x1631e1
call fcn.1006fff3
and dword [edi], 0
xor ebx, ebx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10033218
leave
ret 0x14
Function at 0x1012e8af
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov bl, dl
mov esi, ecx
call fcn.100278ea
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1012e90f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1012e90f
test bl, bl
je 0x1012e90b
push esi
push ecx
push eax
push ecx
lea ecx, [ebp - 0x390]
call fcn.1012e723
push 0x101ebb90
lea eax, [ebp - 0x390]
push eax
call fcn.100357e4
xor al, al
jmp 0x1012e911
mov al, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10033218
leave
ret 4

Function at 0x1012e964
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x80
mov esi, ecx
mov dword [ebp - 0x39c], edi
call fcn.100278ea
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1012e9c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x39c]
push ecx
push esi
push ecx
push eax
push ecx
push 0x30303030
lea ecx, [ebp - 0x398]
call fcn.1012e606
push 0x101ebb90
lea eax, [ebp - 0x398]
push eax
call fcn.100357e4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10033218
leave
ret

Function at 0x1012fa69
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x20], 0
jne 0x1012fab0
push str.ORegistryKey.SetValue_failure:_Cannot_set_DWORD_value._The_registry_key_is_closed_or_not_set
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.100b7ff1
push 0x101ebb90
lea eax, [ebp - 0x390]
push eax
call fcn.100357e4
cmp dword [esi + 0x10], 0x3fff
jbe 0x1012facd
push ecx
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.1012f6cd
jmp 0x1012fa9f
mov ecx, esi
call fcn.100278ea
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1012fb0a
lea ecx, [edi + 8]
push ecx
lea ecx, [ebp + 0xc]
push ecx
push esi
push ecx
push eax
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.1012f742
jmp 0x1012fa9f
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10033218
leave
ret 8
Function at 0x101304c9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x394], eax
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x20], 0
jne 0x10130515
push ecx
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.1012fb8c
push 0x101ebb90
lea eax, [ebp - 0x390]
push eax
call fcn.100357e4
cmp dword [eax + 0x10], 0x3fff
jbe 0x10130536
lea eax, [ebx + 8]
push eax
push ecx
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.101300b1
jmp 0x10130504
push edi
mov edi, dword [esi]
mov esi, dword [esi + 4]
push 0
pop ecx
sub esi, edi
cmove edi, ecx
mov ecx, eax
call fcn.100278ea
push esi
push edi
push 3
push 0
push eax
push dword [ebx + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
je 0x1013057f
lea ecx, [ebx + 8]
push ecx
push dword [ebp - 0x394]
push ecx
push eax
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.1012fbfe
jmp 0x10130504
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10033218
leave
ret 8

Function at 0x1013122a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d0
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x394], eax
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0xffffffff
je 0x10131283
call fcn.1013162b
test al, al
jne 0x10131283
push ecx
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.10130d56
push 0x101ebb90
lea eax, [ebp - 0x390]
push eax
call fcn.100357e4
lea eax, [ebp + 0x10]
push eax
push ebx
push edi
sub esp, 0xc
call fcn.101310eb
push 0x3c
lea eax, [ebp - 0x3d0]
push 0
push eax
call fcn.10035153
mov eax, dword [ebp - 0x394]
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x3c8], eax
cmp byte [ebp + 0x10], cl
mov eax, str.runas
mov dword [ebp - 0x3d0], 0x3c
cmove eax, ecx
mov ecx, edi
mov dword [ebp - 0x3c4], eax
call fcn.100278ea
mov ecx, ebx
mov dword [ebp - 0x3c0], eax
call fcn.100278ea
xor ecx, ecx
mov dword [ebp - 0x3bc], eax
inc ecx
mov dword [ebp - 0x3cc], 0x340
cmp byte [ebp + 0x18], 0
mov eax, 0x8000000
cmovne eax, ecx
mov dword [ebp - 0x3b4], eax
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x10131345
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 8], eax
cmp eax, 0x4c7
jne 0x1013132b
xor al, al
jmp 0x10131357
push ebx
push edi
push ecx
push eax
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.10130c30
jmp 0x10131272
mov ecx, dword [ebp - 0x398]
mov al, 1
mov dword [esi + 4], ecx
mov dword [esi + 8], 0x103
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033218
leave
ret 0x14
Function at 0x101313b4
Capabilities:
Create process on windows

Disassembly:
push 0x7d8
mov eax, 0x10157143
call fcn.10033f2f
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x788], edi
je 0x10131403
call fcn.1013162b
test al, al
jne 0x10131403
push ecx
push ecx
push 0x30303030
lea ecx, [ebp - 0x3ec]
call fcn.10130d56
push 0x101ebb90
lea eax, [ebp - 0x3ec]
push eax
call fcn.100357e4
lea ecx, [ebp - 0x2c]
call fcn.1001305d
and dword [ebp - 4], 0
cmp dword [edi + 0x10], 0
je 0x10131471
cmp dword [ebx + 0x10], 0
je 0x10131480
mov ecx, ebx
call fcn.100278ea
push 0x20
pop ecx
cmp cx, word [eax]
je 0x10131471
lea ecx, [ebp - 0x44]
call fcn.1001305d
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov ecx, edi
call fcn.100279d8
push ebx
lea eax, [ebp - 0x44]
mov edx, str._s__s
push eax
lea ecx, [ebp - 0x5c]
call fcn.1001734f
push eax
lea ecx, [ebp - 0x2c]
call fcn.100057ca
lea ecx, [ebp - 0x5c]
call fcn.100093c1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.100093c1
jmp 0x10131480
cmp dword [ebx + 0x10], 0
je 0x10131480
push ebx
lea ecx, [ebp - 0x2c]
call fcn.100287cd
push 0x44
pop edi
push edi
lea eax, [ebp - 0x7e4]
push 0
push eax
call fcn.10035153
mov dword [ebp - 0x7e4], edi
xor eax, eax
lea edi, [ebp - 0x79c]
add esp, 0xc
cmp dword [esi + 0x1c], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jne 0x101314b6
and dword [ebp - 0x780], 0
jmp 0x101314c4
lea ecx, [esi + 0xc]
call fcn.100278ea
mov dword [ebp - 0x780], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
or eax, 0x8000000
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 0x78c], eax
sete cl
test cl, cl
je 0x101314f0
and dword [ebp - 0x784], 0
jmp 0x101314fe
lea ecx, [ebp - 0x2c]
call fcn.100278ea
mov dword [ebp - 0x784], eax
mov edi, dword [ebp - 0x788]
cmp dword [edi + 0x10], 0
jne 0x1013150e
xor eax, eax
jmp 0x10131515
mov ecx, edi
call fcn.100278ea
lea ecx, [ebp - 0x79c]
push ecx
lea ecx, [ebp - 0x7e4]
push ecx
push dword [ebp - 0x780]
push 0
push dword [ebp - 0x78c]
push 0
push 0
push 0
push dword [ebp - 0x784]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10131577
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
call esi
push ebx
push edi
push ecx
push eax
push ecx
push 0x30303030
lea ecx, [ebp - 0x77c]
call fcn.10130cc3
push 0x101ebb90
lea eax, [ebp - 0x77c]
jmp 0x101313fd
mov eax, dword [ebp - 0x79c]
push dword [ebp - 0x798]
mov dword [esi + 4], eax
mov dword [esi + 8], 0x103
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
call fcn.100093c1
xor eax, eax
call fcn.10033ee4
ret 0x14