joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009d0d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023cb70
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.10008714
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x1009d116
mov al, 1
jmp 0x1009d20b
mov ecx, esi
call fcn.10008714
push eax
lea ecx, [ebp - 0x28]
call fcn.10005e0a
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1009cf20
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
cmp ebx, 0xffffffff
jne 0x1009d155
xor al, al
jmp 0x1009d20b
mov ecx, esi
call fcn.10008714
push eax
lea ecx, [ebp - 0x28]
call fcn.10005e0a
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.1009ce60
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
test bl, bl
je 0x1009d14e
mov ecx, esi
call fcn.10008714
push eax
call edi
test eax, eax
jne 0x1009d10f
lea ecx, [ebp - 0x28]
call fcn.1000879d
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1009e820
test al, al
je 0x1009d1cd
lea ecx, [ebp - 0x28]
call fcn.10008714
push eax
call edi
test eax, eax
je 0x1009d1cd
mov bl, 1
jmp 0x1009d1fa
mov ecx, esi
call fcn.10008714
push eax
lea ecx, [ebp - 0x44]
call fcn.10005e0a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.1009ce60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.10005e05
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
Function at 0x1009d800
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
mov ebp, dword [esp + 0x22c]
lea eax, [esp + 0x18]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.101ffde0
add esp, 0xc
lea eax, [esp + 0x20]
mov ecx, esi
push eax
push 0
call fcn.10008714
push eax
mov ecx, edi
call fcn.10008714
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1009da16
xor eax, eax
mov word [esp + 0x22a], ax
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.10005f42
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
cmp ebx, eax
ja 0x1009d8bf
mov esi, edi
cmp eax, 8
jb 0x1009d892
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x28]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10005f10
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x1009d9fb
mov ecx, ebp
call fcn.1000608d
cmp ebx, eax
ja 0x1009da30
mov ecx, ebp
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x18], ecx
cmp ecx, esi
ja 0x1009d915
mov ecx, ebp
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1009d915
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1009d927
or ecx, 0xffffffff
jmp 0x1009d92f
cmp ecx, 0x1000
jb 0x1009d958
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.101e74f1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1009da35
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1009d969
test ecx, ecx
je 0x1009d967
push ecx
call fcn.101e74f1
add esp, 4
jmp 0x1009d969
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10005f29
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [esp + 0x34]
add esp, 0x14
cmp ecx, 8
jb 0x1009d9da
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1009d9c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009da35
mov eax, edx
push ecx
push eax
call fcn.101e74c0
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1009d9fb
lea eax, [esp + 0x10]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.101e7040
add esp, 0x224
ret
mov ecx, dword [esp + 0x22c]
xor al, al
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.101e7040
add esp, 0x224
ret
call fcn.1000604b
call fcn.102086be
int3
Function at 0x1009dd90
Capabilities:
Get common file path

Disassembly:
jmp 0x1009dd90
sub esp, 0x42c
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
mov ebp, ecx
call fcn.10010566
push 0x412
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.101ffde0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1009dfa0
cmp eax, 0x208
jae 0x1009dfa0
push ebx
xor eax, eax
push esi
mov word [esp + 0x430], ax
lea eax, [esp + 0x20]
push edi
push eax
call fcn.10005f42
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
cmp ebx, eax
ja 0x1009de49
mov esi, edi
cmp eax, 8
jb 0x1009de1c
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x28]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10005f10
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x1009df85
mov ecx, ebp
call fcn.1000608d
cmp ebx, eax
ja 0x1009dfb8
mov ecx, ebp
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x18], ecx
cmp ecx, esi
ja 0x1009de9f
mov ecx, ebp
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1009de9f
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1009deb1
or ecx, 0xffffffff
jmp 0x1009deb9
cmp ecx, 0x1000
jb 0x1009dee2
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.101e74f1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1009dfbd
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1009def3
test ecx, ecx
je 0x1009def1
push ecx
call fcn.101e74f1
add esp, 4
jmp 0x1009def3
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10005f29
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [esp + 0x34]
add esp, 0x14
cmp ecx, 8
jb 0x1009df64
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1009df52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009dfbd
mov eax, edx
push ecx
push eax
call fcn.101e74c0
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1009df85
lea eax, [esp + 0x10]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101e7040
add esp, 0x42c
ret
mov ecx, dword [esp + 0x42c]
xor al, al
pop ebp
xor ecx, esp
call fcn.101e7040
add esp, 0x42c
ret
call fcn.1000604b
call fcn.102086be
int3
Function at 0x1009fa30
Capabilities:
Check for peb ntglobalflag flag
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023ced9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x102ca474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.RC::IRefCount.0
mov dword [ebp - 4], 0
mov dword [ebx], vtable.DL::ISimpleDownloadHandler.0
mov dword [ebp - 4], 1
mov dword [ebx + 4], vtable.RC::RCRefCounted.0
mov dword [ebx + 8], 0
mov byte [ebp - 4], 2
mov dword [ebx], vtable.RC::RCRefCountImpl1_class_DL::ISimpleDownloadHandler_.1.0
mov dword [ebx + 4], vtable.RC::RCRefCountImpl1_class_DL::ISimpleDownloadHandler_.0
mov dword [ebp - 4], 3
lea esi, [ebx + 0x10]
mov ecx, esi
mov dword [ebx], vtable.DL::RCSimpleDownloadHandler.0
mov dword [ebx + 4], vtable.DL::RCSimpleDownloadHandler.1.0
mov dword [ebp - 0x14], esi
call fcn.1000879d
mov byte [ebp - 4], 4
lea ecx, [esi + 0x18]
call fcn.1000879d
mov byte [ebp - 4], 5
lea ecx, [esi + 0x30]
call fcn.1000879d
mov byte [ebp - 4], 6
lea ecx, [esi + 0x48]
call fcn.1000879d
mov byte [ebp - 4], 7
lea ecx, [esi + 0x70]
mov word [esi + 0x60], 0x101
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
call fcn.1000879d
mov byte [ebp - 4], 9
mov dword [ebx + 0x98], 0
mov byte [ebx + 0x9c], 0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0xa4], 0
mov dword [ebx + 0xa8], 0
mov byte [ebp - 4], 0xa
push 0x18
call fcn.101e74f1
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 4
mov dword [ebx + 0xac], eax
push eax
call esi
mov byte [ebp - 4], 0xb
lea edi, [ebx + 0xc0]
mov dword [ebx + 0xb0], 0
lea ecx, [edi + 8]
mov dword [ebx + 0xb4], 0
mov dword [ebx + 0xb8], 0
mov dword [ebx + 0xbc], 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov byte [edi + 4], 0
call fcn.1000879d
mov byte [ebp - 4], 0xd
push 0x18
mov dword [ebx + 0xe0], 0
call fcn.101e74f1
add esp, 4
mov dword [ebx + 0xe4], eax
push eax
call esi
mov byte [ebp - 4], 0xe
mov dword [ebx + 0xe8], 0
mov dword [ebx + 0xec], 0
mov byte [ebp - 4], 0xf
mov byte [ebx + 0xf0], 0
mov dword [ebx + 0xf4], 0
mov dword [ebx + 0xf8], 0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2c]
push 0x10275ce0
call fcn.10005e0a
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x2c]
push ecx
push 1
push eax
mov ecx, edi
call fcn.1007bea0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2c]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a33b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023d638
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.1009ca20
test al, al
jne 0x100a3410
mov eax, 1
jmp 0x100a358d
push 0x10000
call fcn.101e7526
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call fcn.101ffde0
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x100a3566
test ebx, ebx
je 0x100a3566
cmp dword [eax], 0xffffffff
je 0x100a3566
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100a3566
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x100a355c
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.101da880
test al, al
je 0x100a354f
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x100a3502
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x100a34f1
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x100a355c
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x100a350c
add ebx, eax
cmp ebx, 0x8000
je 0x100a351c
cmp dword [ebp - 0x28], 0xf
ja 0x100a3545
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x100a34a0
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x100a353e
add ecx, 4
add esi, 4
sub edx, 4
jae 0x100a3526
mov esi, 4
jmp 0x100a3577
mov esi, 5
jmp 0x100a3577
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x100a3577
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x100a3571
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x100a3577
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100a358b
push ebx
call fcn.101e7521
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100a97a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023b7af
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102ca474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.10005b84
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.100087b0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.100087b0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.100087b0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.100087b0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.100087b0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.100087b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100ab7a0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x100ab805
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100ab7e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100ab805
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.101e7040
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.101e7040
add esp, 8
ret 4
Function at 0x100ab9a0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023e5a8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x100ab9e9
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x100abb3b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x100abb06
test eax, eax
je 0x100abb06
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x100abb09
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x100aba8b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100aba7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100aba8b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x100aba99
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.100087b0
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x100abb06
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x100aba44
jmp 0x100abb09
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x100abb32
test edx, edx
je 0x100abb2e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x100aba00
mov al, 1
jmp 0x100abb3d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x100abb3b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100adf70
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023eb18
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.100086fc
test al, al
jne 0x100adfca
cmp byte [ebp + 8], al
jne 0x100adfd1
mov eax, dword [ebx]
test eax, eax
je 0x100ae12f
cmp byte [eax + 0xa5], 0
je 0x100ae12f
xor al, al
jmp 0x100ae143
mov ecx, esi
call fcn.100086fc
test al, al
jne 0x100ae12f
mov ecx, esi
call fcn.10079d00
test al, al
je 0x100adff7
push esi
push edi
call fcn.100adba0
jmp 0x100ae12b
push 0xb
mov ecx, esi
call fcn.10008714
push eax
mov ecx, edi
call fcn.10008714
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x100ae01c
mov al, 1
jmp 0x100ae12b
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.1000879d
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.1009e820
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.1000879d
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.1009e820
test al, al
jne 0x100ae069
cmp byte [ebp - 0x60], al
je 0x100ae0a5
push 0xb
lea ecx, [ebp - 0x40]
call fcn.10008714
push eax
lea ecx, [ebp - 0x58]
call fcn.10008714
push eax
call ebx
test eax, eax
je 0x100ae0a5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10005e05
mov al, 1
jmp 0x100ae12b
mov ecx, esi
call fcn.1009cf20
cmp eax, 0xffffffff
je 0x100ae10e
push esi
lea ecx, [ebp - 0x28]
call fcn.100087b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1009e280
test al, al
je 0x100ae102
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1009cfc0
test al, al
je 0x100ae102
mov edx, esi
mov ecx, edi
call fcn.1009cfc0
lea ecx, [ebp - 0x28]
test al, al
je 0x100ae0fb
call fcn.1009d0d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10005e05
jmp 0x100ae083
mov edx, esi
call fcn.1009cfc0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10005e05
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10005e05
xor al, al
test al, al
jne 0x100ae141
mov ecx, edi
call fcn.10079d00
test al, al
je 0x100ae141
mov ecx, edi
call fcn.1009d0d0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100b4110
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.101ffde0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x100b41a7
cmp dword [esp + 8], 6
jb 0x100b41a7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.101e7040
add esp, 0x118
ret

Function at 0x100b41c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023f320
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x102ca474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.10005e0a
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1008ec20
mov ecx, eax
call fcn.1008ece0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.10005e0a
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.1008ec20
mov ecx, eax
call fcn.1008ece0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005e05
test ebx, ebx
je 0x100b42d5
test esi, esi
je 0x100b42d5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret