joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1041d77
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10023c8
call fcn.01041f6c
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x1000000], 0x5a4d
jne 0x1041dbf
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1041dbf
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1041dd8
cmp ecx, 0x20b
je 0x1041dc5
and dword [ebp - 0x1c], 0
jmp 0x1041dec
cmp dword [eax + 0x84], 0xe
jbe 0x1041dbf
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1041de6
cmp dword [eax + 0x74], 0xe
jbe 0x1041dbf
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 2
pop esi
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or edi, 0xffffffff
mov dword [0x10f5720], edi
mov dword [0x10f5724], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10f028c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10f0288]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10f571c], eax
call fcn.01042050
cmp dword [0x10cf234], 0
jne 0x1041e4c
push fcn.01042050
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01042039
push 0x10cf104
push 0x10cf100
call sub.msvcrt.dll__initterm
mov eax, dword [0x10f0284]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10f0280]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x10cf0fc
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov eax, dword [eax]
test eax, eax
jne 0x1041eb1
mov dword [ebp - 4], edi
mov eax, 0xff
jmp 0x1041f60
mov dword [ebp - 0x20], eax
cmp word [eax], 0x22
jne 0x1041ef2
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x1041ecd
cmp cx, 0x22
jne 0x1041eba
cmp word [eax], 0x22
jne 0x1041ed8
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x1041ee6
cmp cx, 0x20
jbe 0x1041ed3
test byte [ebp - 0x54], 1
je 0x1041eff
movzx ecx, word [ebp - 0x50]
jmp 0x1041f02
cmp word [eax], 0x20
jbe 0x1041ed8
add eax, esi
mov dword [ebp - 0x20], eax
jmp 0x1041ef2
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call fcn.01041950
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1041f22
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x1041f5e
mov eax, esi
call fcn.01041fa7
ret
Function at 0x10424ee
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10cf230]
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov word [esi + 8], ax
cmp dword [0x10f0294], eax
jne 0x1042575
push edi
push 0x44
pop ecx
lea edi, [ebp - 0x114]
rep stosd dword es:[edi], eax
xor edi, edi
lea eax, [ebp - 0x118]
inc edi
push eax
mov dword [0x10f0294], edi
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1042574
cmp dword [ebp - 0x114], 5
jb 0x1042558
cmp dword [ebp - 0x110], edi
jae 0x1042561
cmp dword [ebp - 0x114], 6
jb 0x1042574
cmp dword [ebp - 0x108], 2
jne 0x1042574
mov dword [0x10cf238], 0x7f
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.01041c5f
leave
ret

Function at 0x104336d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.01042c9c
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x1043399
mov eax, dword [0x10f027c]
mov esi, dword [eax + 8]
test esi, esi
jne 0x1043399
mov ebx, 0x80070057
jmp 0x1043415
mov eax, dword [ebp + 8]
shr eax, 4
push edi
inc eax
movzx eax, ax
push 6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10433bf
call fcn.01042099
mov ebx, eax
test ebx, ebx
jl 0x1043414
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x10433d4
call fcn.01042099
mov ebx, eax
test ebx, ebx
jl 0x1043414
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x10433ec
call fcn.01042099
mov ebx, eax
test ebx, ebx
jl 0x1043414
mov eax, dword [ebp + 8]
and eax, 0xf
je 0x1043402
dec eax
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10433f8
movzx eax, word [esi]
mov ecx, dword [ebp - 4]
push eax
add esi, 2
push esi
call fcn.01042ec9
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x1043422
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
call fcn.01042c9c
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x1043444
mov eax, 0x80070057
jmp 0x104350c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x80070057
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x1043508
cmp dword [ebp - 8], 1
je 0x1043488
cmp dword [ebp - 8], 2
je 0x1043488
cmp dword [ebp - 8], 7
jne 0x1043508
shr dword [ebp - 4], 1
test byte [esi + 8], 0x20
je 0x10434c4
mov eax, dword [esi + 4]
cmp dword [ebp - 4], eax
jb 0x104349c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi]
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp eax, ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov word [edx + ecx*2 - 2], bx
jne 0x1043508
jmp 0x1043505
push dword [ebp - 4]
mov ecx, esi
call fcn.01042b34
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x1043508
mov ecx, dword [ebp - 4]
add ecx, ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
mov ecx, esi
je 0x10434fd
lea eax, [ebp - 0x10]
push eax
call fcn.01042b58
jmp 0x1043508
push dword [ebp - 0x10]
call fcn.01042e3d
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x104369e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
je 0x10436f6
cmp word [eax], si
je 0x10436f6
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10436cd
test al, 0x10
jne 0x10436cd
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x10436fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10436ef
cmp eax, 3
je 0x10436ef
cmp eax, esi
jle 0x10436eb
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x10436fb
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
jmp 0x10436fb
mov esi, 0x80070057
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10439ad
Capabilities:
Copy file
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.010424ee
xor edi, edi
push 2
lea esi, [ebp - 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.0104396d
mov esi, eax
cmp esi, edi
jl 0x1043b5d
cmp dword [ebp - 4], edi
jne 0x1043b5d
push ebx
lea ecx, [ebp - 0x14]
call fcn.010424ee
push 1
lea esi, [ebp - 4]
lea eax, [ebp - 0x14]
call fcn.0104396d
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x1043b47
cmp dword [ebp - 4], edi
jne 0x1043a16
push edi
lea eax, [ebp - 0x14]
call fcn.0104396d
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jl 0x1043b47
cmp dword [ebp - 4], edi
je 0x1043b47
lea ecx, [ebp - 0x14]
call fcn.010425a8
lea eax, [eax + eax + 4]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
cmp ebx, edi
pop ecx
mov dword [ebp - 4], ebx
jne 0x1043a4e
mov esi, 0x8007000e
jmp 0x1043b4a
lea ecx, [ebp - 0x14]
call fcn.010425a8
lea ecx, [eax + eax + 4]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call fcn.010425a8
mov ecx, eax
shl ecx, 1
mov eax, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x20]
call fcn.010425a8
lea eax, [eax + eax + 4]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x1043aaf
push dword [ebp - 4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1043a44
lea ecx, [ebp - 0x20]
call fcn.010425a8
lea ecx, [eax + eax + 4]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call fcn.010425a8
mov ecx, eax
shl ecx, 1
mov eax, ecx
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
and dword [ebp - 0x40], 0
mov esi, dword [ebp - 4]
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ebx
mov word [ebp - 0x30], 0x1614
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1043b27
mov dword [ebp - 8], 0x80004005
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov esi, dword [ebp - 8]
lea ecx, [ebp - 0x14]
call fcn.01042e75
lea ecx, [ebp - 0x20]
call fcn.01042e75
pop ebx
jmp 0x1043b65
lea ecx, [ebp - 0x20]
call fcn.01042e75
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x104410f
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 8]
push eax
push dword [0x10f0260]
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x1044140
mov edi, 0x80004005
jmp 0x10441d4
push ebx
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
cmp ebx, edi
pop ecx
jne 0x1044155
mov edi, 0x8007000e
jmp 0x10441d3
push ebx
push esi
push edi
push dword [0x10f0260]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x104419c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, edi
jne 0x1044178
push 0x57
pop eax
cmp eax, edi
jg 0x1044187
call esi
cmp eax, edi
jne 0x1044183
push 0x57
pop eax
mov edi, eax
jmp 0x10441cc
call esi
cmp eax, edi
jne 0x1044190
push 0x57
pop eax
and eax, 0xffff
or eax, 0x80070000
jmp 0x1044183
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1008648
push ebx
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x10441bd
mov edi, 0x80004005
jmp 0x10441cc
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x10441cc
movzx eax, word [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x104497e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0xc]
call fcn.010424ee
lea ebx, [edi + 0x28]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [edi + 0x1c], eax
dec eax
mov dword [edi + 0x30], esi
je 0x1044a77
dec eax
je 0x1044a4e
dec eax
je 0x1044a28
dec eax
je 0x10449ff
dec eax
je 0x10449d6
dec eax
jne 0x1044ac4
push 0x1008748
jmp 0x1044ab6
mov eax, dword [edi + 0x9c]
cmp eax, esi
je 0x10449f5
push 4
lea ecx, [edi + 0x6c]
push ecx
push 4
push esi
push 0x1006768
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1008720
jmp 0x1044ab6
mov eax, dword [edi + 0x9c]
cmp eax, esi
je 0x1044a1e
push 4
lea ecx, [edi + 0x6c]
push ecx
push 4
push esi
push 0x1006768
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10086fc
jmp 0x1044ab6
mov eax, dword [edi + 0x9c]
cmp eax, esi
je 0x1044a47
push 4
lea ecx, [edi + 0x6c]
push ecx
push 4
push esi
push 0x1006768
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov word [ebx], 8
jmp 0x1044ac4
mov eax, dword [edi + 0x9c]
cmp eax, esi
je 0x1044a6d
push 4
lea ecx, [edi + 0x70]
push ecx
push 4
push esi
push 0x1006768
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [edi + 0x14]
mov word [ebx], 3
jmp 0x1044ac1
mov eax, dword [edi + 0x9c]
cmp eax, esi
je 0x1044ab1
push 4
lea ecx, [edi + 0x70]
push ecx
push 4
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1006768
push eax
call esi
push 4
lea eax, [edi + 0x6c]
push eax
push 4
push 0
push 0x100672c
push dword [edi + 0x9c]
call esi
xor esi, esi
push 0x10086d0
mov word [ebx], 8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi + 0x30], eax
mov eax, dword [edi + 8]
cmp eax, esi
je 0x1044aea
cmp word [ebx], si
je 0x1044aea
push dword [edi + 0x18]
mov ecx, dword [eax]
sub esp, 0x10
mov edi, esp
push dword [ebp + 0xc]
mov esi, ebx
push dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0xc]
lea ecx, [ebp - 0xc]
call fcn.01042e75
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x1045d58
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [0x10cf230]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov esi, ecx
push edi
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x264], eax
call fcn.010424ee
lea ecx, [ebp - 0x2cc]
call fcn.0107e139
lea eax, [ebp - 0x2cc]
xor ebx, ebx
push eax
mov dword [ebp - 0x260], 1
mov dword [ebp - 0x258], ebx
call fcn.010413d9
mov edi, eax
cmp edi, ebx
jl 0x1045ed3
lea eax, [ebp - 0x270]
push eax
push ebx
lea ecx, [ebp - 0x2cc]
call fcn.0107f08b
mov edi, eax
cmp edi, ebx
jl 0x1045ed3
cmp dword [ebp + 8], 0x10
je 0x1045de4
mov edi, 0x80070057
jmp 0x1045ed3
push 0xffffffffffffffff
push 0x100229c
lea ecx, [ebp - 0x270]
call fcn.01043145
mov edi, eax
cmp edi, ebx
jl 0x1045ed3
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x25c], eax
je 0x1045ea9
test byte [ebp - 0x254], 0x10
jne 0x1045e8e
cmp dword [ebp + 0xc], ebx
je 0x1045e88
cmp dword [ebp - 0x260], ebx
lea ecx, [ebp - 0x2cc]
lea eax, [ebp - 0x228]
je 0x1045e4e
push 0xffffffffffffffff
push eax
call fcn.0107e578
jmp 0x1045e54
push eax
call fcn.0107f28d
mov edi, eax
cmp edi, ebx
jl 0x1045e8e
push ebx
push ebx
push 0x1002424
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2cc]
push eax
push dword [esi + 0x5c]
mov dword [ebp - 0x260], ebx
call fcn.01088184
inc dword [esi + 0x70]
push edi
push 2
mov ecx, esi
call fcn.0104497e
inc dword [ebp - 0x258]
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1045e22
cmp dword [ebp - 0x25c], ebx
je 0x1045ebd
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, ebx
jl 0x1045ed3
mov eax, dword [ebp - 0x264]
cmp eax, ebx
je 0x1045ed3
mov ecx, dword [ebp - 0x258]
mov dword [eax], ecx
lea ecx, [ebp - 0x2cc]
call fcn.0104163c
lea ecx, [ebp - 0x270]
call fcn.01042e75
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.01041c5f
leave
ret 0xc
Function at 0x104e74d
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push dword [esi + 0x78]
xor ebx, ebx
lea ecx, [ebp - 8]
mov dword [ebp - 4], ebx
call fcn.01043b97
cmp dword [esi + 0x10], ebx
je 0x104e776
cmp dword [esi + 0x14], ebx
jne 0x104e814
mov eax, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x7c], eax
call edi
cmp eax, ebx
mov dword [esi + 0x10], eax
je 0x104e7c3
push ebx
push ebx
push ebx
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x14], eax
je 0x104e7c3
mov eax, dword [esi]
push esi
call dword [eax + 4]
lea eax, [esi + 0x1c]
push eax
push ebx
push esi
push 0x104e6de
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x18], eax
jne 0x104e813
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x104e7d3
call edi
jmp 0x104e7df
call edi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 4], eax
jge 0x104e813
mov eax, dword [esi + 0x10]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x104e7f9
push eax
call edi
mov dword [esi + 0x10], ebx
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x104e806
push eax
call edi
mov dword [esi + 0x14], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x104e813
push eax
call edi
mov dword [esi + 0x18], ebx
pop edi
mov eax, dword [ebp - 8]
pop esi
cmp eax, ebx
pop ebx
je 0x104e823
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x105f133
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x10cf230]
mov dword [ebp + 0x74], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x9c
call esi
test eax, eax
jne 0x105f16b
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call esi
xor eax, eax
xor ecx, ecx
inc eax
cmp dword [ebp - 0x18], eax
pop esi
sete cl
cmp dword [ebp - 0x24], 5
mov dword [0x10f1310], ecx
jb 0x105f188
mov dword [0x10f1314], eax
mov ecx, dword [ebp + 0x74]
call fcn.01041c5f
add ebp, 0x78
leave
ret

Function at 0x105fd59
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0105fd2c
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x105fd8c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x105fd8c
push dword [ebp + 0x10]
call fcn.0105f56c
pop ecx
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x105fd96
Capabilities:
Get file size

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
jne 0x105fdbb
push dword [esp + 0x10]
call fcn.0105f56c
pop ecx
mov esi, eax
mov eax, esi
pop esi
ret

Function at 0x105fdc4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0105fd2c
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x105fe0c
push edi
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x105fe00
cmp dword [ebp - 4], edi
je 0x105fe0b
push dword [ebp + 0x18]
call fcn.0105f56c
pop ecx
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x105fe16
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0105fd2c
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x105fe5e
push edi
mov edi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x105fe52
cmp dword [ebp - 4], edi
je 0x105fe5d
push dword [ebp + 0x18]
call fcn.0105f56c
pop ecx
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x1060430
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [0x10f134c], edi
je 0x106043f
xor eax, eax
pop edi
ret
push esi
mov esi, 0x10f1360
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10f134c], edi
jne 0x106048c
push 0x10f1350
push edi
push edi
push 0x1060367
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [0x10f134c], eax
jne 0x106047f
push dword [esp + 0xc]
call fcn.0105f56c
pop ecx
mov edi, eax
jmp 0x106048c
push dword [0x10f1358]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, edi
pop edi
ret

Function at 0x1060b07
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
cmp dword [0x10f1310], edi
jne 0x1060b22
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1060b57
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01081f90
mov ebx, esp
push edi
push edi
push esi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1060b57
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1060b64
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
cmp dword [0x10f1310], edi
jne 0x1060b7f
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1060bb4
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01081f90
mov ebx, esp
push edi
push edi
push esi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1060bb4
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret