joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f010
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp byte [ecx + 0x1cc], 0
push esi
push edi
je 0x1002f067
cmp dword [ebp + 0xc], 0
jle 0x1002f047
cmp dword [ebp + 8], 0
sete al
movzx edx, al
mov eax, dword [ecx + 0x1c8]
push edx
call fcn.10023620
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 8], 0
sete al
movzx edx, al
mov eax, dword [ecx + 0x1c8]
push edx
call fcn.10023720
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp byte [ecx + 0x1d4], 0
je 0x1002f078
mov ecx, dword [ecx + 0x1d0]
jmp 0x1002f07e
mov ecx, dword [ecx + 0x1c4]
mov esi, dword [ebp + 0xc]
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
push esi
push edx
call eax
call fcn.100025a0
test esi, esi
mov esi, eax
mov eax, dword [esi + 0x20]
jle 0x1002f18b
test eax, eax
je 0x1002f24c
mov edi, dword [eax + 0x26c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [0x1016cc7c]
cmp ecx, 0x14
jb 0x1002f24c
mov dword [0x1016cc7c], eax
cmp edi, 0xfffffffe
je 0x1002f13b
mov esi, dword [esi + 0x20]
mov eax, esi
call fcn.1002e160
test eax, eax
je 0x1002f24c
mov eax, esi
call fcn.1002d3f0
test eax, eax
je 0x1002f24c
mov eax, esi
call fcn.1002d380
test eax, eax
je 0x1002f24c
mov eax, esi
call fcn.1002d3f0
mov ecx, eax
mov eax, ecx
call fcn.1007e510
test al, al
je 0x1002f24c
mov edx, dword [ecx + 0x148]
test edx, edx
je 0x1002f24c
sub edx, dword [ecx + 0x128]
mov eax, ecx
call fcn.10082d20
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 0x1dc], 0
je 0x1002f24c
mov eax, dword [ecx + 0x1dc]
test eax, eax
je 0x1002f24c
cmp dword [eax + 0x124], 0
je 0x1002f24c
mov eax, ecx
call fcn.1002d480
test eax, eax
je 0x1002f24c
mov eax, ecx
call fcn.1002d4a0
mov ecx, eax
test ecx, ecx
je 0x1002f24c
jmp 0x1002f107
test eax, eax
je 0x1002f24c
mov edi, dword [eax + 0x26c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [0x1016cc7c]
cmp edx, 0x14
jb 0x1002f24c
mov dword [0x1016cc7c], eax
cmp edi, 0xfffffffe
je 0x1002f1ed
mov esi, dword [esi + 0x20]
mov eax, esi
call fcn.1002e160
test eax, eax
je 0x1002f24c
mov eax, esi
call fcn.1002d3f0
test eax, eax
je 0x1002f24c
mov eax, esi
call fcn.1002d380
test eax, eax
je 0x1002f24c
mov eax, esi
call fcn.1002d3f0
mov ecx, eax
jmp 0x1002f224
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 0x1dc], 0
je 0x1002f24c
mov eax, dword [ecx + 0x1dc]
test eax, eax
je 0x1002f24c
cmp dword [eax + 0x124], 0
je 0x1002f24c
mov eax, ecx
call fcn.1002d480
test eax, eax
je 0x1002f24c
mov eax, ecx
call fcn.1002d4a0
mov ecx, eax
test ecx, ecx
je 0x1002f24c
mov eax, ecx
call fcn.1007e510
test al, al
je 0x1002f24c
mov eax, dword [ecx + 0x148]
cmp eax, dword [ecx + 0x13c]
je 0x1002f24c
mov edx, dword [ecx + 0x128]
add edx, eax
mov eax, ecx
call fcn.10082d20
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1002ffc0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
cmp byte [esi + 0x30], 1
je 0x1002ffd8
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
mov byte [esi + 0x30], 1
call edx
cmp dword [esi + 0x84], esi
je 0x1002ffe4
mov byte [esi + 0x64], 1
mov eax, dword [esi + 0x12c]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov ecx, dword [esi + 0x12c]
neg eax
sbb eax, eax
neg eax
add eax, 4
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x15e
push 1
call fcn.1002e320
mov edx, dword [esi + 0x12c]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0x12c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, 1
pop esi
ret
Function at 0x100333d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x1cd], 0
push edi
je 0x100334bc
cmp byte [esi + 0x1b8], 0
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
je 0x10033448
fld qword [esi + 0x130]
mov dword [esp + 0x10], 0
call fcn.100d7c00
fild dword [esi + 0x144]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x28]
fadd qword [esi + 0x130]
mov dword [esp + 0x18], eax
call fcn.100d7c00
push edi
push ebx
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x100334c7
mov dword [esi + 0x14c], edi
push edi
push ebx
mov ecx, esi
call fcn.10083470
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1003347c
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1003347c
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1003347c
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100334b2
mov esi, dword [eax + 0x200]
test esi, esi
je 0x100334b2
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x100334b2
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100334b2
mov ecx, dword [esi + 0x12c]
push 0
push ecx
call edi
call fcn.100025a0
call fcn.1000b140
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x200]
test ecx, ecx
je 0x10033448
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push edi
call eax
jmp 0x100334b2

Function at 0x1003c080
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x101297ed
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x178], eax
push ebx
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x18c]
mov dword fs:[0], eax
xor ebx, ebx
cmp byte [0x101680ba], bl
je 0x1003c161
push 0x110
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.100d6e40
add esp, 0xc
lea ecx, [esp + 0x74]
push ecx
mov dword [esp + 0x78], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1003c0fa
mov byte [0x101680ba], bl
jmp 0x1003c161
cmp dword [esp + 0x78], 5
jbe 0x1003c0f2
lea eax, [esp + 0x10]
call fcn.10085840
push ebx
push ebx
push 0xc
mov edi, 0x10142b64
mov esi, eax
mov dword [esp + 0x1a0], ebx
call fcn.10085960
cmp byte [esp + 0x68], bl
jne 0x1003c146
cmp byte [0x101680bb], bl
je 0x1003c136
call fcn.1003c190
jmp 0x1003c13b
mov al, byte [0x1016cc8d]
cmp al, bl
je 0x1003c146
mov byte [0x1016cc8c], 1
lea edx, [esp + 0x10]
push edx
mov byte [0x101680ba], bl
mov dword [esp + 0x198], 0xffffffff
call fcn.100858a0
mov al, byte [0x1016cc8c]
mov ecx, dword [esp + 0x18c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.100cf604
add esp, 0x188
ret
Function at 0x1003c280
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x101287a6
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x16c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x184]
mov dword fs:[0], eax
mov eax, dword [esp + 0x19c]
mov ebp, dword [esp + 0x198]
lea edi, [esp + 0x58]
mov esi, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.10062500
mov eax, dword [esp + 0x194]
push esi
mov ebx, edi
mov dword [esp + 0x190], 0
call fcn.10062770
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
mov ecx, 0x64
mov edi, eax
mov dword [esp + 0x24], vtable.t_cuObject.0
mov dword [esp + 0x28], 0xffffffff
push 0xff
mov eax, ecx
lea esi, [esp + 0x28]
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], vtable.t_cuCanvas.0
mov byte [esp + 0x38], bl
mov dword [esp + 0x44], ebx
mov byte [esp + 0x48], bl
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x34], ebx
call fcn.10079510
mov byte [esp + 0x18c], 1
lea eax, [esp + 0x64]
cmp byte [esp + 0x174], bl
jne 0x1003c375
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push ebx
push edx
push ecx
add eax, 4
push ebp
push eax
xor eax, eax
lea esi, [esp + 0x38]
call fcn.1007ab80
push edi
mov byte [esp + 0x1f], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], vtable.t_cuCanvas.0
cmp eax, ebx
je 0x1003c3cd
mov edx, dword [esp + 0x50]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esp + 0x4c], ebx
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x1003c3e0
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x24], vtable.t_cuObject.0
mov dword [esp + 0x58], vtable.t_str.0
cmp byte [esp + 0x174], bl
jne 0x1003c40e
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x64]
cmp eax, ecx
je 0x1003c40e
push eax
call fcn.100cf89b
add esp, 4
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x184]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.100cf604
add esp, 0x17c
ret 0xc
Function at 0x1003fc20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1003fc53
mov eax, dword [eax + 0x1e8]
test eax, eax
je 0x1003fc53
mov eax, dword [eax + 0x12c]
test eax, eax
je 0x1003fc53
push 0
push eax
call edi
call fcn.100025a0
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1003fc89
mov esi, dword [eax + 0x200]
test esi, esi
je 0x1003fc89
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x1003fc89
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1003fc89
mov eax, dword [esi + 0x12c]
push 0
push eax
call edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100415a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1012eca1
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
call fcn.1001caf0
mov dword [esi], vtable.t_PicFaceUserCollectPanel.0
xor edi, edi
mov dword [esi + 0x318], edi
mov dword [esi + 0x31c], edi
mov dword [esi + 0x320], edi
mov dword [esi + 0x324], edi
mov edx, fcn.100cf978
mov ebp, fcn.100cfa42
mov ebx, fcn.100cf89b
mov dword [esi + 0x328], edx
mov dword [esi + 0x32c], ebp
mov dword [esi + 0x330], ebx
mov dword [esi + 0x334], edi
mov dword [esi + 0x338], edi
mov dword [esi + 0x33c], edi
mov dword [esi + 0x340], edi
mov dword [esi + 0x344], edx
mov dword [esi + 0x348], ebp
mov dword [esi + 0x34c], ebx
mov dword [esi + 0x350], edi
mov dword [esi + 0x354], edi
mov dword [esi + 0x358], edi
mov dword [esi + 0x35c], edi
mov dword [esi + 0x360], edx
mov dword [esi + 0x364], ebp
mov dword [esi + 0x368], ebx
mov dword [esi + 0x36c], edi
mov dword [esi + 0x370], edi
mov dword [esi + 0x374], edi
mov dword [esi + 0x378], edi
mov dword [esi + 0x37c], edx
mov dword [esi + 0x380], ebp
mov dword [esi + 0x384], ebx
lea eax, [esi + 0x388]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
push eax
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], ebp
mov dword [eax + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3bc], edi
mov dword [esi + 0x3c0], edi
mov dword [esi + 0x3c4], edi
mov dword [esi + 0x3c8], edi
mov dword [esi + 0x3cc], fcn.100cf978
mov dword [esi + 0x3d0], ebp
mov dword [esi + 0x3d4], ebx
mov al, 1
mov byte [esi + 0x3dc], al
mov byte [esi + 0x3dd], al
mov dword [esi + 0x2ec], edi
mov dword [esi + 0x2f0], edi
mov dword [esi + 0x2f4], edi
mov dword [esi + 0x2f8], edi
mov dword [esi + 0x2fc], edi
mov dword [esi + 0x300], edi
mov dword [esi + 0x314], edi
mov dword [esi + 0x304], edi
mov dword [esi + 0x308], edi
mov dword [esi + 0x310], edi
mov dword [esi + 0x30c], edi
mov dword [esi + 0x2e8], edi
mov dword [esi + 0x3d8], edi
mov eax, 0xffffffff
mov dword [esi + 0x3e0], eax
mov dword [esi + 0x3e4], eax
mov dword [esi + 0x3e8], edi
mov dword [esi + 0x3ec], edi
mov dword [esi + 0x3f0], 2
mov dword [esi + 0x3f4], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x10046ad0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x1012c398
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
xor ebx, ebx
cmp dword [eax + 4], ebx
je 0x10046b7a
cmp byte [eax + 0x11c], bl
je 0x10046b13
add eax, 0xc
jmp 0x10046b16
mov eax, dword [eax + 8]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10046b7a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp], eax
add eax, 2
push eax
call fcn.100cedc2
mov ecx, dword [ebp]
add esp, 4
push ebx
mov edi, eax
lea eax, [esp + 0x68]
push eax
push ecx
push edi
push esi
mov dword [esp + 0x78], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x10046b7e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.100d1d34
add esp, 4
xor al, al
jmp 0x10046bcf
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x14]
push edx
call fcn.10073380
push ebx
mov dword [esp + 0x5c], ebx
mov ebx, dword [esp + 0x68]
push str.sogouTest
lea eax, [esp + 0x1c]
call fcn.100751c0
push edi
mov bl, al
call fcn.100d1d34
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x34]
mov dword [ecx], eax
mov eax, dword [esp + 0x70]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [eax], edx
call fcn.10073430
mov al, bl
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0x10
Function at 0x10046fd0
Capabilities:
Get common file path

Disassembly:
cmp dword [edi + 0x120], 0
je 0x10046fe3
mov dword [edi + 0x120], 0
push ebp
push esi
lea esi, [edi + 8]
mov ecx, 1
mov dword [edi + 4], 0
call fcn.100632f0
cmp byte [esi + 0x114], 0
je 0x10047007
add esi, 4
jmp 0x10047009
mov esi, dword [esi]
xor eax, eax
mov word [esi + 4], ax
call fcn.100680e0
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x1004704a
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1004704a
push esi
push 1
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1004704a
xor esi, esi
push esi
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push 0x1013c82c
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push str.SogouInputComponentsPicfaceCollections
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
add esp, 0x18
pop esi
mov al, 1
pop ebp
ret

Function at 0x10047090
Capabilities:
Get common file path

Disassembly:
cmp dword [edi + 0x120], 0
je 0x100470a3
mov dword [edi + 0x120], 0
push ebp
push esi
lea esi, [edi + 8]
mov ecx, 1
mov dword [edi + 4], 0
call fcn.100632f0
cmp byte [esi + 0x114], 0
je 0x100470c7
add esi, 4
jmp 0x100470c9
mov esi, dword [esi]
xor eax, eax
mov word [esi + 4], ax
call fcn.100680e0
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x1004710a
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1004710a
push esi
push 1
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1004710a
xor esi, esi
push esi
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push 0x1013c82c
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push str.SogouInputComponentsPicfaceJson
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push 0x1013c82c
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push str.SGUserCollection.json
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
add esp, 0x28
pop esi
mov al, 1
pop ebp
ret

Function at 0x10047800
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x10047811
xor al, al
pop esi
pop ecx
ret 4
push 8
call fcn.100cfcae
add esp, 4
test eax, eax
je 0x1004782a
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [esp + 4], eax
jmp 0x10047832
mov dword [esp + 4], 0
push ebx
push ebp
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 0x36c]
call fcn.10023830
mov ebp, dword [edi + 0x3c0]
xor esi, esi
test ebp, ebp
jle 0x1004789b
mov ecx, dword [edi + 0x3bc]
mov ebx, dword [ecx + esi*4]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1004786d
inc esi
cmp esi, ebp
jl 0x10047850
jmp 0x1004789b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0xc]
push 0
push 0
push edx
push 0x10047b70
push 0
push 0
call fcn.100d1a8f
mov ecx, dword [edi + 0x3bc]
add esp, 0x18
mov dword [ecx + esi*4], eax
test eax, eax
jne 0x100478c9
mov edx, dword [esp + 0xc]
push 0
push 0
push edx
push 0x10047b70
push 0
push 0
call fcn.100d1a8f
mov dword [esp + 0x2c], eax
add esp, 0x18
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 0x3bc]
call fcn.10023830
pop ebp
pop ebx
mov al, 1
pop esi
pop ecx
ret 4
Function at 0x1004a3c0
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp byte [edi + 0x112], 0
push esi
lea esi, [edi + 4]
mov eax, esi
jne 0x1004a3d5
mov eax, dword [esi + 0x108]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [esi + 0x10e], 0
jne 0x1004a3f3
mov esi, dword [esi + 0x108]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1004a415
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
call fcn.1004a1c0
test al, al
sete al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x1004a420
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x800], eax
push edi
mov edi, dword [esp + 0x80c]
push 0x1016f388
push edi
call fcn.100d2590
add esp, 8
test eax, eax
jne 0x1004a589
mov eax, 0x4000
test word [0x1016f38e], ax
je 0x1004a582
push esi
push edi
push str._s.
lea edx, [esp + 0x10]
call fcn.1004b060
add esp, 8
push 0x1016f138
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1004a55a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea esp, [esp]
mov ecx, 0x1013fd6c
mov eax, 0x1016f164
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004a4d6
test dx, dx
je 0x1004a4d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004a4d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004a4b0
xor eax, eax
jmp 0x1004a4db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004a542
mov ecx, 0x10142b5c
mov eax, 0x1016f164
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004a516
test dx, dx
je 0x1004a512
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004a516
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004a4f0
xor eax, eax
jmp 0x1004a51b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004a542
push 0x1016f164
push edi
push 0x1013c7c8
lea edx, [esp + 0x18]
call fcn.1004b060
lea edx, [esp + 0x18]
push 1
push edx
call fcn.1004a420
add esp, 0x14
push 0x1016f138
push esi
call ebx
test eax, eax
jne 0x1004a4a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
cmp byte [esp + 0x814], 0
pop esi
je 0x1004a589
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.100cf604
add esp, 0x804
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x804]
pop edi
xor ecx, esp
call fcn.100cf604
add esp, 0x804
ret
Function at 0x1004a5a0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x1012a33b
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x112], 0
lea ebp, [esi + 4]
mov eax, ebp
jne 0x1004a5f1
mov eax, dword [ebp + 0x108]
push 2
add eax, 4
push 0x10143644
push eax
call fcn.100d2c37
add esp, 0xc
test eax, eax
je 0x1004a6f2
mov ecx, esi
call fcn.1004a200
test al, al
je 0x1004a627
cmp byte [esp + 0x144], 0
sete al
jmp 0x1004a6f4
lea edi, [esp + 0x14]
call fcn.1004b080
mov ebx, edi
mov eax, esi
mov dword [esp + 0x13c], 0
call fcn.1004aa10
test al, al
je 0x1004a66e
mov eax, edi
call fcn.1004a040
test al, al
jne 0x1004a66e
push 0
mov ecx, edi
call fcn.1004a5a0
test al, al
jne 0x1004a66e
mov eax, edi
call fcn.100023e0
xor al, al
jmp 0x1004a6f4
cmp byte [ebp + 0x10e], 0
mov eax, ebp
jne 0x1004a67f
mov eax, dword [ebp + 0x108]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1004a6b4
cmp byte [esp + 0x126], al
jne 0x1004a6b0
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x1004a6b0
push eax
call fcn.100cf89b
add esp, 4
xor al, al
jmp 0x1004a6f4
cmp byte [ebp + 0x10e], 0
jne 0x1004a6c3
mov ebp, dword [ebp + 0x108]
lea ecx, [ebp + 4]
call fcn.1004c540
call fcn.1004aab0
cmp byte [esp + 0x126], 0
jne 0x1004a6f2
mov eax, dword [esp + 0x120]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x1004a6f2
push eax
call fcn.100cf89b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.100cf604
add esp, 0x12c
ret 4
Function at 0x1004a720
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1012a33b
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x101636d0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x144]
lea edi, [esp + 0x14]
mov esi, ecx
call fcn.1004b080
mov ebx, edi
mov eax, esi
mov dword [esp + 0x13c], 0
call fcn.1004aa10
test al, al
je 0x1004a7ba
push 0
mov ecx, edi
call fcn.1004a5a0
test al, al
jne 0x1004a7ba
cmp byte [esp + 0x126], al
jne 0x1004a7b3
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x1004a7b3
push eax
call fcn.100cf89b
add esp, 4
xor al, al
jmp 0x1004a88d
cmp byte [esi + 0x112], 0
lea edi, [esi + 4]
mov eax, edi
jne 0x1004a7ce
mov eax, dword [edi + 0x108]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
add eax, 4
push eax
call ebx
cmp byte [edi + 0x10e], 0
mov ecx, edi
jne 0x1004a7f0
mov ecx, dword [edi + 0x108]
cmp byte [ebp + 0x112], 0
lea eax, [ebp + 4]
jne 0x1004a802
mov eax, dword [eax + 0x108]
push 0
add ecx, 4
push ecx
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1004a831
cmp byte [esp + 0x126], al
jne 0x1004a7b3
mov eax, dword [esp + 0x120]
lea edx, [esp + 0x18]
cmp eax, edx
jmp 0x1004a7a8
cmp byte [edi + 0x10e], 0
mov eax, edi
jne 0x1004a842
mov eax, dword [edi + 0x108]
push 0x80
add eax, 4
push eax
call ebx
cmp byte [edi + 0x10e], 0
jne 0x1004a85c
mov edi, dword [edi + 0x108]
lea ecx, [edi + 4]
call fcn.1004c540
call fcn.1004aab0
cmp byte [esp + 0x126], 0
jne 0x1004a88b
mov eax, dword [esp + 0x120]
lea ecx, [esp + 0x18]
cmp eax, ecx
je 0x1004a88b
push eax
call fcn.100cf89b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.100cf604
add esp, 0x12c
ret 4