joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ef537c5
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Resume thread

Disassembly:
mov eax, 0x7ef92f6e
call fcn.7ef890d8
sub esp, 0x60
call dword [0x7ef9606c]
push eax
push str.ts_log._d
lea eax, [ebp - 0x14]
push eax
call fcn.7ef85dd0
add esp, 0xc
and dword [ebp - 4], 0
push dword [ebp - 0x14]
push 0
push 2
call dword [0x7ef96068]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x7ef53827
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 0x10]
call dword [0x7ef960a0]
mov dword [0x7efa5a60], eax
call fcn.7ef52dd8
jmp 0x7ef53937
mov eax, dword [0x7efa59a0]
and eax, 0x40000000
test eax, eax
je 0x7ef53937
mov dword [ebp - 0x58], 0x44
lea eax, [ebp - 0x58]
push eax
call dword [0x7ef96064]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push dword [0x7efa5e10]
call dword [0x7ef96060]
test eax, eax
je 0x7ef53937
push dword [ebp - 0x60]
push str.ts_log._d
lea eax, [ebp - 0x6c]
push eax
call fcn.7ef85dd0
add esp, 0xc
mov byte [ebp - 4], 1
push dword [ebp - 0x6c]
push 0x210
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [0x7ef9605c]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0xf001f
push dword [ebp - 0x10]
call dword [0x7ef960a0]
mov dword [0x7efa5a60], eax
mov eax, dword [0x7efa5a60]
mov ecx, dword [0x7efa59a0]
mov dword [eax], ecx
mov eax, dword [0x7efa5a60]
and dword [eax + 4], 0
call dword [0x7ef9606c]
mov ecx, dword [0x7efa5a60]
mov dword [ecx + 8], eax
push 0x100
call dword [0x7ef9609c]
push eax
mov eax, dword [0x7efa5a60]
add eax, 0xc
push eax
call fcn.7ef862fb
add esp, 0xc
push dword [ebp + 8]
mov eax, dword [0x7efa5a60]
add eax, 0x10c
push eax
call fcn.7ef862c2
pop ecx
pop ecx
mov eax, dword [0x7efa5a60]
mov dword [0x7efa2154], eax
push dword [ebp - 0x64]
call dword [0x7ef96098]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.7ef86114
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.7ef86114
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ef56c7a
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x7efa59a4]
and eax, 0x80
test eax, eax
je 0x7ef56d8a
push 2
lea eax, [ebp - 4]
push eax
push str.TS_LEVEL
call dword [0x7ef96074]
test eax, eax
jne 0x7ef56d8a
push 0x7efa5e18
mov ecx, 0x7efa5e10
call fcn.7ef860eb
movzx eax, al
test eax, eax
je 0x7ef56cc5
jmp 0x7ef56d8a
mov eax, dword [0x7efa59a4]
and eax, 0x100
test eax, eax
je 0x7ef56ce4
push dword [0x7efa5e2c]
call fcn.7ef56d8c
pop ecx
jmp 0x7ef56d8a
mov eax, dword [0x7efa59a4]
and eax, 0x80
test eax, eax
je 0x7ef56d8a
call dword [0x7ef9609c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x7ef56d42
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
je 0x7ef56d2f
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
cmp eax, 0x22
je 0x7ef56d2f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x7ef56d11
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
je 0x7ef56d40
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x7ef56d60
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
je 0x7ef56d60
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
cmp eax, 0x20
je 0x7ef56d60
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x7ef56d42
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x7ef56d74
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
jmp 0x7ef56d60
mov eax, dword [ebp - 8]
movsx eax, byte [eax]
test eax, eax
jne 0x7ef56d8a
push dword [0x7efa5e2c]
call fcn.7ef56d8c
pop ecx
leave
ret
Function at 0x7ef56d8c
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
mov eax, 0x7ef931de
call fcn.7ef890d8
sub esp, 0x18
call dword [0x7ef9609c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x7ef56ddb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
je 0x7ef56dd2
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
cmp eax, 0x22
je 0x7ef56dd2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x7ef56db4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x7ef56df9
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
je 0x7ef56df9
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
cmp eax, 0x20
je 0x7ef56df9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x7ef56ddb
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
je 0x7ef56e17
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x7ef56e17
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x7ef56df9
push dword [ebp + 8]
call fcn.7ef865bd
pop ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
mov eax, dword [0x7efa59a4]
and eax, 0x100
test eax, eax
jne 0x7ef56e4d
mov eax, dword [0x7efa59a4]
and eax, 0x80
test eax, eax
je 0x7ef56e75
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
jne 0x7ef56e75
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.7ef8872b
pop ecx
pop ecx
push 0
push dword [ebp + 8]
push 0x7efa59b8
call fcn.7ef5c94f
add esp, 0xc
mov eax, dword [0x7efa59b8]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x24], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
movsx eax, byte [eax]
test eax, eax
je 0x7ef56ea0
push dword [ebp - 0x1c]
push dword [ebp + 8]
push str.__s___s
lea eax, [ebp - 0x24]
push eax
call fcn.7ef863ab
add esp, 0x10
jmp 0x7ef56eb4
push dword [ebp + 8]
push str.__s_
lea eax, [ebp - 0x24]
push eax
call fcn.7ef863ab
add esp, 0xc
push 0
call dword [0x7ef962c8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x18], eax
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + 0x44]
cmp eax, 3
jne 0x7ef56ee6
mov dword [ebp - 0x10], 1
push 0x7ef96cdc
push str.TS_LEVEL
call dword [0x7ef96070]
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x24]
push dword [ebp - 0x14]
call fcn.7ef56f34
add esp, 0x10
push 0
call fcn.7ef775b3
and byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.7ef86114
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.7ef86114
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ef56f34
Capabilities:
Create process on windows
Set environment variable

Disassembly:
mov eax, 0x7ef931fa
call fcn.7ef890d8
sub esp, 0x74
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x54]
push eax
call dword [0x7ef96064]
push 0
push str.TS_LOADER
call dword [0x7ef96070]
push 0
push str.TS_MODULE0
call dword [0x7ef96070]
and dword [ebp - 0x68], 0
and dword [ebp - 4], 0
push dword [ebp + 8]
call fcn.7ef865bd
pop ecx
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.7ef884fe
add esp, 0xc
and byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.7ef86114
cmp dword [ebp + 0x14], 0
je 0x7ef56fb5
mov eax, dword [ebp - 0x28]
or al, 1
mov dword [ebp - 0x28], eax
and word [ebp - 0x24], 0
mov eax, dword [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x68]
push 0
push dword [ebp - 0x10]
push 0
push 0
push 0
push dword [ebp + 0xc]
push 0
call dword [0x7ef96060]
test eax, eax
jne 0x7ef56ffc
or dword [ebp - 0x74], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.7ef86114
mov eax, dword [ebp - 0x74]
jmp 0x7ef5705d
cmp dword [ebp + 0x10], 0
je 0x7ef5704a
push 0xffffffffffffffff
push dword [ebp - 0x64]
call dword [0x7ef960c0]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x64]
call dword [0x7ef96088]
test eax, eax
je 0x7ef57035
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.7ef86114
mov eax, dword [ebp - 0x78]
jmp 0x7ef5705d
or dword [ebp - 0x7c], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.7ef86114
mov eax, dword [ebp - 0x7c]
jmp 0x7ef5705d
or dword [ebp - 0x80], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.7ef86114
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ef5c8e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [0x7efa2360]
push dword [ebp + 8]
call dword [0x7ef9600c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x7ef5c911
mov eax, dword [ebp - 4]
jmp 0x7ef5c94d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 1
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [0x7ef96010]
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
call dword [section..rdata]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x7ef5d138
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [0x7ef9600c]
test eax, eax
jne 0x7ef5d1b3
mov dword [ebp - 0x110], 0x104
mov dword [ebp - 8], 1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [0x7ef96010]
lea eax, [ebp - 0x10c]
push eax
push 0x7ef97740
push dword [ebp + 8]
call fcn.7ef86788
add esp, 0xc
push dword [ebp - 4]
call dword [section..rdata]
leave
ret
Function at 0x7ef604e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x7ef604fb
mov eax, dword [0x7efa58d8]
mov dword [ebp + 8], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7ef5eeca
pop ecx
push eax
call dword [0x7ef96158]
mov dword [ebp - 4], eax
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x8000000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef60540
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.LoadResource_mod_x_ptr0x_x____0x_x_n
call fcn.7ef54190
add esp, 0x10
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x7ef60561
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x7ef938dd
call fcn.7ef890d8
sub esp, 0x2c
push 2
push 0
push dword [ebp + 8]
call fcn.7ef765b1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x7ef6058a
xor eax, eax
jmp 0x7ef6066d
and dword [ebp - 0x10], 0
and dword [ebp - 0x18], 0
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0x7ef60679
push 0x10
push dword [ebp - 0x1c]
call fcn.7ef60262
cmp dword [ebp - 0x18], 0
jne 0x7ef605bd
cmp dword [ebp - 0x14], 0xffffffff
je 0x7ef60650
cmp dword [ebp - 0x18], 0
je 0x7ef605cb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
jmp 0x7ef605d1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
push 0x10
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
call fcn.7ef6036e
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x7ef60650
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call fcn.7ef60547
mov dword [ebp - 0x28], eax
push 0
call dword [0x7ef96044]
cmp dword [ebp + 0xc], 0
je 0x7ef6064a
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call fcn.7ef604e9
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
call dword [0x7ef96160]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x28]
jae 0x7ef60633
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x7ef60639
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0x2c]
push dword [ebp + 0xc]
call fcn.7ef89190
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x1c]
call fcn.7ef73828
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.7ef86114
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x7ef63dd8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 0
push 1
push dword [ebp + 8]
call fcn.7ef61631
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x7ef63e4f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
jne 0x7ef63e4f
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x200000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef63e30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push dword [eax + 0xc]
push dword [ebp + 8]
push str.GetFileSize__internal__h_x_____x_n
call fcn.7ef54190
add esp, 0xc
push 0
call dword [0x7ef96044]
cmp dword [ebp + 0xc], 0
je 0x7ef63e44
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
jmp 0x7ef63e8d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x7ef960e4]
mov dword [ebp - 8], eax
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x200000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef63e8a
push dword [ebp - 8]
push dword [ebp + 8]
push str.GetFileSize__internal__h_x_____x_n
call fcn.7ef54190
add esp, 0xc
mov eax, dword [ebp - 8]
leave
ret 8
Function at 0x7ef640ea
Capabilities:
Delete file

Disassembly:
mov eax, 0x7ef93b28
call fcn.7ef890d8
sub esp, 0x15c
and dword [ebp - 0x160], 0
and dword [ebp - 0x158], 0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
call dword [0x7ef960b0]
mov dword [ebp - 0x14], eax
cmp dword [0x7efa5dd0], 5
jge 0x7ef64264
push 0
lea eax, [ebp - 0x160]
push eax
push 8
push dword [ebp + 8]
call fcn.7ef80086
add esp, 0x10
test eax, eax
je 0x7ef64264
cmp dword [ebp - 0x158], 0
je 0x7ef64264
mov eax, dword [ebp - 0x158]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x168], eax
push dword [ebp - 0x168]
call fcn.7ef7066d
test eax, eax
je 0x7ef6419e
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x20
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef64195
push dword [ebp + 8]
push str.DeleteFile__s____0__Loaded_as_DLL_EXE__n
call fcn.7ef54190
pop ecx
pop ecx
and dword [ebp - 0x10], 0
jmp 0x7ef64262
cmp dword [ebp - 0x15c], 3
jne 0x7ef641de
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x20
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef641cd
push dword [ebp + 8]
push str.DeleteFile__s____0__already_deleted__n
call fcn.7ef54190
pop ecx
pop ecx
push 2
call dword [0x7ef96044]
and dword [ebp - 0x10], 0
jmp 0x7ef64262
mov eax, dword [ebp - 0x158]
and dword [eax + 0x44], 0
push dword [ebp - 0x14]
call dword [0x7ef96044]
cmp dword [ebp - 0x15c], 0
jne 0x7ef64229
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x20
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef64220
push dword [ebp + 8]
push str.DeleteFile__internal_only___s____1_n
call fcn.7ef54190
pop ecx
pop ecx
mov dword [ebp - 0x10], 1
jmp 0x7ef64262
push dword [ebp - 0x160]
call dword [0x7ef961ac]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x20
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef64262
push dword [ebp - 0x10]
push dword [ebp + 8]
push str.DeleteFile__cached_extracted___s_____x_n
call fcn.7ef54190
add esp, 0xc
jmp 0x7ef642a5
push dword [ebp - 0x14]
call dword [0x7ef96044]
push dword [ebp + 8]
call dword [0x7ef961ac]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x200000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef642a5
push dword [ebp - 0x10]
push dword [ebp + 8]
push str.DeleteFile__system___s_____x_n
call fcn.7ef54190
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x164], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.7ef86114
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x7ef64324
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, 0x7ef93b51
call fcn.7ef890d8
sub esp, 0x54
mov eax, dword [ebp + 8]
cmp eax, dword [0x7efa2480]
jne 0x7ef64354
push dword [ebp + 8]
call dword [0x7ef960b8]
or dword [0x7efa2480], 0xffffffff
push 1
pop eax
jmp 0x7ef6451a
push 1
push 0
push dword [ebp + 8]
call fcn.7ef61631
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x7ef64497
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x100000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef64398
push dword [ebp + 8]
push str.CloseHandle__internal__:_h_x_n
call fcn.7ef54190
pop ecx
pop ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0xffffffff
je 0x7ef643b1
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [0x7ef960b8]
mov eax, dword [ebp - 0x10]
or dword [eax], 0xffffffff
call dword [0x7ef960b0]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x28]
shr eax, 0x13
and eax, 3
cmp eax, 2
jne 0x7ef64423
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
cmp dword [eax + 0x44], 2
jne 0x7ef64423
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x5c], eax
and dword [ebp - 4], 0
push dword [ebp - 0x5c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.7ef61550
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
call dword [0x7ef961ac]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.7ef86114
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [eax + 0x44], 3
push 0x7efa5ba8
call dword [0x7ef96168]
mov eax, dword [0x7efa5bfc]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x50]
call fcn.7ef67c14
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x58], eax
mov eax, dword [0x7efa5bfc]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x58]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x54]
call fcn.7ef676ae
mov eax, dword [ebp + 8]
cmp eax, dword [0x7efa2484]
jne 0x7ef6447c
and dword [0x7efa5c24], 0
or dword [0x7efa2484], 0xffffffff
push 0x7efa5ba8
call dword [0x7ef96164]
push 0
call dword [0x7ef96044]
push 1
pop eax
jmp 0x7ef6451a
push dword [ebp + 8]
call fcn.7ef695c2
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x7ef64517
push dword [ebp + 8]
call dword [0x7ef960b8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x100000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
jne 0x7ef644eb
cmp dword [ebp - 0x18], 0
jne 0x7ef64517
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 8
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef64517
cmp dword [ebp - 0x18], 0
jne 0x7ef644fa
mov dword [ebp - 0x60], str._failed
jmp 0x7ef64501
mov dword [ebp - 0x60], str.success
push dword [ebp - 0x60]
push dword [ebp - 0x18]
push dword [ebp + 8]
push str.CloseHandle__extern__hObject_x_____d__s_n
call fcn.7ef54190
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x7ef661e6
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7ef65ea5
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x7ef66219
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x7ef961c0]
mov dword [ebp - 8], eax
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x40
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef66262
cmp dword [ebp - 4], 0
je 0x7ef6623f
mov dword [ebp - 0xc], str.Internally_handled
jmp 0x7ef66246
mov dword [ebp - 0xc], str.System_handled
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.CopyFile__s__s_fail_if_exist_d_____d__s_n
call fcn.7ef54190
add esp, 0x18
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x7ef668fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7efa5bc0], 0
je 0x7ef6692d
push dword [ebp + 8]
push dword [0x7efa5bc0]
push dword [ebp + 0xc]
call fcn.7ef862fb
add esp, 0xc
push dword [0x7efa5bc0]
call fcn.7ef86136
pop ecx
inc eax
jmp 0x7ef66939
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x7ef960d8]
pop ebp
ret 8
Function at 0x7ef695c2
Capabilities:
Read file via mapping

Disassembly:
mov eax, 0x7ef93eb9
call fcn.7ef890d8
sub esp, 0x4c
mov eax, dword [0x7efa5c50]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x40]
call fcn.7ef856b8
and dword [ebp - 4], 0
mov eax, dword [0x7efa5c4c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.7ef69ffa
mov eax, dword [0x7efa5c4c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
movzx eax, al
neg eax
sbb eax, eax
inc eax
movzx eax, al
test eax, eax
je 0x7ef69777
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x28]
and eax, 7
test eax, eax
jne 0x7ef696cf
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x28]
shr eax, 0x11
and eax, 3
cmp eax, 1
jne 0x7ef696cf
push 0
push 0
push 0
push 4
push dword [ebp + 8]
call dword [0x7ef960a0]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x7ef696cf
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x4c], eax
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push dword [ebp - 0x4c]
call fcn.7ef6299c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x7ef696c6
push 0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
push dword [eax + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.7ef63b27
push dword [ebp - 0x20]
call fcn.7ef64324
push dword [ebp - 0x1c]
call dword [0x7ef961e8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x7ef69707
mov ecx, dword [ebp - 0x2c]
call fcn.7ef86114
push 1
pop eax
and eax, 1
test eax, eax
je 0x7ef696ff
push dword [ebp - 0x2c]
call fcn.7ef87197
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
jmp 0x7ef6970b
and dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [0x7efa5c4c]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x54]
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x50]
call fcn.7ef69aff
mov eax, dword [0x7efa2154]
mov eax, dword [eax]
and eax, 0x2000000
neg eax
sbb eax, eax
neg eax
movzx eax, al
test eax, eax
je 0x7ef69750
push dword [ebp + 8]
push str.closing_open_memory_map_:__x_n
call fcn.7ef54190
pop ecx
pop ecx
push dword [ebp + 8]
call dword [0x7ef960b8]
mov dword [ebp - 0x38], 1
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x7ef69772
mov ecx, dword [ebp - 0x14]
call fcn.7ef856ec
mov eax, dword [ebp - 0x38]
jmp 0x7ef69790
and dword [ebp - 0x3c], 0
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x7ef6978d
mov ecx, dword [ebp - 0x14]
call fcn.7ef856ec
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret