joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100060b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x23c
push ebp
push esi
mov edx, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x250]
mov dword [esp + 0xc], 1
test eax, eax
lea eax, [edx + 0xa008]
push eax
je 0x100060f8
add edx, 0x9808
push edx
push str._s.64._s
jmp 0x10006104
add edx, 0x9808
push edx
push str._s._s
lea ecx, [esp + 0x4c]
push 0x104
push ecx
call fcn.1000f0c0
mov edi, dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x14
lea edx, [esp + 0x40]
push 0x100bcd54
push edx
call edi
mov esi, eax
mov eax, dword [esp + 0x254]
push 0x100bcd58
push eax
mov dword [esp + 0x20], esi
call edi
add esp, 0x10
mov ebp, eax
test esi, esi
je 0x10006280
test ebp, ebp
je 0x1000627d
lea ecx, [esp + 0x40]
push ebx
push ecx
call fcn.100118e0
mov ebx, eax
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x10006255
mov ecx, 9
mov esi, str.64F05BA8_9BB7_4864_A938_F946AD308168
lea edi, [esp + 0x1c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ebp
dec ecx
push 1
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__strrev]
mov esi, dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 4
push eax
call esi
lea edi, [esp + 0x54]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
push 1
lea eax, [esp + 0x5c]
push ecx
push eax
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x169]
mov byte [esp + 0x168], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
lea ecx, [esp + 0x16c]
push 0x100bcd84
push ecx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x174]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
push 1
lea edx, [esp + 0x17c]
push ecx
push edx
call esi
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
push eax
push 1
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x4c
cmp eax, 1
jne 0x1000623e
push ebp
push eax
push ebx
push edi
call esi
add esp, 0x10
cmp eax, 1
je 0x10006246
mov dword [esp + 0x10], 0
push edi
call fcn.10084060
mov esi, dword [esp + 0x18]
add esp, 4
jmp 0x1000625d
mov dword [esp + 0x10], 0
push esi
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
call esi
push ebp
call esi
mov eax, dword [esp + 0x18]
add esp, 8
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x23c
ret 8
push esi
jmp 0x10006285
test ebp, ebp
je 0x1000628e
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x23c
ret 8
Function at 0x100096b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008458a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x33c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x20]
call fcn.10010270
push ebx
push ebx
push 0x100bd5ec
push reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x20]
call fcn.100102c0
test eax, eax
je 0x10009724
mov dword [ebp - 0x344], 0xfffffffe
lea ecx, [ebp - 0x20]
call fcn.10010280
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push str.UnInstallAll
lea ecx, [ebp - 0x20]
call fcn.10010400
lea ecx, [ebp - 0x20]
call fcn.10010310
cmp dword [ebp - 0x14], ebx
je 0x1000984a
lea ecx, [ebp - 0x238]
call fcn.10010270
xor esi, esi
mov dword [ebp - 0x23c], esi
push ebx
push ebx
push str.SoftwareGatewayGWClientSSOFile
push reloc.WS2_32.dll_bind
lea ecx, [ebp - 0x238]
call fcn.100102c0
mov byte [ebp - 0x22c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x340], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x33f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push str._SystemRoot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, esi
inc esi
mov dword [ebp - 0x23c], esi
lea edx, [ebp - 0x128]
push edx
push eax
lea ecx, [ebp - 0x238]
call fcn.10010520
cmp eax, 0x103
je 0x10009811
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 0x100bd654
push 0x104
lea edx, [ebp - 0x340]
push edx
call fcn.1000f0c0
push 1
lea eax, [ebp - 0x340]
push eax
call fcn.10011120
add esp, 0x1c
jmp 0x100097b7
lea ecx, [ebp - 0x238]
call fcn.10010310
push ebx
push 0x100bd65c
push reloc.WS2_32.dll_bind
call fcn.10010600
push ebx
push str.SoftwareGateway
push reloc.WS2_32.dll_accept
call fcn.10010600
add esp, 0x18
lea ecx, [ebp - 0x238]
call fcn.10010280
lea ecx, [ebp - 0x20]
call fcn.10010280
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cd50
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 0
push 0x1000cbe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
mov dword [0x100c3b94], eax
mov eax, dword [0x100c3b90]
push eax
call esi
test eax, eax
jne 0x1000cd9a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call edi
mov ecx, dword [0x100c3b90]
push ecx
call esi
test eax, eax
je 0x1000cd84
pop edi
xor eax, eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x1000cdc0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x100c3b90]
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 0
push 0xf0
push 0x3f0
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
mov ecx, dword [0x100c3b90]
dec eax
neg eax
push 0
push 0
sbb eax, eax
push 0xf0
inc eax
push 0x3f1
push ecx
mov dword [0x100c3b6c], eax
call esi
push eax
call edi
mov edx, dword [0x100c3b90]
dec eax
neg eax
push 0
push 0
sbb eax, eax
push 0xf0
inc eax
push 0x3f2
push edx
mov dword [0x100c3b74], eax
call esi
push eax
call edi
dec eax
push 0
neg eax
sbb eax, eax
inc eax
mov dword [0x100c3b78], eax
mov eax, dword [0x100c3b90]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [0x100c3b94]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
xor eax, eax
pop esi
ret

Function at 0x1000d6c0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [sym.imp.MSVCRT.dll_strncat]
repne scasb al, byte es:[edi]
not ecx
mov edi, dword [esp + 0x14]
dec ecx
cmp byte [ecx + esi - 1], 0x5c
je 0x1000d708
test edi, edi
jbe 0x1000d720
lea eax, [edi - 1]
push eax
push 0x100be064
push esi
call ebp
add esp, 0xc
mov byte [esi + edi - 1], 0
test edi, edi
jbe 0x1000d720
lea ecx, [edi - 1]
push ecx
push str.gwtemp_
push esi
call ebp
add esp, 0xc
mov byte [esi + edi - 1], 0
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x1000d73a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebp
ret

Function at 0x1000e030
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], 0
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
lea edx, [esp + 0x108]
push ecx
push str._sdriversgwvnic.inf
push 0x104
push edx
call fcn.1000f0c0
call fcn.10013a50
call fcn.10013cb0
lea eax, [esp + 0x118]
push eax
call fcn.10013a10
call fcn.10013ce0
push 0
call fcn.10013610
add esp, 0x18
xor eax, eax
pop edi
add esp, 0x208
ret
Function at 0x1000eeb0
Capabilities:
Copy file
Delete file
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x1114
call fcn.10084230
mov eax, dword [0x100beaa8]
push ebp
push esi
mov esi, dword [esp + 0x1120]
cmp esi, eax
push edi
jb 0x1000f0a9
mov eax, dword [esp + 0x1128]
test eax, eax
je 0x1000f0a9
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x20]
cmp esi, 8
rep stosd dword es:[edi], eax
mov ecx, 0x240
lea edi, [esp + 0x820]
rep stosd dword es:[edi], eax
jbe 0x1000ef02
xor esi, esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a]
mov eax, dword [esp + 0x18]
push str.GWCLI
shl esi, 4
add esi, 0x100beab0
and ecx, 0xffff
push esi
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x22]
push edx
mov edx, dword [esp + 0x22]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push str.__02d__02d__02d:_02d:_02d___s___s_
lea eax, [esp + 0x40]
push 0x800
push eax
call fcn.1000f0c0
mov edx, dword [esp + 0x1150]
lea ecx, [esp + 0x1154]
push ecx
push edx
lea eax, [esp + 0x850]
push 0x800
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
lea ecx, [esp + 0x858]
push 0x7ff
lea edx, [esp + 0x5c]
push ecx
push edx
call esi
add esp, 0x44
lea eax, [esp + 0x20]
mov byte [esp + 0x81f], 0
push 0x100bebb0
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
push 0x7ff
lea ecx, [esp + 0x24]
push 0x100bebb4
push ecx
call esi
mov al, byte [0x100beaac]
add esp, 0xc
test al, 1
mov byte [esp + 0x81f], 0
je 0x1000efee
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [0x100beaac], 2
je 0x1000f0a9
xor ebp, ebp
push ebp
push 0x80
push 4
push ebp
push ebp
push 0x40000000
push str.c:gwlog.txt
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f0a9
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebp
push ebp
push esi
call edi
cmp eax, 0x400000
jbe 0x1000f03f
mov ebp, 1
push 2
push 0
push 0
push esi
call edi
cmp eax, 0x500000
jbe 0x1000f05f
push 0
push 0
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0xc]
push 0
push eax
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1000f0a9
push 0
push str.c:gwlogbk.txt
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
add esp, 0x1114
ret
Function at 0x1000fc60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [esp + 0x10c]
push ebx
push edi
mov ebx, 0xfffffffe
mov cl, byte [eax]
mov dword [esp + 8], 0
test cl, cl
jne 0x1000fc8e
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x108
ret
mov edi, dword [esp + 0x118]
cmp byte [edi], 0
jne 0x1000fca6
pop edi
or eax, 0xffffffff
pop ebx
add esp, 0x108
ret
lea ecx, [esp + 0xc]
push 0
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp eax, 0x104
jae 0x1000fd29
test eax, eax
je 0x1000fd29
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000fd29
push esi
push str.newdev.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x1000fd1d
push str.UpdateDriverForPlugAndPlayDevicesA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000fd16
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 1
push edx
push edi
push 0
call eax
test eax, eax
je 0x1000fd16
mov eax, dword [esp + 0xc]
xor ebx, ebx
test eax, eax
setne bl
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, ebx
pop edi
pop ebx
add esp, 0x108
ret
pop edi
mov eax, 0xfffffffe
pop ebx
add esp, 0x108
ret

Function at 0x10010350
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [edx + 4]
push esi
push 1
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 8

Function at 0x10010400
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea edx, [esp]
push eax
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10010441
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
mov dword [ecx], edx
add esp, 8
ret 8

Function at 0x10010450
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
lea eax, [esp]
push eax
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x18], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop ecx
ret 8

Function at 0x100104f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
ret 0x14
Function at 0x10010600
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x120
lea ecx, [esp + 8]
push ebx
push ebp
push esi
push edi
call fcn.10010270
mov edi, dword [esp + 0x13c]
mov esi, 0x10008
test edi, edi
je 0x10010628
mov esi, 0x10108
mov ebx, dword [esp + 0x138]
test ebx, ebx
jne 0x1001064c
lea ecx, [esp + 0x18]
call fcn.10010280
pop edi
pop esi
pop ebp
mov eax, 0x3f2
pop ebx
add esp, 0x120
ret
mov ebp, dword [esp + 0x134]
push edi
push ebx
push ebp
call fcn.10010730
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push esi
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1001070f
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x40]
push ecx
push edx
push 0
push eax
mov dword [esp + 0x34], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x100106c8
test esi, esi
jne 0x10010704
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x30]
push edi
push ecx
push edx
call fcn.10010600
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10010678
jmp 0x10010704
lea ecx, [esp + 0x24]
call fcn.10010270
push edi
push ebx
push ebp
call fcn.10010730
add esp, 0xc
test edi, edi
je 0x100106f1
push edi
push ebx
push ebp
call fcn.10010590
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100106fb
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
lea ecx, [esp + 0x24]
call fcn.10010280
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
call fcn.10010280
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret

Function at 0x10010f90
Capabilities:
Copy file

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x10010fb4
mov eax, dword [esp + 8]
test eax, eax
je 0x10010fb4
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
ret
mov eax, 1
ret
Function at 0x10010fc0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x118
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
test ebp, ebp
je 0x100110d9
mov esi, dword [esp + 0x12c]
test esi, esi
je 0x100110d9
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 3
push esi
push ebp
call ebx
test eax, eax
jne 0x100110cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x100110be
lea eax, [esp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1e]
mov edx, dword [esp + 0x1c]
stosw word es:[edi], ax
and ecx, 0xffff
and edx, 0xffff
stosb byte es:[edi], al
mov eax, dword [esp + 0x1a]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1e]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push esi
push 0x100bedc8
lea eax, [esp + 0x40]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x24
lea ecx, [esp + 0x24]
push 3
push ecx
push esi
call ebx
push 4
lea edx, [esp + 0x28]
push 0
push edx
call ebx
push 3
push esi
push ebp
call ebx
test eax, eax
pop edi
jne 0x100110af
push 5
push esi
push ebp
call ebx
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x118
ret
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x118
ret
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0x118
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118
ret
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x118
ret

Function at 0x100110f0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10011117
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001110d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
ret
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret
Function at 0x10011120
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100845e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1001115f
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001118e
mov dword [ebp - 4], 0
push esi
call fcn.100110f0
push esi
call fcn.10010d90
add esp, 8
jmp 0x10011187
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1001124e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1001123a
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov byte [ebp - 0x128], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x127]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0x16]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x18]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x1a]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x1c]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x1e]
and edx, 0xffff
push edx
push esi
push str._s._x_x_x_x_x
push 0x103
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x24
push 3
lea ecx, [ebp - 0x128]
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call esi
push 4
push 0
lea edx, [ebp - 0x128]
push edx
call esi
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100112b0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0x14], eax
jle 0x10011327
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x18]
add esp, 4
mov ebx, eax
push ebx
push ecx
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1001131a
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
push eax
push 0x100bede8
push ebx
mov dword [esp + 0x24], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x1001132f
test ebx, ebx
je 0x10011327
push ebx
call fcn.10084060
add esp, 4
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov esi, dword [esp + 8]
push edi
mov ecx, 0xd
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
pop edi
je 0x10011327
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x18]
shr ecx, 0x10
mov dword [edx], ecx
mov eax, dword [ebx + 8]
mov ecx, dword [esp + 0x1c]
and eax, 0xffff
push ebx
mov dword [ecx], eax
mov edx, dword [ebx + 0xc]
mov eax, dword [esp + 0x24]
shr edx, 0x10
mov dword [eax], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x28]
and ecx, 0xffff
mov dword [edx], ecx
call fcn.10084060
add esp, 4
mov eax, 1
pop esi
pop ebx
add esp, 8
ret

Function at 0x10011540
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x80
push ebx
mov ebx, dword [esp + 0x8c]
test ebx, ebx
push esi
je 0x10011660
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x10011660
push 0x100bee04
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 8], esi
je 0x10011660
push ebp
push edi
push 0x4000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov ebp, eax
call dword [sym.imp.MSVCRT.dll__fileno]
mov esi, eax
lea eax, [esp + 0x3c]
push eax
call fcn.1001bb20
mov edi, dword [sym.imp.MSVCRT.dll__read]
push 0x4000
push ebp
push esi
call edi
add esp, 0x18
test eax, eax
jle 0x100115d6
push eax
lea ecx, [esp + 0x38]
push ebp
push ecx
call fcn.1001b710
push 0x4000
push ebp
push esi
call edi
add esp, 0x18
test eax, eax
jg 0x100115ba
lea edx, [esp + 0x34]
lea eax, [esp + 0x14]
push edx
push eax
call fcn.1001b9e0
add esp, 8
mov byte [ebx], 0
xor ebx, ebx
xor ecx, ecx
lea edx, [esp + 0x24]
mov cl, byte [esp + ebx + 0x14]
push ecx
push 0x100bee08
push 0x10
push edx
call fcn.1000f0c0
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x98]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
cmp ebx, 0x10
rep movsb byte es:[edi], byte [esi]
jl 0x100115ed
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
push ebp
call fcn.10084060
add esp, 8
mov eax, 1
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x80
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x80
ret