joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100013d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x1000e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1f4
call fcn.100020dd
push 0x40
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x44]
push 0
push eax
mov word [ebp - 0x188], 2
call fcn.10001f60
mov esi, dword [ebp + 8]
mov ecx, 8
lea edi, [ebp - 0x44]
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, edi
lea ecx, [ebp - 0x18c]
push ecx
lea edx, [ebp - 0x190]
push edx
lea eax, [ebp + esi - 0x44]
push eax
call fcn.100011b0
lea ecx, [ebp - 0x18c]
push ecx
lea edx, [ebp - 0x190]
push edx
push 0x1000fa80
call fcn.10001040
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x18c]
mov dword [ebp + esi - 0x184], eax
mov dword [ebp + esi - 0x180], ecx
add esi, 8
add esp, 0x18
cmp esi, 0x20
jl 0x10001420
mov edi, dword [ebp + 0xc]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001480
sub eax, edx
sar eax, 1
lea ebx, [eax + eax + 2]
shr ebx, 3
xor esi, esi
test ebx, ebx
js 0x10001508
lea edx, [ebp - 0x144]
sub edi, edx
jmp 0x100014b0
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x190]
lea edx, [edi + esi*8]
push ecx
lea eax, [ebp + edx - 0x144]
push eax
call fcn.100011b0
lea ecx, [ebp - 0x18c]
push ecx
lea edx, [ebp - 0x190]
push edx
push 0x1000fa80
call fcn.10001040
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x18c]
mov dword [ebp + esi*8 - 0x144], eax
mov dword [ebp + esi*8 - 0x140], ecx
inc esi
add esp, 0x18
cmp esi, ebx
jle 0x100014b0
inc bl
push 0x1f4
mov byte [ebp - 0x186], bl
mov ebx, dword [ebp - 0x194]
push 0
push ebx
call fcn.10001f60
mov dx, word [ebp - 0x188]
mov al, byte [ebp - 0x186]
mov word [ebx], dx
mov byte [ebx + 2], al
mov eax, dword [0x1000edec]
add esp, 0xc
lea edi, [ebx + 3]
mov ecx, 0x50
lea esi, [ebp - 0x184]
rep movsd dword es:[edi], dword [esi]
test eax, eax
je 0x1000157f
cmp eax, 0xffffffff
je 0x1000157f
push 0
lea ecx, [ebp - 0x198]
push ecx
push 0x143
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x1000edec]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call fcn.10001260
push ebx
call fcn.10001fda
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001f4c
mov esp, ebp
pop ebp
ret

Function at 0x100015a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1000edec]
xor ecx, ecx
mov word [ebp - 4], cx
mov byte [ebp - 2], cl
cmp eax, ecx
je 0x100015e8
cmp eax, 0xffffffff
je 0x100015e8
push ecx
lea ecx, [ebp - 8]
push ecx
push 3
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x1000edec]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [0x1000edec]
push ecx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov esp, ebp
pop ebp
ret
Function at 0x10001df0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1000e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x20
mov dword [ebp - 0x18], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10001e59
lea ecx, [ebp - 0x10]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10001e59
mov eax, dword [ebp - 0x18]
push esi
push esi
push esi
lea edx, [ebp - 0x14]
push edx
push esi
push eax
mov dword [ebp - 8], 2
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10001e6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.PT_failed:__d_n
call fcn.100012c0
add esp, 8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10001e7d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10001f4c
mov esp, ebp
pop ebp
ret

Function at 0x10001f4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000e004]
jne 0x10001f56
repz ret
jmp fcn.100038eb
Function at 0x100072fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100042e1
and dword [ebp - 0x14], 0
cmp dword [0x1000fa58], 0
mov dword [ebp - 0x18], eax
jne 0x100073af
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10007457
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10007457
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000fa58], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000fa5c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000fa60], eax
call edi
push eax
call esi
mov dword [0x1000fa68], eax
test eax, eax
je 0x100073af
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000fa64], eax
mov eax, dword [0x1000fa64]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10007408
cmp dword [0x1000fa68], ecx
je 0x10007408
push eax
call esi
push dword [0x1000fa68]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10007408
test ebx, ebx
je 0x10007408
call edi
test eax, eax
je 0x100073ff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100073ff
test byte [ebp - 8], 1
jne 0x10007408
or dword [ebp + 0x10], 0x200000
jmp 0x1000743b
mov eax, dword [0x1000fa5c]
cmp eax, dword [ebp - 0x18]
je 0x1000743b
push eax
call esi
test eax, eax
je 0x1000743b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000743b
mov eax, dword [0x1000fa60]
cmp eax, dword [ebp - 0x18]
je 0x1000743b
push eax
call esi
test eax, eax
je 0x1000743b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000fa58]
call esi
test eax, eax
je 0x10007457
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10007459
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001f4c
leave
ret
Function at 0x9e7440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e748c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e7452
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e74f0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e7542
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e7548
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9ffa35
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009ff6f5

Function at 0xa0482f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a046ae

Function at 0xa09de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa09e0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa09e0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408d8d
Capabilities:
Get disk information

Disassembly:
xor eax, eax
lea eax, [eax + 0x40a51c]
call dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx - 0x3ca214], cl
jmp dword [sym.imp.kernel32.dll_OpenMutexW]
Function at 0x417e10
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
push str.uxtheme.dll
add bh, bh
adc eax, sym.imp.KERNEL32.dll_LoadLibraryW
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [edi + 8]

Function at 0x420c58
Capabilities:
Encode data using xor

Disassembly:
mov byte [0xc98f4c31], al
mov bl, 0x22
ja 0x420c43
iretd
loop 0x420c57
and byte [ebx + 0x254fcd4b], al
sti
loop 0x420bda
or dword [ebx - 0x33], 0x4f
and eax, 0xc89be2fb
sahf
mov es, word [ecx]
enter 0xffffffffffff8e9e, 1
rol dl, 0x5b
dec eax
adc esp, dword [edx - 0x2b]
sbb dword [ebx], ebp
inc ecx
bt ebp, ebp
inc eax
adc byte [ebx + edi*8 - 0x2f], dl
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jle 0x420c35
mov edx, 0xe2f5471d
mov ah, 0xc3
lcall 0xaf0c, 0x7215944a
jb 0x420c73
scasd eax, dword es:[edi]
aam 0x72
add byte [edx + 0x43], bl
cmpsd dword [esi], dword es:[edi]
xor al, 0xc6
sub eax, 0xfc2c5894
sub al, 0xfc
jb 0x420ca0
mov dl, 0x9c
cmpsd dword [esi], dword es:[edi]
jl 0x420c65
in eax, 0x6a
jne 0x420ca8
adc al, 0x42
movsd dword es:[edi], dword [esi]
pop ebp
loope 0x420cf0
mov word [edx], cs
invalid
outsd dx, dword [esi]
inc eax
jecxz 0x420c36
js 0x420cbf
cmp dword [ebx], edx
leave
test dword [eax + 0x52], ebp
js 0x420c98
xor eax, 0x3200ce7
add ah, dl
lds ebx, es:[edi]
or al, 0x20
add eax, dword [edx]
loop 0x420cd4
lds ebx, [edi]
fidivr word [esi]
cmpsd dword [esi], dword es:[edi]
mov dword [0x9b7ca12b], eax
mov word [edi], cs
dec ebp
xor dword [bp + 0x5c], ecx
or al, 0xef
shl dword [esi], 1
mov ebx, 0x753563f2
pushfd
salc
outsb dx, byte [esi]
push esi
sbb eax, 0xfd395682
neg dword [ebp + eax + 0x152f17b2]
jle 0x420d07
invalid
push ebx

Function at 0x4a372c
Capabilities:
Encode data using xor

Disassembly:
add al, 0x43
xchg dword [esi], eax
xchg ecx, eax
mov eax, dword [0x5ac2d05a]
push ss
mov ebp, dword [eax]
invalid
Function at 0x4bbd2d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c63a0
cmp edx, dword [eax]
je 0x4bbd4f
add eax, 8
inc ecx
cmp eax, 0x4c6430
jl 0x4bbd40
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c63a0]
jne 0x4bbe7d
mov eax, dword [0x4cad2c]
cmp eax, 1
je 0x4bbe57
test eax, eax
jne 0x4bbd80
cmp dword [0x4c62c8], 1
je 0x4bbe57
cmp edx, 0xfc
je 0x4bbe7d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bbdb7
lea eax, [ebp - 0x1a4]
push 0x4c1d40
push eax
call fcn.004bc710
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bcba0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbdfa
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bcba0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1d3c
push edi
call fcn.004bea70
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1d20
push eax
call fcn.004bc710
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc720
lea eax, [ebp - 0xa0]
push 0x4c1d1c
push eax
call fcn.004bc720
push dword [esi + 0x4c63a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc720
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c1cf4
push eax
call fcn.004be9e4
add esp, 0x2c
pop edi
jmp 0x4bbe7d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c63a4]
push 0
push eax
push dword [esi]
call fcn.004bcba0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10001648
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa94
mov eax, dword [0x1006d144]
xor eax, esp
mov dword [esp + 0xa90], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp + 0x18]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], edx
test esi, esi
je 0x10001849
test eax, eax
jne 0x10001698
test ecx, ecx
je 0x10001849
movzx eax, word [esi + 2]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp ax, 0x3a
je 0x100016f3
cmp ax, 0x5c
je 0x100016f3
xor eax, eax
push 0x40e
push eax
mov word [esp + 0x690], ax
lea eax, [esp + 0x692]
push eax
call fcn.1003c230
add esp, 0xc
lea eax, [esp + 0x688]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [esp + 0x68c]
push eax
call edi
lea esi, [esp + 0x688]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10001849
test al, 0x10
je 0x10001849
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [esp + 0x484]
push eax
call ebx
push 0x1005d220
lea eax, [esp + 0x484]
push eax
call edi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x10001849
mov dword [esp + 0x10], 1
push 0x1005d224
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10001818
push 0x1005d228
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10001818
cmp dword [esp + 0x28], 0xffffffff
je 0x10001818
push esi
lea eax, [esp + 0x27c]
push eax
call ebx
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x27c]
push eax
call edi
test byte [esp + 0x28], 0x10
je 0x100017fd
cmp dword [esp + 0x14], 0
je 0x100017ca
push dword [esp + 0x24]
lea eax, [esp + 0x27c]
push eax
call dword [esp + 0x1c]
test eax, eax
je 0x10001831
cmp dword [ebp + 0xc], 0
je 0x10001818
push dword [esp + 0x24]
lea eax, [esp + 0x27c]
push dword [esp + 0x18]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [ebp + 0xc]
push eax
call fcn.10001648
push 2
pop ecx
cmp eax, ecx
jne 0x10001818
mov dword [esp + 0x10], ecx
jmp 0x10001839
cmp dword [esp + 0x18], 0
je 0x10001818
push dword [esp + 0x1c]
lea eax, [esp + 0x27c]
push eax
call dword [esp + 0x20]
test eax, eax
je 0x10001831
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10001753
jmp 0x10001839
mov dword [esp + 0x10], 2
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
jmp 0x1000184b
xor eax, eax
mov ecx, dword [esp + 0xa9c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003b874
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10001862
Capabilities:
Enumerate files on windows

Disassembly:
push 0x6bc
mov eax, 0x10053c45
call fcn.1003b8ec
and dword [ebp - 0x678], 0
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 0x67c], edi
mov dword [ebp - 0x680], esi
call fcn.10004fc5
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
test esi, esi
jne 0x100018c7
lea eax, [ebp - 0x6a0]
push eax
mov ecx, edi
call fcn.10004fde
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 0x678], ebx
mov byte [ebp - 4], 0
call fcn.10005034
mov eax, edi
jmp 0x100019f6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x218]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str..________.dirty
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x674], eax
cmp eax, 0xffffffff
je 0x100019c9
push 0x1005d224
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x100019a2
push 0x1005d228
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x100019a2
cmp dword [ebp - 0x670], 0xffffffff
je 0x100019a2
push dword [ebp - 0x680]
lea eax, [ebp - 0x420]
push eax
call esi
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x420]
push eax
call edi
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x6bc]
call fcn.10004b06
lea eax, [ebp - 0x6bc]
push eax
lea eax, [ebp - 0x6c8]
push eax
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 4], 2
call fcn.1000505c
push 0
push ebx
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], bl
call fcn.10005a6e
lea eax, [ebp - 0x670]
push eax
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000190e
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x67c]
lea eax, [ebp - 0x6a0]
push eax
call fcn.10004fde
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 0x678], ebx
mov byte [ebp - 4], 0
call fcn.10005034
mov eax, dword [ebp - 0x67c]
call fcn.1003b96f
ret
Function at 0x10001a7e
Capabilities:
Check if file exists
Clear file content
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10001ba8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x10001ba8
xor eax, eax
push 0x206
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.1003c230
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push esi
call fcn.100027a8
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10001afc
shr eax, 4
not eax
and eax, 1
jmp 0x10001baa
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [ebp - 0x41c]
call fcn.10001bba
test eax, eax
je 0x10001ba8
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x10000000
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], esi
je 0x10001b77
cmp esi, ebx
je 0x10001b8a
cmp esi, 0xffffffff
je 0x10001b77
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp esi, ebx
je 0x10001b8a
mov dword [ebp - 0x420], 1
cmp esi, 0xffffffff
jne 0x10001b90
mov dword [ebp - 0x420], ebx
lea ecx, [ebp - 0x424]
call fcn.10001336
xor eax, eax
cmp byte [ebp - 0x420], bl
setne al
jmp 0x10001baa
xor eax, eax
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b874
leave
ret 0xc
Function at 0x10001fa7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10002021
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.1003c230
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x10002021
push esi
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x10002021
cmp byte [ebp + 0xc], bl
je 0x1000201c
push ebx
push ebx
push esi
call fcn.10001a7e
jmp 0x10002023
xor eax, eax
inc eax
jmp 0x10002023
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b874
leave
ret 8
Function at 0x10002033
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2038
call fcn.1003c2b0
mov eax, dword [0x1006d144]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x201c], eax
mov dword [ebp - 0x2020], ebx
cmp edi, ebx
je 0x10002211
cmp eax, ebx
je 0x10002211
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000208b
mov dword [ebp - 0x2020], 1
jmp 0x10002211
push ebx
push ebx
push 3
push ebx
push ebx
mov esi, SysReAllocString
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
call edi
push ebx
push ebx
push 3
push ebx
push ebx
push esi
push dword [ebp - 0x201c]
mov dword [ebp - 0x2010], eax
call edi
mov esi, dword [ebp - 0x2010]
mov dword [ebp - 0x2014], eax
cmp esi, ebx
je 0x100021fb
cmp esi, 0xffffffff
je 0x100021fb
cmp eax, ebx
je 0x100021fb
cmp eax, 0xffffffff
je 0x100021fb
xor eax, eax
mov dword [ebp - 0x2034], ebx
lea edi, [ebp - 0x2030]
stosd dword es:[edi], eax
mov dword [ebp - 0x202c], ebx
lea edi, [ebp - 0x2028]
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
lea eax, [ebp - 0x2034]
push eax
push esi
call edi
test eax, eax
je 0x100021fb
lea eax, [ebp - 0x202c]
push eax
push dword [ebp - 0x2014]
call edi
test eax, eax
je 0x100021fb
mov eax, dword [ebp - 0x2034]
cmp eax, dword [ebp - 0x202c]
jne 0x100021fb
mov eax, dword [ebp - 0x2030]
cmp eax, dword [ebp - 0x2028]
jne 0x100021fb
push ebx
lea eax, [ebp - 0x2018]
push eax
push 0x1000
lea eax, [ebp - 0x200c]
push eax
mov dword [ebp - 0x2018], ebx
push esi
jmp 0x100021e5
cmp dword [ebp - 0x2018], ebx
je 0x100021f1
push ebx
lea eax, [ebp - 0x201c]
push eax
push dword [ebp - 0x2018]
lea eax, [ebp - 0x100c]
push eax
push dword [ebp - 0x2014]
mov dword [ebp - 0x201c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100021fb
mov ecx, dword [ebp - 0x2018]
cmp ecx, dword [ebp - 0x201c]
jne 0x100021fb
lea edi, [ebp - 0x100c]
lea esi, [ebp - 0x200c]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x100021c7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x100021fb
push ebx
lea eax, [ebp - 0x2018]
push eax
push 0x1000
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 0x2010]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000216f
jmp 0x100021fb
mov dword [ebp - 0x2020], 1
lea ecx, [ebp - 0x2014]
call fcn.10001336
lea ecx, [ebp - 0x2010]
call fcn.10001336
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x2020]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003b874
leave
ret 4

Function at 0x10002228
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000223f
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
ret
test al, 1
je 0x1000224e
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
ret