joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cfda0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [0x101558f8], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [0x101558fc], eax
call fcn.100d1ed0
mov esi, eax
call fcn.100d1ed0
mov ebx, eax
call fcn.100d1ed0
mov dword [esp + 0x10], eax
call fcn.100d1ed0
mov dword [esp + 0x14], 0
mov edi, eax
test esi, esi
je 0x100cfe37
lea eax, [esp + 0x14]
push eax
push edi
push 0
push dword [esp + 0x1c]
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x100cfe37
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100cfe7c
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x100cfe7c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100cfe7c
push eax
push 0
push 0x100011
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100cfe7c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100cfe7c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100dc9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011dbd2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
mov dword [ebp - 0x14], 0
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x20a
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x14], 1
push eax
call fcn.100747a0
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x10], 0x208
mov dword [ebp - 0x18], 1
cmp dword [eax + 0x14], 8
jb 0x100dca44
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100dcaae
mov eax, dword [ebp - 0x10]
cmp eax, 0x104
ja 0x100dca79
xor ecx, ecx
mov word [ebp + eax*2 - 0x224], cx
jmp 0x100dca7f
xor eax, eax
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x224]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100dca90
sub ecx, edx
lea eax, [ebp - 0x224]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1001a860
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100df360
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x100df474
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x100df474
cmp edi, 3
jl 0x100df405
mov eax, 0xaaaaaaab
mul edi
push ebx
mov ebx, edx
shr ebx, 1
lea eax, [ebx*4]
sub eax, ebx
neg eax
add edi, eax
nop dword [eax]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x10139ae0]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + 0x10139ae0]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + 0x10139ae0]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + 0x10139ae0]
mov byte [ecx + 3], al
add ecx, 4
sub ebx, 1
jne 0x100df3a0
pop ebx
test edi, edi
jle 0x100df46a
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x10139ae0]
mov byte [ecx], al
mov dl, byte [esi]
and dl, 3
shl dl, 4
cmp edi, 1
jle 0x100df42c
mov al, byte [esi + 1]
shr al, 4
or dl, al
movzx eax, dl
mov al, byte [eax + 0x10139ae0]
mov byte [ecx + 1], al
cmp edi, 2
jge 0x100df452
mov al, 0x3d
mov byte [ecx + 2], al
mov byte [ecx + 3], al
add ecx, 4
pop edi
mov al, 1
pop esi
mov byte [ecx], 0
ret 8
movzx eax, byte [esi + 1]
and eax, 0xf
mov al, byte [eax*4 + 0x10139ae0]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
pop edi
mov byte [ecx], 0
mov al, 1
pop esi
ret 8
pop edi
xor al, al
pop esi
ret 8
Function at 0x100e1e00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011dee2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
mov esi, ecx
mov dword [ebp - 0x10], 0
push 0
push edi
push dword [esi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100e1e61
mov dword [esi + 0x1c], eax
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.1001b730
mov ebx, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], 0
mov dword [ebx + 0x18], eax
lea edx, [ecx + 2]
xor eax, eax
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100e1e96
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x3c]
call fcn.1001a860
lea ecx, [ebx + 0x1c]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x3c]
cmp ecx, eax
je 0x100e1ece
cmp dword [ebp - 0x28], 8
push dword [ebp - 0x2c]
cmovae eax, dword [ebp - 0x3c]
push eax
call fcn.1001a860
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x28]
cmp edx, 8
jb 0x100e1f08
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100e1efe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100e1f78
push edx
push ecx
call fcn.100703b3
add esp, 8
cmp ebx, esi
je 0x100e1f21
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100e1f16
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, ebx
push eax
call fcn.1001a860
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
push dword [esi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100e1f46
mov dword [esi + 0x1c], eax
xor bl, bl
jmp 0x100e1f56
push dword [ebp - 0x10]
mov ecx, ebx
push edi
call fcn.10102dc0
test al, al
setne bl
test edi, edi
je 0x100e1f63
push edi
call fcn.100703c1
add esp, 4
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.1007e0fa
int3
Function at 0x100e2680
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x400
mov edi, ecx
mov dword [esp + 0x14], 1
xor bl, bl
call fcn.10096b22
push 0x400
mov esi, eax
push 0
push esi
call fcn.100747a0
add esp, 0x10
mov dword [esp + 0xc], 0x400
lea eax, [esp + 0xc]
push eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x28]
push dword [edi + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100e2705
mov dword [edi + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x100e26e5
mov ecx, dword [eax]
mov dword [eax + 0x10], 0
xor eax, eax
push esi
mov word [ecx], ax
call fcn.1007e266
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
add esp, 8
ret 8
mov ecx, esi
mov bl, 1
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100e2710
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [esp + 0x20]
push esi
call fcn.1001a860
push esi
call fcn.1007e266
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
add esp, 8
ret 8
Function at 0x100e4cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e11e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ecx
lea ecx, [ebp - 0x24]
call fcn.1001cdf0
mov edx, 0x24
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.100e7380
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100e4d18
test al, 0x10
je 0x100e4d18
mov bl, 1
jmp 0x100e4d1a
xor bl, bl
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x100e4d50
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100e4d46
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100e4d61
push edx
push ecx
call fcn.100703b3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1007e0fa
int3

Function at 0x100e4fc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1011e153
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x100e50d2
nop dword [eax]
mov ecx, dword [esi + 0x14]
mov eax, esi
cmp ecx, 8
jb 0x100e4ffc
mov eax, dword [esi]
mov edx, 0x2f
cmp dx, word [eax + edi*2]
mov edx, 0x5c
je 0x100e501f
mov eax, esi
cmp ecx, 8
jb 0x100e5015
mov eax, dword [esi]
cmp dx, word [eax + edi*2]
jne 0x100e50c9
xor eax, eax
mov dword [ebp - 0x14], 0
cmp dword [esi + 0x10], edi
mov edx, edi
mov word [ebp - 0x24], ax
mov eax, esi
cmovb edx, dword [esi + 0x10]
mov dword [ebp - 0x10], 7
cmp ecx, 8
jb 0x100e5045
mov eax, dword [esi]
push edx
push eax
lea ecx, [ebp - 0x24]
call fcn.1001a860
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x100e507c
lea ecx, [ebp - 0x24]
call fcn.100e5720
test al, al
jne 0x100e507c
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
push 0
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x100e50b9
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100e50af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100e511f
push edx
push ecx
call fcn.100703b3
add esp, 8
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], eax
mov word [ebp - 0x24], ax
inc edi
cmp edi, ebx
jb 0x100e4ff0
mov ecx, esi
call fcn.100e5720
test al, al
jne 0x100e5107
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100e50e7
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100e5107
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.100e4cc0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1007e0fa
int3
Function at 0x100e5130
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e165
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 0x28]
call fcn.100e7220
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.100e5720
test al, al
jne 0x100e5175
lea ecx, [ebp - 0x28]
call fcn.100e4fc0
cmp dword [esi + 0x14], 8
jb 0x100e517d
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
jb 0x100e5185
mov edi, dword [edi]
movzx eax, byte [ebp + 8]
xor eax, 1
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, dword [ebp - 0x14]
test eax, eax
setne bl
cmp edx, 8
jb 0x100e51d0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100e51c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100e51e3
push edx
push ecx
call fcn.100703b3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1007e0fa
int3
Function at 0x100e56d0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100e56dd
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x100e56fd
and eax, 0xfffffffe
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x100e56f5
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], 8
jb 0x100e5705
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
pop esi
sete al
ret

Function at 0x100e5720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e1af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ecx
lea ecx, [ebp - 0x24]
call fcn.1001cdf0
mov edx, 0x24
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.100e7380
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x10]
cmp eax, 0xffffffff
setne bl
cmp edx, 8
jb 0x100e57a7
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100e579d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100e57b8
push edx
push ecx
call fcn.100703b3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1007e0fa
int3

Function at 0x100e57c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011e1c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ecx
lea ecx, [ebp - 0x24]
call fcn.1001cdf0
mov edx, 0x24
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.100e7380
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100e5818
test al, 0x10
jne 0x100e5818
mov bl, 1
jmp 0x100e581a
xor bl, bl
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x100e5850
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100e5846
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100e5861
push edx
push ecx
call fcn.100703b3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1007e0fa
int3
Function at 0x100e5f90
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100e5fa4
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x100e602a
push eax
call fcn.100703f6
add esp, 4
mov edi, eax
cmp dword [esi + 0x14], 8
jb 0x100e5fcb
mov esi, dword [esi]
push edi
push dword [esp + 0x14]
push dword [esp + 0x1c]
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x100e602a
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10139e88
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [esp + 0x18]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push ebx
call fcn.100d43b0
push edi
call fcn.100703c1
add esp, 0x1c
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10
ret

Function at 0x100e7f90
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, ecx
push esi
push edi
mov dword [esp + 0x14], edx
mov esi, ebp
mov edi, dword [eax]
mov al, byte [edi]
lea ebx, [eax - 0x30]
cmp bl, 9
ja 0x100e8003
xor edx, edx
mov ebx, ecx
lea ecx, [edx - 0x30]
movsx eax, al
add ecx, eax
inc edi
mov eax, 0x66666667
mov dword [ebx], edi
imul esi
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
lea edx, [ecx + ecx*4]
add edx, edx
cmp edx, ebp
jg 0x100e7fe6
test esi, esi
je 0x100e7fe6
mov al, byte [edi]
cmp al, 0x30
jl 0x100e7fe6
cmp al, 0x39
jle 0x100e7fb3
cmp ecx, dword [esp + 0x1c]
jl 0x100e8003
cmp ecx, ebp
jg 0x100e8003
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, 1
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x100ea3d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014a658
push 0x10117d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x23c
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], ebx
cmp edi, 0xffffffff
je 0x100ea469
push 0x22c
push ebx
lea eax, [ebp - 0x24c]
push eax
call fcn.100747a0
add esp, 0xc
mov dword [ebp - 0x24c], 0x22c
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100ea469
cmp dword [ebp - 0x244], esi
je 0x100ea460
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100ea444
jmp 0x100ea469
mov ebx, dword [ebp - 0x234]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xffffffff
call fcn.100ea48e
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ebba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x40
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
cdq
lea ecx, [esp + 0xc]
push edx
push eax
call fcn.100d3fe0
mov esi, dword [esp + 0x5c]
add esp, 8
cmp esi, edi
je 0x100ebbd9
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x100ebbd0
mov edi, dword [edi]
push eax
push edi
mov ecx, esi
call fcn.1001a860
mov edx, dword [esi + 0x14]
mov eax, edx
mov ecx, dword [esi + 0x10]
sub eax, ecx
push ebp
cmp eax, 1
jb 0x100ebc13
lea ebp, [ecx + 1]
mov edi, esi
mov dword [esi + 0x10], ebp
cmp edx, 8
jb 0x100ebbf8
mov edi, dword [esi]
push 2
lea eax, [edi + ecx*2]
push str._____
push eax
call fcn.10074220
add esp, 0xc
xor eax, eax
mov word [edi + ebp*2], ax
jmp 0x100ebc2c
push 1
push str._____
mov byte [esp + 0x5c], 0
mov ecx, esi
push dword [esp + 0x5c]
push 1
call fcn.1001f850
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ebc33
mov eax, dword [esi + 0x14]
sub ecx, edx
mov edx, dword [esi + 0x10]
sub eax, edx
sar ecx, 1
cmp ecx, eax
ja 0x100ebc7b
cmp dword [esi + 0x14], 8
lea ebp, [edx + ecx]
mov dword [esi + 0x10], ebp
mov edi, esi
jb 0x100ebc5e
mov edi, dword [esi]
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [edi + edx*2]
push eax
call fcn.10074220
add esp, 0xc
xor eax, eax
mov word [edi + ebp*2], ax
jmp 0x100ebc92
push ecx
lea eax, [esp + 0x14]
mov byte [esp + 0x58], 0
push eax
push dword [esp + 0x5c]
push ecx
mov ecx, esi
call fcn.1001f850
mov edx, dword [esi + 0x14]
mov eax, edx
mov ecx, dword [esi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x100ebccb
lea ebp, [ecx + 1]
mov edi, esi
mov dword [esi + 0x10], ebp
cmp edx, 8
jb 0x100ebcb0
mov edi, dword [esi]
push 2
lea eax, [edi + ecx*2]
push 0x101335a8
push eax
call fcn.10074220
add esp, 0xc
xor eax, eax
mov word [edi + ebp*2], ax
jmp 0x100ebce4
push 1
push 0x101335a8
mov byte [esp + 0x5c], 0
mov ecx, esi
push dword [esp + 0x5c]
push 1
call fcn.1001f850
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
pop ebp
jb 0x100ebcf0
mov ebx, dword [ebx]
push eax
push ebx
mov ecx, esi
call fcn.1001e7b0
cmp dword [esi + 0x14], 8
jb 0x100ebd01
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
pop esi
setne al
pop ebx
add esp, 0x40
ret

Function at 0x100ec2b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push esi
push edi
push 0x20c
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.100747a0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x100ec2d7
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x100ec2df
mov esi, dword [esi]
lea eax, [esp + 8]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop edi
pop esi
test eax, eax
je 0x100ec32d
xor eax, eax
lea ecx, [esp]
mov word [esp + 0x20a], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ec304
sub ecx, edx
lea eax, [esp]
sar ecx, 1
push ecx
mov ecx, dword [esp + 0x214]
push eax
call fcn.1001a860
mov al, 1
add esp, 0x20c
ret
xor al, al
add esp, 0x20c
ret
Function at 0x100ec360
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x100ec378
mov edx, dword [esi]
mov ecx, edx
mov dword [esp + 0x20], 0
xor eax, eax
mov dword [esp + 0x24], 7
mov word [esp + 0x10], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ec394
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.1001a860
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
push 0
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [esp + 0x24]
test eax, eax
sete bl
cmp edx, 8
jb 0x100ec402
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100ec3f8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100ec42b
push edx
push ecx
call fcn.100703b3
add esp, 8
test bl, bl
jne 0x100ec422
cmp dword [esi + 0x14], 8
jb 0x100ec40e
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100ec422
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1007e0fa
int3

Function at 0x100ec870
Capabilities:
Get common file path

Disassembly:
mov edx, dword [0x10151e7c]
sub esp, 0x620
push esi
mov esi, ecx
test edx, edx
je 0x100ec8b3
cmp esi, 0x10151e6c
je 0x100ec98c
cmp dword [0x10151e80], 8
mov eax, 0x10151e6c
push edx
cmovae eax, dword [0x10151e6c]
push eax
call fcn.1001a860
mov al, 1
pop esi
add esp, 0x620
ret
push 0x20c
lea eax, [esp + 8]
push 0
push eax
call fcn.100747a0
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x100ec996
xor eax, eax
push 0x412
push eax
mov word [esp + 0x216], ax
lea eax, [esp + 0x218]
push eax
call fcn.100747a0
add esp, 0xc
lea eax, [esp + 0x210]
push 0x208
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x100ec969
test eax, eax
je 0x100ec969
xor ecx, ecx
mov word [esp + eax*2 + 0x210], cx
lea ecx, [esp + 0x210]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ec940
sub ecx, edx
lea eax, [esp + 0x210]
sar ecx, 1
push ecx
mov ecx, esi
push eax
call fcn.1001a860
mov al, 1
pop esi
add esp, 0x620
ret
lea ecx, [esp + 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ec970
sub ecx, edx
lea eax, [esp + 4]
sar ecx, 1
push ecx
mov ecx, esi
push eax
call fcn.1001a860
mov al, 1
pop esi
add esp, 0x620
ret
xor al, al
pop esi
add esp, 0x620
ret