joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409438
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409492
inc esi
xor edi, edi
cmp edi, 1
jne 0x40945e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40946c
cmp edi, 1
jle 0x40946c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408f08
test eax, eax
jne 0x409492
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409492
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409492
inc edi
dec esi
jne 0x40944e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40949c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x4094e9
xor ebx, ebx
jmp 0x4094de
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00404bcc
test eax, eax
jne 0x4094dd
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409599
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4094bf
mov al, byte [ebp - 1]
sub al, 1
jb 0x4094f4
je 0x4094fd
jmp 0x409506
call fcn.00406fc0
mov edi, eax
jmp 0x409508
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x409508
xor edi, edi
test di, di
je 0x409599
xor ebx, ebx
jmp 0x409544
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x409543
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409538
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409543
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409599
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409515
xor ebx, ebx
jmp 0x40958e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40958d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409582
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x40958d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409599
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x409553
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x409904
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4099d7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099f0
push ebx
push 0x4099fc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409984
mov al, 0x69
call fcn.004095a8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004098d8
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40998d
call fcn.004098d8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4099de
lea eax, [ebp - 4]
call fcn.00403150
ret

Function at 0x409a70
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b24
jmp 0x409b19
cmp dword [esi + 0x10], 0x1000
jne 0x409b05
test byte [esi + 0x15], 1
jne 0x409b05
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409ac4
cmp eax, 2
je 0x409ac4
cmp eax, 0x10
je 0x409ac4
cmp eax, 0x20
jne 0x409ad9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ad9
mov bl, 1
xor ebp, ebp
jmp 0x409aea
mov eax, dword [esi]
add eax, ebp
call fcn.00409a68
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409add
test bl, bl
je 0x409b05
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b24
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a9c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x401640
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
push 0xa
push 0
call fcn.004022d0
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov esi, dword [ebp + 8]
mov dword [0x428e1c], esi
mov dword [esp + 0xc], vtable.window.0
call fcn.00401310
mov ecx, dword [0x428e1c]
lea eax, [esp + 0xc]
push eax
push ecx
push 0
push 0
push 0x1f4
push 0x1f4
push 0x64
push 0x64
push 0x80000000
push 0x40b0c4
push str.sciter_layered_window
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4016d8
lea ebx, [esp + 0xc]
call fcn.004013b0
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esp + 0x10], 0
jne 0x4016e3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x6b
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, eax
mov eax, dword [esp + 0x10]
mov ecx, esi
call fcn.00401290
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call esi
test eax, eax
je 0x40174e
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
push edi
push eax
call ebx
test eax, eax
jne 0x40173d
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jne 0x401716
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x40d01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x210], eax
test esi, esi
je 0x401a19
cmp word [esi], 0
je 0x401a19
push 4
push str.res:
push esi
call fcn.00402f9f
add esp, 0xc
test eax, eax
jne 0x401948
add esi, 8
push 2
push 0x40b204
push esi
call fcn.00402f9f
add esp, 0xc
test eax, eax
jne 0x40195f
add esi, 4
push 0x104
push esi
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.00402ed2
lea edx, [ebp - 0x20c]
push 0x2e
push edx
call fcn.00402c7c
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4019c6
xor eax, eax
add esi, 2
mov word [esi - 2], ax
je 0x4019c6
push str.HTML
push esi
call fcn.00402e47
add esp, 8
test eax, eax
je 0x4019c6
push 0x40b218
push esi
call fcn.00402e47
add esp, 8
test eax, eax
je 0x4019c6
push esi
lea ecx, [ebp - 0x20c]
push ecx
jmp 0x4019cf
push 0x17
lea edx, [ebp - 0x20c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x401a19
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401a19
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx], eax
test eax, eax
je 0x401a19
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x210]
test eax, eax
mov dword [ecx], eax
setne al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004028ce
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
pop esi
call fcn.004028ce
mov esp, ebp
pop ebp
ret

Function at 0x4028ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d01c]
jne 0x4028d8
repz ret
jmp fcn.00403178
Function at 0x4060fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40d01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004038b4
and dword [ebp - 0x14], 0
cmp dword [0x4289f0], 0
mov dword [ebp - 0x18], eax
jne 0x4061ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406256
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406256
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4289f0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4289f4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4289f8], eax
call edi
push eax
call esi
mov dword [0x428a00], eax
test eax, eax
je 0x4061ae
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4289fc], eax
mov eax, dword [0x4289fc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406207
cmp dword [0x428a00], ecx
je 0x406207
push eax
call esi
push dword [0x428a00]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406207
test ebx, ebx
je 0x406207
call edi
test eax, eax
je 0x4061fe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4061fe
test byte [ebp - 8], 1
jne 0x406207
or dword [ebp + 0x10], 0x200000
jmp 0x40623a
mov eax, dword [0x4289f4]
cmp eax, dword [ebp - 0x18]
je 0x40623a
push eax
call esi
test eax, eax
je 0x40623a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40623a
mov eax, dword [0x4289f8]
cmp eax, dword [ebp - 0x18]
je 0x40623a
push eax
call esi
test eax, eax
je 0x40623a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4289f0]
call esi
test eax, eax
je 0x406256
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406258
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004028ce
leave
ret
Function at 0x100b6b0
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x10203e8
call fcn.0100be64
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1023a40
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100b46b
cmp eax, esi
jne 0x100b45e
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100b46e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100b445
xor esi, esi
inc esi
mov eax, dword [0x1023a3c]
cmp eax, esi
jne 0x100b481
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100b4b0
mov eax, dword [0x1023a3c]
test eax, eax
jne 0x100b4aa
mov dword [0x1023a3c], esi
push 0x100153c
push 0x1001530
call fcn.0100b3a7
pop ecx
pop ecx
test eax, eax
je 0x100b4b0
jmp 0x100b5d4
mov dword [0x1023408], esi
mov eax, dword [0x1023a3c]
cmp eax, esi
jne 0x100b4d4
push 0x100152c
push 0x1001518
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1023a3c], 2
cmp dword [ebp - 0x20], ebx
jne 0x100b4e1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1023a50], ebx
je 0x100b502
push 0x1023a50
call fcn.0100bdd9
pop ecx
test eax, eax
je 0x100b502
push ebx
push 2
push ebx
call dword [0x1023a50]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x100b5d4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x100b56c
cmp cx, bx
je 0x100b527
cmp dword [ebp - 0x1c], ebx
jne 0x100b56c
movzx ecx, word [eax]
cmp cx, bx
je 0x100b53c
cmp cx, 0x20
ja 0x100b53c
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x100b527
test byte [ebp - 0x40], 1
je 0x100b548
movzx ecx, word [ebp - 0x3c]
jmp 0x100b54b
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1023404], eax
cmp dword [0x10233f8], ebx
jne 0x100b5b1
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x100b57d
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x100b511
cmp dword [0x1023408], ebx
jne 0x100b5bf
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1023404]
jmp 0x100b5e0
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100bea9
ret
call fcn.0100bf87
jmp 0x100b408
Function at 0x100e447
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100e476
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0100b8a2
add esp, 0x14
jmp 0x100e554
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100e554
test al, 0x40
jne 0x100e554
test al, 2
je 0x100e498
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100e554
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x100e458
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x100e544
cmp eax, 0xffffffff
je 0x100e544
test byte [esi + 0xc], 0x82
jne 0x100e519
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x100e504
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x100e504
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100e509
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100e519
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100e537
mov eax, dword [esi + 0xc]
test al, 8
je 0x100e537
test eax, 0x400
jne 0x100e537
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x100e557
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100fd77
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100fda6
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0100b8a2
add esp, 0x14
jmp 0x100fe90
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100fe90
test al, 0x40
jne 0x100fe90
test al, 2
je 0x100fdc8
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100fe90
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x100fd88
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x100fe80
cmp eax, 1
je 0x100fe80
cmp eax, 0xffffffff
je 0x100fe80
test byte [esi + 0xc], 0x82
jne 0x100fe52
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x100fe3d
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x100fe3d
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100fe42
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100fe52
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100fe70
mov eax, dword [esi + 0xc]
test al, 8
je 0x100fe70
test eax, 0x400
jne 0x100fe70
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x100fe95
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1010337
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
xor edi, edi
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0101138c
mov ebx, eax
cmp ebx, edi
je 0x1010418
push esi
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10103e4
mov eax, dword [ebp + 0xc]
and al, 1
movsx eax, al
push edi
push 0x2200000
neg eax
push 3
sbb eax, eax
push edi
and eax, 0xfffffff9
add eax, 7
push eax
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10103d3
push 0xd
push 1
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp + 0xb], 1
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
cmp eax, edi
jge 0x10103c3
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 4], eax
jmp 0x10103ca
mov dword [ebp - 8], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1010408
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1001bf8
jmp 0x10103f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1001b70
push 0x3000000
push 0x102373c
mov dword [ebp - 4], eax
call fcn.0100a7d5
add esp, 0x14
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret 8

Function at 0x101042f
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x101050f
xor eax, eax
cmp ax, word [esi]
je 0x101050f
push ebx
push edi
push esi
call fcn.0101138c
mov dword [ebp + 8], eax
cmp eax, edi
je 0x10104c6
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x3000000
mov edi, 0x102373c
test eax, eax
jne 0x101049d
call esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x1001d50
push ebx
push edi
call fcn.0100a7d5
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x10104e8
cmp dword [ebp - 4], eax
jne 0x10104b7
call esi
mov dword [ebp - 4], eax
call esi
push eax
push dword [ebp + 8]
push 0x1001cd0
push ebx
push edi
jmp 0x10104e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1001c58
push 0x3000000
mov dword [ebp - 4], eax
push 0x102373c
call fcn.0100a7d5
add esp, 0x14
cmp dword [ebp + 8], 0
pop ebx
je 0x1010501
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
jmp 0x1010519
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x1010524
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp eax, esi
je 0x1010595
xor ecx, ecx
cmp cx, word [eax]
je 0x1010595
push edi
push esi
push eax
call fcn.0101138c
mov edi, eax
cmp edi, esi
je 0x1010590
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x101055e
test al, 0x10
je 0x101055e
inc ebx
jmp 0x1010579
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1010571
mov esi, 0x10b
cmp esi, 2
jne 0x1010579
push 3
pop esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop edi
jmp 0x101059f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10105aa
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x1010608
xor ecx, ecx
cmp cx, word [eax]
je 0x1010608
push esi
push ebx
push eax
call fcn.0101138c
mov esi, eax
cmp esi, ebx
je 0x1010603
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10105e2
test eax, 0x400
je 0x10105e2
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, ebx
pop esi
jmp 0x1010612
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x101072d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp eax, edi
je 0x101079c
xor ecx, ecx
cmp cx, word [eax]
je 0x101079c
push esi
push edi
push eax
call fcn.0101138c
mov esi, eax
test esi, esi
je 0x1010788
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x101076e
test al, 0x10
je 0x1010769
push 2
pop edi
jmp 0x1010776
xor ebx, ebx
inc ebx
jmp 0x1010776
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1010790
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop esi
jmp 0x10107a6
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop ebx
pop ebp
ret 4