joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c416
Capabilities:
Check if file exists

Disassembly:
push 0x23c
mov eax, 0x1023d960
call fcn.10045b3f
mov edi, ecx
lea eax, [ebp - 0x230]
push eax
call fcn.1004bebb
and dword [ebp - 4], 0
lea esi, [edi + 4]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1004c448
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x10246c1c
call fcn.1001c9c0
push 0x10246c20
mov ecx, esi
call fcn.1001c9c0
push 0x102b5bc8
mov ecx, esi
call fcn.1001c9c0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.1001c950
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1004c49d
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004c535
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100a4c40
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1004bd8f
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1004c4f4
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.1001c9c0
push 0x102b5bc8
mov ecx, esi
call fcn.1001c9c0
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push dword [ebp - 0x220]
cmovae eax, dword [ebp - 0x230]
mov ecx, esi
push eax
call fcn.1001c950
cmp dword [esi + 0x14], 8
jb 0x1004c53d
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea esi, [edi + 0x1c]
and dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1004c555
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push 0x10246c1c
call fcn.1001c9c0
push 0x10246c20
mov ecx, esi
call fcn.1001c9c0
push 0x102b5bc8
mov ecx, esi
call fcn.1001c9c0
lea eax, [ebp - 0x248]
mov ecx, edi
push eax
call fcn.1004bf1a
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1000aff0
lea ecx, [ebp - 0x248]
call fcn.10021eb0
lea ecx, [ebp - 0x230]
call fcn.10021eb0
call fcn.10045ae9
ret
Function at 0x1004db01
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x1023db23
call fcn.10045b3f
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x1004db22
push dword [esi + 0x1c]
call fcn.100d20a7
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1004cf34
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.100c89c7
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x1004dba6
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.1004cf34
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.1004cf34
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.10021eb0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10021eb0
sub edi, 1
jns 0x1004db50
mov ecx, esi
call fcn.1004d9e0
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.10021eb0
call fcn.10045ae9
ret

Function at 0x1004dbbf
Capabilities:
Move file

Disassembly:
push 0x4c
mov eax, 0x1023db23
call fcn.10045b3f
mov esi, ecx
cmp dword [esi + 0x1c], 0xffffffff
je 0x1004dbe0
push dword [esi + 0x1c]
call fcn.100d20a7
or dword [esi + 0x1c], 0xffffffff
pop ecx
mov eax, dword [esi + 0x28]
mov ecx, esi
dec eax
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1004cf34
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
cmp dword [ebp - 0x44], 8
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.100c89c7
mov edi, dword [esi + 0x28]
sub edi, 2
pop ecx
js 0x1004dc64
push edi
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.1004cf34
lea eax, [edi + 1]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.1004cf34
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x28]
call fcn.10021eb0
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10021eb0
sub edi, 1
jns 0x1004dc0e
mov ecx, esi
call fcn.1004da77
lea ecx, [ebp - 0x58]
mov byte [esi + 0x5c], 0
call fcn.10021eb0
call fcn.10045ae9
ret
Function at 0x100508c3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x100508d5
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x1005091a
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret

Function at 0x1005098e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x10050997
pop esi
ret

Function at 0x100509cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, dword [ebp + 0xc]
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100509e6
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10050f6e
Capabilities:
Check mutex on windows

Disassembly:
push 0x1c
mov eax, 0x1023e20b
call fcn.10045b0b
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.10060ba5
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10060bba
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0xc
call fcn.1001f8e0
push dword [ebp + 8]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
lea ecx, [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
call fcn.10060bb5
call fcn.10045ad4
ret 4
Function at 0x10050fda
Capabilities:
Check mutex on windows

Disassembly:
push 0x1c
mov eax, 0x1023e20b
call fcn.10045b0b
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.10060ba5
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10060bba
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0xc
call fcn.1001f8e0
push dword [ebp + 8]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
lea ecx, [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
call fcn.10060bb5
call fcn.10045ad4
ret 4

Function at 0x1005143e
Capabilities:
Check if file exists

Disassembly:
push 0x234
mov eax, 0x1023e231
call fcn.10045b3f
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x1a
push eax
push ebx
call fcn.10051ba8
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1005146e
sub ecx, edx
sar ecx, 1
je 0x10051509
push 0x102b5bc8
mov ebx, 0x104
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100d2edd
push edi
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100d2edd
push 0x102b5bc8
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100d2edd
add esp, 0x24
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100514fb
and dword [ebp - 0x21c], eax
and dword [ebp - 4], eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10052b0a
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x240]
call fcn.1001b290
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.1001c400
call fcn.10045ae9
ret 8
Function at 0x10051690
Capabilities:
Check if file exists

Disassembly:
push 0xc7c
mov eax, 0x1023e2b2
call fcn.10045b3f
mov esi, ecx
mov dword [ebp - 0xc88], esi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc40]
mov ebx, dword [ebp + 0xc]
push 0x208
push 0
push eax
mov dword [ebp - 0xc84], edi
call fcn.100a4c40
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.100a4c40
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.100a4c40
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.100a4c40
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100a4c40
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.100a4c40
xor ecx, ecx
mov dword [ebp - 0xc44], 7
xor eax, eax
mov dword [ebp - 0xc48], ecx
add esp, 0x48
mov word [ebp - 0xc58], ax
push ecx
push 0x1a
lea eax, [ebp - 0xc40]
mov dword [ebp - 4], ecx
push eax
push ecx
mov ecx, esi
call fcn.10051ba8
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100c6cd7
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.100a7d26
add esp, 0x14
test eax, eax
jne 0x1005178c
mov ecx, esi
jmp 0x100518fb
xor ecx, ecx
mov esi, 0x104
mov word [eax], cx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push esi
push eax
call fcn.100c6cd7
push str.Local
lea eax, [ebp - 0x830]
push esi
push eax
call fcn.100d2edd
add esp, 0x18
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
xor esi, esi
inc ecx
test eax, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
cmovne esi, ecx
push 0x104
push eax
call fcn.100c6cd7
push str.LocalLow
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.100d2edd
add esp, 0x18
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 1
xor ecx, ecx
test eax, eax
pop eax
cmovne ecx, eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xc84], ecx
push 0x104
push eax
call fcn.100c6cd7
push str.Roaming
lea eax, [ebp - 0xa38]
push 0x104
push eax
call fcn.100d2edd
add esp, 0x18
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ecx, ecx
test eax, eax
push 1
pop eax
cmovne ecx, eax
test esi, esi
je 0x100518f5
cmp dword [ebp - 0xc84], 0
je 0x100518f5
test ecx, ecx
je 0x100518f5
push ebx
lea eax, [ebp - 0x420]
push eax
push 0x1024731c
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.1004a9d0
add esp, 0x14
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100518e1
and dword [ebp - 0xc5c], eax
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.10052b0a
pop ecx
pop ecx
lea ecx, [ebp - 0xc80]
mov byte [ebp - 4], 0
call fcn.1001b290
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0xc58]
call fcn.1001c400
jmp 0x10051908
mov ecx, dword [ebp - 0xc88]
push ebx
lea eax, [ebp - 0xc58]
push eax
call fcn.1005143e
lea eax, [ebp - 0xc58]
mov ecx, edi
push eax
call fcn.1001d690
lea ecx, [ebp - 0xc58]
call fcn.10021eb0
mov eax, edi
call fcn.10045ae9
ret 8
Function at 0x100529d6
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x102cc06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10052a05
push 2
pop eax
jmp 0x10052a97
push 0x102b6048
push 0x102b605c
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.100525db
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.100a4c40
add esp, 0x1c
mov dword [ebp - 0x58], edi
test ebx, ebx
mov dword [ebp - 0x48], esi
mov ecx, str.open
mov dword [ebp - 0x54], 0x40
mov eax, 0x102473bc
mov dword [ebp - 0x3c], 5
cmove eax, ecx
cmp dword [ebp - 8], 8
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
and dword [ebp - 0x40], 0
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20], 0
mov esi, eax
je 0x10052a8d
cmp dword [ebp + 0x10], 0
je 0x10052a8d
push dword [ebp + 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x1c]
call fcn.10021eb0
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100451cc
leave
ret

Function at 0x10052b0a
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
push 2
mov byte [ebp - 1], dl
pop ebx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, ebx
cmp ax, dx
jne 0x10052b1f
push dword [ebp + 8]
sub edi, ecx
sar edi, 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10052b41
mov al, 1
jmp 0x10052bd2
push esi
xor ecx, ecx
lea esi, [edi + 1]
mov eax, esi
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100219c0
push esi
mov ebx, eax
push 0
push ebx
call fcn.1001b930
push dword [ebp + 8]
push esi
push ebx
call fcn.100c6cd7
add esp, 0x1c
xor esi, esi
movzx eax, word [ebx + esi*2]
cmp eax, 0x5c
je 0x10052b80
cmp eax, 0x2f
jne 0x10052bbc
mov dword [ebp - 8], eax
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10052bb5
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10052bc3
mov eax, dword [ebp + 0xc]
mov byte [ebp - 1], 1
cmp dword [eax + 0x24], 0
je 0x10052bb5
push ebx
mov ecx, eax
call fcn.10052ac4
mov eax, dword [ebp - 8]
mov word [ebx + esi*2], ax
inc esi
cmp esi, edi
jbe 0x10052b72
jmp 0x10052bc7
mov byte [ebp - 1], 0
push ebx
call fcn.10045361
mov al, byte [ebp - 1]
pop ecx
pop esi
pop edi
pop ebx
leave
ret
Function at 0x10053e2a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102cc06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], esi
push edi
push eax
call fcn.100a4c40
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
or eax, 0x8000
cmp byte [ebp + 0x10], 0
push edi
cmove eax, dword [ebp + 0xc]
push edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x10053e95
xor eax, eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x10053ea3
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.1001c380
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100451cc
leave
ret
Function at 0x1005443f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x102cc06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push esi
push edi
push dword [ebp + 8]
xor esi, esi
push 0x104
push eax
call fcn.100558de
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x1024741c
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100545cb
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100540ef
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [ebp - 0x45c], 0x10
je 0x10054588
mov ecx, 0x10246e10
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10054508
test dx, dx
je 0x10054504
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10054508
add eax, 4
add ecx, 4
test dx, dx
jne 0x100544e2
xor eax, eax
jmp 0x1005450d
sbb eax, eax
or eax, 1
test eax, eax
je 0x100545ae
mov ecx, 0x10247414
lea eax, [ebp - 0x430]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10054546
test dx, dx
je 0x10054542
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10054546
add eax, 4
add ecx, 4
test dx, dx
jne 0x10054520
xor eax, eax
jmp 0x1005454b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100545ae
cmp byte [ebp + 0xc], 0
je 0x1005456a
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call fcn.1005443f
add esp, 0xc
add esi, eax
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x100545a4
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x100545ab
inc esi
jmp 0x100545ae
mov byte [ebx], 1
lea eax, [ebp - 0x45c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100544a2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100451cc
leave
ret
Function at 0x100551b3
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push edi
je 0x10055263
cmp dword [ebp + 0xc], 0
je 0x10055263
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100551f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10055266
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 8], edi
cmp edi, 0xffffffff
je 0x100551f0
jb 0x10055214
push 8
pop eax
jmp 0x10055266
push esi
mov esi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10055220
mov dword [eax], edi
inc esi
push esi
call fcn.100219c0
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
push esi
push eax
mov dword [ecx], eax
call fcn.100a4c40
add esp, 0x10
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
push esi
push eax
mov eax, dword [ebp + 0xc]
push edi
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop esi
test eax, eax
je 0x100551f0
cmp dword [ebp + 8], edi
jne 0x10055263
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10055266
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret

Function at 0x10055412
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [eax + 0x10], ebx
je 0x10055523
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], ebx
je 0x10055522
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10055441
mov eax, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
test eax, eax
je 0x10055522
push 0x102d92fc
push eax
call fcn.1013b077
mov dword [ebp - 4], eax
pop ecx
pop ecx
test eax, eax
je 0x10055522
cmp dword [esi + 0x14], 0x10
jb 0x10055476
mov esi, dword [esi]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, dword [ebp - 4]
test eax, eax
je 0x10055510
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x10055510
mov eax, dword [ebp - 0x10]
push 0x102d92fc
push 0x80
movzx ecx, word [eax]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 8], ecx
call fcn.1013b077
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10055510
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x100554d9
mov eax, dword [eax]
push eax
push dword [ebp - 8]
push str.StringFileInfo_08lx_s
push 0x80
push edi
call fcn.10018990
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1005550e
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
call fcn.100212e0
mov bl, 1
push esi
call fcn.10045361
pop ecx
test edi, edi
je 0x10055522
push edi
call fcn.10045361
pop ecx
pop esi
pop edi
mov al, bl
pop ebx
leave
ret
Function at 0x10055541
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x102cc06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x664]
push esi
push 0x250
push 0
push eax
call fcn.100a4c40
add esp, 0xc
lea eax, [ebp - 0x414]
push dword [ebp + 8]
push 0x104
push eax
call fcn.100540ef
push ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100556c6
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100540ef
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [ebp - 0x664], 0x10
je 0x1005568a
mov ecx, 0x10246e10
lea eax, [ebp - 0x638]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10055616
test dx, dx
je 0x10055612
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10055616
add eax, 4
add ecx, 4
test dx, dx
jne 0x100555f0
xor eax, eax
jmp 0x1005561b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100556a9
mov ecx, 0x10247414
lea eax, [ebp - 0x638]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10055654
test dx, dx
je 0x10055650
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10055654
add eax, 4
add ecx, 4
test dx, dx
jne 0x1005562e
xor eax, eax
jmp 0x10055659
sbb eax, eax
or eax, 1
test eax, eax
je 0x100556a9
cmp byte [ebp + 0x10], 0
je 0x100556a9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100556a9
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.10055541
add esp, 0xc
jmp 0x100556a9
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100556a9
lea eax, [ebp - 0x20c]
push eax
call fcn.10055529
pop ecx
lea eax, [ebp - 0x664]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100555b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.100451cc
leave
ret

Function at 0x10055874
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
test eax, eax
je 0x100558d7
xor edi, edi
cmp word [eax], di
je 0x100558d7
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100558ad
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100558cc
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100558da
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret