joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c355
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0048f563
and dword [ebp - 4], 0
cmp dword [0x4ef53c], 0
mov ebx, eax
jne 0x49c406
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x49c4b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x49c4b7
push eax
call fcn.0048f4f1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4ef53c], eax
call esi
push eax
call fcn.0048f4f1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ef540], eax
call esi
push eax
call fcn.0048f4f1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ef544], eax
call esi
push eax
call fcn.0048f4f1
pop ecx
mov dword [0x4ef54c], eax
test eax, eax
je 0x49c406
push 0x4c1fe0
push edi
call esi
push eax
call fcn.0048f4f1
pop ecx
mov dword [0x4ef548], eax
mov eax, dword [0x4ef548]
cmp eax, ebx
je 0x49c45e
cmp dword [0x4ef54c], ebx
je 0x49c45e
push eax
call fcn.0048f56c
push dword [0x4ef54c]
mov esi, eax
call fcn.0048f56c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x49c45e
test edi, edi
je 0x49c45e
call esi
test eax, eax
je 0x49c455
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49c455
test byte [ebp - 0xc], 1
jne 0x49c45e
or dword [ebp + 0x10], 0x200000
jmp 0x49c497
mov eax, dword [0x4ef540]
cmp eax, ebx
je 0x49c497
push eax
call fcn.0048f56c
pop ecx
test eax, eax
je 0x49c497
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x49c497
mov eax, dword [0x4ef544]
cmp eax, ebx
je 0x49c497
push eax
call fcn.0048f56c
pop ecx
test eax, eax
je 0x49c497
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ef53c]
call fcn.0048f56c
pop ecx
test eax, eax
je 0x49c4b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x49c4b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a1b41
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
je 0x4a1b4b
or eax, 0xffffffff
ret
cmp dword [esi + 4], 0
jne 0x4a1b94
call fcn.0048cdf7
and dword [eax], 0
push dword [esi + 0x40]
push 0x4000
push 1
push dword [esi + 0x44]
call fcn.004a9b4c
add esp, 0x10
mov dword [esi + 4], eax
test eax, eax
jne 0x4a1b8f
push dword [esi + 0x40]
mov dword [esi + 0x3c], 1
call fcn.004a9878
pop ecx
test eax, eax
je 0x4a1b47
or dword [esi + 0x38], 0xffffffff
jmp 0x4a1b47
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret
Function at 0x4a1ba2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov edi, dword [esi + 4]
inc ebx
cmp edi, 2
jae 0x4a1c14
test edi, edi
je 0x4a1bc1
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov al, byte [eax]
mov byte [ecx], al
call fcn.0048cdf7
and dword [eax], 0
push dword [esi + 0x40]
mov ecx, edi
mov eax, 0x4000
sar eax, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push ebx
push eax
call fcn.004a9b4c
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4a1bfc
push dword [esi + 0x40]
call fcn.004a9878
pop ecx
test eax, eax
je 0x4a1bfc
or dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x44]
mov dword [esi], ecx
cmp eax, 2
jae 0x4a1c14
mov dword [esi + 0x58], eax
jmp 0x4a1ccd
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x4a1cca
cmp byte [eax + 1], 0x8b
jne 0x4a1cca
add dword [esi + 4], 0xfffffffe
add eax, 2
mov dword [esi], eax
call fcn.004a1b41
mov edi, eax
call fcn.004a1b41
mov ebx, eax
cmp edi, 8
jne 0x4a1cc1
test bl, 0xe0
jne 0x4a1cc1
push 6
pop edi
call fcn.004a1b41
dec edi
jne 0x4a1c4d
test bl, 4
je 0x4a1c7c
call fcn.004a1b41
mov edi, eax
call fcn.004a1b41
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x4a1c7c
call fcn.004a1b41
cmp eax, 0xffffffff
jne 0x4a1c6b
test bl, 8
je 0x4a1c8f
call fcn.004a1b41
test eax, eax
je 0x4a1c8f
cmp eax, 0xffffffff
jne 0x4a1c81
test bl, 0x10
je 0x4a1ca2
call fcn.004a1b41
test eax, eax
je 0x4a1ca2
cmp eax, 0xffffffff
jne 0x4a1c94
test bl, 2
je 0x4a1cb2
push 2
pop edi
call fcn.004a1b41
dec edi
jne 0x4a1caa
mov eax, dword [esi + 0x3c]
neg eax
sbb eax, eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
jmp 0x4a1ccd
mov dword [esi + 0x38], 0xfffffffd
jmp 0x4a1ccd
mov dword [esi + 0x58], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4a1d6b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4a1e0d
cmp byte [esi + 0x5c], 0x77
jne 0x4a1e0d
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [esi], eax
mov dword [esi + 4], ebx
test ebx, ebx
je 0x4a1df3
push edi
mov edi, 0x4000
cmp dword [esi + 0x10], 0
jne 0x4a1dbe
push dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push edi
push 1
push eax
mov dword [esi + 0xc], eax
call fcn.004a97f6
add esp, 0x10
cmp eax, edi
jne 0x4a1dee
mov dword [esi + 0x10], edi
mov eax, dword [esi + 4]
add dword [esi + 0x64], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push 0
push esi
call fcn.004a250f
pop ecx
pop ecx
mov ecx, dword [esi + 4]
sub dword [esi + 0x64], ecx
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
mov dword [esi + 0x38], eax
test eax, eax
jne 0x4a1df2
cmp dword [esi + 4], eax
jne 0x4a1d9c
jmp 0x4a1df2
or dword [esi + 0x38], 0xffffffff
pop edi
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x4c]
call fcn.004a5241
mov dword [esi + 0x4c], eax
add esp, 0xc
mov eax, ebx
sub eax, dword [esi + 4]
pop ebx
jmp 0x4a1e10
push 0xfffffffffffffffe
pop eax
pop esi
pop ebp
ret
Function at 0x4a1e13
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
cmp esi, ebx
je 0x4a1ebd
cmp byte [esi + 0x5c], 0x77
jne 0x4a1ebd
mov dword [esi + 4], ebx
mov edi, 0x4000
sub edi, dword [esi + 0x10]
je 0x4a1e60
push dword [esi + 0x40]
push edi
push 1
push dword [esi + 0x48]
call fcn.004a97f6
add esp, 0x10
cmp eax, edi
jne 0x4a1eb5
mov eax, dword [esi + 0x48]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x4a1ea7
push dword [ebp + 8]
mov eax, dword [esi + 0x10]
add dword [esi + 0x68], eax
push esi
call fcn.004a250f
pop ecx
pop ecx
mov ecx, dword [esi + 0x10]
sub dword [esi + 0x68], ecx
mov dword [esi + 0x38], eax
test edi, edi
jne 0x4a1e8a
cmp eax, 0xfffffffb
jne 0x4a1e8a
and dword [esi + 0x38], edi
test ecx, ecx
jne 0x4a1e98
cmp dword [esi + 0x38], 1
je 0x4a1e98
xor ebx, ebx
jmp 0x4a1e9b
xor ebx, ebx
inc ebx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x4a1e34
cmp eax, 1
je 0x4a1e34
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
and eax, esi
jmp 0x4a1ec0
or eax, 0xffffffff
mov dword [esi + 0x38], eax
jmp 0x4a1ec0
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4a2f87
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x4a3016
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0048afb0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4a2fd6
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4a2ff8
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4a30d4
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x4a303e
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x4a3049
xor eax, eax
jmp 0x4a3095
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x4a3066
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.004a5274
jmp 0x4a3076
cmp ecx, 2
jne 0x4a307f
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.004a5241
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.0048afb0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x4a30c0
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x4a30d4
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4a2f94
pop edi
pop ebx
leave
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x483b66c6
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2eb3320d
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x108eca0
Capabilities:
Install driver

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10054c8
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0xa
call fcn.01092bc0
test eax, eax
jge 0x108ecf4
call fcn.010947d0
mov dword [ebp - 0x10], eax
push 0x1b8
push 0x10051b4
call fcn.0108e430
push eax
push 0x1005480
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x108ed3d
lea edx, [ebp - 8]
push edx
call sub.ntdll.dll_NtLoadDriver
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x108ed38
call fcn.010947d0
mov dword [ebp - 0x14], eax
push 0x1bf
push 0x10051b4
call fcn.0108e430
push eax
push 0x1005460
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
xor eax, eax
jmp 0x108ed3d
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x108ed50
Capabilities:
Unload driver

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push 0x10054c8
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea ecx, [ebp - 8]
push ecx
call sub.ntdll.dll_NtUnloadDriver
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x108edab
call fcn.010947d0
mov dword [ebp - 0x10], eax
push 0x1cf
push 0x10051b4
call fcn.0108e430
push eax
push 0x100553c
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
xor eax, eax
jmp 0x108edb0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x108ef90
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0xb
call dword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
jne 0x108efb8
xor eax, eax
jmp 0x108f097
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0108d7a0
add esp, 4
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x108efda
xor eax, eax
jmp 0x108f097
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0xb
call dword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x108effe
xor eax, eax
jmp 0x108f097
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], 0
jmp 0x108f021
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 8]
jae 0x108f083
push 0x100555c
mov edx, dword [ebp - 0xc]
add edx, 0x1c
push edx
call sub.ntdll.dll__strlwr
add esp, 4
push eax
call sub.ntdll.dll_strstr
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x108f075
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
push ecx
call fcn.0108eeb0
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.0108d7c0
add esp, 4
mov eax, dword [ebp - 0x20]
jmp 0x108f097
mov ecx, dword [ebp - 0xc]
add ecx, 0x11c
mov dword [ebp - 0xc], ecx
jmp 0x108f018
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0108d7c0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x108f0a0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x530
mov dword [ebp - 0x4a4], 0
jmp 0x108f0c6
mov eax, dword [ebp - 0x4a4]
add eax, 1
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0x100
jge 0x108f16b
mov dword [ebp - 0x52c], 0
mov word [ebp - 0x528], 0
push 0x7e
push 0
lea ecx, [ebp - 0x526]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x4a4]
push edx
push 0x10055ac
lea eax, [ebp - 0x528]
push eax
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea ecx, [ebp - 0x528]
push ecx
call fcn.01091ef0
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0xffffffff
je 0x108f166
mov dword [ebp - 0x530], 0
mov edx, dword [ebp - 0x52c]
push edx
call fcn.01092770
mov eax, dword [ebp - 0x52c]
push eax
call fcn.01092350
jmp 0x108f0b7
mov word [ebp - 0x498], 0
push 0x3fe
push 0
lea ecx, [ebp - 0x496]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
lea edx, [ebp - 0x498]
push edx
call fcn.0108fb30
mov word [ebp - 0x80], 0
push 0x7e
push 0
lea eax, [ebp - 0x7e]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x498]
push ecx
push 0x100558c
lea edx, [ebp - 0x80]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call fcn.010922c0
mov word [ebp - 0x4a0], 0
xor ecx, ecx
mov dword [ebp - 0x49e], ecx
mov word [ebp - 0x49a], cx
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 0x98], 0
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x98], 0x18
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x8c], 0x40
lea edx, [ebp - 0x4a0]
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.ntdll.dll_ZwDeleteFile]
push 0x80
push 0
lea ecx, [ebp - 0x80]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x498]
push edx
push 0x1005568
lea eax, [ebp - 0x80]
push eax
call sub.ntdll.dll_swprintf
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
call fcn.010922c0
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 0x98], 0x18
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x8c], 0x40
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.ntdll.dll_ZwDeleteFile]
mov esp, ebp
pop ebp
ret 4
Function at 0x10921c0
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x28], 0xffffffff
push 0
push 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
movzx edx, al
test edx, edx
jne 0x10921f5
push 3
call fcn.0108f8a0
xor al, al
jmp 0x10922b5
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0x40
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x20
push 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x100100
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_ZwOpenFile]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp dword [ebp - 0x24], 0
jne 0x109229a
xor edx, edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 0xc]
or eax, 0x80
mov dword [ebp - 0x38], eax
push 4
push 0x28
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_ZwSetInformationFile]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ntdll.dll_ZwClose]
cmp dword [ebp - 0x24], 0
jne 0x10922a4
mov al, 1
jmp 0x10922b5
mov edx, dword [ebp - 0x24]
push edx
call sub.ntdll.dll_RtlNtStatusToDosError
push eax
call fcn.0108f8a0
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x1092390
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x14], 0
je 0x10923bb
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
cmp dword [ebp + 0x10], 0
jne 0x10923c8
mov al, 1
jmp 0x1092476
cmp dword [ebp + 0x18], 0
je 0x10923f5
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0x103
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntdll.dll_ZwReadFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x103
je 0x1092449
cmp dword [ebp + 0x14], 0
je 0x1092449
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
mov dword [eax], edx
cmp dword [ebp - 0x1c], 0
je 0x1092474
cmp dword [ebp - 0x1c], 0xc0000011
je 0x1092474
cmp dword [ebp - 0x1c], 0x102
je 0x1092474
mov eax, dword [ebp - 0x1c]
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
push eax
call fcn.0108f8a0
xor al, al
jmp 0x1092476
mov al, 1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1092490
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0x14], 0
je 0x10924c9
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
cmp dword [ebp + 0x10], 0
jne 0x10924d6
mov al, 1
jmp 0x109257c
cmp dword [ebp + 0x18], 0
je 0x1092503
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0x103
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntdll.dll_ZwWriteFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x103
je 0x1092558
cmp dword [ebp + 0x14], 0
je 0x1092558
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 4]
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
cmp dword [ebp - 0x1c], 0
je 0x109257a
cmp dword [ebp - 0x1c], 0x5b4
je 0x109257a
mov eax, dword [ebp - 0x1c]
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
push eax
call fcn.0108f8a0
xor al, al
jmp 0x109257c
mov al, 1
mov esp, ebp
pop ebp
ret 0x14