joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e03257b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x2e032596
mov eax, dword [esi]
jmp 0x2e032598
mov eax, esi
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x2e0325ef
cmp eax, 0x50
je 0x2e0325ef
cmp eax, 0xb7
je 0x2e0325ef
cmp dword [edi + 0x18], 8
jb 0x2e0325bb
mov esi, dword [esi]
push esi
push 0x2e004648
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.2e02fdfb
add esp, 0x10
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
pop edi
pop esi
leave
ret 4

Function at 0x2e0325f5
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x218
cmp dword [eax + 0x18], 8
jb 0x2e03260c
mov eax, dword [eax + 4]
jmp 0x2e03260f
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x2e032653
push 0x2e004678
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.2e02fdfb
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
leave
ret 4

Function at 0x2e032d75
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x18], 8
push edi
lea edi, [esi + 4]
jb 0x2e032d90
mov eax, dword [edi]
jmp 0x2e032d92
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x2e032de4
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp dword [esi + 0x18], 8
jb 0x2e032dad
mov edi, dword [edi]
push eax
push edi
push 0x2e004744
call ebx
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.2e02fdfb
add esp, 0x14
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
pop edi
pop esi
leave
ret 4

Function at 0x2e033145
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x218
cmp eax, 0xffffffff
jne 0x2e033189
push 0x2e00484c
lea eax, [ebp - 0x218]
push 0x3d
push eax
call fcn.2e028862
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
leave
ret 4

Function at 0x2e033197
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
sub esp, 0x218
cmp eax, 0xffffffff
jne 0x2e0331db
push 0x2e00484c
lea eax, [ebp - 0x218]
push 0x3d
push eax
call fcn.2e028862
add esp, 0xc
push 0x43
pop ecx
mov esi, eax
push 0x2e078468
lea eax, [ebp - 0x10c]
lea edi, [ebp - 0x10c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.2e056019
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
leave
ret
Function at 0x2e035bb2
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x811c9dc5
jmp 0x2e035bcc
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
inc ecx
inc ecx
cmp ecx, dword [ebp + 0xc]
jne 0x2e035bbf
pop ebp
ret 8

Function at 0x2e0362d9
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x14]
xor edx, edx
push 0xa
mov eax, edi
pop ecx
div ecx
xor ebx, ebx
mov dword [ebp - 4], 0x811c9dc5
mov esi, eax
inc esi
cmp esi, edi
jae 0x2e036301
sub edi, esi
test edi, edi
jbe 0x2e036325
mov ecx, dword [ebp + 8]
push ebx
call fcn.2e02e49a
mov ecx, dword [ebp - 4]
movzx eax, word [eax]
imul ecx, ecx, 0x1000193
xor ecx, eax
add ebx, esi
mov dword [ebp - 4], ecx
cmp ebx, edi
jb 0x2e036305
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x2e040554
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
jne 0x2e04056c
xor eax, eax
jmp 0x2e040662
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x2e04057c
cmp dword [0x2e0b77f0], ebx
je 0x2e04058e
mov dword [ebp - 4], ebx
call fcn.2e03fa11
test eax, eax
je 0x2e040595
test byte [edi + 0xc], 0x10
jne 0x2e040595
xor eax, eax
jmp 0x2e040661
lea ecx, [ebp - 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
call fcn.2e03fc4d
movzx eax, word [edi + 0xc]
neg esi
sbb esi, esi
shr eax, 1
and esi, 2
and eax, 0x10
mov dword [ebp - 0xc], esi
or eax, esi
jmp 0x2e040624
mov eax, dword [edi]
cmp eax, ebx
je 0x2e0405c9
push eax
call fcn.2e04bda8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x2e0405d5
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x2e0405f2
push dword [ebp - 4]
call fcn.2e041ded
push esi
call fcn.2e03faaa
pop ecx
test eax, eax
je 0x2e040645
push 0x796d7468
push ebx
call fcn.2e045f0f
push dword [ebp + 8]
mov ecx, 0x2e0b7808
call fcn.2e03fe62
movzx eax, word [edi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
mov dword [ebp + 8], ebx
push ebx
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [edi + 8]
call fcn.2e03fec2
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x2e0405ba
jmp 0x2e040652
push dword [ebp + 8]
mov ecx, 0x2e0b7808
call fcn.2e03fdb2
lea ecx, [ebp - 0x10]
call fcn.2e03fc71
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop edi
pop ebx
leave
ret
Function at 0x2e040a2f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x2e040a45
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp + 0xc]
push ecx
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 2
pop ebx
mov esi, eax
cmp dword [ebp - 4], ebx
jae 0x2e040a77
cmp dword [ebp + 0xc], 1
je 0x2e040a75
cmp dword [ebp + 0xc], ebx
jne 0x2e040a77
mov esi, ebx
push esi
call fcn.2e03faaa
pop ecx
test eax, eax
je 0x2e040a9d
push 0x796d746b
push 0
call fcn.2e045f0f
push dword [ebp + 8]
mov ecx, 0x2e0b7808
call fcn.2e03fe62
jmp 0x2e040afd
test esi, esi
jne 0x2e040af0
cmp dword [ebp + 0xc], ebx
je 0x2e040aac
cmp dword [ebp + 0xc], 1
jne 0x2e040ab8
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
cmp dword [ebp + 0xc], ebx
je 0x2e040ac2
cmp byte [ebp + 0x1c], bl
jne 0x2e040adb
mov eax, dword [ebp + 0x18]
shr eax, 1
push eax
push edi
call fcn.2e03f419
pop ecx
pop ecx
test eax, eax
jne 0x2e040adb
mov esi, 0xea
jmp 0x2e040af0
movzx eax, byte [ebp + 0x1c]
push eax
push dword [ebp + 0xc]
call fcn.2e03f9e9
pop ecx
pop ecx
test eax, eax
jne 0x2e040af0
mov esi, ebx
push dword [ebp + 8]
mov ecx, 0x2e0b7808
call fcn.2e03fdb2
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x2e040b04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
or edi, 0xffffffff
cmp dword [ebp - 4], ebx
jne 0x2e040b2e
cmp dword [0x2e0b77f0], ebx
je 0x2e040b3d
mov dword [ebp - 0xc], 2
jmp 0x2e040b4a
cmp dword [ebp - 4], 1
jne 0x2e040b3d
call fcn.2e03fa11
test eax, eax
je 0x2e040b47
test byte [esi + 0xc], 0x10
je 0x2e040c3a
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x18]
call fcn.2e03fc4d
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call fcn.2e03fec2
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x2e040c30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x2e040b97
mov eax, dword [ebx]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
push 0
push dword [ebp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push edi
call fcn.2e03faaa
pop ecx
test eax, eax
je 0x2e040bfc
push 0x796d746c
xor edi, edi
push edi
call fcn.2e045f0f
push ebx
mov ecx, 0x2e0b7808
call fcn.2e03fe62
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
mov dword [ebp - 8], edi
call fcn.2e03fec2
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2e040b83
jmp 0x2e040c30
push ebx
mov ecx, 0x2e0b7808
call fcn.2e03fdb2
test edi, edi
jne 0x2e040c30
movzx eax, word [esi + 0xc]
mov ecx, eax
and ecx, 0xf
cmp dword [ebp - 0x14], ecx
je 0x2e040c4e
cmp dword [ebp - 0x14], 3
jne 0x2e040c2d
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 4
jne 0x2e040c2d
and al, 0xf
cmp al, 4
je 0x2e040c4e
push 2
pop edi
lea ecx, [ebp - 0x18]
call fcn.2e03fc71
xor ebx, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x2e040b15
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x18]
mov dword [eax], 1
call fcn.2e03fc71
xor eax, eax
jmp 0x2e040c49
Function at 0x2e040e83
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x2e040e9b
xor eax, eax
jmp 0x2e040ff8
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
call fcn.2e03fa11
mov eax, dword [esi]
mov dword [ebp - 0x14], edi
cmp eax, edi
je 0x2e040eb8
push eax
call fcn.2e04bda8
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edi
push ebx
or ebx, 0xffffffff
cmp dword [ebp - 8], edi
jne 0x2e040ed5
cmp dword [0x2e0b77f0], edi
je 0x2e040ee4
mov dword [ebp - 0x18], 2
jmp 0x2e040ef1
cmp dword [ebp - 8], 1
jne 0x2e040ee4
call fcn.2e03fa11
test eax, eax
je 0x2e040eee
test byte [esi + 0xc], 0x10
je 0x2e040fa4
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], edi
call fcn.2e03fc4d
jmp 0x2e040f5b
mov eax, dword [ebp - 0xc]
cmp eax, edi
jne 0x2e040f0a
mov eax, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], 2
mov ebx, eax
jae 0x2e040f35
cmp dword [ebp - 0x10], 1
je 0x2e040f32
cmp dword [ebp - 0x10], 2
jne 0x2e040f35
push 2
pop ebx
push ebx
call fcn.2e03faaa
pop ecx
test eax, eax
je 0x2e040f8b
push 0x796d746f
push edi
call fcn.2e045f0f
push dword [ebp + 8]
mov ecx, 0x2e0b7808
call fcn.2e03fe62
mov dword [ebp + 8], edi
movzx eax, word [esi + 0xc]
shr eax, 1
and eax, 0x10
or eax, dword [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
mov dword [ebp - 0xc], edi
call fcn.2e03fec2
mov ebx, eax
add esp, 0x14
cmp ebx, edi
je 0x2e040efe
jmp 0x2e040f9c
push dword [ebp + 8]
mov ecx, 0x2e0b7808
call fcn.2e03fdb2
cmp ebx, edi
je 0x2e040fb3
lea ecx, [ebp - 0x1c]
call fcn.2e03fc71
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x2e040ebc
jmp 0x2e040fbb
lea ecx, [ebp - 0x1c]
call fcn.2e03fc71
cmp ebx, edi
jne 0x2e040fda
cmp dword [ebp - 0x10], 2
je 0x2e040fce
mov al, byte [esi + 0xc]
and al, 0xf
cmp al, 2
jne 0x2e040fda
push dword [ebp - 4]
call fcn.2e03f4b5
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], edi
je 0x2e040fe7
push dword [ebp - 0x14]
call fcn.2e041ded
cmp ebx, edi
pop ebx
je 0x2e040ff5
push esi
call fcn.2e03f892
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4

Function at 0x2e04189b
Capabilities:
Set thread local storage value

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, edx
jb 0x2e0418bc
mov eax, dword [eax + 8]
cmp ecx, eax
jb 0x2e0418bc
cmp edx, eax
jb 0x2e0418bc
add eax, 0x10000
cmp eax, ecx
jae 0x2e0418e7
mov eax, dword [0x2e08135c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0x35636561
call fcn.2e045ed0
push 0
push 0
push 1
push 0xe0000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
ret
Function at 0x2e041f9e
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 4]
push eax
push 1
push ecx
xor esi, esi
push edx
mov dword [esp + 0x14], esi
call fcn.2e04a59a
test eax, eax
jne 0x2e042008
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e042008
cmp dword [esp + 0x10], 4
jne 0x2e042008
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 8]
mov dword [edx], eax
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x2e04201f
push eax
mov dword [esp + 8], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x2e042f21
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x2e042f67
push edi
push esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.2e04a2ff
mov edi, eax
cmp edi, 0xffffffff
je 0x2e042f66
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret
Function at 0x2e0440d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xffffffff
jne 0x2e0440e8
xor eax, eax
leave
ret
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
inc edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.2e042f6a
add esp, 0x10
test eax, eax
je 0x2e044235
cmp dword [ebp - 4], esi
je 0x2e044235
push ebx
mov ebx, 0x2e0b77d0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.2e045039
pop ecx
test eax, eax
jne 0x2e044143
xor edi, edi
jmp 0x2e04422d
cmp dword [0x2e0b8604], esi
je 0x2e044156
push esi
push 0x72766c72
call fcn.2e045ed0
lea eax, [ebp - 0x14]
push eax
mov dword [0x2e0b8604], 1
mov dword [ebp - 0x14], esi
call fcn.2e042e8d
pop ecx
cmp eax, dword [ebp - 8]
jne 0x2e04417a
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x2e0441b3
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.2e042fb7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.2e042f6a
add esp, 0x18
test eax, eax
je 0x2e0441a6
cmp dword [ebp - 4], esi
jne 0x2e0441b3
push esi
push 0x72766c73
call fcn.2e045ed0
xor edi, edi
cmp dword [ebp + 0x14], esi
jne 0x2e0441c5
cmp dword [ebp - 8], 0xea60
ja 0x2e04413c
cmp edi, esi
je 0x2e0441df
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.2e043e92
add esp, 0x10
mov edi, eax
mov dword [0x2e0b8604], esi
push esi
cmp edi, esi
je 0x2e044223
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x2e04420e
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jne 0x2e04420e
xor edi, edi
inc edi
jmp 0x2e044210
xor edi, edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.2e042f21
add esp, 0xc
jmp 0x2e04422d
push 0x74697970
call fcn.2e045ed0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x2e044250
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.2e042fb7
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x2e044506
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, edi
jne 0x2e044528
push edi
push 0x36717370
call fcn.2e045ed0
jmp 0x2e044666
push esi
mov esi, dword [ebp + 0x10]
cmp esi, edi
jne 0x2e04453b
push edi
push 0x36717371
jmp 0x2e04463b
cmp dword [ebp + 8], 2
je 0x2e044558
cmp dword [ebp + 8], 8
je 0x2e044558
cmp dword [ebp + 8], 3
je 0x2e044558
push edi
push 0x36717372
jmp 0x2e04463b
cmp dword [ebx], edi
je 0x2e044567
push edi
push 0x36717373
call fcn.2e045ed0
cmp dword [esi], edi
je 0x2e044576
push edi
push 0x37667270
call fcn.2e045ed0
push esi
push edi
push dword [ebp + 8]
mov dword [esi], edi
call sub.Secur32.dll_GetUserNameExW
movzx edi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x2e044642
cmp eax, 0xea
jne 0x2e044642
mov eax, dword [esi]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.2e05769b
pop ecx
mov dword [ebx], eax
test eax, eax
jne 0x2e0445c6
push eax
push 0x36717375
jmp 0x2e044649
mov ecx, dword [esi]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x2e0445e6
push 0
push 0x36717376
jmp 0x2e044649
mov eax, dword [esi]
dec eax
cmp dword [ebp - 4], eax
je 0x2e0445fa
push 0
push 0x36717377
call fcn.2e045ed0
cmp edi, 2
jne 0x2e044616
push dword [esi]
push dword [ebx]
call fcn.2e044493
pop ecx
pop ecx
test eax, eax
jne 0x2e044665
push eax
push 0x36717378
jmp 0x2e044649
cmp edi, 8
jne 0x2e04462f
push dword [ebx]
call fcn.2e043275
pop ecx
test eax, eax
jne 0x2e044665
push eax
push 0x36717379
jmp 0x2e044649
cmp edi, 3
je 0x2e044665
push 0
push 0x3671737a
call fcn.2e045ed0
jmp 0x2e044665
push 0
push 0x36717374
call fcn.2e045ed0
mov eax, dword [ebx]
xor edi, edi
cmp eax, edi
je 0x2e04465f
push eax
call fcn.2e0576a6
pop ecx
mov dword [ebx], edi
cmp dword [esi], edi
je 0x2e044665
mov dword [esi], edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x2e044b80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x240], eax
mov ebx, 0x104
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.2e043dd5
pop ecx
pop ecx
test eax, eax
jne 0x2e044bbd
or eax, 0xffffffff
jmp 0x2e044d98
cmp word [ebp - 0x22c], 0
push esi
lea esi, [ebp - 0x22c]
push edi
mov dword [ebp - 0x238], esi
je 0x2e044be3
inc esi
inc esi
cmp word [esi], 0
jne 0x2e044bd5
mov dword [ebp - 0x238], esi
xor edi, edi
inc edi
push edi
call fcn.2e04299f
mov dword [esp], 0x2e0096f8
call fcn.2e03f922
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x248], eax
cmp eax, 0x64
jbe 0x2e044c0f
mov dword [ebp - 0x230], edi
mov eax, esi
lea ecx, [ebp - 0x22c]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x234], eax
mov esi, 0x80
mov edi, 0xc0000000
push dword [ebp - 0x230]
lea eax, [ebp - 0x24]
push 0x2e009e04
push 0xffffffffffffffff
push eax
call fcn.2e043259
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x2e044d43
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.2e045c14
add esp, 0xc
mov ecx, eax
call fcn.2e041ebd
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.2e04a83f
xor eax, eax
push eax
push eax
push esi
push 1
push eax
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.2e04a2ff
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
jne 0x2e044d48
cmp dword [ebp - 0x230], 0x64
jb 0x2e044cb4
and dword [ebp - 0x230], 0
inc dword [ebp - 0x230]
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x248]
jne 0x2e044c2b
push eax
push 0x2e009e04
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.2e043259
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x2e044d43
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.2e045c14
add esp, 0xc
mov ecx, eax
call fcn.2e041ebd
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.2e04a83f
push esi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
push ebx
push ebx
push esi
push 2
push ebx
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.2e04a2ff
mov dword [ebp - 0x23c], eax
jmp 0x2e044d4a
call fcn.2e03355d
xor ebx, ebx
cmp dword [ebp - 0x230], 0x64
pop edi
pop esi
jb 0x2e044d5b
mov dword [ebp - 0x230], ebx
mov eax, dword [ebp - 0x230]
inc eax
push eax
push 0x2e0096f8
call fcn.2e03f4d0
call fcn.2e0429f7
cmp dword [ebp - 0x240], ebx
je 0x2e044d92
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
push dword [ebp - 0x240]
push eax
call fcn.2e03fc11
add esp, 0xc
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.2e056441
leave
ret
Function at 0x2e044da5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x2e0b1da0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
xor edi, edi
push eax
inc edi
call fcn.2e043dd5
pop ecx
pop ecx
test eax, eax
je 0x2e044e6a
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x2e009e14
call fcn.2e04ba93
call fcn.2e042df8
test eax, eax
je 0x2e044e68
call fcn.2e042d03
test eax, eax
jne 0x2e044e68
call fcn.2e04441a
test eax, eax
jne 0x2e044e1f
call fcn.2e043d92
test eax, eax
je 0x2e044e68
push dword [0x2e0b83b8]
call fcn.2e0459c7
pop ecx
test eax, eax
jne 0x2e044e68
call fcn.2e043d51
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.2e044b80
push 0
lea ecx, [ebp - 0x20c]
push ecx
push edi
push eax
call fcn.2e0440d8
mov edi, eax
add esp, 0x18
lea eax, [ebp - 0x414]
test edi, edi
jne 0x2e044e59
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x2e044e68
push esi
push 0x2e0b83e4
push eax
call fcn.2e03fc11
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.2e056441
leave
ret