joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10220a74]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
lea ebp, [eax - 4]
cmp ebx, ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, ebx
jge 0x100144ae
nop
mov ebx, dword [esi]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push esi
call edi
test eax, eax
jne 0x10014492
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push esi
call edi
test eax, eax
je 0x100144a3
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push esi
mov dword [esi], ebx
call edi
add esi, 4
cmp esi, ebp
jl 0x10014470
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 4
push 4
add esi, 3
push esi
call edi
test eax, eax
jne 0x100144d5
lea eax, [esp + 0x20]
push eax
push 0x40
push 4
push esi
call edi
test eax, eax
je 0x100144e6
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
push 4
push esi
mov dword [esi], ebx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x10015070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x102207a4]
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea edi, [eax + 1]
mov ebx, 0x100074a0
sub ebx, eax
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
sub ebx, 5
call esi
test eax, eax
jne 0x100150af
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x100150c0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [edi], ebx
call esi
mov edi, dword [0x102209a0]
mov ebp, dword [edi]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x100150ea
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x100150fb
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [ebx], ebp
call esi
mov ecx, dword [0x1022093c]
mov eax, 0x10014540
call fcn.10007e20
mov ecx, dword [0x1022075c]
mov eax, 0x10015030
call fcn.10007e20
mov edi, dword [0x10220aa8]
mov ebp, dword [edi]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x10015145
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x10015156
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [ebx], ebp
call esi
mov ecx, dword [0x10220a38]
mov eax, 0x10014560
call fcn.10007e20
mov eax, dword [0x10220774]
mov ecx, dword [0x10220a98]
push eax
push ecx
call fcn.10014450
mov edx, dword [0x10220894]
mov eax, dword [0x10220878]
push edx
push eax
call fcn.10014450
mov ecx, dword [0x10220abc]
mov eax, 0x10014d60
call fcn.10007e20
mov ecx, dword [0x10220a9c]
pop edi
pop esi
pop ebp
mov eax, 0x10014d60
pop ebx
add esp, 8
jmp fcn.10007e20
Function at 0x10016090
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
push esi
push edi
call ebx
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [esp + 0x10], 0x1c
xor esi, esi
call ebx
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Thread32First
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100160ec
call ebp
cmp eax, 0x12
je 0x100160ec
cmp dword [esp + 0x1c], ebx
jne 0x100160dd
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edi
call sub.KERNEL32.dll_Thread32Next
test esi, esi
je 0x100160c8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10016280
Capabilities:
Create thread
Read .ini file

Disassembly:
sub esp, 0x10
mov eax, dword [0x101252d0]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [0x10220a20]
mov ecx, dword [0x102208a4]
mov edx, dword [0x102208e0]
push esi
push str..config.ini
mov dword [0x10164668], eax
mov eax, dword [0x10220794]
push 0xa
mov dword [0x1020b504], eax
lea eax, [esp + 0xc]
push eax
push 0x1010b90f
mov dword [0x10175c2c], ecx
mov ecx, dword [0x10220998]
mov dword [0x102201cc], edx
mov edx, dword [0x102209c0]
push 0x1010ce98
push str.CONFIG
mov dword [0x10209538], ecx
mov dword [edx], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 4]
push ecx
call fcn.10092cee
add esp, 4
mov dword [0x10209a8c], eax
cmp eax, 0x3c
jne 0x10016315
mov dword [0x102206d8], eax
jmp 0x10016409
cmp eax, 0xc8
jne 0x10016391
call fcn.10016090
push str.NtDelayExecution
push str.ntdll.dll
mov dword [0x1012c9d4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10015eb0
push eax
call fcn.100bdf30
cmp dword [0x102206e4], 0
mov dword [0x1015bb84], eax
jne 0x1001637b
push 0x20
call sub.d3d9.dll_Direct3DCreate9
test eax, eax
je 0x1001637b
mov eax, dword [eax]
mov edx, dword [eax + 0x40]
push 0x10015fb0
push edx
mov dword [0x1020b95c], eax
call fcn.100bdf30
mov dword [0x1015bb44], eax
mov dword [0x102206d8], 0xc8
mov dword [0x102206dc], 0x1388
jmp 0x10016409
mov esi, 0x3e8
cmp eax, esi
je 0x1001639e
test eax, eax
jne 0x10016409
call fcn.10016090
push str.NtDelayExecution
push str.ntdll.dll
mov dword [0x1012c9d4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10015eb0
push eax
call fcn.100bdf30
cmp dword [0x102206e4], 0
mov dword [0x1015bb84], eax
jne 0x100163fd
push 0x20
call sub.d3d9.dll_Direct3DCreate9
test eax, eax
je 0x100163fd
mov eax, dword [eax]
mov dword [0x1020b95c], eax
mov eax, dword [eax + 0x40]
push 0x10015fb0
push eax
call fcn.100bdf30
mov dword [0x1015bb44], eax
mov dword [0x102206d8], esi
mov dword [0x102206dc], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000e9f0
push 0
push 0
call esi
call fcn.10014210
mov ecx, dword [0x102209e8]
push 0
push 4
push 0x10220508
inc ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.10015070
call fcn.10015760
cmp byte [0x1022045a], 0
jne 0x10016467
push 0
push 0
push 0
push 0x100151c0
push 0
push 0
call esi
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.10091714
add esp, 0x10
ret
Function at 0x10016480
Capabilities:
Allocate or change rwx memory
Delete file
Execute shellcode via indirect call

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x1001655b
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
xor bl, bl
nop
push 0x1f4
call ebp
mov ecx, dword [0x102207a4]
lea eax, [esp + 0x18]
push eax
push 0x40
push 4
push ecx
call esi
test eax, eax
je 0x100164bf
mov bl, 1
mov eax, dword [esp + 0x18]
mov ecx, dword [0x102207a4]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push ecx
call esi
test bl, bl
je 0x100164a0
mov eax, dword [esp + 0x14]
call fcn.10008b40
mov edi, dword [0x10220870]
push 0x10129daa
mov esi, 1
call fcn.100080d0
mov edi, dword [0x102207dc]
push 0x10129daa
call fcn.100080d0
mov edi, dword [0x10220760]
push 0x10129daa
call fcn.100080d0
mov edi, dword [0x10220908]
push 0x10129daa
call fcn.100080d0
mov edi, dword [0x102209d4]
push 0x10129daa
call fcn.100080d0
mov edi, dword [0x1022099c]
push 0x10129daa
call fcn.100080d0
call fcn.10016280
push 0x7d0
call ebp
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
test eax, eax
jne 0x1001658c
mov ecx, dword [0x10131794]
test ecx, ecx
jle 0x1001657c
mov eax, dword [0x102206d4]
test eax, eax
jle 0x1001657c
push eax
push ecx
call fcn.100042d0
add esp, 8
call fcn.100094f0
push str..XNova_bake.dll
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
ret 0xc
Function at 0x10016af0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100c8c02
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101252d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x1010cf64
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.10017d00
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.10018a90
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x10220b58]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x24], 2
call fcn.10017f30
test eax, eax
jne 0x10016be7
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x10016be0
or eax, 4
push ebx
push eax
call fcn.10001e10
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x10018a90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100c872b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101252d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100bd7b0
push 4
mov dword [esp + 0x20], 0
call fcn.10094f37
mov edi, eax
add esp, 4
test edi, edi
je 0x10018b0e
call fcn.100bd1f5
mov dword [edi], eax
call fcn.100bcfee
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.100bd448
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10018b03
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.100bd470
jmp 0x10018b10
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x1001aa60
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x3c]
add eax, ecx
movzx ecx, word [eax + 0x14]
cmp esi, dword [ecx + eax + 0x2c]
push edi
lea edi, [ecx + eax + 0x18]
jae 0x1001aa78
mov eax, esi
pop edi
ret
push ebx
movzx ebx, word [eax + 6]
xor eax, eax
xor edx, edx
cmp ax, bx
jae 0x1001aaa5
movzx eax, dx
lea ecx, [eax + eax*4]
lea eax, [edi + ecx*8]
mov ecx, dword [eax + 0xc]
cmp esi, ecx
jb 0x1001aa9f
mov eax, dword [eax + 0x10]
add eax, ecx
cmp esi, eax
jb 0x1001aaaa
inc edx
cmp dx, bx
jb 0x1001aa86
pop ebx
xor eax, eax
pop edi
ret
movzx eax, dx
lea ecx, [eax + eax*4]
mov eax, dword [edi + ecx*8 + 0x14]
sub eax, dword [edi + ecx*8 + 0xc]
lea ecx, [edi + ecx*8]
pop ebx
add eax, esi
pop edi
ret
Function at 0x1001aac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edi + 0x3c]
movzx ecx, word [eax + edi + 0x18]
add eax, edi
mov edx, 0x10b
sub esp, 8
cmp cx, dx
je 0x1001aae2
mov eax, 0x20b
xor eax, eax
add esp, 8
ret
push ebx
push ebp
push esi
mov esi, dword [eax + 0x78]
mov ecx, edi
call fcn.1001aa60
mov ebp, eax
mov esi, dword [ebp + edi + 0x20]
add ebp, edi
mov ecx, edi
mov dword [esp + 0x10], ebp
call fcn.1001aa60
mov esi, dword [ebp + 0x24]
mov ebx, eax
mov ecx, edi
add ebx, edi
call fcn.1001aa60
mov ebp, dword [ebp + 0x18]
add eax, edi
mov dword [esp + 0xc], eax
test ebp, ebp
je 0x1001ab4a
lea ecx, [ecx]
mov esi, dword [ebx]
mov ecx, edi
dec ebp
call fcn.1001aa60
add eax, edi
push str.ReflectiveLoader
push eax
call fcn.10092830
add esp, 8
test eax, eax
jne 0x1001ab53
add dword [esp + 0xc], 2
add ebx, 4
test ebp, ebp
jne 0x1001ab20
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
mov esi, dword [edx + 0x1c]
mov ecx, edi
call fcn.1001aa60
mov ecx, dword [esp + 0xc]
movzx edx, word [ecx]
add eax, edi
mov esi, dword [eax + edx*4]
mov ecx, edi
call fcn.1001aa60
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10038a30
Capabilities:
Parse credit card information

Disassembly:
mov al, byte [esp + 4]
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x10038a41
mov al, 1
ret
mov dl, al
sub dl, 0x61
cmp dl, 0x19
jbe 0x10038a3e
mov cl, al
sub cl, 0x30
cmp cl, 9
jbe 0x10038a3e
cmp al, 0x2f
je 0x10038a3e
cmp al, 0x2e
je 0x10038a3e
cmp al, 0x40
je 0x10038a3e
cmp al, 0x2d
je 0x10038a3e
cmp al, 0x25
je 0x10038a3e
cmp al, 0x3a
je 0x10038a3e
cmp al, 0x3f
je 0x10038a3e
cmp al, 0x21
je 0x10038a3e
cmp al, 0x5f
je 0x10038a3e
cmp al, 0x26
je 0x10038a3e
cmp al, 0x3b
je 0x10038a3e
cmp al, 0xc0
jae 0x10038a88
xor al, al
ret
cmp al, 0xf7
je 0x10038a85
cmp al, 0xd7
setne al
ret
Function at 0x10044f50
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100c42bb
mov eax, dword fs:[0]
push eax
mov eax, 0x18a4
call fcn.10096de0
mov eax, dword [0x101252d0]
xor eax, esp
mov dword [esp + 0x18a0], eax
push esi
mov eax, dword [0x101252d0]
xor eax, esp
push eax
lea eax, [esp + 0x18ac]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18bc]
lea ecx, [esp + 8]
call fcn.10064af0
lea ecx, [esp + 8]
mov dword [esp + 0x18b4], 0
call fcn.10064b20
test al, al
jne 0x10044fcb
lea edx, [esp + 0x8a4]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x10044fef
lea eax, [esp + 0xa0]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xa0]
push ecx
mov ecx, esi
call fcn.10031690
jmp 0x10044ffe
lea edx, [esp + 0x8a4]
push edx
mov ecx, esi
call fcn.10034a10
lea ecx, [esp + 8]
mov dword [esp + 0x18b4], 0xffffffff
call fcn.10064b10
mov ecx, dword [esp + 0x18ac]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x18a0]
xor ecx, esp
call fcn.10091714
add esp, 0x18b0
ret
Function at 0x10045500
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x100c442c
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x101252d0]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101252d0]
xor eax, esp
push eax
lea eax, [esp + 0x458]
mov dword fs:[0], eax
mov edi, dword [esp + 0x468]
mov esi, dword [esp + 0x46c]
lea ecx, [esp + 0x14]
call fcn.10031300
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x464], 0
call fcn.100353c0
push 0x5c
push 0x2f
lea ecx, [esp + 0x1c]
call fcn.10033350
lea ecx, [esp + 0x14c]
call fcn.10064af0
lea ecx, [esp + 0x14c]
mov byte [esp + 0x460], 1
call fcn.10064b20
test al, al
lea ecx, [esp + 0x14]
je 0x100455af
call fcn.100320b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jmp 0x100456cc
call fcn.10033930
cmp eax, 0x104
jle 0x1004567e
lea ecx, [esp + 0x31c]
call fcn.10031300
lea eax, [esp + 0x31c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x468], 2
call fcn.10044e20
add esp, 8
lea ecx, [esp + 0x1e4]
call fcn.10031300
push 0x101001f0
lea ecx, [esp + 0x1e8]
mov byte [esp + 0x464], 3
call fcn.100350f0
lea ecx, [esp + 0x31c]
call fcn.10032520
push eax
lea ecx, [esp + 0x1e8]
call fcn.100350f0
lea ecx, [esp + 0x1e4]
call fcn.10034bc0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x10045651
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1004564f
mov esi, 1
test esi, esi
lea ecx, [esp + 0x1e4]
setne bl
mov byte [esp + 0x460], 2
call fcn.100313c0
lea ecx, [esp + 0x31c]
mov byte [esp + 0x460], 1
call fcn.100313c0
jmp 0x100456cf
lea ecx, [esp + 0x14]
call fcn.10034bc0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
jne 0x100456cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov edi, eax
je 0x100456c0
push edi
mov ecx, esi
call fcn.1004d200
mov ebx, dword [esi]
lea ecx, [esp + 0x14]
call fcn.10032520
mov edx, dword [ebx + 0x2c]
push eax
push str.failedToDeleteFilepath
mov ecx, esi
call edx
cmp edi, 2
jne 0x100456ca
mov ebp, 1
test ebp, ebp
setne bl
lea ecx, [esp + 0x14c]
mov byte [esp + 0x460], 0
call fcn.10064b10
lea ecx, [esp + 0x14]
mov dword [esp + 0x460], 0xffffffff
call fcn.100313c0
mov al, bl
mov ecx, dword [esp + 0x458]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.10091714
add esp, 0x450
ret
Function at 0x10047640
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100c48c1
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x101252d0]
xor eax, esp
mov dword [esp + 0x308], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101252d0]
xor eax, esp
push eax
lea eax, [esp + 0x320]
mov dword fs:[0], eax
mov edi, dword [esp + 0x330]
mov ebx, dword [esp + 0x338]
mov esi, dword [esp + 0x334]
mov ebp, dword [esp + 0x33c]
mov dword [ebx], 0
mov ecx, edi
mov dword [esi], 0xffffffff
call fcn.10033930
test eax, eax
jne 0x100476c8
test ebp, ebp
je 0x100476c1
mov eax, dword [ebp]
mov edx, dword [eax + 0x14]
push str.GetAttributes:_filename_is_empty
mov ecx, ebp
call edx
xor al, al
jmp 0x100477f5
lea ecx, [esp + 0x14]
call fcn.10031300
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x32c], 0
call fcn.100353c0
push 0x5c
push 0x2f
lea ecx, [esp + 0x1c]
call fcn.10033350
lea ecx, [esp + 0x14]
call fcn.10033930
lea ecx, [esp + 0x14c]
mov edi, eax
call fcn.10064af0
cmp edi, 0x104
mov byte [esp + 0x328], 1
jge 0x1004774e
lea ecx, [esp + 0x14]
call fcn.10031e20
test al, al
jne 0x10047737
lea ecx, [esp + 0x14c]
call fcn.10064b20
test al, al
je 0x1004774e
lea ecx, [esp + 0x14]
call fcn.100320b0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi], eax
cmp eax, 0xffffffff
jmp 0x100477bb
test edi, edi
jle 0x100477a6
lea ecx, [esp + 0x1e4]
call fcn.10031300
lea eax, [esp + 0x1e4]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x330], 2
call fcn.100453f0
add esp, 8
lea ecx, [esp + 0x1e4]
call fcn.10031c30
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x1e4]
mov dword [esi], eax
mov byte [esp + 0x328], 1
call fcn.100313c0
jmp 0x100477b8
lea ecx, [esp + 0x14]
call fcn.10031c30
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x100477c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
cmp dword [esi], 0xffffffff
lea ecx, [esp + 0x14c]
setne bl
mov byte [esp + 0x328], 0
call fcn.10064b10
lea ecx, [esp + 0x14]
mov dword [esp + 0x328], 0xffffffff
call fcn.100313c0
mov al, bl
mov ecx, dword [esp + 0x320]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.10091714
add esp, 0x318
ret
Function at 0x10047a00
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100c4971
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x101252d0]
xor eax, esp
mov dword [esp + 0x308], eax
push ebx
push esi
mov eax, dword [0x101252d0]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
mov esi, dword [esp + 0x328]
lea ecx, [esp + 0xc]
call fcn.10031300
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0x324], 0
call fcn.100353c0
push 0x5c
push 0x2f
lea ecx, [esp + 0x14]
call fcn.10033350
push 0
mov ebx, 1
lea eax, [esp + 0x10]
push ebx
push eax
call fcn.10045730
add esp, 0xc
lea ecx, [esp + 0x144]
call fcn.10064af0
lea ecx, [esp + 0x144]
mov byte [esp + 0x320], bl
call fcn.10064b20
test al, al
lea ecx, [esp + 0xc]
je 0x10047ac5
call fcn.100320b0
mov ecx, dword [esp + 0x32c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
neg esi
sbb esi, esi
neg esi
jmp 0x10047b43
call fcn.10033930
test eax, eax
jle 0x10047b29
lea ecx, [esp + 0x1dc]
call fcn.10031300
lea edx, [esp + 0x1dc]
push edx
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x328], 2
call fcn.100453f0
mov ecx, dword [esp + 0x334]
add esp, 8
push ecx
lea ecx, [esp + 0x1e0]
call fcn.10034bc0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x1dc]
mov esi, eax
mov byte [esp + 0x320], bl
call fcn.100313c0
jmp 0x10047b43
mov edx, dword [esp + 0x32c]
push edx
lea ecx, [esp + 0x10]
call fcn.10034bc0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x144]
setne bl
mov byte [esp + 0x320], 0
call fcn.10064b10
lea ecx, [esp + 0xc]
mov dword [esp + 0x320], 0xffffffff
call fcn.100313c0
mov al, bl
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.10091714
add esp, 0x318
ret
Function at 0x1004dae0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
mov edi, dword [esp + 0x1c]
mov byte [ebp], 0
mov ebx, ecx
mov dword [edi], 0
je 0x1004dbbd
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1004dbbd
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x1004db60
push 0
push edi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1004db4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1004db53
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1004dbd1
push eax
call fcn.1004d200
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
cmp dword [edi], 0
jne 0x1004db57
mov byte [ebp], 1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x14
mov eax, dword [ebx + 8]
test eax, eax
je 0x1004dba0
push eax
push esi
push 1
push ecx
call fcn.10093e84
add esp, 0x10
cmp eax, esi
mov dword [edi], eax
je 0x1004db57
mov eax, dword [ebx + 8]
push eax
call fcn.10096fe7
add esp, 4
test eax, eax
je 0x1004db53
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1004dbd1
call fcn.1004d110
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1004dbd1
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.No_file_is_open.
call eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1004dbd1
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push str.NULL_buf_or_bufSize
call eax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14