joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102c1cf4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [0x103a608c], edi
jne 0x102c1dbb
mov esi, 0x114
push esi
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.102f835e
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jbe 0x102c1d6a
mov dword [0x103a608c], 1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret 4
jne 0x102c1db1
xor esi, esi
inc esi
cmp dword [ebp - 0x110], esi
jb 0x102c1d9d
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x102c1da9
cmp dword [ebp - 0x11c], edi
je 0x102c1da9
mov dword [0x103a608c], 2
jmp 0x102c1dc4
mov dword [0x103a608c], esi
jmp 0x102c1d57
mov dword [0x103a608c], 2
cmp dword [0x103a608c], 2
jne 0x102c1d57
mov esi, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push edi
call esi
mov edi, eax
push edi
call esi
xor esi, esi
test edi, edi
je 0x102c1de6
push ebx
call edi
mov esi, eax
test esi, esi
je 0x102c1de6
cmp esi, 1
jne 0x102c1dee
push 0
call fcn.102fb7d4
pop ecx
mov eax, esi
jmp 0x102c1d59

Function at 0x102c2181
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
jle 0x102c21f2
cmp ebx, dword [ebp + 0xc]
je 0x102c21f2
push dword [0x1039b850]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x102c21e8
push dword [0x1039b850]
call esi
mov esi, eax
mov eax, dword [edi]
xor ecx, ecx
cmp eax, ecx
je 0x102c21c2
add eax, 0xfffffffc
mov dword [ebp + 0xc], eax
jmp 0x102c21c5
mov dword [ebp + 0xc], ecx
push ecx
push SysReAllocString
push ecx
push 4
push ebx
call fcn.10201991
push eax
push dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x102c21f2
add eax, 4
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax - 4], ebx
xor eax, eax
inc eax
jmp 0x102c21f4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x102c2235
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
test eax, eax
je 0x102c2249
mov ebx, dword [eax - 4]
jmp 0x102c224b
xor ebx, ebx
mov ecx, dword [ebp + 8]
test ecx, ecx
jl 0x102c2309
cmp ecx, ebx
jge 0x102c2309
dec ebx
push esi
mov dword [ebp + 8], ebx
test ebx, ebx
jle 0x102c22d9
cmp ecx, ebx
jge 0x102c2283
mov edx, ebx
sub edx, ecx
lea eax, [eax + ecx*4]
shl edx, 2
push edx
lea ecx, [eax + 4]
push ecx
push eax
call fcn.102fa5b7
add esp, 0xc
push dword [0x1039b850]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x102c22d2
push dword [0x1039b850]
call esi
mov esi, dword [edi]
push 0
push SysReAllocString
push 0
mov dword [ebp - 4], eax
mov eax, dword [eax]
push 4
push ebx
sub esi, 4
mov dword [ebp - 8], eax
call fcn.10201991
mov ecx, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push esi
call dword [eax + 8]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x102c22d2
add eax, 4
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax - 4], ebx
jmp 0x102c2303
push dword [0x1039b850]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x102c2300
push dword [0x1039b850]
call esi
mov ecx, dword [edi]
mov edx, dword [eax]
sub ecx, 4
push ecx
mov ecx, eax
call dword [edx + 0x10]
and dword [edi], 0
xor eax, eax
inc eax
pop esi
jmp 0x102c230b
xor eax, eax
pop edi
pop ebx
leave
ret 4

Function at 0x102cc63c
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x40]
call fcn.102cc59d
lea ecx, [esi + 0x20]
call fcn.102cc59d
mov ecx, esi
pop esi
jmp fcn.102cc59d
push esi
mov esi, ecx
mov ecx, dword [esi + 0x74]
or dword [esi + 0x9c], 2
test ecx, ecx
je 0x102cc667
push esi
push 0x102cc54d
call fcn.102bd766
test eax, eax
je 0x102cc663
mov ecx, esi
call fcn.102cc506
and dword [esi + 0x74], 0
push 1
lea ecx, [esi + 0x78]
call fcn.102cc914
lea ecx, [esi + 0x68]
call fcn.102ca05e
lea ecx, [esi + 8]
pop esi
jmp 0x102cc621
Function at 0x102cc711
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x102cc72e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x102cc7a7
push ebx
push esi
push edi
mov dword [ebp - 4], 0x80070057
call fcn.102cc6e6
mov esi, eax
test esi, esi
jne 0x102cc74c
mov dword [ebp - 4], 0x8007000e
jmp 0x102cc7b1
lea eax, [esi + 0x9c]
mov ecx, dword [eax]
xor ecx, dword [ebp + 8]
mov ebx, 0x1039ed84
and ecx, 1
xor dword [eax], ecx
lea edi, [esi + 0x94]
mov ecx, dword [ebx]
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [edi], eax
test eax, eax
je 0x102cc7ab
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov dword [ebp - 4], eax
test eax, eax
jl 0x102cc7ab
add ebx, 4
add edi, 4
cmp ebx, 0x1039ed88
jl 0x102cc767
push esi
push dword [0x1039deb8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
push esi
call fcn.102bbcc7
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, dword [ebp - 4]
jmp 0x102cc7a4

Function at 0x102cc85c
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
jge 0x102cc871
xor eax, eax
jmp 0x102cc90e
cmp edi, dword [esi + 0x18]
push ebx
jle 0x102cc8af
push dword [0x1039b850]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
push SysReAllocString
push 0
push edi
push 1
mov ebx, eax
call fcn.10201991
push eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test eax, eax
je 0x102cc8e9
mov ecx, dword [esi + 0xc]
mov dword [eax], ecx
mov dword [esi + 0xc], eax
add eax, 4
jmp 0x102cc90d
cmp dword [esi + 8], 0
je 0x102cc8ba
cmp edi, dword [esi + 0x10]
jle 0x102cc901
push dword [0x1039b850]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, dword [eax]
push 1
push SysReAllocString
push 0
push dword [esi + 0x14]
mov dword [ebp + 8], eax
push 1
call fcn.10201991
mov ecx, dword [ebp + 8]
push eax
call dword [ebx + 4]
test eax, eax
jne 0x102cc8ed
xor eax, eax
jmp 0x102cc90d
mov ecx, dword [esi + 8]
mov dword [eax], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 8], eax
add eax, 4
mov dword [esi + 0x10], ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
sub dword [esi + 0x10], edi
lea ecx, [edi + eax]
mov dword [esi + 4], ecx
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x102cc914
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
jmp 0x102cc94c
mov eax, dword [edi]
push dword [0x1039b850]
mov dword [ebp - 4], eax
call ebx
test eax, eax
je 0x102cc949
push dword [0x1039b850]
call ebx
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0x10]
mov edi, dword [ebp - 4]
test edi, edi
jne 0x102cc928
and dword [esi + 0xc], edi
mov edi, dword [esi + 8]
jmp 0x102cc985
mov eax, dword [edi]
mov dword [ebp - 4], eax
test eax, eax
jne 0x102cc966
cmp dword [ebp + 8], eax
je 0x102cc98b
push dword [0x1039b850]
call ebx
test eax, eax
je 0x102cc982
push dword [0x1039b850]
call ebx
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx + 0x10]
mov edi, dword [ebp - 4]
test edi, edi
jne 0x102cc958
jmp 0x102cc99a
mov eax, dword [esi + 0x14]
mov dword [esi + 8], edi
add edi, 4
mov dword [esi + 0x10], eax
mov dword [esi + 4], edi
xor eax, eax
cmp dword [ebp + 8], eax
je 0x102cc9aa
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0x10], eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x102ccf06
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push 0
push esi
call fcn.102f835e
add esp, 0xc
mov dword [esi], edi
call dword [sym.imp.USER32.dll_GetMessageTime]
and dword [esi + 0x18], 0
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x102ccfae
mov eax, 0x80
test byte [ebp - 0x103], al
je 0x102ccf5e
or dword [esi + 0x18], 0x40
test byte [ebp - 0x102], al
je 0x102ccf69
or dword [esi + 0x18], eax
test byte [ebp - 0x100], al
je 0x102ccf78
or dword [esi + 0x18], 0x100
test byte [ebp - 0x64], al
je 0x102ccf81
or dword [esi + 0x18], 4
test byte [ebp - 0x63], al
je 0x102ccf8a
or dword [esi + 0x18], 8
test byte [ebp - 0x62], al
je 0x102ccf93
or dword [esi + 0x18], 1
test byte [ebp - 0x61], al
je 0x102ccf9c
or dword [esi + 0x18], 2
test byte [ebp - 0x60], al
je 0x102ccfa5
or dword [esi + 0x18], 0x10
test byte [ebp - 0x5f], al
je 0x102ccfae
or dword [esi + 0x18], 0x20
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.102f77a6
leave
ret 8
Function at 0x102cf12b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
mov edi, dword [ebp + 0xc]
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x11
push ebx
call esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101f082b
push dword [ebp + 0x10]
push dword [edi + 0xc]
push 0xe
push ebx
call esi
xor eax, eax
push 0xa
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x18]
push eax
push 0x10
push ebx
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.101ef4cb
and dword [ebp - 0x20], 0
and dword [ebp - 0x1c], 0
test eax, eax
jle 0x102cf1c5
mov ecx, dword [ebp - 0x1c]
movzx ecx, word [ebp + ecx*2 - 0x18]
cmp cx, 0x3b
jne 0x102cf1aa
inc dword [ebp - 0x20]
jmp 0x102cf1bd
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
movzx ecx, word [ebp + ecx*2 - 0x18]
sub edx, dword [ebp - 0x20]
mov word [ebp + edx*2 - 0x18], cx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jl 0x102cf197
sub eax, dword [ebp - 0x20]
add eax, eax
lea ecx, [ebp + eax - 0x18]
cmp word [ecx - 2], 0x30
jne 0x102cf1dd
xor eax, eax
mov word [ecx - 2], ax
jmp 0x102cf1ea
push 0x30
pop edx
mov word [ecx], dx
xor ecx, ecx
mov word [ebp + eax - 0x16], cx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101f082b
push dword [ebp + 0x10]
push dword [edi + 0x10]
push 0xf
push ebx
call esi
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x12
push ebx
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101f082b
xor eax, eax
push 0xa
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x18]
push eax
push 0x1010
push ebx
call esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101f082b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov dword [edi], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x14], eax
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.102f77a6
leave
ret 0xc

Function at 0x102d287c
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x1035a640
call fcn.102f919a
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
movzx edx, word [eax]
mov ecx, 0x5a4d
cmp dx, cx
jne 0x102d28ba
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov esi, 0xe0
cmp word [ecx + 0x14], si
jne 0x102d28ba
add esi, 0x2b
cmp word [ecx + 0x18], si
jne 0x102d28ba
mov eax, dword [ecx + 0x50]
jmp 0x102d28db
mov ecx, 0x4550
cmp dx, cx
jne 0x102d28e7
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x102d28e7
add ecx, 0x2b
cmp word [eax + 0x18], cx
jne 0x102d28e7
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
jmp 0x102d28eb
and dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.102f91df
ret
Function at 0x102d30a8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x102d30ee
push edi
push esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.101f6153
mov edi, eax
cmp edi, 0xffffffff
je 0x102d30ed
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret

Function at 0x102d42d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xffffffff
jne 0x102d42e5
xor eax, eax
leave
ret
push esi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 0xc]
xor edi, edi
push eax
inc edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.102d30f1
add esp, 0x10
test eax, eax
je 0x102d4432
cmp dword [ebp - 4], esi
je 0x102d4432
push ebx
mov ebx, 0x103a9480
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call fcn.102d524f
pop ecx
test eax, eax
jne 0x102d4340
xor edi, edi
jmp 0x102d442a
cmp dword [0x103a972c], esi
je 0x102d4353
push esi
push 0x72766c72
call fcn.102d8670
lea eax, [ebp - 0x14]
push eax
mov dword [0x103a972c], 1
mov dword [ebp - 0x14], esi
call fcn.102d3014
pop ecx
cmp eax, dword [ebp - 8]
jne 0x102d4377
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
je 0x102d43b0
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.102d313e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.102d30f1
add esp, 0x18
test eax, eax
je 0x102d43a3
cmp dword [ebp - 4], esi
jne 0x102d43b0
push esi
push 0x72766c73
call fcn.102d8670
xor edi, edi
cmp dword [ebp + 0x14], esi
jne 0x102d43c2
cmp dword [ebp - 8], 0xea60
ja 0x102d4339
cmp edi, esi
je 0x102d43dc
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.102d408f
add esp, 0x10
mov edi, eax
mov dword [0x103a972c], esi
push esi
cmp edi, esi
je 0x102d4420
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x102d440b
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jne 0x102d440b
xor edi, edi
inc edi
jmp 0x102d440d
xor edi, edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.102d30a8
add esp, 0xc
jmp 0x102d442a
push 0x74697970
call fcn.102d8670
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
je 0x102d444d
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.102d313e
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x102d4703
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, edi
jne 0x102d4725
push edi
push 0x36717370
call fcn.102d8670
jmp 0x102d4863
push esi
mov esi, dword [ebp + 0x10]
cmp esi, edi
jne 0x102d4738
push edi
push 0x36717371
jmp 0x102d4838
cmp dword [ebp + 8], 2
je 0x102d4755
cmp dword [ebp + 8], 8
je 0x102d4755
cmp dword [ebp + 8], 3
je 0x102d4755
push edi
push 0x36717372
jmp 0x102d4838
cmp dword [ebx], edi
je 0x102d4764
push edi
push 0x36717373
call fcn.102d8670
cmp dword [esi], edi
je 0x102d4773
push edi
push 0x37667270
call fcn.102d8670
push esi
push edi
push dword [ebp + 8]
mov dword [esi], edi
call sub.Secur32.dll_GetUserNameExW
movzx edi, al
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x102d483f
cmp eax, 0xea
jne 0x102d483f
mov eax, dword [esi]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.102f7fef
pop ecx
mov dword [ebx], eax
test eax, eax
jne 0x102d47c3
push eax
push 0x36717375
jmp 0x102d4846
mov ecx, dword [esi]
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x102d47e3
push 0
push 0x36717376
jmp 0x102d4846
mov eax, dword [esi]
dec eax
cmp dword [ebp - 4], eax
je 0x102d47f7
push 0
push 0x36717377
call fcn.102d8670
cmp edi, 2
jne 0x102d4813
push dword [esi]
push dword [ebx]
call fcn.102d4690
pop ecx
pop ecx
test eax, eax
jne 0x102d4862
push eax
push 0x36717378
jmp 0x102d4846
cmp edi, 8
jne 0x102d482c
push dword [ebx]
call fcn.102d349c
pop ecx
test eax, eax
jne 0x102d4862
push eax
push 0x36717379
jmp 0x102d4846
cmp edi, 3
je 0x102d4862
push 0
push 0x3671737a
call fcn.102d8670
jmp 0x102d4862
push 0
push 0x36717374
call fcn.102d8670
mov eax, dword [ebx]
xor edi, edi
cmp eax, edi
je 0x102d485c
push eax
call fcn.102f72fe
pop ecx
mov dword [ebx], edi
cmp dword [esi], edi
je 0x102d4862
mov dword [esi], edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x102d4d96
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x240], eax
mov ebx, 0x104
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.102d3fd2
pop ecx
pop ecx
test eax, eax
jne 0x102d4dd3
or eax, 0xffffffff
jmp 0x102d4fae
cmp word [ebp - 0x22c], 0
push esi
lea esi, [ebp - 0x22c]
push edi
mov dword [ebp - 0x238], esi
je 0x102d4df9
inc esi
inc esi
cmp word [esi], 0
jne 0x102d4deb
mov dword [ebp - 0x238], esi
xor edi, edi
inc edi
push edi
call fcn.102d2b30
mov dword [esp], 0x10149f80
call fcn.102d62fd
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x248], eax
cmp eax, 0x64
jbe 0x102d4e25
mov dword [ebp - 0x230], edi
mov eax, esi
lea ecx, [ebp - 0x22c]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x234], eax
mov esi, 0x80
mov edi, 0xc0000000
push dword [ebp - 0x230]
lea eax, [ebp - 0x24]
push 0x1013df18
push 0xffffffffffffffff
push eax
call fcn.102d33e0
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x102d4f59
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.102d494c
add esp, 0xc
mov ecx, eax
call fcn.101f0605
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.101edea4
xor eax, eax
push eax
push eax
push esi
push 1
push eax
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.101f6153
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
jne 0x102d4f5e
cmp dword [ebp - 0x230], 0x64
jb 0x102d4eca
and dword [ebp - 0x230], 0
inc dword [ebp - 0x230]
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x248]
jne 0x102d4e41
push eax
push 0x1013df18
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.102d33e0
add esp, 0x10
cmp dword [ebp - 0x234], 0
jl 0x102d4f59
push dword [ebp - 0x234]
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.102d494c
add esp, 0xc
mov ecx, eax
call fcn.101f0605
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
call fcn.101edea4
push esi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
push ebx
push ebx
push esi
push 2
push ebx
push 1
push edi
lea eax, [ebp - 0x22c]
push eax
call fcn.101f6153
mov dword [ebp - 0x23c], eax
jmp 0x102d4f60
call fcn.101df922
xor ebx, ebx
cmp dword [ebp - 0x230], 0x64
pop edi
pop esi
jb 0x102d4f71
mov dword [ebp - 0x230], ebx
mov eax, dword [ebp - 0x230]
inc eax
push eax
push 0x10149f80
call fcn.102d5e91
call fcn.102d2b88
cmp dword [ebp - 0x240], ebx
je 0x102d4fa8
push dword [ebp + 0xc]
lea eax, [ebp - 0x22c]
push dword [ebp - 0x240]
push eax
call fcn.102d3436
add esp, 0xc
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.102f77a6
leave
ret
Function at 0x102d4fbb
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1039fb98]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
xor edi, edi
push eax
inc edi
call fcn.102d3fd2
pop ecx
pop ecx
test eax, eax
je 0x102d5080
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x1013df28
call fcn.101ef613
call fcn.102d2f69
test eax, eax
je 0x102d507e
call fcn.102d2e74
test eax, eax
jne 0x102d507e
call fcn.102d4617
test eax, eax
jne 0x102d5035
call fcn.102d3f8f
test eax, eax
je 0x102d507e
push dword [0x103a94e0]
call fcn.102d5d0f
pop ecx
test eax, eax
jne 0x102d507e
call fcn.102d3f4e
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.102d4d96
push 0
lea ecx, [ebp - 0x20c]
push ecx
push edi
push eax
call fcn.102d42d5
mov edi, eax
add esp, 0x18
lea eax, [ebp - 0x414]
test edi, edi
jne 0x102d506f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x102d507e
push esi
push 0x103a950c
push eax
call fcn.102d3436
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.102f77a6
leave
ret

Function at 0x102d5877
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
call fcn.102d2d0c
cmp dword [ebp + 8], esi
jne 0x102d5890
mov edi, 0x80004003
jmp 0x102d58d5
push esi
xor edi, edi
call fcn.102d524f
pop ecx
test eax, eax
je 0x102d58d0
push esi
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.101f6153
push 1
push esi
push esi
push eax
call fcn.102d42d5
add esp, 0x10
test eax, eax
jne 0x102d58d5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 0x80004005
mov eax, 0x103a94cc
or ecx, 0xffffffff
lock xadd dword [eax], ecx
xor eax, eax
cmp edi, esi
pop edi
setge al
pop esi
pop ebp
ret 4

Function at 0x102d58ee
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push ebx
push esi
call fcn.101f60d1
mov edi, eax
test edi, edi
je 0x102d5976
cmp edi, esi
ja 0x102d5976
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x1013dfcc
push 0xffffffffffffffff
sub esi, edi
lea eax, [ebx + edi*2]
push esi
push eax
call fcn.102f86da
add esp, 0x14
test eax, eax
jle 0x102d5976
xor esi, esi
push esi
call fcn.102d524f
pop ecx
test eax, eax
je 0x102d594b
push ebx
call fcn.102d5877
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x102d5976
push esi
call fcn.102d524f
pop ecx
test eax, eax
jne 0x102d5976
cmp word [0x103a950c], si
je 0x102d5976
xor esi, esi
inc esi
push esi
push ebx
push 0x103a950c
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x102d5976
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8