joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100167c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov eax, dword [ebx + 0x4e6c]
push edi
test eax, eax
jne 0x100167ff
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [ebx + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100167f8
mov ebp, dword [esp + 0x14]
test ebp, ebp
jne 0x1001686f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp eax, 1
jne 0x100167f8
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [ebx + 0x2c]
lea ecx, [esp + 0x14]
shr eax, 1
push 0
push ecx
lea edi, [esi + eax]
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100167f8
mov ebp, dword [esp + 0x14]
test ebp, ebp
mov dword [esp + 0x18], ebp
je 0x100167f8
mov al, byte [edi]
cmp al, 0xa
jne 0x10016842
mov byte [esi], 0xd
inc esi
mov byte [esi], al
jmp 0x10016857
mov byte [esi], al
mov al, byte [edi]
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x10016859
mov cl, byte [edi + 1]
mov byte [esi], cl
inc esi
inc ebp
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
jne 0x10016834
sub esi, ebp
push ebx
push ebp
push esi
call fcn.10016e60
mov edx, dword [ebx + 0x38]
add esp, 0xc
add edx, ebp
mov dword [ebx + 0xb7a0], eax
mov eax, dword [ebx + 0xb79c]
mov dword [ebx + 0x38], edx
mov ecx, dword [ebx + 0x3c]
adc ecx, 0
test eax, eax
mov dword [ebx + 0x3c], ecx
jne 0x100168ac
mov eax, dword [ebx + 0x38]
mov edx, ecx
mov ecx, dword [ebx + 0x44]
push edx
mov edx, dword [ebx + 0x40]
push eax
push ecx
push edx
jmp 0x100168b4
push 0
push 0
push 0
push 0x64
add ebx, 0xaf9c
push ebx
call fcn.100136a0
add esp, 0x14
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10016e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
jne 0x10016e70
or eax, 0xffffffff
pop esi
not eax
ret
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov esi, edx
dec edx
mov eax, dword [eax + 0xb7a0]
test esi, esi
not eax
je 0x10016eaa
push edi
lea esi, [edx + 1]
xor edx, edx
mov edi, eax
mov dl, byte [ecx]
and edi, 0xff
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x10059c24]
xor eax, edx
inc ecx
dec esi
jne 0x10016e8b
pop edi
not eax
pop esi
ret
Function at 0x10017b80
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
test eax, eax
mov esi, 1
jl 0x10017bfa
jg 0x10017b9d
cmp ebp, 0xffffffff
jbe 0x10017bfa
xor edi, edi
xor ebx, ebx
cmp ebx, eax
jg 0x10017c2c
jl 0x10017baf
cmp edi, ebp
jae 0x10017c2c
mov ecx, ebp
mov esi, 0x8000
sub ecx, edi
sbb eax, ebx
test eax, eax
jg 0x10017bc8
jl 0x10017bc4
cmp ecx, esi
jae 0x10017bc8
mov esi, ebp
sub esi, edi
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x20]
lea edx, [edi + ecx]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10017c1c
mov eax, dword [esp + 0x10]
cmp eax, esi
jne 0x10017c1c
add edi, eax
mov eax, dword [esp + 0x24]
adc ebx, 0
jmp 0x10017ba1
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push 0
push ecx
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10017c1c
cmp dword [esp + 0x10], ebp
je 0x10017c24
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x10019bc0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 8], 0x8074b50
mov eax, dword [esi + 0xa8]
push esi
cmp eax, 0xffffffff
jne 0x10019c30
mov edi, dword [esp + 0x14]
push 0
push 4
push edi
push 0
call fcn.10020210
add esp, 0x14
test eax, eax
je 0x10019c05
mov eax, dword [esi + 0xa0]
pop edi
neg eax
sbb eax, eax
pop esi
and al, 0xf6
add eax, 0x13
pop ecx
ret
mov edx, dword [edi]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x10]
push 4
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10019c27
cmp dword [esp + 0x14], 4
je 0x10019c7d
mov eax, 0xa
pop edi
pop esi
pop ecx
ret
call fcn.10020aa0
add esp, 4
test edx, edx
jg 0x10019c57
jl 0x10019c43
cmp eax, 4
jae 0x10019c57
mov eax, dword [esp + 0x10]
push esi
push eax
push 0
call fcn.10020bc0
add esp, 0xc
test eax, eax
jne 0x10019c2c
mov eax, dword [esi + 0xa8]
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x10]
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10019c27
cmp dword [esp + 0x14], 4
jne 0x10019c27
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x1001ad00
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x818]
mov dword [esp + 0x10], 0
mov esi, dword [edi + 0x4eac]
test esi, esi
je 0x1001aebc
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp word [esi + 0x5c], 0
jne 0x1001ad41
cmp word [esi + 0x5e], 0
je 0x1001adbb
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x58]
mov word [esi + 0x5c], 1
cmp byte [eax + ecx - 1], 0x2f
je 0x1001adb7
mov edx, dword [esi + 0x48]
lea eax, [esp + 0x14]
push edx
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
call fcn.10016ee0
add esp, 4
lea edx, [esp + 0x14]
push edx
call ebp
mov eax, dword [edi + 0x4e7c]
test eax, eax
jne 0x1001adbb
mov eax, dword [esi + 0x48]
push eax
call fcn.1001ace0
mov ecx, dword [esi + 0x58]
push ecx
call fcn.1001ace0
mov eax, dword [esi + 0x58]
add esp, 8
cmp byte [eax], 0
je 0x1001ada6
push 0x1005a178
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [esi + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
mov dword [esi + 0x20], eax
jbe 0x1001adbb
inc dword [esp + 0x10]
mov esi, dword [esi + 0x68]
test esi, esi
jne 0x1001ad33
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001aebc
shl eax, 2
push eax
call fcn.10039ff8
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x1001adf8
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x804
ret
mov esi, dword [edi + 0x4eac]
xor ebx, ebx
test esi, esi
je 0x1001ae41
mov edi, ebp
cmp word [esi + 0x5c], 0
je 0x1001ae3a
mov ecx, dword [esi + 0x20]
test ecx, ecx
jbe 0x1001ae3a
mov eax, dword [esi + 0x58]
cmp byte [ecx + eax - 1], 0x2f
jne 0x1001ae3a
test ebx, ebx
je 0x1001ae34
mov ecx, dword [edi - 4]
mov edx, dword [ecx + 0x58]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1001ae3a
mov dword [edi], esi
inc ebx
add edi, 4
mov esi, dword [esi + 0x68]
test esi, esi
jne 0x1001ae06
push 0x10017760
push 4
push ebx
push ebp
call fcn.1003a7c3
add esp, 0x10
xor ebp, ebp
test ebx, ebx
jbe 0x1001aeaf
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
mov esi, dword [eax + 0x48]
cmp byte [esi], 0
je 0x1001aea7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x2f
jne 0x1001ae80
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [eax + esi - 1], 0
test ebp, ebp
je 0x1001ae9b
mov ecx, dword [edi - 4]
mov eax, dword [edi]
mov edx, dword [ecx + 0x58]
mov ecx, dword [eax + 0x58]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1001aea7
mov edx, dword [edi]
mov eax, dword [edx + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
inc ebp
add edi, 4
cmp ebp, ebx
jb 0x1001ae5c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10039f0f
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x804
ret
Function at 0x1001b2e0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x800
lea ecx, [esp]
push esi
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
push 0x2e
push edx
call fcn.10033450
mov edi, eax
test edi, edi
je 0x1001b352
mov esi, dword [esp + 0x810]
inc edi
cmp esi, 0x3e8
jge 0x1001b352
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0x64
push esi
jge 0x1001b335
push str.z_02d
jmp 0x1001b33a
push str._03d
push edi
call ebx
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call ebp
inc esi
cmp esi, 0x3e8
jl 0x1001b328
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x800
ret

Function at 0x1001b360
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x800
lea ecx, [esp]
push esi
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
push str..z00
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
push 0x2e
push eax
call fcn.10033450
mov edi, eax
test edi, edi
je 0x1001b3e2
mov esi, dword [esp + 0x810]
inc edi
cmp esi, 0x3e8
jge 0x1001b3e2
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0x64
push esi
jge 0x1001b3c5
push str.z_02d
jmp 0x1001b3ca
push str._03d
push edi
call ebx
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call ebp
inc esi
cmp esi, 0x3e8
jl 0x1001b3b8
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x800
ret
Function at 0x1001f1b0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x800
mov ecx, dword [eax + 0x914]
test ecx, ecx
jne 0x1001f239
test byte [eax + 0x4ef5], 0x40
jne 0x1001f239
mov eax, dword [esp + 0x804]
test eax, eax
jl 0x1001f230
cmp eax, 0x1a
jg 0x1001f230
test eax, eax
jne 0x1001f1e6
call fcn.1001ff40
lea ecx, [esp]
push esi
push ecx
push eax
xor esi, esi
call fcn.10020060
add esp, 8
test eax, eax
je 0x1001f226
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 3
ja case.0x1001f20e.3
jmp dword [eax*4 + 0x1001f248]
mov esi, 1
mov eax, esi
pop esi
add esp, 0x800
ret
xor esi, esi
mov eax, esi
pop esi
add esp, 0x800
ret
xor eax, eax
add esp, 0x800
ret
mov eax, 1
add esp, 0x800
ret

Function at 0x1001f260
Capabilities:
Get disk size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x828
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, byte [esp + 0x28]
cmp al, 0x5c
mov al, byte [esp + 0x29]
jne 0x1001f2a9
cmp al, 0x5c
jne 0x1001f2a9
lea edx, [esp + 0x2a]
push 0x5c
push edx
call fcn.1001fb10
test eax, eax
je 0x1001f2b7
inc eax
push 0x5c
push eax
call fcn.1001fb10
test eax, eax
je 0x1001f2b7
mov byte [eax + 1], 0
jmp 0x1001f2b7
cmp al, 0x3a
jne 0x1001f2b7
mov byte [esp + 0x2a], 0x5c
mov byte [esp + 0x2b], 0
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001f302
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x30]
push ecx
push edx
call eax
test eax, eax
je 0x1001f302
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp ecx, 0xffffffff
mov edx, ecx
jg 0x1001f355
jl 0x1001f302
cmp eax, 0xffffffff
ja 0x1001f355
lea eax, [esp + 0x14]
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1001f334
or eax, 0xffffffff
mov edx, 0x7fffffff
add esp, 0x828
ret
mov edx, dword [esp + 8]
mov eax, dword [esp]
push 0
push edx
push 0
push eax
call fcn.1003a570
mov ecx, dword [esp + 4]
push 0
push ecx
push edx
push eax
call fcn.1003a570
add esp, 0x828
ret
Function at 0x1001f360
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x800
push ebx
push ebp
push esi
mov esi, dword [esp + 0x81c]
push edi
mov edi, dword [esp + 0x81c]
mov dword [edi], 0xffffffff
mov al, byte [esi]
test al, al
jne 0x1001f395
mov eax, dword [esp + 0x814]
push esi
push eax
call fcn.10020060
add esp, 8
lea ecx, [esp + 0x10]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x10]
push edx
call fcn.1001fb50
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
test eax, eax
jne 0x1001f3c4
lea eax, [esp + 0x10]
push 0x100596b4
push eax
call ebp
lea ecx, [esp + 0x10]
push 0x10059818
push ecx
call ebp
mov esi, dword [esp + 0x818]
lea edx, [esp + 0x10]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x1001f464
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esi]
test al, 0x10
je 0x1001f411
mov ecx, dword [esp + 0x824]
mov edx, dword [ecx + 0x4e74]
test edx, edx
jne 0x1001f40b
test al, 6
jne 0x1001f411
cmp byte [esi + 0x2c], 0x2e
jne 0x1001f41d
mov edx, dword [edi]
push esi
push edx
call ebx
test eax, eax
je 0x1001f450
jmp 0x1001f3f0
mov edi, dword [esp + 0x820]
push edi
call fcn.1001fb50
add esp, 4
test eax, eax
jne 0x1001f439
push 0x100596b4
push edi
call ebp
add esi, 0x2c
push esi
push edi
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x800
ret
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x1001f464
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi], 0xffffffff
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x800
ret

Function at 0x1001f510
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [ebp], eax
je 0x1001f582
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
test byte [edi], 0x10
jne 0x1001f556
lea esi, [edi + 0x2c]
push 0x10059824
push esi
call ebx
test eax, eax
je 0x1001f556
push 0x10059820
push esi
call ebx
test eax, eax
jne 0x1001f567
mov ecx, dword [ebp]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1001f571
jmp 0x1001f536
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov edx, dword [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp], 0xffffffff
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x1001f620
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x948
lea eax, [esp + 0x148]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
mov ebp, dword [esp + 0x954]
push esi
push edi
push ebp
push eax
xor esi, esi
call ebx
lea ecx, [esp + 0x158]
push ecx
call fcn.1001fb50
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
test eax, eax
jne 0x1001f66d
lea edx, [esp + 0x158]
push 0x100596b4
push edx
call edi
lea eax, [esp + 0x158]
push eax
call fcn.1001fd40
add al, 0x40
add esp, 4
movsx ecx, al
push ecx
push 0
push 0x25d
call fcn.10020fb0
add esp, 8
lea edx, [esp + 0x15c]
push eax
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
push 0
push 0
lea eax, [esp + 0x170]
push 0x64
push eax
call fcn.100136a0
add esp, 0x20
lea ecx, [esp + 0x158]
push ebp
push ecx
call ebx
lea edx, [esp + 0x158]
push edx
call fcn.1001fb50
add esp, 4
test eax, eax
jne 0x1001f6e7
lea eax, [esp + 0x158]
push 0x100596b4
push eax
call edi
lea ecx, [esp + 0x158]
push 0x10059818
push ecx
call edi
mov edx, dword [esp + 0x964]
lea eax, [esp + 0x158]
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x20], 0xffffffff
call fcn.1001f510
add esp, 0x10
test eax, eax
je 0x1001f801
mov esi, dword [esp + 0x960]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x18]
test esi, esi
mov ebx, eax
je 0x1001f745
and al, 0xf8
mov ebx, eax
test bl, 7
jne 0x1001f7c6
lea eax, [esp + 0x158]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x158]
push ecx
call fcn.1001fb50
add esp, 4
test eax, eax
jne 0x1001f77c
lea edx, [esp + 0x158]
push 0x100596b4
push edx
call edi
lea eax, [esp + 0x44]
lea ecx, [esp + 0x158]
push eax
push ecx
call edi
cmp ebx, dword [esp + 0x18]
je 0x1001f7a0
lea edx, [esp + 0x158]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea eax, [esp + 0x15c]
push 0x64
push eax
call fcn.10013800
add esp, 0xc
test eax, eax
jne 0x1001f7e9
lea ecx, [esp + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x964]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.1001f590
add esp, 0xc
test eax, eax
je 0x1001f7ed
jmp 0x1001f737
xor esi, esi
jmp 0x1001f7f1
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x1001f801
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x948
ret
Function at 0x1001ff70
Capabilities:
Delete file
Get common file path
Get disk information

Disassembly:
mov eax, 0x1004
call fcn.10039ee0
mov eax, dword [esp + 0x100c]
push ebx
push esi
mov ax, word [eax + 0x4ef4]
test al, 1
jne 0x10020044
test ah, 0x40
jne 0x10020044
mov ebx, dword [esp + 0x1010]
xor esi, esi
test ebx, ebx
jne 0x1001ffaf
call fcn.1001ff40
mov ebx, eax
lea ecx, [esp + 0x80c]
push ecx
push ebx
call fcn.10020060
add esp, 8
test eax, eax
je 0x10020052
lea edx, [esp + 0x80c]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
je 0x10020044
add bl, 0x40
lea ecx, [esp + 8]
movsx eax, bl
push eax
push str._c:_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push 0
push 0x1005a1d8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x10020052
push 0
push 0x80
push 2
push 0
push 0
lea ecx, [esp + 0x20]
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x10020052
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
mov eax, 1
pop ebx
add esp, 0x1004
ret
mov eax, esi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x10020fb0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x10063c00]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
test ebp, ebp
jne 0x10020fe9
mov ecx, edi
push 0x1006161c
shl ecx, 0xb
lea esi, [ecx + edi + 0x8f78]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
test edi, edi
jge 0x10020ff1
xor edi, edi
jmp 0x10020ffb
cmp edi, 2
jle 0x10020ffb
mov edi, 2
xor ebx, ebx
xor eax, eax
test ebx, ebx
jl 0x100210b7
mov ecx, dword [ebx*8 + 0x1005a258]
mov edx, dword [esp + 0x14]
cmp ecx, edx
mov dword [esp + 0x18], ecx
jne 0x10021050
mov edx, edi
mov ecx, dword [ebx*8 + 0x1005a25c]
shl edx, 0xb
mov eax, ebp
push 0x7ff
add eax, edx
push ecx
lea esi, [edi + eax]
lea edx, [esi + 0x8f78]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [esp + 0x18]
mov byte [esi + 0x9777], 0
mov eax, 1
test ecx, ecx
jne 0x10021059
or ebx, 0xffffffff
jmp 0x1002105a
inc ebx
test eax, eax
je 0x10020fff
mov eax, dword [ebp + 0x3e10]
test eax, eax
je 0x100210a4
lea esi, [ebp + 0xa77b]
push 0x1006161c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0x3e14]
mov edx, edi
shl edx, 0xb
mov eax, ebp
push ecx
add eax, edx
mov edx, dword [esp + 0x18]
push esi
lea ecx, [edi + eax + 0x8f78]
push ecx
push 0
push edx
push 0
push 0xd
call dword [ebp + 0x3e10]
mov eax, edi
shl eax, 0xb
add ebp, eax
lea eax, [edi + ebp + 0x8f78]
pop edi
pop esi
pop ebp
pop ebx
ret
test eax, eax
jne 0x1002105e
mov eax, edi
push 0x1006161c
shl eax, 0xb
add ebp, eax
lea esi, [edi + ebp + 0x8f78]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x100210e0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x810
test eax, eax
push esi
push edi
je 0x10021175
add al, 0x40
push 0x1005ba94
mov byte [esp + 0xc], al
lea eax, [esp + 0xd]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [esp + 0x828]
lea ecx, [esp + 0x18]
push 0x800
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
push eax
lea esi, [edi + 0xb7b0]
push ecx
push 0x800
lea edx, [esp + 0x20]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x10021175
push edi
push 0
push 0
push 0
call fcn.10021990
mov ecx, dword [esp + 0x830]
mov edx, dword [esp + 0x834]
add esp, 0x10
mov dword [ecx], eax
mov eax, esi
pop edi
mov dword [edx], 8
pop esi
add esp, 0x810
ret
pop edi
xor eax, eax
pop esi
add esp, 0x810
ret
Function at 0x10021c40
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x24
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push eax
push esi
call fcn.10031a90
mov ebp, dword [esp + 0x44]
add esp, 8
test eax, eax
jne 0x10021c81
cmp word [esp + 0x18], 1
jg 0x10021c91
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10021c81
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x24
ret
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x10021d20
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push ebp
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x10021cc0
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0x24
ret
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebp
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x10021cf0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0xf
pop ebx
add esp, 0x24
ret
mov ecx, dword [esp + 0x40]
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
push edi
call fcn.10021e40
add esp, 0x14
mov ebx, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
test eax, eax
jne 0x10021d2a
test ebx, ebx
jne 0x10021d2a
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test ebx, ebx
je 0x10021d40
cmp ebx, 0xa
mov eax, ebx
jne 0x10021d22
pop edi
pop esi
pop ebp
mov eax, 0xe
pop ebx
add esp, 0x24
ret
Function at 0x10021e40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x2000
call fcn.10039ff8
mov edx, eax
add esp, 4
test edx, edx
mov dword [esp + 0x10], edx
jne 0x10021e6b
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0xc
ret
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
xor esi, esi
xor ebp, ebp
mov eax, edi
and eax, ebx
cmp eax, 0xffffffff
je 0x10021eae
cmp ebp, ebx
jg 0x10021f4a
jl 0x10021e92
cmp esi, edi
jae 0x10021f4a
mov ecx, edi
mov eax, ebx
sub ecx, esi
sbb eax, ebp
test eax, eax
jg 0x10021eae
jl 0x10021ea8
cmp ecx, 0x2000
jae 0x10021eae
mov eax, edi
sub eax, esi
jmp 0x10021eb3
mov eax, 0x2000
lea ecx, [esp + 0x14]
push 0
push ecx
push eax
push edx
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10021f2c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10021f46
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 0
push ecx
push eax
mov eax, dword [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10021f77
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp ecx, eax
jne 0x10021f77
mov edx, dword [esp + 0x30]
push edx
call fcn.10013980
mov eax, dword [esp + 0x34]
add esp, 4
mov ecx, dword [eax + 0xa0]
test ecx, ecx
jne 0x10021f5d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
add esi, ecx
adc ebp, 0
jmp 0x10021e77
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10039f0f
add esp, 4
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x10]
push edx
call fcn.10039f0f
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x10]
push edx
call fcn.10039f0f
add esp, 4
mov eax, 9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.10039f0f
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret