joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014090
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x2c
lea eax, [esp + 8]
push ebx
push esi
push edi
push 0
push eax
push str.SoftwarePocketSoftRTPatchRegUndo
push 0x80000002
call fcn.10013630
add esp, 0x10
mov eax, dword [0x1002f48c]
cmp eax, 0xffffffff
jne 0x10014123
push str.RTPatchRegSvrKeyMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0x14]
push eax
push str.CurKey
push ecx
call fcn.10013310
add esp, 0xc
test eax, eax
je 0x100140f6
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x14]
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
push str.CurKey
push ecx
call fcn.10013fc0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
push eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x1002fdec
mov dword [0x1002f48c], eax
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esp + 0x30]
lea eax, [esp + 0x24]
add esp, 0xc
push ecx
push eax
call fcn.10018b30
lea ecx, [esp + 0x18]
lea edx, [esp + 0x2c]
mov eax, dword [esp + 0x1c]
add esp, 8
push 0
push ecx
push edx
push eax
call fcn.10013670
add esp, 0x10
mov ebx, eax
test ebx, ebx
mov eax, dword [esp + 0x14]
push eax
je 0x1001418d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
mov dword [0x1002f48c], 0xffffffff
pop esi
pop ebx
add esp, 0x2c
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push ecx
push str.NumEntries
push eax
call fcn.10013310
add esp, 0xc
test eax, eax
je 0x100141b8
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x10]
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
push eax
push str.NumEntries
push ecx
call fcn.10013fc0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
add esp, 0xc
push ecx
push 0x1002fdec
push edx
call edi
lea ecx, [esp + 0x30]
lea edx, [esp + 0x24]
add esp, 0xc
push ecx
push edx
call fcn.10018b30
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x2c]
mov eax, dword [esp + 0x18]
add esp, 8
push 0
push ecx
push edx
push eax
call fcn.10013670
add esp, 0x10
mov edi, eax
test edi, edi
mov eax, dword [esp + 0x10]
push eax
je 0x10014232
call esi
mov dword [0x1002f48c], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
call esi
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x10014790
Capabilities:
Copy file

Disassembly:
sub esp, 0x208
cmp dword [0x100307cc], 0
je 0x100147a6
mov eax, dword [0x100307d0]
jmp 0x100147ab
call fcn.100188c0
test eax, eax
jne 0x100147f8
lea eax, [esp]
mov ecx, dword [esp + 0x20c]
push eax
push ecx
call fcn.10018bb0
lea ecx, [esp + 0x10c]
mov edx, dword [esp + 0x218]
add esp, 8
push ecx
push edx
call fcn.10018bb0
lea ecx, [esp + 0x10c]
lea edx, [esp + 8]
add esp, 8
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x208
ret
mov eax, dword [esp + 0x210]
push 0
mov ecx, dword [esp + 0x210]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
add esp, 0x208
ret
Function at 0x100150e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x690
lea eax, [esp + 0x58]
push ebx
mov ebx, dword [esp + 0x698]
push esi
xor si, si
push edi
push eax
push ebx
call fcn.10018bb0
lea edi, [esp + 0x6c]
add esp, 8
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edi, [esp + 0x64]
sub eax, eax
lea edx, [esp + ecx + 0x63]
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jb 0x10015140
push 0x100305ec
sub edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10015140
mov si, 1
xor edi, edi
push 0x104
mov word [esp + 0x498], di
lea eax, [esp + 0x290]
mov word [esp + 0x290], di
push eax
call fcn.10020b4b
lea eax, [esp + 0x49c]
add esp, 8
push ebx
push eax
call fcn.1001ef83
lea eax, [esp + 0x49c]
add esp, 8
push 0x5c
push eax
call fcn.1001f40d
add esp, 8
test eax, eax
je 0x10015191
mov word [eax], di
lea eax, [esp + 0x494]
push eax
call fcn.10020ac9
add esp, 4
test si, si
je 0x10015272
mov eax, str._REGSERVER
mov ecx, dword [sym.imp.USER32.dll_wsprintfA]
cmp word [esp + 0x6a4], 0
jne 0x100151c5
mov eax, str._UNREGSERVER
lea edx, [esp + 0x168]
push eax
lea eax, [esp + 0x68]
push eax
push str.__s___s
push edx
call ecx
lea edi, [esp + 0x30]
add esp, 0x10
xor eax, eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov word [esp + 0x50], ax
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 0x81
push edx
push eax
push eax
push 8
push eax
push eax
push eax
lea eax, [esp + 0x188]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [esp + 0xc], eax
test eax, eax
je 0x100152da
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x10]
push ecx
call esi
cmp dword [esp + 0xc], 1
mov esi, 0
adc esi, 0xffffffff
and esi, 0x8000ffff
jmp 0x100152df
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x100152da
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100152cd
mov ecx, str.DllRegisterServer
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp word [esp + 0x6a4], 0
jne 0x100152a9
mov ecx, str.DllUnregisterServer
push ecx
push edi
call eax
test eax, eax
je 0x100152b7
call eax
mov esi, eax
jmp 0x100152be
mov esi, dword [esp + 0x494]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x100152df
mov esi, 0x8000ffff
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x100152df
mov esi, 0x8000ffff
cmp word [esp + 0x28c], 0
je 0x100152fa
lea eax, [esp + 0x28c]
push eax
call fcn.10020ac9
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x690
ret
Function at 0x10017d50
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
xor esi, esi
cmp dword [0x100306c8], esi
jne 0x10017e5a
push str.rtpmsi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100306c8], eax
test eax, eax
jne 0x10017d7c
mov eax, 0xfffffffe
pop edi
pop esi
ret
push str.RTPMsiOpen
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
mov dword [0x100306c8], eax
call edi
mov dword [0x100306a8], eax
test eax, eax
jne 0x10017d9d
mov esi, 1
push str.RTPMsiClose
mov eax, dword [0x100306c8]
push eax
call edi
mov dword [0x100306ac], eax
test eax, eax
jne 0x10017db8
mov esi, 1
push str.RTPMsiOpenDatabase
mov eax, dword [0x100306c8]
push eax
call edi
mov dword [0x100306b0], eax
test eax, eax
jne 0x10017dd3
mov esi, 1
push str.RTPMsiCloseDatabase
mov eax, dword [0x100306c8]
push eax
call edi
mov dword [0x100306b4], eax
test eax, eax
jne 0x10017dee
mov esi, 1
push str.RTPMsiUpdateFile
mov eax, dword [0x100306c8]
push eax
call edi
mov dword [0x100306b8], eax
test eax, eax
jne 0x10017e09
mov esi, 1
push str.RTPMsiCommitChanges
mov eax, dword [0x100306c8]
push eax
call edi
mov dword [0x100306bc], eax
test eax, eax
jne 0x10017e24
mov esi, 1
push str.RTPMsiGetBackupStringA
mov eax, dword [0x100306c8]
push eax
call edi
mov dword [0x100306c0], eax
test eax, eax
jne 0x10017e3f
mov esi, 1
push str.RTPMsiGetLastErrorStrA
mov eax, dword [0x100306c8]
push eax
call edi
mov dword [0x100306c4], eax
test eax, eax
jne 0x10017e5a
mov esi, 1
test esi, esi
je 0x10017e70
push 0xffffffffffffffff
call fcn.10017e80
add esp, 4
mov eax, 0xfffffffe
pop edi
pop esi
ret
call dword [0x100306a8]
pop edi
pop esi
ret

Function at 0x100184f0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
mov esi, dword [esp + 8]
cmp word [esi], ax
je 0x10018525
mov edx, eax
xor ecx, ecx
mov cx, word [esi]
and edx, 0xe0
shr edx, 5
add esi, 2
shl eax, 3
xor edx, ecx
xor edx, eax
mov ecx, edx
shr ecx, 8
mov eax, edx
xor eax, ecx
cmp word [esi], 0
jne 0x100184fc
pop esi
ret

Function at 0x10018660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push 0x5032
mov dword [0x10029448], eax
mov word [0x100307c0], 1
push 0x604a
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x100186b5
mov word [0x100307c4], 1
push eax
mov eax, dword [0x10029448]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [eax]
add eax, 4
mov dword [0x10029c50], ecx
mov dword [0x1002944c], eax
pop esi
ret

Function at 0x10018cb0
Capabilities:
Get disk information

Disassembly:
sub esp, 4
lea eax, [esp]
push 0
push 0
push 0
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [esp], 0x6e
jl 0x10018ce4
mov ax, 1
add esp, 4
mov word [0x100307dc], 1
ret
xor ax, ax
add esp, 4
ret
Function at 0x100197f0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x244
cmp dword [0x1003097c], 0
push ebx
push esi
push edi
push ebp
je 0x1001983a
cmp dword [0x100307e4], 0
je 0x1001983a
mov ebx, dword [esp + 0x258]
add ebx, 4
push ebx
push 1
push 0
call dword [0x1003097c]
mov ecx, 0
pop ebp
pop edi
cmp eax, 1
adc ecx, 0xffffffff
pop esi
mov ax, cx
pop ebx
add esp, 0x244
ret
cmp dword [0x100307cc], 0
je 0x1001984a
mov eax, dword [0x100307d0]
jmp 0x1001984f
call fcn.100188c0
test eax, eax
jne 0x100199d2
call fcn.100188f0
push 1
call fcn.10018960
lea eax, [esp + 0x118]
mov ebx, dword [esp + 0x25c]
add esp, 4
mov ecx, dword [ebx]
lea edi, [ebx + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea esi, [esp + 0x114]
mov ecx, 0xb
cmp eax, 1
sbb ebp, ebp
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x30]
lea eax, [esp + 0x140]
push edi
lea esi, [ebx + 0x238]
push eax
call fcn.10018b50
mov byte [esp + 0x258], 0
lea eax, [esp + 0x24c]
add esp, 8
push esi
push eax
call fcn.10018b50
add esp, 8
test ebp, ebp
jne 0x100199b3
mov eax, dword [0x100307e0]
cmp dword [ebx], eax
jne 0x100199b3
lea eax, [esp + 0x140]
push 0x5f
push eax
call fcn.10020368
add esp, 8
test eax, eax
je 0x100199b3
cmp byte [esp + 0x244], 0
je 0x100199b3
push 0
call fcn.10018960
lea eax, [esp + 0x14]
add esp, 4
push eax
push 0x10029ca8
call fcn.10018bb0
lea eax, [esp + 0x18]
add esp, 8
push 0x5c
push eax
call fcn.1001fdec
add esp, 8
test eax, eax
je 0x10019936
inc eax
jmp 0x10019945
cmp byte [esp + 0x11], 0x3a
lea eax, [esp + 0x12]
je 0x10019945
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
lea ecx, [esp + 0x114]
lea eax, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x100199b3
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x140]
push 0x5f
push eax
call fcn.10020368
add esp, 8
test eax, eax
jne 0x100199b3
lea eax, [esp + 0x140]
push edi
push eax
call fcn.10018b50
mov byte [esp + 0x258], 0
lea eax, [esp + 0x24c]
add esp, 8
push esi
push eax
call fcn.10018b50
add esp, 8
call fcn.10018920
cmp bp, 1
mov ecx, 0
adc ecx, 0xffffffff
pop ebp
mov ax, cx
pop edi
pop esi
pop ebx
add esp, 0x244
ret
mov ebx, dword [esp + 0x258]
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call ebp
cmp ax, 1
pop ebp
sbb ecx, ecx
pop edi
mov ax, cx
pop esi
mov word [ebx + 0x250], 0
pop ebx
add esp, 0x244
ret
Function at 0x10019a90
Capabilities:
Decompress data using quicklz

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
sub esp, 0x18
lea edx, [esp]
push esi
mov dword [esp + 0xc], eax
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0x14], ecx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [esp + 0xc]
lea eax, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ax, word [esp + 0x18]
mov esi, dword [esp + 0x24]
mov cx, word [esi]
shr ax, 1
xor ax, cx
and ax, 0x1f
xor ax, cx
mov dx, word [esp + 0x16]
shl dx, 5
xor dx, ax
and dx, 0x7e0
xor dx, ax
mov word [esi], ax
mov ax, word [esp + 0x14]
shl ax, 0xb
mov cx, ax
xor cx, dx
and cx, 0x7ff
xor cx, ax
mov ax, word [esp + 0x12]
mov word [esi], dx
mov edx, dword [esp + 0x20]
mov word [esi], cx
mov cx, word [edx]
xor ax, cx
and ax, 0x1f
xor ax, cx
mov cx, word [esp + 0xe]
shl cx, 5
xor cx, ax
and cx, 0x1e0
xor cx, ax
mov word [edx], ax
test byte [esp + 0x18], 1
mov ax, word [esp + 0xc]
mov word [edx], cx
je 0x10019b71
shl ax, 9
xor ax, cx
and ax, 0x1ff
mov cx, word [esp + 0xc]
pop esi
add cx, 4
shl cx, 9
xor ax, cx
mov word [edx], ax
add esp, 0x18
ret
shl ax, 9
xor ax, cx
and ax, 0x1ff
mov cx, word [esp + 0xc]
pop esi
sub cx, 0x3c
shl cx, 9
xor ax, cx
mov word [edx], ax
add esp, 0x18
ret
Function at 0x1001ca00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ecx
push ebx
push edx
mov ecx, dword [ebp + 0xc]
or ecx, ecx
je 0x1001cb49
mov esi, dword [ebp + 8]
or esi, esi
je 0x1001cb49
mov edi, dword [ebp + 0x10]
mov eax, ecx
xor ebx, ebx
xor edx, edx
mov bl, byte [edi]
add eax, ebx
mov bl, 0x1f
div ebx
mov byte [edi], dl
mov eax, ecx
mov bl, byte [edi + 1]
add eax, ebx
mov bl, 0x1e
xor edx, edx
div ebx
mov byte [edi + 1], dl
mov eax, esi
neg eax
and eax, 3
mov ebx, ecx
sub ebx, eax
jbe 0x1001cb08
mov edx, ebx
and edx, 7
sub ebx, edx
push edx
shr ebx, 3
push ebx
mov ecx, eax
mov ebx, dword [edi + 2]
mov edx, dword [edi + 6]
jecxz 0x1001ca91
lodsb al, byte [esi]
xor dl, al
xor bl, al
mov eax, 0x7f800000
and eax, ebx
xor ebx, eax
shl ebx, 8
rol eax, 9
or ebx, eax
mov eax, 0x3fc00000
and eax, edx
xor edx, eax
shl edx, 8
rol eax, 0xa
or edx, eax
loop 0x1001ca68
pop ecx
jecxz 0x1001cb03
mov eax, 0x60000000
and eax, ebx
xor ebx, eax
shl ebx, 2
rol eax, 3
or ebx, eax
mov eax, 0x3c000000
and eax, edx
xor edx, eax
shl edx, 4
rol eax, 6
or edx, eax
lodsd eax, dword [esi]
xchg al, ah
rol eax, 0x10
xchg al, ah
mov ebp, eax
and eax, 0x3fffff
shl eax, 9
xor ebx, eax
and eax, 0x3fffffff
shl eax, 1
xor edx, eax
shr ebp, 0x14
xor edx, ebp
shr ebp, 2
xor ebx, ebp
lodsd eax, dword [esi]
xchg al, ah
rol eax, 0x10
xchg al, ah
mov ebp, eax
and eax, 0x7fffff
shl eax, 8
xor ebx, eax
and eax, 0x3fffffff
xor edx, eax
shr ebp, 0x16
xor edx, ebp
shr ebp, 1
xor ebx, ebp
loop 0x1001ca94
pop ecx
jecxz 0x1001cb37
jmp 0x1001cb0e
mov ebx, dword [edi + 2]
mov edx, dword [edi + 6]
lodsb al, byte [esi]
xor dl, al
xor bl, al
mov eax, 0x7f800000
and eax, ebx
xor ebx, eax
shl ebx, 8
rol eax, 9
or ebx, eax
mov eax, 0x3fc00000
and eax, edx
xor edx, eax
shl edx, 8
rol eax, 0xa
or edx, eax
loop 0x1001cb0e
and ebx, 0x7fffffff
and edx, 0x3fffffff
mov dword [edi + 2], ebx
mov dword [edi + 6], edx
pop edx
pop ebx
pop ecx
pop esi
pop edi
pop ebp
ret

Function at 0x1001cc53
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ecx
push ebx
push edx
mov ecx, dword [ebp + 0xc]
or ecx, ecx
je 0x1001cccb
mov esi, dword [ebp + 8]
or esi, esi
je 0x1001cccb
mov edi, dword [ebp + 0x10]
mov eax, ecx
xor ebx, ebx
xor edx, edx
mov bl, byte [edi]
add eax, ebx
mov bl, 0x1f
div ebx
mov byte [edi], dl
mov eax, ecx
mov bl, byte [edi + 1]
add eax, ebx
mov bl, 0x1e
xor edx, edx
div ebx
mov byte [edi + 1], dl
mov ebx, dword [edi + 2]
mov edx, dword [edi + 6]
lodsb al, byte [esi]
xor dl, al
xor bl, al
mov eax, 0x40000000
and eax, ebx
xor ebx, eax
shl ebx, 1
rol eax, 2
or ebx, eax
mov eax, 0x20000000
and eax, edx
xor edx, eax
shl edx, 1
rol eax, 3
or edx, eax
loop 0x1001cc92
and ebx, 0x7fffffff
and edx, 0x3fffffff
mov dword [edi + 2], ebx
mov dword [edi + 6], edx
pop edx
pop ebx
pop ecx
pop esi
pop edi
pop ebp
ret
Function at 0x1001f3ad
Capabilities:
Delete directory

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, 0
jne 0x1001f3c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001f3da
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x1001f3dc
xor eax, eax
ret

Function at 0x1001f3dd
Capabilities:
Delete directory

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
mov eax, 0
jne 0x1001f3f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001f40a
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x1001f40c
xor eax, eax
ret

Function at 0x1001f8a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
xor esi, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1001f8df
cmp byte [ebp - 0x103], 0x3a
jne 0x1001f8df
movzx eax, byte [ebp - 0x104]
push eax
call fcn.1001f7d5
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001f8e6
Capabilities:
Set current directory

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 4
cmp eax, 1
jl 0x1001f92a
cmp eax, 0x1f
jg 0x1001f92a
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0
add al, 0x40
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x1001f919
xor eax, eax
jmp 0x1001f943
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10023070
add esp, 4
jmp 0x1001f93e
mov dword [0x10030a40], 0xd
mov dword [0x10030a44], 0xf
mov eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1001ff14
Capabilities:
Create directory

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov eax, 0
jne 0x1001ff2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1001ff43
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x1001ff45
xor eax, eax
ret

Function at 0x10020ac9
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x10020b33
lea eax, [ebp - 0x214]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10020b33
push dword [ebp - 0x214]
mov word [ebp - 8], 0x3d
call fcn.1001f74e
mov word [ebp - 6], ax
add esp, 4
lea eax, [ebp - 0x214]
lea ecx, [ebp - 8]
mov word [ebp - 4], 0x3a
mov word [ebp - 2], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
mov eax, 0
jne 0x10020b47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x10020b5e
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10020bcb
push esi
call fcn.100222f2
add esp, 4
test eax, eax
jne 0x10020b95
mov dword [0x10030a44], 0xf
mov dword [0x10030a40], 0xd
jmp 0x10020c39
add si, 0x40
lea eax, [ebp - 4]
mov word [ebp - 0xc], si
push eax
lea ecx, [ebp - 0x214]
lea esi, [ebp - 0xc]
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], 0x2e
mov word [ebp - 6], 0
push ecx
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x10020bdd
lea eax, [ebp - 0x214]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10020c39
inc eax
cmp eax, 0x104
ja 0x10020c39
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x10020c16
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jg 0x10020bf9
mov ecx, eax
add ecx, ecx
push ecx
call fcn.1001f4f3
add esp, 4
mov ecx, eax
test ecx, ecx
jne 0x10020c27
mov dword [0x10030a40], 0xc
jmp 0x10020c39
cmp dword [ebp + 0x10], eax
jge 0x10020c27
mov dword [0x10030a40], 0x22
jmp 0x10020c39
lea eax, [ebp - 0x214]
push eax
push ecx
call fcn.1001ef83
add esp, 8
jmp 0x10020c3b
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100219bb
Capabilities:
Delete file

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, 0
jne 0x100219d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100219e8
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x100219ea
xor eax, eax
ret

Function at 0x100219f8
Capabilities:
Delete file

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov eax, 0
jne 0x10021a11
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10021a25
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x10021a27
xor eax, eax
ret

Function at 0x10021a35
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10021a5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x10021a82
test al, 1
je 0x10021a80
test byte [esp + 8], 2
je 0x10021a80
mov dword [0x10030a40], 0xd
mov dword [0x10030a44], 5
mov eax, 0xffffffff
jmp 0x10021a82
xor eax, eax
ret

Function at 0x10021a83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10021aa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x10021ad0
test al, 1
je 0x10021ace
test byte [esp + 8], 2
je 0x10021ace
mov dword [0x10030a40], 0xd
mov dword [0x10030a44], 5
mov eax, 0xffffffff
jmp 0x10021ad0
xor eax, eax
ret

Function at 0x10021ad1
Capabilities:
Move file

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
mov eax, 0
jne 0x10021aee
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10021b02
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x10021b04
xor eax, eax
ret

Function at 0x10021b05
Capabilities:
Move file

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x10021b22
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10021b36
push eax
call fcn.10023070
add esp, 4
mov eax, 0xffffffff
jmp 0x10021b38
xor eax, eax
ret
Function at 0x100221ff
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10022266
push ebx
call fcn.100222f2
add esp, 4
test eax, eax
jne 0x10022238
mov dword [0x10030a44], 0xf
mov dword [0x10030a40], 0xd
jmp 0x100222e9
add bl, 0x40
lea eax, [ebp - 8]
push eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10c]
lea ebx, [ebp - 4]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push ecx
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x10022278
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x100222e9
inc eax
cmp eax, 0x104
ja 0x100222e9
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x100222af
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
jg 0x10022294
mov eax, ecx
push eax
call fcn.1001f4f3
add esp, 4
mov edx, eax
test edx, edx
jne 0x100222c0
mov dword [0x10030a40], 0xc
jmp 0x100222e9
cmp eax, dword [ebp + 0x10]
jle 0x100222c0
mov dword [0x10030a40], 0x22
jmp 0x100222e9
lea edi, [ebp - 0x10c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
jmp 0x100222eb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10022304
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x10022369
lea eax, [ebp - 0x10c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x10022369
mov byte [ebp - 4], 0x3d
invalid

Function at 0x1002270f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.10022389
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.100223c4
xor ah, al
cmc
invalid