joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8062a0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x80b004]
xor eax, esp
mov dword [esp + 0x804], eax
cmp dword [0x26b0e8c], 0xfc7
jne 0x8062cf
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x80e2a4]
imul eax, eax, 0x343fd
cmp dword [0x26b0e8c], 0x139e
mov dword [0x80e2a4], eax
jne 0x8062fe
mov ecx, dword [esp]
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x80e2a4]
add eax, 0x269ec3
push esi
mov dword [0x80e2a4], eax
movzx esi, word [0x80e2a6]
and esi, 0x7fff
cmp dword [0x26b0e8c], 0x8e7
jne 0x806333
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x806400
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x80b004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x80c1f0]
push ebx
mov ebx, dword [0x26b0830]
push edi
mov edi, dword [0x26b0e8c]
call fcn.00806350
cmp dword [0x26b0e8c], 0x2f
jne 0x806465
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00806380
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret
Function at 0x806710
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call fcn.00409170
mov eax, dword [0x80b004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x806739
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x8067df
cmp dword [0x26b0e8c], 0xa5f
jne 0x806783
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x1018]
push edx
push 0x809c6c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp dword [ebp - 4], 0x84526b
jne 0x8067a8
mov eax, dword [0x80d010]
mov dword [0x26b0e8c], eax
mov ecx, dword [0x26b0e8c]
add ecx, 0xa231
mov dword [0x26b0e8c], ecx
cmp dword [0x26b0e8c], 0x141
jne 0x8067da
push str.durudaxo_payuyafelamelokeyir_tacadasevow_kipazoci_kanorowawacasolicalotija
lea edx, [ebp - 0x1818]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x80e2a8], 0xec58acac
mov dword [0x80e2ac], 0xffffffff
jmp 0x806730
call fcn.00806480
jmp dword [0x26b0830]
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40633c
pop dword [ebp - 0x44]
mov eax, 0x1b93fd34
sub eax, 0x1b5399f8
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xcec9820d
sub dword [ebp - 0x54], 0x80773cc2
mov dword [ebp - 0x50], 0x658478b
add dword [ebp - 0x50], 0x2bdb04ba
mov dword [ebp - 0x4c], 0x4aaeac2b
add dword [ebp - 0x4c], 0x19d9803
mov dword [ebp - 0x48], 0xcc0f02ec
sub dword [ebp - 0x48], 0xcc0f02ec
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xd2b9935
add dword [ebp - 0x54], 0x6746d021
mov dword [ebp - 0x50], 0xdcb539ea
add dword [ebp - 0x50], 0x64b7278b
mov dword [ebp - 0x4c], 0x556844f1
sub dword [ebp - 0x4c], 0xf1f8d885
mov dword [ebp - 0x48], 0x9b6288ea
sub dword [ebp - 0x48], 0x9b6288ea
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x31fc1
push 0
call eax
mov ecx, 0xf59083f9
sub ecx, 0xf5904e82
xor ebx, ebx
add ebx, eax
mov esi, 0x735b0dcd
sub esi, 0x731a0dcd
add esi, dword [ebp - 0x44]
mov edx, 0x95914ddc
sub edx, 0x216bd9c
mov edi, dword [esi]
sub dword [ebp - 8], 0xc336fb9e
xor edi, edx
sub dword [ebp - 0x14], edi
mov dword [ebx], edi
add dword [ebp - 0xc], 0x64c2c9f4
add ebx, 4
add esi, 0x9d3844ce
sub esi, 0x9d3844ca
loop 0x406456
add eax, 0x71f0f2b8
add eax, 0x8e0fd5f7
xor ebx, ebx
add ebx, eax
add eax, 0xaad03e0b
sub eax, 0xaad03e06
mov ecx, 0xf75c95fc
sub ecx, 0xf71c95fc
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x1002c060
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1002c09e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1002c096
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1002c0a0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1002c086
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1002c170
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1002c1a1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1002c1a1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x1002c1a1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1002c82e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1002c869
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1002c850
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1002c861
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1002c86b
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1002c846
xor eax, eax
pop edi
pop esi
ret

Function at 0x1002dbd2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
add ebx, esp
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.1002c75f
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x1002dbfb
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x1002dc44
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x1002dbee
call fcn.1002c7ee
sal bh, 0xb0
and byte [eax - 0x72b5b], al
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
invalid
invalid
Function at 0x100367c0
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x100a6b34]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [0x100a5010]
or eax, dword [0x100a5014]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0xc], edi
jne 0x10036923
xor edi, edi
cmp byte [0x100a7230], al
jne 0x100368bf
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10036842
cmp dword [esp + 0x1c], 6
setb al
mov byte [0x100a7224], al
ja 0x1003683b
jne 0x10036837
cmp dword [esp + 0x20], 1
ja 0x1003683b
xor edi, edi
jmp 0x1003683e
xor edi, edi
inc edi
test al, al
jne 0x100368b8
push 0x10005520
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x10036868
test edi, edi
je 0x100368b1
push 0x10005540
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x100368b1
push 0x10005590
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a722c], eax
test eax, eax
je 0x100368b1
push 0x1000559c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [section..data], eax
test eax, eax
je 0x100368a7
push 0x100055ac
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a7220], eax
test eax, eax
jne 0x100368b8
mov dword [section..data], 0x1002c6f0
mov byte [0x100a7224], 1
mov byte [0x100a7230], 1
cmp byte [0x100a7224], 0
mov ecx, 0x100a5010
push ecx
jne 0x100368eb
mov esi, dword [section..data]
push ecx
push 0x10035b50
push 0x100099c0
mov ecx, esi
call dword [0x100a83d4]
call esi
jmp 0x1003691f
and dword [esp + 0x18], 0
mov eax, ecx
push 0
cdq
push 0
mov dword [0x100a5010], eax
lea eax, [esp + 0x1c]
push eax
push 1
mov dword [0x100a5014], edx
mov edx, 0x100099c0
push edx
push ecx
push 0x100359f0
mov dword [esp + 0x30], edx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov edi, dword [esp + 0xc]
test byte [0x100a73c0], 1
je 0x1003693b
push 0x10009830
mov edx, 0x10009510
call fcn.10036e23
push edi
push ebx
push dword [ebp + 8]
call fcn.1003bf20
test byte [0x100a73c0], 1
mov esi, eax
je 0x1003695f
push 0x10009830
mov edx, 0x10009a50
call fcn.10036e23
mov ecx, dword [esp + 0x134]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002bcc0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003a581
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1003a5d9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1003a5d9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1003a5cb
cmp esi, ecx
jae 0x1003a5d9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1003a5b9
cmp esi, ecx
jae 0x1003a5d9
cmp word [esi], 0
je 0x1003a5d9
mov eax, esi
jmp 0x1003a5db
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10071500
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x10034c74
call fcn.1002c490
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov esi, 0x100a7388
push esi
call fcn.10037ec3
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.10038b45
mov ecx, dword [0x100a73d8]
mov edi, dword [ebp - 0x14]
test ecx, ecx
je 0x10071547
push edi
push dword [ebp + 8]
call fcn.1006f007
push esi
lea ecx, [ebp - 0x18]
call fcn.10037ec3
push edi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push 0x10025868
push eax
call fcn.10038b2f
mov esi, dword [ebp - 0x18]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esi - 0x10]
call fcn.10039da9
lea ecx, [edi - 0x10]
call fcn.10039da9
jmp 0x10071593
call fcn.1002c3f5
ret
Function at 0x10074722
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x100a6b34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x148], esi
push edi
mov edi, edx
test ecx, ecx
je 0x10074916
test edi, edi
je 0x10074916
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x144], eax
cmp eax, 0xffffffff
jne 0x10074794
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10074912
movzx esi, si
or esi, 0x80070000
jmp 0x10074912
push esi
lea ecx, [ebp - 0x148]
push ecx
push 0x40
lea ecx, [ebp - 0x48]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100747cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10074906
movzx esi, si
or esi, 0x80070000
jmp 0x10074906
mov eax, 0x5a4d
cmp word [ebp - 0x48], ax
jne case.default.0x100748ba
push esi
push esi
push dword [ebp - 0xc]
xor ebx, ebx
push dword [ebp - 0x144]
inc ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100747ad
push esi
lea eax, [ebp - 0x148]
push eax
push 0xf8
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100747ad
cmp dword [ebp - 0x140], 0x4550
push 5
pop edx
jne 0x100748b2
movzx eax, word [ebp - 0xe4]
sub eax, edx
je 0x100748b0
dec eax
sub eax, ebx
je 0x100748ac
movzx eax, word [ebp - 0x13c]
mov ecx, 0x1f0
cmp eax, ecx
ja 0x1007487c
je 0x10074878
sub eax, 0x14c
je 0x10074873
sub eax, 0x16
je 0x1007486f
sub eax, 4
je 0x1007486f
sub eax, 0x1e
je 0x1007486b
sub eax, 0x40
jne 0x10074898
push 0xd
jmp 0x10074875
push 8
jmp 0x10074875
push 7
jmp 0x10074875
push 6
pop ebx
jmp 0x100748b2
push 9
jmp 0x10074875
cmp eax, 0x200
je 0x100748a8
cmp eax, 0x284
je 0x100748a4
cmp eax, 0x8664
je 0x100748a0
cmp eax, 0xaa64
je 0x1007489c
mov ebx, esi
jmp 0x100748b2
push 0xe
jmp 0x10074875
push 0xc
jmp 0x10074875
push 0xa
jmp 0x10074875
push 0xb
jmp 0x10074875
push 4
jmp 0x10074875
mov ebx, edx
add ebx, 0xfffffffa
cmp ebx, 8
ja case.default.0x100748ba
jmp dword [ebx*4 + 0x1007492a]
mov dword [edi], 2
jmp 0x10074906
mov dword [edi], 9
jmp 0x10074906
mov dword [edi], edx
jmp 0x10074906
mov dword [edi], 0xc
jmp 0x10074906
mov dword [edi], 7
jmp 0x10074906
mov dword [edi], 6
jmp 0x10074906
mov dword [edi], esi
jmp 0x10074906
mov dword [edi], 1
jmp 0x10074906
mov dword [edi], 3
jmp 0x10074906
mov esi, 0x80070057
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1007491b
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002bcc0
leave
ret
Function at 0x10074a55
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
and dword [esp], 0
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
test ecx, ecx
je 0x10074b05
test ebx, ebx
je 0x10074b05
xor edx, edx
call fcn.10075c3c
mov edi, eax
test edi, edi
je 0x10074ac1
xor edx, edx
mov ecx, ebx
call fcn.10075c3c
mov esi, eax
test esi, esi
je 0x10074ac1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10074aaa
xor edx, edx
mov ecx, esi
call fcn.10074b18
push dword [ebp + 8]
mov edx, esi
push ecx
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.10075061
mov ebx, eax
jmp 0x10074ac5
mov ebx, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0xc], eax
test edi, edi
je 0x10074ae3
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x10074af7
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x10074b0f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10074f06
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push edi
xor edi, edi
test ecx, ecx
je 0x10074f72
xor eax, eax
cmp ax, word [ecx]
je 0x10074f72
push ebx
xor edx, edx
call fcn.10075c3c
mov ebx, eax
test ebx, ebx
je 0x10074f6d
push esi
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10074f3a
test al, 0x10
je 0x10074f3a
inc edi
jmp 0x10074f55
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x10074f4d
mov esi, 0x10b
cmp esi, 2
jne 0x10074f55
push 3
pop esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebx
mov eax, edi
pop edi
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
ret

Function at 0x10074f7e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
test ecx, ecx
je 0x10074fe9
xor eax, eax
cmp ax, word [ecx]
je 0x10074fe9
push esi
push edi
xor edx, edx
call fcn.10075c3c
mov edi, eax
test edi, edi
je 0x10074fd4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10074fba
and esi, 0x10
sete bl
neg esi
sbb esi, esi
and esi, 2
jmp 0x10074fc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10074fdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
ret
Function at 0x10075061
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, ecx
xor edi, edi
test dword [ebp + 0x14], 0xffffffe0
mov ebx, edx
mov dword [ebp - 0xc], eax
je 0x1007508d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100751eb
mov esi, dword [ebp + 0x14]
and esi, 1
test dword [ebp + 0x14], 8
je 0x100750a2
or esi, 0x1000
xor edx, edx
call fcn.10075c3c
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100751e9
xor edx, edx
mov ecx, ebx
call fcn.10075c3c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100751c0
and dword [ebp - 4], edi
and dword [ebp - 8], 0
push esi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov edi, eax
test edi, edi
jne 0x10075143
test dword [ebp + 0x14], 2
je 0x1007513f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
inc ecx
mov dword [ebp - 0x10], eax
push edx
mov edx, eax
mov dword [ebp - 4], ecx
call fcn.100757cb
test eax, eax
je 0x1007513f
mov edi, dword [ebp - 8]
push edi
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0xc]
push 0x10026540
push 0x4000000
push 0x100a7310
call fcn.10074ff5
add esp, 0x1c
test edi, edi
je 0x100750cb
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100750cb
test edi, edi
je 0x100751c0
test dword [ebp + 0x14], 4
je 0x100751c0
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
test edi, edi
jne 0x100751c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1007516d
push 0x1f
pop esi
push esi
push ebx
push 0x100265d8
push 0x2000000
push 0x100a7310
call fcn.10074ff5
add esp, 0x14
xor edx, edx
mov ecx, ebx
call fcn.10074b18
test eax, eax
jne 0x100751b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100751a0
push 0x1f
pop eax
push eax
push ebx
push 0x10026678
push 0x2000000
push 0x100a7310
call fcn.10074ff5
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100751e9
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100756de
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
test ebx, ebx
je 0x100757bc
xor eax, eax
cmp ax, word [ebx]
je 0x100757bc
xor edx, edx
call fcn.10075c3c
mov edi, eax
test edi, edi
je 0x10075779
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x10075740
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
push 0x10026720
push 0x3000000
push 0x100a7310
call fcn.10074ff5
add esp, 0x14
xor edx, edx
mov ecx, edi
call fcn.10074b18
mov ebx, eax
test ebx, ebx
jne 0x1007579d
test esi, esi
jne 0x1007575b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x100267a8
push 0x3000000
push 0x100a7310
call fcn.10074ff5
jmp 0x1007579a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push ebx
push 0x10026828
push 0x3000000
push 0x100a7310
call fcn.10074ff5
mov ebx, dword [ebp - 4]
add esp, 0x14
test edi, edi
je 0x100757b1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x100757c6
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10075885
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor eax, eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
push edi
test esi, esi
je 0x10075a07
cmp ax, word [esi]
je 0x10075a07
lea edx, [ebp - 4]
call fcn.10075c3c
mov ebx, eax
test ebx, ebx
je 0x100759f3
xor eax, eax
lea edx, [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push ecx
push eax
mov ecx, ebx
call fcn.10075b51
test eax, eax
js 0x100759b5
cmp dword [ebp - 8], 1
push 0x5c
pop ecx
jne 0x10075955
mov edx, dword [ebp - 0xc]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x14]
jne 0x100758f3
mov eax, dword [ebp - 4]
sub ecx, esi
sar ecx, 1
lea esi, [eax + ecx*2]
test edx, edx
je 0x1007591e
push edx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x5c
pop ecx
xor edi, edi
push ecx
push esi
call sub.msvcrt.dll_wcschr
pop ecx
mov esi, eax
pop ecx
mov ecx, ebx
test esi, esi
je 0x10075983
xor eax, eax
mov word [esi], ax
call fcn.10074f06
test eax, eax
jne 0x1007594a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
pop ecx
mov word [esi], cx
add esi, 2
jmp 0x10075923
mov esi, dword [ebp - 4]
movzx eax, word [esi]
cmp eax, 0x61
jb 0x10075965
cmp eax, 0x7a
jbe 0x1007596f
cmp eax, 0x41
jb 0x10075921
cmp eax, 0x5a
ja 0x10075921
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x10075921
cmp cx, word [esi + 4]
jne 0x10075921
add esi, 8
jmp 0x10075921
call fcn.10074f06
xor esi, esi
inc esi
cmp eax, esi
je 0x100759b0
xor eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
je 0x100759b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push dword [ebp - 0x1c]
push 0x100071c8
jmp 0x100759ce
mov dword [ebp - 0x10], esi
jmp 0x100759e0
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push esi
push 0x10007228
push 0x3000000
push 0x100a7310
call fcn.10074ff5
add esp, 0x14
push ebx
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100759fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
jmp 0x10075a11
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret