joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007780c
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x90
mov eax, 0x10109cc1
call fcn.100b2747
and dword [ebp - 4], 0
mov edi, dword [ebp + 0x218]
mov eax, dword [ebp + 0x21c]
and dword [ebp - 0x10], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
mov esi, 0x102b0070
test byte [0x102b006c], bl
jne 0x1007787a
or dword [0x102b006c], ebx
push 0x102b0b9c
mov ecx, esi
call fcn.100035c0
push 0x10112a6d
call fcn.100b3915
pop ecx
mov eax, dword [0x102b0070]
cmp dword [eax - 0xc], 0
jne 0x100778b9
push ebx
push 5
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.10003b50
push 0x101157b0
mov ecx, esi
call fcn.100030e0
push 0
push dword [0x102b0070]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x14]
push esi
push edi
call fcn.10008a30
add esp, 0xc
push dword [edi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x10], ebx
call fcn.10008d90
push dword [eax]
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea eax, [ebp - 0x98]
cmp dword [ebp - 0x9c], eax
je 0x100778fc
push dword [ebp - 0x9c]
call fcn.100b2b5c
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.100b2738
add ebp, 0x210
leave
ret
Function at 0x10077921
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0xa0
mov eax, 0x10109c7d
call fcn.100b2747
mov edi, dword [ebp + 0x218]
mov eax, dword [ebp + 0x21c]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
test byte [0x102b0078], 1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], eax
mov esi, 0x102b0074
jne 0x1007798e
or dword [0x102b0078], 1
push 0x102b0b9c
mov ecx, esi
call fcn.100035c0
push 0x10112a7b
call fcn.100b3915
pop ecx
mov eax, dword [0x102b0074]
cmp dword [eax - 0xc], ebx
jne 0x10077aa8
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, ebx
jle 0x10077aa8
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.10003b50
push str.RootGenius_
mov ecx, esi
call fcn.100030e0
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push dword [0x102b0074]
call edi
push 0x101157e4
lea ecx, [ebp - 0x18]
call fcn.10002f20
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push esi
push eax
mov dword [ebp - 4], 1
call fcn.10003010
mov eax, dword [eax]
add esp, 0xc
push ebx
push eax
call edi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10005330
push str.DataApk
lea ecx, [ebp - 0x10]
call fcn.10002f20
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [ebp - 4], 2
call fcn.10003010
mov eax, dword [eax]
add esp, 0xc
push ebx
push eax
call edi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10005330
push str.DataBin
lea ecx, [ebp - 0x10]
call fcn.10002f20
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [ebp - 4], 3
call fcn.10003010
mov eax, dword [eax]
add esp, 0xc
push ebx
push eax
call edi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10005330
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x28]
push esi
push edi
call fcn.10008a30
add esp, 0xc
push dword [edi]
lea ecx, [ebp - 0xac]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 1
call fcn.10008d90
push dword [eax]
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea eax, [ebp - 0xa8]
cmp dword [ebp - 0xac], eax
je 0x10077aee
push dword [ebp - 0xac]
call fcn.100b2b5c
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.100b2738
add ebp, 0x210
leave
ret
Function at 0x10077b2d
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x20c
lea ebp, [esp - 4]
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push 0x90
mov eax, 0x10109cc1
call fcn.100b2747
and dword [ebp - 4], 0
mov edi, dword [ebp + 0x218]
mov eax, dword [ebp + 0x21c]
and dword [ebp - 0x10], 0
test byte [0x102b0080], 1
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
mov esi, 0x102b007c
jne 0x10077b9a
or dword [0x102b0080], 1
push 0x102b0b9c
mov ecx, esi
call fcn.100035c0
push 0x10112a89
call fcn.100b3915
pop ecx
mov eax, dword [0x102b007c]
cmp dword [eax - 0xc], 0
jne 0x10077bdd
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jle 0x10077bdd
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.10003b50
push str.RootGenius_
mov ecx, esi
call fcn.100030e0
push 0
push dword [0x102b007c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x14]
push esi
push edi
call fcn.10008a30
add esp, 0xc
push dword [edi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x10], 1
call fcn.10008d90
push dword [eax]
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
lea eax, [ebp - 0x98]
cmp dword [ebp - 0x9c], eax
je 0x10077c24
push dword [ebp - 0x9c]
call fcn.100b2b5c
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.100b2738
add ebp, 0x210
leave
ret

Function at 0x10077c49
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x10
mov eax, 0x10109cf4
call fcn.100b2747
mov esi, dword [ebp + 0x80c]
mov ebx, dword [ebp + 0x810]
mov edi, dword [ebp + 0x814]
xor eax, eax
mov byte [ebp - 0xd], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push 0x102895f5
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.100033f0
mov esi, dword [esi]
push 0x20019
push esi
push connect
lea ecx, [ebp - 0x18]
call fcn.10068260
test eax, eax
jne 0x10077ceb
mov ebx, dword [ebx]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], 0x400
call fcn.100682a1
test eax, eax
jne 0x10077ceb
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.10003b50
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10077ceb
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x18]
call fcn.10068245
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.100b2738
add ebp, 0x804
leave
ret
Function at 0x10078b58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x574]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [edi], ebx
je 0x10078b7d
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [edi], ebx
mov eax, dword [esi + 0x57c]
test eax, eax
je 0x10078c0d
push eax
call fcn.1005d556
mov ebx, eax
xor edi, edi
pop ecx
cmp ebx, edi
je 0x10078c07
push 2
push edi
push ebx
mov ecx, esi
call fcn.1007887b
mov eax, dword [esi + 0x57c]
cmp eax, dword [esi + 0x578]
jne 0x10078c07
cmp ebx, esi
je 0x10078bd4
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.1005e5ce
mov eax, dword [ebx + 0xa0]
cmp eax, edi
je 0x10078bf6
cmp word [eax], di
je 0x10078bf6
push 1
push edi
push edi
push eax
push 0x1011401c
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10078c07
mov eax, dword [ebx + 0x14]
cmp eax, edi
je 0x10078c07
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
mov dword [esi + 0x57c], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0x128]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1007a585
cmp dword [ebp - 4], 0
je 0x10078c60
mov eax, dword [esi + 0x10]
push eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
push 0x4e
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1007c5e5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea eax, [esi + 0x2b8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [eax], ebx
je 0x1007c603
mov dword [eax], ebx
mov eax, dword [esi + 0x2d8]
cmp eax, ebx
je 0x1007c6d4
push edi
push eax
call fcn.1005d556
mov edi, eax
pop ecx
cmp edi, ebx
je 0x1007c68f
push 2
push ebx
push edi
mov ecx, esi
call fcn.1007be96
mov eax, dword [esi + 0x2d8]
cmp eax, dword [esi + 0x2d4]
jne 0x1007c68f
lea eax, [esi + 0x64]
cmp edi, eax
je 0x1007c65c
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.1005e5ce
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x1007c67e
cmp word [eax], bx
je 0x1007c67e
push 1
push ebx
push ebx
push eax
push 0x1011401c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1007c68f
mov eax, dword [edi + 0x14]
cmp eax, ebx
je 0x1007c68f
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
mov dword [esi + 0x2d8], ebx
cmp dword [ebp - 4], ebx
je 0x1007c6d3
mov eax, dword [esi + 0x74]
push eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
push 0x4e
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1007caff
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x14
mov eax, 0x1010a090
call fcn.100b2747
mov esi, ecx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
test al, al
js 0x1007cb30
push 0xa1
call edi
test al, al
js 0x1007cb30
xor ebx, ebx
mov dword [esi + 0x2c0], ebx
jmp 0x1007cb3c
mov dword [esi + 0x2c0], 1
xor ebx, ebx
push 0x11
call edi
test al, al
js 0x1007cb57
push 0xa3
call edi
test al, al
js 0x1007cb57
mov dword [esi + 0x2bc], ebx
jmp 0x1007cb61
mov dword [esi + 0x2bc], 1
cmp dword [esi + 0x2bc], ebx
je 0x1007cb9e
cmp dword [esi + 0x60], ebx
je 0x1007cb9e
mov ebx, dword [esi + 0x48]
push 0
lea edi, [esi + 0x1c]
push ebx
mov ecx, edi
call fcn.1007b0b2
mov ecx, edi
test eax, eax
jne 0x1007cb8c
push ebx
call fcn.1007b24f
jmp 0x1007cb92
push eax
call fcn.1007e755
mov ecx, esi
call fcn.1007bee6
jmp 0x1007ccb9
cmp dword [esi + 0x2c0], ebx
je 0x1007cc08
cmp dword [esi + 0x60], ebx
je 0x1007cc08
cmp dword [esi + 0x24], ebx
jne 0x1007cbb8
lea ecx, [esi + 0x1c]
jmp 0x1007ccb1
lea ebx, [esi + 0x1c]
mov ecx, ebx
call fcn.1007abaa
mov edi, dword [eax]
cmp edi, dword [esi + 0x44]
je 0x1007ccb9
mov ecx, ebx
call fcn.1007d3da
cmp edi, dword [esi + 0x44]
jle 0x1007cbe9
push edi
mov ecx, ebx
call fcn.1007b24f
dec edi
cmp edi, dword [esi + 0x44]
jge 0x1007cbd9
jmp 0x1007cbf7
push edi
mov ecx, ebx
call fcn.1007b24f
inc edi
cmp edi, dword [esi + 0x44]
jle 0x1007cbe9
lea ecx, [esi + 0x64]
lea eax, [ecx + 0x18]
push eax
call fcn.10060697
jmp 0x1007ccb9
lea ebx, [esi + 0x1c]
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
jmp 0x1007cca0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1007e427
mov edi, dword [eax]
push edi
mov ecx, esi
call fcn.1007accc
test eax, eax
je 0x1007cc9d
cmp edi, dword [esi + 0x48]
je 0x1007cc9d
mov eax, dword [esi]
push edi
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call dword [eax + 0xd0]
and dword [ebp - 4], 0
push 0
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.100195f0
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x10113958
mov byte [ebp - 4], 1
call fcn.100181c0
lea ecx, [esi + 0x188]
mov eax, dword [ecx]
add eax, 0x10
mov byte [ebp - 4], 0
call dword [eax]
push dword [ebp - 0x18]
mov ecx, ebx
call fcn.1007e755
mov ecx, esi
call fcn.1007bee6
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.10005330
mov eax, dword [ebp - 0x14]
mov ecx, ebx
test eax, eax
jne 0x1007cc15
call fcn.1007d3da
mov ecx, ebx
push dword [esi + 0x48]
call fcn.1007b24f
call fcn.100b281f
ret 4

Function at 0x10080fea
Capabilities:
Hide graphical window

Disassembly:
push esi
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x10081011
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10081011
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x100848e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010aab0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
push edi
push ecx
lea edi, [ebp - 0x50]
mov ecx, 0x11
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x102ac760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x18]
call fcn.10002e50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10002e50
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10084b20
add esp, 8
push 0x1026f788
lea edx, [ebp - 0x30]
push edx
call fcn.10077b2d
add esp, 8
mov byte [ebp - 4], 2
push 0x1026f790
lea ecx, [ebp - 0x30]
call fcn.10008dd0
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10083250
movzx eax, al
test eax, eax
jne 0x10084995
lea ecx, [ebp - 0x30]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
jmp 0x10084a6c
lea ecx, [ebp - 0x30]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
push 0
push 1
push 1
push 0
push 0x493e0
lea ecx, [ebp - 0x18]
push ecx
push 0x1026f7c8
mov ecx, dword [ebp - 0x10]
call fcn.100835d0
call fcn.100d5c20
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x1026f7c4
call fcn.10002e70
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x48], edx
mov byte [ebp - 4], 3
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push 0x1026f850
call fcn.10002e70
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
call fcn.10083730
mov byte [ebp - 0x4d], al
movzx eax, byte [ebp - 0x4d]
test eax, eax
jne 0x10084a1b
jmp 0x10084a6c
push 0x1026f854
call fcn.100d6a20
add esp, 4
push 0x2710
call fcn.100d7240
add esp, 4
mov byte [0x102addec], 1
mov byte [ebp - 0x3d], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.10003610
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10003610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x3d]
jmp 0x10084aa7
push 0x1026f888
call fcn.100d6a20
add esp, 4
mov byte [ebp - 0x3e], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.10003610
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.10003610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x3e]
push edx
mov ecx, ebp
push eax
lea edx, [0x10084ad8]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x50
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret 8
Function at 0x10084b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
lea edi, [ebp - 0x54]
mov ecx, 0x15
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.100b0a2f
add esp, 4
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.100b3c60
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.100fd9f0
add esp, 8
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, 4
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
sub eax, 4
mov dword [ebp - 0xc], eax
push 4
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.100b3c60
add esp, 0xc
mov eax, dword [ebp - 0x14]
push eax
call fcn.100b0a2f
add esp, 4
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
add eax, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call sub.zlib1.dll_Ordinal_26
push 0x1026f778
lea eax, [ebp - 0x24]
push eax
call fcn.10077b2d
add esp, 8
push 0x1026f780
lea ecx, [ebp - 0x24]
call fcn.10008dd0
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.100b5379
add esp, 0xc
cmp dword [ebp - 0x30], 0
je 0x10084c70
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], edx
mov eax, 1
test eax, eax
je 0x10084c64
cmp dword [ebp - 0x14], 0x1000
jbe 0x10084c1b
mov dword [ebp - 0x54], 0x1000
jmp 0x10084c21
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0
jg 0x10084c2f
jmp 0x10084c64
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
push 1
mov edx, dword [ebp - 0x38]
push edx
call fcn.100b521a
add esp, 0x10
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jg 0x10084c50
jmp 0x10084c64
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x38], ecx
jmp 0x10084c00
mov edx, dword [ebp - 0x30]
push edx
call fcn.100b503c
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.100b2d1b
add esp, 4
mov edx, dword [ebp - 4]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
push eax
call fcn.100b2d1b
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.10003610
push edx
mov ecx, ebp
push eax
lea edx, [0x10084cbc]
call fcn.100b4c4b
pop eax
pop edx
pop edi
add esp, 0x54
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret
Function at 0x10085b70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ac50
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
push ecx
lea edi, [ebp - 0x3c]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x102ac760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x3208
push 0x101c5c18
call fcn.10084b20
add esp, 8
push 0x1026fdbc
lea eax, [ebp - 0x18]
push eax
call fcn.10077b2d
add esp, 8
mov dword [ebp - 4], 0
push 0x1026fdc4
lea ecx, [ebp - 0x18]
call fcn.10008dd0
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10083250
movzx ecx, al
test ecx, ecx
jne 0x10085c25
lea ecx, [ebp - 0x18]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
mov byte [ebp - 0x1d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x1d]
jmp 0x10085cea
lea ecx, [ebp - 0x18]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
push 0
push 1
push 1
push 0
push 0x4e20
push 0
push 0x1026fdf8
mov ecx, dword [ebp - 0x10]
call fcn.100835d0
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.doomed2
call fcn.10002e70
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x1026fe60
call fcn.10002e70
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call fcn.10084430
mov byte [ebp - 0x39], al
movzx eax, byte [ebp - 0x39]
test eax, eax
jne 0x10085cc7
push 0x1026fe94
call fcn.100d6a20
add esp, 4
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x29]
jmp 0x10085cea
push 0x1026fec8
call fcn.100d6a20
add esp, 4
mov byte [ebp - 0x2a], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x2a]
push edx
mov ecx, ebp
push eax
lea edx, [0x10085d18]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret
Function at 0x10086260
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ac50
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
push ecx
lea edi, [ebp - 0x3c]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x102ac760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x50994
push 0x1015e7b8
call fcn.10084b20
add esp, 8
push 0x10270460
lea eax, [ebp - 0x18]
push eax
call fcn.10077b2d
add esp, 8
mov dword [ebp - 4], 0
push 0x10270468
lea ecx, [ebp - 0x18]
call fcn.10008dd0
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10083250
movzx ecx, al
test ecx, ecx
jne 0x10086315
lea ecx, [ebp - 0x18]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
mov byte [ebp - 0x1d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x1d]
jmp 0x100863da
lea ecx, [ebp - 0x18]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
push 0
push 1
push 1
push 0
push 0x4e20
push 0
push 0x102704a0
mov ecx, dword [ebp - 0x10]
call fcn.100835d0
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x1027049c
call fcn.10002e70
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x102704f8
call fcn.10002e70
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call fcn.10083730
mov byte [ebp - 0x39], al
movzx eax, byte [ebp - 0x39]
test eax, eax
jne 0x100863b7
push 0x10270530
call fcn.100d6a20
add esp, 4
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x29]
jmp 0x100863da
push 0x10270564
call fcn.100d6a20
add esp, 4
mov byte [ebp - 0x2a], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x2a]
push edx
mov ecx, ebp
push eax
lea edx, [0x10086408]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret