joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62d250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x641808
push 0x631288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x62d329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x62d329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.006301d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x62d329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x62d329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x62d32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0062d351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x62dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x62dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x62dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x62dd94
push eax
push esi
call fcn.0063020b
add esp, 8
pop esi
ret 0x10

Function at 0x62dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x62de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x62de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x646320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0062fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x62ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x62de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x62dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x62deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x646320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0062fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x62deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x62de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x62e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x62e131
push esi
call fcn.00631145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00620080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x62e131
push 0
push ebp
call fcn.006203a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00620260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x62e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006202f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x62e121
push 0x646918
push edi
call fcn.0062f3f0
push eax
push ebx
push esi
call fcn.0062df60
push 0x6468f8
push edi
call fcn.0062f3f0
push eax
push ebx
push esi
call fcn.0062df60
push 0x6468d8
push edi
call fcn.0062f3f0
push eax
push ebx
push esi
call fcn.0062df60
push 0x6468c0
push edi
call fcn.0062f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.0062df60
push 0x6468a0
push edi
call fcn.0062f3f0
push eax
push ebx
push esi
call fcn.0062df60
push 0x646888
push edi
call fcn.0062f3f0
push eax
push ebx
push esi
call fcn.0062df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x62f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0062f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0062f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0062f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0062f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x62fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x62fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x64187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x62fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x62fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4022a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
cmp dword [esi + 0x14], eax
mov dword [esp + 4], eax
jne 0x4022d5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x402530
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [0x40572c]
push eax
push ecx
mov dword [esp + 8], 0
call fcn.00403267
test eax, eax
je 0x402582
cmp dword [eax + 4], 0
je 0x402568
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
push ecx
push eax
call fcn.00402790
pop ecx
ret 0xc
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
push 0
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 0xc

Function at 0x402590
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
mov dword [esp + 4], eax
je 0x4025e9
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4025e8
mov eax, dword [esp + 0x10]
mov ecx, dword [0x40572c]
push eax
push ecx
call fcn.00403267
test eax, eax
je 0x4025e4
cmp dword [eax + 4], 0
je 0x4025d2
push esi
push edi
push eax
call fcn.004028c0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x402790
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 0
push edi
jne 0x4027b1
push esi
call fcn.004022a0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ebx, edi
jl 0x40282a
mov eax, dword [esi + 0x10]
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
sub ecx, 1
je 0x402817
sub ecx, 1
je 0x402802
sub ecx, 2
je 0x4027ef
push edi
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ax, word [eax]
mov ecx, dword [esp + 0x14]
mov word [ecx], ax
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov dl, byte [eax]
mov eax, dword [esp + 0x14]
mov byte [eax], dl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esi + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 4]
push ebx
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
cmp edi, eax
push 0
jl 0x402873
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
pop esi
add eax, ebx
pop ebx
ret 0xc
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp edi, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jle 0x402896
mov edi, eax
mov ecx, dword [esi + 4]
push edi
push ecx
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
add esp, 0xc
pop ebp
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x4028c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x4028f5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40296e
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
sub ecx, 1
je 0x40295b
sub ecx, 1
je 0x402946
sub ecx, 2
je 0x402933
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.004022a0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40299b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x402f8b
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x402fa3
push dword [esp + 4]
push 0x402f24
call dword [sym.imp.USER32.DLL_EnumWindows]
jmp 0x402fe0
push esi
mov esi, dword [0x40571c]
test esi, esi
je 0x402fdf
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x402fd7
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
push edi
push 0x40571c
call fcn.00403406
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x402fb0
pop edi
pop ebx
pop esi
ret 4

Function at 0x4030b8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp dword [0x405720], ebx
jne 0x4030e6
push fcn.00403085
push 0x10
push 0x148
call fcn.004032c8
mov dword [0x405720], eax
mov esi, dword [ebp + 0xc]
cmp esi, ebx
jne 0x4030f2
mov esi, section..rdata
push 0x104
lea eax, [ebp - 0x108]
push esi
push eax
call sub.MSVCRT.dll_strncpy
push esi
mov byte [ebp - 4], bl
call sub.MSVCRT.dll_strlen
add esp, 0x10
cmp eax, ebx
je 0x40312e
cmp byte [eax + esi - 1], 0x5c
je 0x40312e
lea eax, [ebp - 0x108]
push 0x404018
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x403139
cmp byte [eax], bl
jne 0x40313e
mov eax, 0x404014
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push dword [ebp + 8]
push dword [0x405720]
call fcn.00403203
mov esi, eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x40317a
mov dword [esi + 4], ebx
jmp 0x40318c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x403190
mov dword [esi + 4], 1
mov edi, esi
jmp 0x4031a4
cmp dword [ebp + 8], 0xffffffff
jne 0x4031a2
push esi
push dword [0x405720]
call fcn.00403292
mov dword [esi], ebx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4031f2
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x403200
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 8
Function at 0x100e227
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100e256
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0100b682
add esp, 0x14
jmp 0x100e334
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100e334
test al, 0x40
jne 0x100e334
test al, 2
je 0x100e278
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100e334
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x100e238
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x100e324
cmp eax, 0xffffffff
je 0x100e324
test byte [esi + 0xc], 0x82
jne 0x100e2f9
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x100e2e4
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x100e2e4
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100e2e9
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100e2f9
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100e317
mov eax, dword [esi + 0xc]
test al, 8
je 0x100e317
test eax, 0x400
jne 0x100e317
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x100e337
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100fb57
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100fb86
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0100b682
add esp, 0x14
jmp 0x100fc70
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100fc70
test al, 0x40
jne 0x100fc70
test al, 2
je 0x100fba8
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100fc70
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x100fb68
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x100fc60
cmp eax, 1
je 0x100fc60
cmp eax, 0xffffffff
je 0x100fc60
test byte [esi + 0xc], 0x82
jne 0x100fc32
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x100fc1d
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x100fc1d
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100fc22
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100fc32
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100fc50
mov eax, dword [esi + 0xc]
test al, 8
je 0x100fc50
test eax, 0x400
jne 0x100fc50
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x100fc75
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1010117
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
xor edi, edi
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0101116c
mov ebx, eax
cmp ebx, edi
je 0x10101f8
push esi
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10101c4
mov eax, dword [ebp + 0xc]
and al, 1
movsx eax, al
push edi
push 0x2200000
neg eax
push 3
sbb eax, eax
push edi
and eax, 0xfffffff9
add eax, 7
push eax
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10101b3
push 0xd
push 1
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp + 0xb], 1
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
cmp eax, edi
jge 0x10101a3
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 4], eax
jmp 0x10101aa
mov dword [ebp - 8], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10101e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1001bd8
jmp 0x10101d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1001b50
push 0x3000000
push 0x102273c
mov dword [ebp - 4], eax
call fcn.0100a624
add esp, 0x14
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret 8

Function at 0x101020f
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x10102ef
xor eax, eax
cmp ax, word [esi]
je 0x10102ef
push ebx
push edi
push esi
call fcn.0101116c
mov dword [ebp + 8], eax
cmp eax, edi
je 0x10102a6
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x3000000
mov edi, 0x102273c
test eax, eax
jne 0x101027d
call esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x1001d30
push ebx
push edi
call fcn.0100a624
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x10102c8
cmp dword [ebp - 4], eax
jne 0x1010297
call esi
mov dword [ebp - 4], eax
call esi
push eax
push dword [ebp + 8]
push 0x1001cb0
push ebx
push edi
jmp 0x10102c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1001c38
push 0x3000000
mov dword [ebp - 4], eax
push 0x102273c
call fcn.0100a624
add esp, 0x14
cmp dword [ebp + 8], 0
pop ebx
je 0x10102e1
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
jmp 0x10102f9
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
leave
ret 4