joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e0050a1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push ebx
xor ebx, ebx
cmp dword [0x1e02a540], ebx
jne 0x1e005227
cmp dword [0x1e02a534], ebx
je 0x1e005227
mov eax, dword [0x1e02a53c]
cmp eax, ebx
je 0x1e005227
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.1e0179d5
test eax, eax
je 0x1e005227
cmp dword [ebp - 0xc], 8
jne 0x1e0050ef
cmp dword [ebp - 8], ebx
je 0x1e005105
push ebx
push 8
push dword [0x1e02a53c]
call fcn.1e01789b
test eax, eax
je 0x1e005227
push esi
push edi
xor eax, eax
push 0x41
pop edx
mov ecx, edx
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x630]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x424]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
cmp dword [ebp + 8], ebx
mov ecx, edx
lea edi, [ebp - 0x83c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov esi, 0x20a
je 0x1e005158
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
call fcn.1e017ce7
cmp dword [ebp + 0xc], ebx
je 0x1e00516d
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x630]
push eax
call fcn.1e017ce7
cmp dword [ebp + 0x10], ebx
je 0x1e005182
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x424]
push eax
call fcn.1e017ce7
cmp dword [ebp + 0x14], ebx
je 0x1e005197
push esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x83c]
push eax
call fcn.1e017ce7
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 4]
push eax
mov edi, 0x105
push edi
lea eax, [ebp - 0x218]
push eax
push dword [0x1e02a53c]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x630]
push eax
push dword [0x1e02a53c]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x424]
push eax
push dword [0x1e02a53c]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x83c]
push eax
push dword [0x1e02a53c]
call esi
push ebx
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp + 0x18]
push eax
push dword [0x1e02a53c]
call esi
cmp dword [ebp - 0xc], 8
pop edi
pop esi
jne 0x1e005216
cmp dword [ebp - 8], ebx
je 0x1e005227
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [0x1e02a53c]
call fcn.1e01789b
pop ebx
leave
ret 0x14
Function at 0x1e005b19
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
cmp dword [ebp + 8], 0x10000000
jne 0x1e005b5f
call fcn.1e00ec12
test eax, eax
jne 0x1e005b5f
push dword [0x1e02f1d8]
call sub.LOG.dll_LogBegin
push 5
push 0x3ec
push 0x1e0016e8
call sub.LOG.dll_LogW
add esp, 0xc
call sub.LOG.dll_LogEnd
xor eax, eax
jmp 0x1e005cfa
push esi
push edi
push 0x45
pop ecx
xor eax, eax
push 7
lea edi, [ebp - 0x148]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
mov dword [ebp - 0x148], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1e005cb9
mov esi, dword [ebp - 0x140]
xor eax, eax
push ebx
inc eax
cmp dword [ebp - 0x138], eax
push 4
pop edx
jne 0x1e005bfb
cmp dword [ebp - 0x144], edx
mov dword [ebp - 0x1c], eax
jne 0x1e005c29
test esi, esi
jne 0x1e005bd2
xor ebx, ebx
cmp word [ebp - 0x13c], 0x457
mov dword [ebp - 0x14], eax
jb 0x1e005c2c
mov dword [ebp - 0x14], 2
jmp 0x1e005c2c
cmp esi, 0xa
jne 0x1e005bef
xor ebx, ebx
cmp word [ebp - 0x13c], 0x8ae
mov dword [ebp - 0x14], 3
jb 0x1e005c2c
mov ebx, eax
jmp 0x1e005c2c
cmp esi, 0x5a
jne 0x1e005c29
mov dword [ebp - 0x14], edx
xor ebx, ebx
jmp 0x1e005bfe
mov ebx, dword [ebp - 0xc]
push 2
pop ecx
cmp dword [ebp - 0x138], ecx
jne 0x1e005c2c
cmp dword [ebp - 0x144], edx
mov dword [ebp - 0x1c], ecx
jne 0x1e005c19
mov dword [ebp - 0x14], eax
mov ebx, esi
cmp dword [ebp - 0x144], 5
jne 0x1e005c2c
mov dword [ebp - 0x14], ecx
mov ebx, esi
jmp 0x1e005c2c
mov ebx, dword [ebp - 0xc]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x1e0014e0
lea eax, [ebp - 0x34]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push 0x1e001854
push 0
push dword [ebp + 8]
call sym.MIGISM.dll_IsmSetEnvironmentString
push dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push 0x1e00182c
push 0
push dword [ebp + 8]
call sym.MIGISM.dll_IsmSetEnvironmentString
push ebx
lea eax, [ebp - 0x34]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push 0x1e00180c
push 0
push dword [ebp + 8]
call sym.MIGISM.dll_IsmSetEnvironmentString
push dword [ebp - 0x13c]
lea eax, [ebp - 0x34]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push 0x1e0017ec
push 0
push dword [ebp + 8]
call sym.MIGISM.dll_IsmSetEnvironmentString
pop ebx
mov edi, dword [ebp + 8]
cmp edi, 0x10000000
jne 0x1e005cef
push 1
push 0
push 0x1e02a558
call fcn.1e01beb3
mov esi, eax
test esi, esi
je 0x1e005cef
push esi
push 0x1e0016a0
call sym.MIGISM.dll_IsmGetObjectTypeId
push eax
call sym.MIGISM.dll_IsmRegisterStaticExclusion
push esi
call fcn.1e01bc81
mov dword [0x1e02a524], edi
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 4
Function at 0x1e00739e
Capabilities:
Delete file

Disassembly:
push 0x218
push 0x1e001970
call fcn.1e0171b4
xor edi, edi
mov dword [ebp - 0x1c], edi
call fcn.1e002cd6
test eax, eax
jne 0x1e007590
mov eax, dword [0x1e02ebb8]
cmp eax, edi
je 0x1e00756f
cmp dword [eax + 0x44], edi
je 0x1e00756f
mov dword [ebp - 4], edi
xor esi, esi
inc esi
mov dword [0x1e02a548], esi
push 0x104
lea eax, [ebp - 0x224]
push eax
call sym.MIGISM.dll_IsmGetTempFile
test eax, eax
jne 0x1e007414
push dword [0x1e02f1d8]
call sub.LOG.dll_LogBegin
push 0x3f0
push 0x1e0016e8
call sub.LOG.dll_LogW
pop ecx
pop ecx
jmp 0x1e007446
mov eax, dword [0x1e02a530]
dec eax
je 0x1e007526
dec eax
je 0x1e007450
push dword [0x1e02f1d8]
call sub.LOG.dll_LogBegin
push dword [0x1e02a530]
push 0x3ef
push 0x1e0016e8
call sub.LOG.dll_LogW
add esp, 0xc
call sub.LOG.dll_LogEnd
jmp 0x1e0074f2
push edi
push 0x1e001910
call sym.MIGISM.dll_TrackedIsmCreateObjectHandle
mov dword [ebp - 0x228], eax
push esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
call fcn.1e00cce4
push dword [ebp - 0x228]
call fcn.1e01bc81
call fcn.1e003804
lea eax, [ebp - 0x224]
push eax
call fcn.1e01f1d5
test eax, eax
je 0x1e0073f6
call fcn.1e010b60
mov dword [0x1e02eb88], esi
mov dword [0x1e02eba8], edi
mov eax, dword [0x1e02ebb8]
mov eax, dword [eax + 0x40]
cmp eax, edi
je 0x1e0074bd
push dword [0x1e02a524]
call eax
push esi
call fcn.1e004b60
mov eax, dword [0x1e02ebb8]
call dword [eax + 0x24]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1e0074df
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 3
call fcn.1e004b60
mov dword [0x1e02eb88], edi
mov dword [0x1e02eba8], edi
or dword [ebp - 4], 0xffffffff
call fcn.1e007568
cmp dword [ebp - 0x1c], edi
jne 0x1e007521
push dword [0x1e02f1d8]
call sub.LOG.dll_LogBegin
push 0x41e
push 0x1e0016e8
call sub.LOG.dll_LogW
pop ecx
pop ecx
call sub.LOG.dll_LogEnd
mov eax, dword [ebp - 0x1c]
jmp 0x1e007592
push edi
push 0x1e0018d4
call sym.MIGISM.dll_TrackedIsmCreateObjectHandle
mov dword [ebp - 0x228], eax
push esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
call fcn.1e00cce4
push dword [ebp - 0x228]
call fcn.1e01bc81
lea eax, [ebp - 0x224]
push eax
call fcn.1e0038ab
jmp 0x1e007490
push dword [0x1e02f1d8]
call sub.LOG.dll_LogBegin
push 0x3ee
push 0x1e0016e8
call sub.LOG.dll_LogW
pop ecx
pop ecx
call sub.LOG.dll_LogEnd
xor eax, eax
call fcn.1e0171ed
ret
Function at 0x1e00a2fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
xchg ebp, eax
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e009f49
push eax
push esi
push dword [ebp + 8]
call fcn.1e009efe
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e009f49
push eax
push esi
push dword [ebp + 8]
call fcn.1e009efe
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e009f39
xor byte [0x9d884198], 0x7c
invalid

Function at 0x1e00a7d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.1e009f49
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1e009efe
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
invalid
invalid
inc eax
Function at 0x1e00c39a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 1
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.1e01bd7e
cmp dword [ebp - 8], esi
je 0x1e00c41d
push ebx
push 0x20006
call fcn.1e025550
push dword [ebp - 4]
mov ebx, eax
call fcn.1e0257d9
push ebx
mov edi, eax
call fcn.1e025550
cmp edi, esi
pop ebx
je 0x1e00c44f
push dword [ebp + 8]
push dword [0x1e02aa10]
push 2
call sym.MIGISM.dll_IsmRecordOperation
push dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, esi
jne 0x1e00c40e
mov dword [ebp - 0xc], 1
jmp 0x1e00c415
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call fcn.1e0258d3
jmp 0x1e00c44f
push dword [ebp + 8]
push dword [0x1e02aa10]
push 2
call sym.MIGISM.dll_IsmRecordOperation
push 0x20007
call fcn.1e025550
cmp dword [ebp - 4], esi
mov edi, eax
je 0x1e00c449
push dword [ebp - 4]
call fcn.1e0258ea
mov dword [ebp - 0xc], eax
push edi
call fcn.1e025550
call fcn.1e018062
push dword [ebp - 4]
call fcn.1e01bc81
push dword [ebp - 8]
mov dword [ebp - 4], esi
call fcn.1e01bc81
mov dword [ebp - 8], esi
call fcn.1e018085
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 4
Function at 0x1e00c5d9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
jne 0x1e00c5fa
xor eax, eax
jmp 0x1e00c735
push ebx
mov ebx, dword [esi + 0x1c]
push 1
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.1e01bd7e
cmp dword [ebp - 8], edi
push 0x20006
je 0x1e00c6d0
call fcn.1e025550
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call fcn.1e0257d9
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
call fcn.1e025550
cmp dword [ebp + 0xc], edi
jne 0x1e00c652
push dword [ebp - 4]
call fcn.1e00c478
cmp eax, edi
mov dword [ebp + 0xc], eax
je 0x1e00c711
cmp dword [esi + 4], edi
je 0x1e00c667
push edi
push edi
push edi
push dword [esi + 8]
call fcn.1e017713
mov esi, dword [esi + 0x10]
jmp 0x1e00c66d
mov eax, dword [esi + 8]
mov esi, dword [esi + 0xc]
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.1e025600
test eax, eax
jne 0x1e00c6b5
push dword [ebp + 8]
push dword [0x1e02aa10]
push 1
call sym.MIGISM.dll_IsmRecordOperation
push esi
push dword [ebp - 0x10]
push dword [ebx]
push edi
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
xor eax, eax
cmp esi, edi
sete al
mov dword [ebp - 0xc], eax
jmp 0x1e00c6ba
mov esi, 0xb7
push dword [ebp + 0xc]
call fcn.1e0258d3
cmp dword [ebp - 0xc], edi
jne 0x1e00c711
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1e00c711
call fcn.1e025550
push dword [ebp - 4]
mov ebx, eax
call fcn.1e0257d9
push ebx
mov esi, eax
call fcn.1e025550
cmp esi, edi
je 0x1e00c6f8
push esi
call fcn.1e0258d3
push 0xb7
jmp 0x1e00c6c8
push dword [ebp - 4]
call fcn.1e00c478
cmp eax, edi
je 0x1e00c711
push eax
mov dword [ebp - 0xc], 1
call fcn.1e0258d3
call fcn.1e018062
push dword [ebp - 4]
call fcn.1e01bc81
push dword [ebp - 8]
mov dword [ebp - 4], edi
call fcn.1e01bc81
mov dword [ebp - 8], edi
call fcn.1e018085
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x1e00f873
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
mov ebx, 0x10000000
cmp dword [ebp + 8], ebx
push esi
push edi
jne 0x1e00f90f
push 0x104
lea eax, [ebp - 0x238]
push eax
call sym.MIGISM.dll_IsmGetTempFile
xor edi, edi
push edi
lea eax, [ebp - 0x238]
push eax
call fcn.1e01800d
push eax
mov dword [0x1e02eb5c], eax
call fcn.1e01795f
cmp eax, edi
mov dword [0x1e02eb58], eax
je 0x1e00f9c6
push 8
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], 0xf062298f
mov dword [ebp - 4], 0x10000
call fcn.1e017a50
test eax, eax
je 0x1e00f9d1
push edi
push 0x1e001d94
call sym.MIGISM.dll_TrackedIsmCreateObjectHandle
mov esi, eax
xor eax, eax
cmp dword [ebp + 0xc], edi
sete al
push eax
push dword [0x1e02eb5c]
push esi
call fcn.1e00cce4
push esi
jmp 0x1e00f9c1
xor edi, edi
push edi
push 0x1e001d94
call sym.MIGISM.dll_TrackedIsmCreateObjectHandle
push edi
push 2
lea ecx, [ebp - 0x30]
push ecx
push eax
mov esi, 0x1e001904
push esi
mov dword [ebp + 8], eax
call sym.MIGISM.dll_IsmGetObjectTypeId
or eax, ebx
push eax
call sym.MIGISM.dll_IsmAcquireObjectEx
test eax, eax
je 0x1e00f97d
push 0x1e001ad8
push 0x104
lea eax, [ebp - 0x238]
push eax
call fcn.1e0177ed
push edi
lea eax, [ebp - 0x238]
push eax
call fcn.1e01800d
push edi
push eax
push dword [ebp - 0x28]
mov dword [0x1e02eb5c], eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1e00f9b5
push dword [0x1e02eb5c]
jmp 0x1e00f9ab
push edi
push 2
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
push esi
call sym.MIGISM.dll_IsmGetObjectTypeId
or eax, 0x20000000
push eax
call sym.MIGISM.dll_IsmAcquireObjectEx
test eax, eax
je 0x1e00f9be
push edi
push dword [ebp - 0x28]
call fcn.1e01800d
mov dword [0x1e02eb5c], eax
push eax
call fcn.1e017913
mov dword [0x1e02eb58], eax
lea eax, [ebp - 0x30]
push eax
call sym.MIGISM.dll_IsmReleaseObject
push dword [ebp + 8]
call sym.MIGISM.dll_IsmDestroyObjectHandle
xor eax, eax
cmp dword [0x1e02eb58], edi
setne al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1e017526
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1e017555
cmp dword [ebp + 8], edi
jne 0x1e017540
xor eax, eax
jmp 0x1e0175ac
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x1e0175ac
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push 1
call ebx
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x1e017583
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1e017597
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x50
pop ecx
lea esi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push dword [ebp + 0xc]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
pop edi
leave
ret 8

Function at 0x1e0175b1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1e0175e0
cmp dword [ebp + 8], edi
jne 0x1e0175cb
xor eax, eax
jmp 0x1e017639
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x1e017639
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push 1
call ebx
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x1e01760e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1e017624
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, 0x94
lea esi, [ebp - 0x250]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push dword [ebp + 0xc]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
pop edi
leave
ret 8

Function at 0x1e01763e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x1e01765d
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1e01765d
test al, 0x10
je 0x1e01765d
xor eax, eax
inc eax
jmp 0x1e01765f
xor eax, eax
ret 4

Function at 0x1e017662
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x1e017681
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1e017681
test al, 0x10
je 0x1e017681
xor eax, eax
inc eax
jmp 0x1e017683
xor eax, eax
ret 4
Function at 0x1e017a7b
Capabilities:
Create directory

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
push dword [esp + 0x18]
call fcn.1e01800d
mov esi, eax
mov ax, word [esi + 2]
cmp ax, 0x3a
push 0x5c
pop ebx
jne 0x1e017aa6
cmp word [esi + 4], bx
jne 0x1e017aa6
push ebx
lea eax, [esi + 6]
push eax
jmp 0x1e017ad9
cmp word [esi], bx
jne 0x1e017ad7
cmp ax, bx
jne 0x1e017ad7
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
lea eax, [esi + 4]
push ebx
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1e017b23
add eax, 2
push ebx
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x1e017b23
push ebx
add eax, 2
push eax
jmp 0x1e017adf
push ebx
push esi
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
call edi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x1e017b23
and word [ebx], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
jne 0x1e017b0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1e017b40
inc ebp
mov word [ebx], 0x5c
push 0x5c
add ebx, 2
push ebx
call edi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x1e017ae9
test ebp, ebp
je 0x1e017b40
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
jne 0x1e017b40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1e017b40
inc ebp
push esi
push 0
call fcn.1e018041
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x1e01f754
Capabilities:
Delete file

Disassembly:
movzx eax, byte [esp + 4]
dec eax
push esi
push edi
je 0x1e01f77e
dec eax
jne 0x1e01f7b4
push dword [0x1e02b344]
mov edi, 0x1e02f1e8
push edi
mov esi, 0x1e02f1e0
call fcn.1e01a329
push 0x1e0028ec
jmp 0x1e01f799
push dword [0x1e02b344]
mov edi, 0x1e02f308
push edi
mov esi, 0x1e02f300
call fcn.1e01a329
push 0x1e0028e0
push edi
call fcn.1e017ea0
push eax
call fcn.1e01a329
push 1
lea edi, [esi + 8]
push edi
call fcn.1e01f538
test eax, eax
jne 0x1e01f7bb
xor eax, eax
jmp 0x1e01f864
push ebx
xor ebx, ebx
push edi
mov dword [esi + 4], ebx
mov dword [esi + 0x10c], ebx
call fcn.1e017939
cmp eax, ebx
mov dword [esi], eax
je 0x1e01f861
push 0x10000
push dword [esp + 0x14]
call fcn.1e01f632
test eax, eax
je 0x1e01f852
mov eax, dword [esi + 0x10c]
cmp eax, ebx
je 0x1e01f852
mov dword [eax + 4], ebx
mov eax, dword [esi + 0x10c]
or ebx, 0xffffffff
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x10c]
mov dword [eax + 0xc], ebx
mov eax, dword [esi + 0x10c]
mov dword [eax + 0x10], ebx
mov eax, dword [esi + 0x10c]
mov dword [eax + 0x14], ebx
mov eax, dword [esi + 0x10c]
mov dword [eax + 0x18], ebx
call fcn.1e0224b7
mov ecx, dword [esi + 0x10c]
mov dword [ecx + 0x20], eax
mov edi, dword [esi + 0x10c]
xor eax, eax
add edi, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x10c]
mov dword [eax + 0x38], ebx
xor eax, eax
inc eax
jmp 0x1e01f863
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop ebx
pop edi
pop esi
ret 4
Function at 0x1e01f869
Capabilities:
Delete file

Disassembly:
push ebx
movzx ebx, byte [esp + 8]
mov eax, ebx
dec eax
push edi
je 0x1e01f87f
dec eax
jne 0x1e01f8d4
mov edi, 0x1e02f1e0
jmp 0x1e01f884
mov edi, 0x1e02f300
push esi
lea esi, [edi + 0x10c]
mov eax, dword [esi]
test eax, eax
je 0x1e01f8a4
push dword [eax + 0x20]
call fcn.1e0221b2
mov eax, dword [esi]
add eax, 0x24
push eax
call fcn.1e01b2eb
push edi
call fcn.1e01f511
mov eax, dword [edi]
test eax, eax
pop esi
je 0x1e01f8bb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [edi], 0
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x44
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
mov eax, ebx
dec eax
je 0x1e01f8ea
dec eax
je 0x1e01f8d8
xor eax, eax
jmp 0x1e01f917
mov eax, dword [0x1e02f40c]
test eax, eax
je 0x1e01f901
mov byte [0x1e02b340], 1
jmp 0x1e01f909
cmp dword [0x1e02f40c], 0
je 0x1e01f901
mov eax, dword [0x1e02f2ec]
mov byte [0x1e02b340], 2
jmp 0x1e01f909
xor eax, eax
and byte [0x1e02b340], al
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x1e02b33c], eax
mov eax, ecx
pop edi
pop ebx
ret 4

Function at 0x1e01f91c
Capabilities:
Get common file path

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
push esi
push edi
mov dword [0x1e02b33c], ebx
mov byte [0x1e02b340], bl
push ebx
je 0x1e01f97c
push dword [esp + 0x14]
call fcn.1e01a679
mov dword [0x1e02b344], eax
push 0x44
pop ecx
xor esi, esi
xor eax, eax
inc esi
mov edi, 0x1e02f300
push esi
rep stosd dword es:[edi], eax
call fcn.1e01f754
test eax, eax
je 0x1e01f978
push 0x44
pop ecx
xor eax, eax
mov edi, 0x1e02f1e0
push 2
rep stosd dword es:[edi], eax
call fcn.1e01f754
test eax, eax
push esi
jne 0x1e01f9b5
call fcn.1e01f869
xor eax, eax
jmp 0x1e01f9c0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x1e01f978
lea eax, [esi + 1]
push eax
call fcn.1e017fc8
push eax
push esi
mov dword [0x1e02b344], eax
call edi
test eax, eax
jne 0x1e01f942
push dword [0x1e02b344]
push ebx
call fcn.1e018041
mov dword [0x1e02b344], ebx
jmp 0x1e01f978
mov dword [0x1e02b338], esi
call fcn.1e01f4aa
pop edi
pop esi
pop ebx
ret 4