joyce8/EMBER2024-capa huggingface dataset:
Function at 0x590598
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5905d0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00593b82
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00593b5a
jmp 0x5905dc
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x59228d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5922cf
call fcn.005aa82c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5922cf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5922c6
xor eax, eax
jmp 0x5922d7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005922dd
pop edi
pop esi
pop ebx
ret 4

Function at 0x5ab33d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.005aa82c
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x5ab37a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5ab37a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x5ab37e
xor eax, eax
jmp 0x5ab3fc
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.0058ecf8
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x5ab3b6
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x5ab3a0
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.005ab4ed
push ebx
mov edi, eax
call fcn.0058ed21
test edi, edi
pop ecx
je 0x5ab3f8
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.005ab2b6
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.005ab401
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x1000f270
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x11c]
cmp dword [esi], 0xffffffff
jne 0x1000f357
xor eax, eax
mov dword [esi], 0
mov word [edi], ax
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
jl 0x1000f2c9
mov eax, 0xfffffc0d
jmp 0x1000f359
lea eax, [esp + 8]
push eax
push 0
push 0x10001f18
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x1000f2e7
mov eax, 0xffffec54
jmp 0x1000f359
lea ecx, [esp + 8]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000f2f0
push 0x104
sub ecx, edx
push edi
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push 0x42
push edi
call fcn.10027770
test eax, eax
je 0x1000f357
cmp eax, 0xfffffffc
jne 0x1000f349
push esi
push 0x42
push edi
call fcn.10027590
test eax, eax
jne 0x1000f349
push dword [esi]
call fcn.10027520
test eax, eax
jne 0x1000f349
push esi
push 0x42
push edi
call fcn.10027770
test eax, eax
je 0x1000f357
cdq
xor eax, edx
sub eax, edx
mov eax, dword [eax*4 + 0x10001edc]
jmp 0x1000f359
xor eax, eax
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x10c
ret 8
Function at 0x10018ca0
Capabilities:
Delete file

Disassembly:
jmp 0x10028310
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x10028352
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027ec0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100283a0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100283a0
cmp dword [esp + 4], 0xffffffff
je 0x100283a0
push eax
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4

Function at 0x10018cb0
Capabilities:
Move file

Disassembly:
jmp 0x100288a0
sub esp, 0x42c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x438]
je 0x100288ec
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.1004486e
add esp, 0x42c
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x220]
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 0
call fcn.10027ec0
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027ec0
push dword [esp + 8]
push dword [esp + 0x220]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x10028965
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10028965
cmp dword [esp + 4], 0xffffffff
je 0x10028965
push eax
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x220]
mov dword [esp + 8], 0
cmp ecx, eax
je 0x1002899b
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1002899b
cmp dword [esp + 0x218], 0xffffffff
je 0x1002899b
push ecx
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x42c
ret 8
Function at 0x10028150
Capabilities:
Create directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x224]
je 0x1002819c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027ec0
cmp dword [esp + 0x214], 0x104
jl 0x100281d4
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x100281e1
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x10028206
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10028206
cmp dword [esp + 4], 0xffffffff
je 0x10028206
push edx
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 8

Function at 0x10028310
Capabilities:
Delete file

Disassembly:
jmp 0x10028310
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x10028352
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027ec0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100283a0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100283a0
cmp dword [esp + 4], 0xffffffff
je 0x100283a0
push eax
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4

Function at 0x10028580
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x100285ca
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1004486e
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10027cb0
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 4]
mov esi, eax
call fcn.10027e50
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1002861c
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1002861c
cmp dword [esp + 4], 0xffffffff
je 0x1002861c
push edx
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x21c
ret 8
Function at 0x10028640
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x10028682
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027ec0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x100286d0
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x100286d0
cmp dword [esp + 4], 0xffffffff
je 0x100286d0
push eax
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4

Function at 0x100286f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x218], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x224]
je 0x1002873a
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1004486e
add esp, 0x21c
ret 8
push esi
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10027cb0
mov eax, dword [esp + 0x218]
push dword [esp + 8]
add eax, eax
shr eax, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 4]
call fcn.10027e50
mov esi, eax
test esi, esi
jle 0x1002876c
dec esi
lea ecx, [esp + 4]
call fcn.10027e50
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x1002879a
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x1002879a
cmp dword [esp + 4], 0xffffffff
je 0x1002879a
push eax
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x21c
ret 8
Function at 0x100288a0
Capabilities:
Move file

Disassembly:
jmp 0x100288a0
sub esp, 0x42c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x430]
push esi
mov esi, dword [esp + 0x438]
je 0x100288ec
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop esi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.1004486e
add esp, 0x42c
ret 8
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x220]
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], 0
call fcn.10027ec0
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027ec0
push dword [esp + 8]
push dword [esp + 0x220]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov esi, eax
lea ecx, [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, ecx
je 0x10028965
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x10028965
cmp dword [esp + 4], 0xffffffff
je 0x10028965
push eax
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0x220]
mov dword [esp + 8], 0
cmp ecx, eax
je 0x1002899b
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x1002899b
cmp dword [esp + 0x218], 0xffffffff
je 0x1002899b
push ecx
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x42c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x42c
ret 8
Function at 0x10028b50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x450]
mov ecx, dword [esp + 0x454]
mov edx, dword [esp + 0x448]
push ebx
mov ebx, dword [esp + 0x448]
push ebp
mov ebp, dword [esp + 0x454]
push esi
mov esi, dword [esp + 0x464]
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
je 0x10028bb6
push esi
push ecx
push eax
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
jmp 0x10028d4f
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x240]
mov dword [esp + 0x240], 0
mov dword [esp + 0x244], 0
call fcn.10027ec0
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push ebp
push dword [esp + 0x24c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x10028d21
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10028d06
cmp eax, 2
jbe 0x10028c88
cmp eax, 7
jne 0x10028d06
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.10027cb0
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x10028c75
lea ecx, [esp + 0x20]
call fcn.10027d30
jmp 0x10028d21
cmp dword [esp + 0x24], 0
je 0x10028cf6
push ecx
lea ecx, [esp + 0x24]
call fcn.10027df0
jmp 0x10028cf0
mov eax, dword [esi]
lea ecx, [esp + 0x20]
shr eax, 1
push eax
push dword [esp + 0x1c]
call fcn.10027cb0
mov eax, dword [esp + 0x234]
add eax, eax
shr eax, 1
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x28]
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov ecx, dword [esp + 0x10]
mov edi, eax
lea eax, [ecx + ecx]
mov dword [esi], eax
test edi, edi
je 0x10028ce0
lea ecx, [esp + 0x20]
call fcn.10027d30
jmp 0x10028d21
cmp dword [esp + 0x24], 0
je 0x10028cf6
lea ecx, [esp + 0x20]
call fcn.10027e50
mov ecx, eax
mov dword [esp + 0x10], ecx
lea eax, [ecx + ecx]
lea ecx, [esp + 0x20]
mov dword [esi], eax
call fcn.10027d30
jmp 0x10028d21
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebp
push dword [esp + 0x24c]
push ebx
call eax
mov edi, eax
mov ecx, dword [esp + 0x23c]
lea eax, [esp + 0x240]
cmp ecx, eax
je 0x10028d4f
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10028d4f
cmp dword [esp + 0x238], 0xffffffff
je 0x10028d4f
push ecx
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x44c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004486e
add esp, 0x440
ret 0x18
Function at 0x10028d70
Capabilities:
Set registry value

Disassembly:
sub esp, 0x42c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x428], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x434]
push ebx
mov ebx, dword [esp + 0x434]
push ebp
mov ebp, dword [esp + 0x448]
push edi
mov edi, dword [esp + 0x450]
je 0x10028dc9
push edi
push ebp
push dword [esp + 0x450]
push dword [esp + 0x450]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10028eb9
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x22c]
mov dword [esp + 0x22c], 0
mov dword [esp + 0x230], 0
call fcn.10027ec0
mov esi, dword [esp + 0x44c]
cmp esi, 1
je 0x10028e21
cmp esi, 2
je 0x10028e21
cmp esi, 7
je 0x10028e21
push edi
push ebp
push esi
push dword [esp + 0x454]
push dword [esp + 0x238]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x10028e88
shr edi, 1
lea ecx, [esp + 0x10]
push edi
push ebp
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.10027ec0
mov eax, dword [esp + 0x220]
inc eax
push eax
push dword [esp + 0x18]
push esi
push dword [esp + 0x454]
push dword [esp + 0x238]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
mov esi, eax
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x10028e88
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10028e88
cmp dword [esp + 0x10], 0xffffffff
je 0x10028e88
push ecx
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0x22c]
cmp ecx, eax
je 0x10028eb6
mov eax, ecx
shr eax, 0x10
test eax, eax
je 0x10028eb6
cmp dword [esp + 0x224], 0xffffffff
je 0x10028eb6
push ecx
call fcn.100469d4
add esp, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x434]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004486e
add esp, 0x42c
ret 0x18

Function at 0x10028ee0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x10028f22
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027ec0
cmp dword [esp + 0x214], 0x104
jl 0x10028f5b
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x10028f67
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x10028f8c
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x10028f8c
cmp dword [esp + 4], 0xffffffff
je 0x10028f8c
push edx
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4
Function at 0x10028fb0
Capabilities:
Set current directory

Disassembly:
sub esp, 0x218
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x214], eax
cmp dword [0x1005b048], 0
mov eax, dword [esp + 0x21c]
je 0x10028ff2
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4
push esi
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.10027ec0
cmp dword [esp + 0x214], 0x104
jl 0x1002902b
push 0xa1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
jmp 0x10029037
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
cmp edx, eax
je 0x1002905c
mov ecx, edx
shr ecx, 0x10
test ecx, ecx
je 0x1002905c
cmp dword [esp + 4], 0xffffffff
je 0x1002905c
push edx
call fcn.100469d4
add esp, 4
mov ecx, dword [esp + 0x218]
mov eax, esi
pop esi
xor ecx, esp
call fcn.1004486e
add esp, 0x218
ret 4
Function at 0x1002aaf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
mov ebp, dword [esp + 0x8c]
push esi
mov esi, dword [esp + 0x8c]
push edi
xor edi, edi
test byte [esi + 0xe], 0x20
je 0x1002acb1
test byte [esi + 0x141], 4
je 0x1002acb1
push esi
call fcn.100395f0
test eax, eax
jne 0x1002acb9
push 0x78
lea eax, [esp + 0x14]
push eax
push edi
push dword [esi]
call fcn.10036ba0
mov ebx, eax
test ebx, ebx
je 0x1002ab72
push esi
call fcn.10038fd0
mov ecx, dword [esi + 0x7d]
mov eax, ebx
pop edi
pop esi
pop ebp
mov dword [ecx], 0x64b
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1004486e
add esp, 0x7c
ret 8
cmp byte [esi + 0xc], 5
jae 0x1002ab87
lea eax, [esp + 0x59]
push eax
call fcn.100345b0
mov dword [esi + 0x69], eax
jmp 0x1002abb7
lea eax, [esp + 0x84]
push eax
call fcn.100345b0
mov dword [esi + 0x69], eax
lea eax, [esp + 0x80]
push eax
call fcn.100345b0
mov dword [esi + 0x71], eax
lea eax, [esp + 0x59]
push eax
call fcn.100345b0
mov dword [esi + 0x16b], eax
mov eax, dword [esi + 0x69]
mov ebx, 1
cmp eax, dword [esi + 0x6d]
cmovne edi, ebx
cmp byte [esi + 0xc], 5
jb 0x1002abd3
mov eax, dword [esi + 0x71]
cmp eax, dword [esi + 0x75]
jne 0x1002abdb
test edi, edi
je 0x1002acb1
movzx eax, byte [esp + 0x3c]
mov byte [esi + 0x91], al
movzx eax, byte [esp + 0x3d]
mov byte [esi + 0x92], al
movzx eax, byte [esp + 0x3e]
mov byte [esi + 0x93], al
movzx eax, byte [esp + 0x3f]
mov byte [esi + 0x94], al
lea eax, [esp + 0x16]
push eax
call fcn.100345b0
mov dword [esi + 0xf], eax
mov dword [esi + 0x13], eax
lea eax, [esp + 0x1a]
push eax
call fcn.10034590
mov word [esi + 0x2b], ax
lea eax, [esp + 0x1c]
push eax
call fcn.10034590
mov word [esi + 0x2d], ax
lea eax, [esp + 0x1e]
push eax
call fcn.10034590
mov word [esi + 0x2f], ax
lea eax, [esp + 0x20]
push eax
call fcn.10034590
cmp word [esi + 0x2b], 0
mov word [esi + 0x31], ax
jne 0x1002ac5a
mov word [esi + 0x2b], bx
cmp word [esi + 0x2d], 0
jne 0x1002ac65
mov word [esi + 0x2d], bx
cmp word [esi + 0x2f], 0
jne 0x1002ac70
mov word [esi + 0x2f], bx
test ax, ax
jne 0x1002ac79
mov word [esi + 0x31], bx
cmp byte [esi + 0xc], 5
mov eax, dword [esi + 0x69]
mov dword [esi + 0x6d], eax
jb 0x1002ac8b
mov eax, dword [esi + 0x71]
mov dword [esi + 0x75], eax
push esi
call fcn.1002aa50
cmp dword [esi + 0x8d], 0
je 0x1002acb1
push esi
call fcn.10038fd0
push 0
push dword [esi + 0x8d]
call fcn.1003d790
test eax, eax
jne 0x1002acb9
mov eax, dword [esi + 0xf]
mov dword [ebp], eax
xor eax, eax
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004486e
add esp, 0x7c
ret 8
Function at 0x1002f030
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov eax, dword [0x10057bf0]
xor eax, esp
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [ecx]
cmp eax, dword [0x1005b150]
jne 0x1002f075
mov eax, dword [ecx + 4]
cmp eax, dword [0x1005b154]
jne 0x1002f075
mov dword [edx + 0x10], 1
fldz
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1004486e
add esp, 0x10
ret 8
mov dword [edx + 0x10], 0
mov al, byte [ecx]
mov dl, byte [ecx + 1]
mov ah, byte [ecx + 3]
mov dh, byte [ecx + 4]
mov byte [esp + 3], al
mov al, byte [ecx + 6]
push ebx
mov bl, byte [ecx + 2]
mov bh, byte [ecx + 5]
mov cl, byte [ecx + 7]
mov byte [esp + 6], al
mov byte [esp + 9], al
mov al, byte [esp + 7]
mov byte [esp + 0xe], dl
mov byte [esp + 0xd], bl
mov byte [esp + 0xc], ah
mov byte [esp + 0xb], dh
mov byte [esp + 0xa], bh
mov byte [esp + 8], cl
test al, al
jns 0x1002f0c4
and al, 0x7f
jmp 0x1002f0f4
not cl
not bh
mov byte [esp + 8], cl
not dh
mov cl, byte [esp + 6]
not ah
not cl
mov byte [esp + 0xa], bh
not bl
mov byte [esp + 9], cl
not dl
mov byte [esp + 0xb], dh
mov byte [esp + 0xc], ah
not al
mov byte [esp + 0xd], bl
mov byte [esp + 0xe], dl
mov ecx, dword [esp + 0x10]
pop ebx
mov byte [esp + 0xb], al
xor ecx, esp
fld qword [esp + 4]
call fcn.1004486e
add esp, 0x10
ret 8