joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009db0
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push 1
push eax
mov dword [ebp - 8], 0x10023e8
call fcn.0100ad7e
mov esi, eax
test esi, esi
je 0x1009de8
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0100b07f
mov esi, eax
cmp dword [ebp - 4], 0
je 0x1009e00
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop esi
leave
ret 8
Function at 0x100a1d7
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
jne 0x100a24e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x100a239
cmp esi, 3
je 0x100a239
push esi
push ebx
call fcn.0100a1af
push esi
push ebx
push 0x1002a90
push 4
call fcn.0100a40e
add esp, 0x10
jmp 0x100a354
push ebx
push 0x1002a00
push 2
call fcn.0100a40e
add esp, 0xc
jmp 0x100a354
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x100a285
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.0100a1af
push dword [ebp - 4]
push ebx
push 0x1002998
push 4
call fcn.0100a40e
add esp, 0x10
jmp 0x100a348
cmp dword [ebp - 0xc], esi
je 0x100a2ac
push 0x57
pop eax
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.0100a1af
push ebx
push 0x1002968
push 4
call fcn.0100a40e
add esp, 0xc
jmp 0x100a348
push esi
push dword [ebp - 0x10]
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp edi, esi
jne 0x100a2e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.0100a1af
push dword [ebp - 4]
push ebx
push 0x1002908
push 4
call fcn.0100a40e
add esp, 0x10
jmp 0x100a33d
push dword [ebp - 0x10]
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, esi
jne 0x100a322
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.0100a1af
push dword [ebp - 4]
push ebx
push 0x10028b0
push 4
call fcn.0100a40e
add esp, 0x10
jmp 0x100a338
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
cmp dword [ebp - 8], esi
jne 0x100a35b
cmp edi, esi
je 0x100a348
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100a4b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x2c
push 0x100dfc0
call fcn.01004914
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
xor edi, edi
inc edi
or dword [ebp + 8], edi
mov dword [ebp - 0x3c], 0x10
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push 3
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_LdrFindResource_U]
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffffe
pop esi
mov dword [ebp - 4], esi
jmp 0x100a522
cmp dword [ebp - 0x1c], ebx
jl 0x100a5ac
mov dword [ebp - 4], edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_LdrAccessResource]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], esi
jmp 0x100a560
cmp dword [ebp - 0x1c], ebx
jl 0x100a5ac
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x5c
jb 0x100a599
push 0x1002b0c
mov eax, dword [ebp - 0x20]
add eax, 6
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100a599
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], esi
jmp 0x100a5ac
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
call fcn.01004959
ret 4
Function at 0x100a5bf
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], 2
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
je 0x100a5e1
xor ebx, ebx
jmp 0x100a6e1
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, esi
je 0x100a5da
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push ebx
push 8
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100a6b8
push eax
push ebx
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
mov ebx, eax
test ebx, ebx
je 0x100a6ba
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push 0x1002b94
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100a6b8
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x100a6b8
cmp dword [ebp - 0x10], ebx
je 0x100a6b8
push 0x208
push 8
call esi
push eax
call edi
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, ebx
je 0x100a6ba
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push 0x1002b48
push 0x104
push edi
call fcn.01004497
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100a6ba
cmp dword [ebp - 8], ebx
je 0x100a6ba
cmp dword [ebp - 0x14], ebx
je 0x100a6ba
push 0x1002b2c
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100a6ba
inc ebx
jmp 0x100a6ba
xor ebx, ebx
cmp dword [ebp + 0xc], 0
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x100a6d0
push dword [ebp + 0xc]
push 0
call esi
push eax
call edi
cmp dword [ebp - 0xc], 0
je 0x100a6e0
push dword [ebp - 0xc]
push 0
call esi
push eax
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x100a6ee
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
cmp ecx, eax
je 0x100a76e
push esi
mov esi, dword [ebp + 0xc]
cmp esi, eax
je 0x100a76d
cmp dword [ebp + 0x10], eax
je 0x100a76d
push ebx
push edi
lea ebx, [ecx + esi]
lea edi, [ecx + 0x10040]
cmp edi, ebx
jbe 0x100a71f
mov edi, ebx
mov esi, ecx
add ecx, 0x40
jmp 0x100a767
mov ecx, dword [ecx - 4]
mov edx, 0x5a4d
add ecx, esi
cmp word [esi], dx
jne 0x100a761
lea edx, [ecx + 0xf8]
cmp edx, ebx
jae 0x100a761
cmp dword [ecx], 0x4550
jne 0x100a761
mov edx, 0x14c
cmp word [ecx + 4], dx
jne 0x100a761
push esi
call fcn.0100a4b8
mov ecx, eax
or ecx, edx
mov dword [ebp - 4], edx
jne 0x100a76b
add esi, dword [ebp + 0x10]
lea ecx, [esi + 0x40]
cmp ecx, edi
jb 0x100a726
pop edi
pop ebx
pop esi
mov edx, dword [ebp - 4]
leave
ret 0xc
Function at 0x100b2d0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0x400
xor ebx, ebx
push 8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
jne 0x100b30a
mov dword [ebp - 8], 8
jmp 0x100b394
cmp dword [ebp + 0xc], ebx
jne 0x100b334
lea eax, [ebp - 4]
push eax
call fcn.0100b1cb
mov ebx, eax
test ebx, ebx
jne 0x100b329
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100b388
push dword [ebp - 4]
push dword [ebp - 4]
push dword [ebp - 4]
jmp 0x100b33c
mov eax, 0x1003068
push eax
push eax
push eax
push dword [ebp + 0x10]
push 0x200
push edi
call fcn.01004497
add esp, 0x18
push edi
push dword [ebp + 8]
call fcn.0100aeba
mov ebx, eax
test ebx, ebx
jne 0x100b388
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp eax, 2
je 0x100b388
push eax
push dword [ebp + 8]
call fcn.0100a1af
push dword [ebp - 8]
push dword [ebp + 8]
push 0x1002ff8
push 4
call fcn.0100a40e
add esp, 0x10
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], 0
je 0x100b3a3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
jne 0x100b3b0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x100b3fc
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100b494
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x100b494
cmp dword [ebp + 0x10], 0
je 0x100b494
push ebx
lea eax, [edi + edx]
lea ebx, [edi + 0x10040]
cmp ebx, eax
jbe 0x100b42f
mov ebx, eax
lea ecx, [edi + 0x40]
push esi
mov esi, edi
cmp ecx, ebx
jae 0x100b492
jmp 0x100b43e
mov edx, dword [ebp + 0xc]
mov ecx, dword [ecx - 4]
mov eax, 0x5a4d
add ecx, esi
cmp word [esi], ax
jne 0x100b488
lea eax, [ecx + 0xf8]
mov dword [ebp + 8], eax
lea eax, [edi + edx]
mov edx, dword [ebp + 8]
cmp edx, eax
jae 0x100b488
cmp dword [ecx], 0x4550
jne 0x100b488
mov eax, 0x14c
cmp word [ecx + 4], ax
jne 0x100b488
mov eax, edi
sub eax, esi
add eax, dword [ebp + 0xc]
push eax
push esi
call fcn.0100b3be
mov dword [ebp - 4], eax
test eax, eax
jne 0x100b492
add esi, dword [ebp + 0x10]
lea ecx, [esi + 0x40]
cmp ecx, ebx
jb 0x100b43b
pop esi
pop ebx
mov eax, dword [ebp - 4]
pop edi
leave
ret 0xc
Function at 0x100b9f2
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
xor edi, edi
push edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0100c144
mov ebx, eax
cmp ebx, edi
je 0x100bad3
push esi
push 0x2000
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x100ba9f
mov eax, dword [ebp + 0xc]
and al, 1
movsx eax, al
push edi
push 0x2200000
neg eax
push 3
sbb eax, eax
push edi
and eax, 0xfffffff9
add eax, 7
push eax
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100ba8e
push 0xd
push 1
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov byte [ebp + 0xb], 1
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
cmp eax, edi
jge 0x100ba7e
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 4], eax
jmp 0x100ba85
mov dword [ebp - 8], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100bac3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1003310
jmp 0x100baae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x1003288
push 0x3000000
push 0x100f6cc
mov dword [ebp - 4], eax
call fcn.0100b534
add esp, 0x14
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop ebx
leave
ret 8

Function at 0x100baea
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp eax, esi
je 0x100bb5b
xor ecx, ecx
cmp cx, word [eax]
je 0x100bb5b
push edi
push esi
push eax
call fcn.0100c144
mov edi, eax
cmp edi, esi
je 0x100bb56
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100bb24
test al, 0x10
je 0x100bb24
inc ebx
jmp 0x100bb3f
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x100bb37
mov esi, 0x10b
cmp esi, 2
jne 0x100bb3f
push 3
pop esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop edi
jmp 0x100bb65
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100bb70
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x100bc44
xor ecx, ecx
cmp cx, word [eax]
je 0x100bc44
push ebx
push eax
call fcn.0100c144
mov edi, eax
cmp edi, ebx
je 0x100bc4c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100bc2c
test eax, 0x800
je 0x100bc23
mov esi, 0x80
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x100bc2c
push ebx
push esi
push 3
push ebx
push 7
push 0xc0010000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100bc2c
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 2
lea eax, [ebp + 8]
push eax
push 0x9c040
push esi
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x100bc11
mov dword [ebp - 8], 1
jmp 0x100bc1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100bc35
mov dword [ebp - 8], 1
jmp 0x100bc35
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop esi
jmp 0x100bc4e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop ebx
leave
ret 4
Function at 0x100bc71
Capabilities:
Copy file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
test dword [ebp + 0x1c], 0xfffffff8
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
je 0x100bc9a
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100bdf8
xor eax, eax
inc eax
test dword [ebp + 0x1c], eax
je 0x100bca5
mov dword [ebp - 0x10], eax
push ebx
push dword [ebp + 8]
call fcn.0100c144
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x100bdf5
push esi
push edi
push ebx
push dword [ebp + 0xc]
call fcn.0100c144
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x100bdd0
mov dword [ebp - 0xc], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x100f6cc
push dword [ebp - 0x10]
and dword [ebp - 4], 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x100bd55
test dword [ebp + 0x1c], 2
je 0x100bd4f
call ebx
inc dword [ebp - 0xc]
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 0xc]
call fcn.0100b994
test eax, eax
je 0x100bd4f
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1003470
push 0x4000000
push edi
call fcn.0100b534
add esp, 0x1c
cmp dword [ebp - 4], 0
jbe 0x100bcdd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100bcdd
cmp dword [ebp - 8], 0
je 0x100bdce
test dword [ebp + 0x1c], 4
je 0x100bdce
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x100bdce
call ebx
mov dword [ebp + 0x1c], 0x1f
test eax, eax
je 0x100bd83
mov dword [ebp + 0x1c], eax
push dword [ebp + 0x1c]
mov esi, 0x2000000
push dword [ebp + 0xc]
push 0x10033d0
push esi
push edi
call fcn.0100b534
add esp, 0x14
push dword [ebp + 0xc]
call fcn.0100bc59
test eax, eax
jne 0x100bdc5
call ebx
test eax, eax
jne 0x100bdb2
push 0x1f
pop eax
push eax
push dword [ebp + 0xc]
push 0x1003370
push esi
push edi
call fcn.0100b534
add esp, 0x14
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
cmp dword [ebp - 0x14], ebx
je 0x100bdf3
push dword [ebp - 0x14]
push ebx
call esi
push eax
call edi
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
leave
ret 0x18
Function at 0x100be02
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x100beba
cmp dword [ebp + 0xc], ebx
je 0x100beba
push esi
push edi
push ebx
push dword [ebp + 8]
call fcn.0100c144
mov esi, eax
mov dword [ebp + 8], esi
cmp esi, ebx
je 0x100be7a
push ebx
push dword [ebp + 0xc]
call fcn.0100c144
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x100be7a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100be5c
push dword [ebp - 4]
call fcn.0100bc59
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 2
push eax
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
push esi
call fcn.0100bc71
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp esi, ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp + 0xc], eax
je 0x100be9c
push dword [ebp + 8]
push ebx
call edi
push eax
call esi
cmp dword [ebp - 4], ebx
je 0x100beaa
push dword [ebp - 4]
push ebx
call edi
push eax
call esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
jmp 0x100bec4
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
leave
ret 0x14
Function at 0x100c346
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x100c4da
xor eax, eax
cmp ax, word [esi]
je 0x100c4da
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.0100c144
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x100c4c3
push edi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
call fcn.0100c126
cmp eax, ebx
jl 0x100c457
cmp dword [ebp - 0x1c], 1
jne 0x100c422
mov eax, dword [ebp - 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100c3bc
mov ecx, dword [ebp - 0x14]
sub eax, edx
sar eax, 1
lea esi, [ecx + eax*2]
cmp dword [ebp - 0xc], ebx
je 0x100c3e6
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov esi, eax
pop ecx
push dword [ebp - 8]
cmp esi, ebx
je 0x100c497
xor eax, eax
mov word [esi], ax
call fcn.0100baea
test eax, eax
jne 0x100c418
push ebx
push dword [ebp - 8]
call edi
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
jmp 0x100c3ec
mov esi, dword [ebp - 0x14]
movzx eax, word [esi]
cmp ax, 0x61
jb 0x100c434
cmp ax, 0x7a
jbe 0x100c440
cmp ax, 0x41
jb 0x100c3e6
cmp ax, 0x5a
ja 0x100c3e6
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x100c3e6
push 0x5c
pop eax
cmp ax, word [esi + 4]
jne 0x100c3e6
add esi, 8
jmp 0x100c3e6
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1003728
push 0x3000000
push 0x100f6cc
mov dword [ebp - 0x10], eax
call fcn.0100b534
add esp, 0x14
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
jmp 0x100c4cc
call fcn.0100baea
xor esi, esi
inc esi
cmp eax, esi
je 0x100c4be
push ebx
push dword [ebp - 8]
call edi
cmp eax, esi
je 0x100c4be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x20]
push 0x10036c8
jmp 0x100c46e
mov dword [ebp - 0x18], esi
jmp 0x100c483
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x18]
jmp 0x100c4e4
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010042c5
leave
ret 4
Function at 0x100ca44
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push edi
push 0x62
call esi
mov ebx, eax
cmp ebx, 0xc0000023
je 0x100ca74
cmp ebx, edi
jl 0x100cae8
mov ebx, 0xc0000001
jmp 0x100cae8
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x100ca97
mov ebx, 0xc000009a
jmp 0x100cacf
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 0x62
call esi
mov ebx, eax
test ebx, ebx
jl 0x100cacf
movzx eax, word [edi]
mov ecx, dword [ebp + 0x10]
add eax, 2
mov dword [ecx], eax
cmp eax, dword [ebp + 0xc]
jbe 0x100cac0
mov ebx, 0xc0000023
jmp 0x100cacf
push eax
push dword [edi + 4]
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x100cae8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc