joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101186f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1011886d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1011884c
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x10118746
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call fcn.101970fe
mov esi, eax
add esp, 4
test esi, esi
je 0x1011886d
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x10118864
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10118864
mov edi, dword [esp + 0x20]
test edi, edi
je 0x10118864
push ebp
push edi
call fcn.101186f0
add esp, 8
test eax, eax
je 0x10118859
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x102ac3bc]
test eax, eax
je 0x101187f5
test ebp, ebp
je 0x101187f5
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x10118864
jmp 0x10118801
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x10118864
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x10118843
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x10118864
mov eax, dword [esp + 0x14]
jmp 0x1011879e
push esi
call fcn.10197127
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x10118864
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.10197127
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret

Function at 0x10118880
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
test esi, esi
je 0x101188e9
mov eax, dword [esp + 0xc]
test eax, eax
je 0x101188a9
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x101188e9
pop edi
mov eax, 1
pop esi
ret 4
push edi
push esi
call fcn.101186f0
add esp, 8
test eax, eax
je 0x101188e9
mov eax, dword [0x102ac3bc]
test eax, eax
je 0x101188d6
test edi, edi
je 0x101188d6
push 0
push edi
push 0
push esi
call eax
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x10118a60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push ebx
test edx, edx
push esi
mov ebx, ecx
je 0x10118a96
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
lea esi, [esp + 0xc]
or eax, 0x20019
push esi
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x10118a98
mov esi, dword [ebx]
test esi, esi
je 0x10118b23
mov edx, dword [esp + 0x10]
push edi
lea eax, [esp + 0x14]
xor edi, edi
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x10118ac8.2
mov eax, dword [esp + 0x18]
cmp eax, 4
ja case.0x10118ac8.2
jmp dword [eax*4 + 0x10118b2c]
mov edi, 1
jmp case.0x10118ac8.2
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 4
sete al
mov edi, eax
jmp case.0x10118ac8.2
mov eax, dword [esp + 0x10]
cmp eax, 1
je case.0x10118ac8.0
cmp eax, 2
je case.0x10118ac8.0
cmp eax, 6
je case.0x10118ac8.0
cmp eax, 7
je case.0x10118ac8.0
xor edi, edi
jmp case.0x10118ac8.2
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, 3
sete cl
mov edi, ecx
cmp esi, dword [ebx]
je 0x10118b1b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x1011ac60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x1011ad20
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.100e99f9
add esp, 8
test eax, eax
je 0x1011acaf
mov word [eax], 0
mov edi, dword [esp + 0x218]
test edi, edi
je 0x1011ad19
mov ebx, dword [esp + 0x21c]
test ebx, ebx
je 0x1011ad19
lea edx, [esp + 0xc]
test edx, edx
je 0x1011ad19
mov eax, dword [esp + 0x220]
mov esi, 0x7a
test eax, eax
je 0x1011acf6
push eax
lea eax, [esp + 0x10]
push eax
push 0x101ed298
push ebx
push edi
call fcn.100ea7cc
add esp, 0x14
xor esi, esi
jmp 0x1011ad28
lea ecx, [esp + 0xc]
push ecx
call fcn.100e9a88
add esp, 4
cmp ebx, eax
jbe 0x1011ad28
lea edx, [esp + 0xc]
push edx
push edi
call fcn.100e9a63
add esp, 8
xor esi, esi
jmp 0x1011ad28
mov esi, 0x57
jmp 0x1011ad28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
mov dword [0x102ac430], esi
je 0x1011ad39
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x208
ret
Function at 0x10120e80
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x10120ea1
push 0x57
mov dword [0x102ac430], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x10120ed2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10120ed2
test al, 0x10
jne 0x10120ed2
test al, 1
je 0x10120e9c
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x10120f40
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x10120f61
push 0x57
mov dword [0x102ac430], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x10120f92
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10120f92
test al, 0x10
jne 0x10120f92
test al, 1
je 0x10120f5c
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
Function at 0x10123050
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x1012306c
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.100ea840
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.100ea710
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x101230f0
cmp byte [esp + 0x10], 0x5c
jne 0x101230f0
cmp byte [esp + 0x11], 0x5c
jne 0x101230f0
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.100ea710
add esp, 8
test eax, eax
je 0x1012316e
inc eax
push 0x5c
push eax
call fcn.100ea710
add esp, 8
mov esi, eax
test esi, esi
je 0x1012316e
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x10123132
test bl, 1
je 0x10123121
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x101231a4
cmp ebx, 0xffffffff
je 0x1012313b
test edi, edi
jne 0x1012314a
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x101231a4
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.100ea710
mov esi, eax
add esp, 8
test esi, esi
jne 0x101230f4
test ebp, ebp
je 0x101231a4
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10123199
test al, 0x10
jne 0x101231a4
test al, 1
je 0x1012318c
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x101231a4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x101231c0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
test ebx, ebx
jne 0x101231dc
xor eax, eax
pop ebx
add esp, 0x410
ret
push ebp
push esi
push edi
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.100e9aa5
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.100ea69e
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.100e9a88
add esp, 0x18
cmp eax, 2
jbe 0x10123261
cmp word [esp + 0x10], di
jne 0x10123261
cmp word [esp + 0x12], di
jne 0x10123261
lea eax, [esp + 0x14]
push edi
push eax
call fcn.100ea69e
add esp, 8
test eax, eax
je 0x101232e9
add eax, 2
push edi
push eax
call fcn.100ea69e
add esp, 8
mov esi, eax
test esi, esi
je 0x101232e9
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x101232a9
test bl, 1
je 0x10123298
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x1012331f
cmp ebx, 0xffffffff
je 0x101232b2
test edi, edi
jne 0x101232c1
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x1012331f
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.100ea69e
mov esi, eax
add esp, 8
test esi, esi
jne 0x10123269
test ebp, ebp
je 0x1012331f
mov ebx, dword [esp + 0x424]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10123314
test al, 0x10
jne 0x1012331f
test al, 1
je 0x10123307
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x1012331f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x10123710
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
push ebp
push esi
test ebx, ebx
push edi
jne 0x10123744
push 0x57
mov dword [0x102ac430], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1012376b
test al, 0x10
jne 0x101238dd
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x101238dd
mov ecx, 0x103
lea edi, [esp + 0x12]
mov word [esp + 0x10], ax
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.100e9aa5
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.100ea69e
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.100e9a88
add esp, 0x18
cmp eax, 2
jbe 0x101237fa
cmp word [esp + 0x10], di
jne 0x101237fa
cmp word [esp + 0x12], di
jne 0x101237fa
lea eax, [esp + 0x14]
push edi
push eax
call fcn.100ea69e
add esp, 8
test eax, eax
je 0x10123882
add eax, 2
push edi
push eax
call fcn.100ea69e
add esp, 8
mov esi, eax
test esi, esi
je 0x10123882
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x10123842
test bl, 1
je 0x10123831
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x101238ba
cmp ebx, 0xffffffff
je 0x1012384b
test edi, edi
jne 0x1012385a
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x101238ba
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.100ea69e
mov esi, eax
add esp, 8
test esi, esi
jne 0x10123802
test ebp, ebp
je 0x101238ba
mov ebx, dword [esp + 0x424]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x101238ab
test al, 0x10
jne 0x101238b6
test al, 1
je 0x101238a0
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x101238ba
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
jne 0x101238dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x102ac430], eax
je 0x101238d0
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x410
ret
mov eax, dword [esp + 0x428]
test eax, eax
je 0x101238f0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x410
ret
Function at 0x10123d20
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x26c]
push ebp
mov ebp, dword [esp + 0x26c]
push esi
mov esi, dword [esp + 0x26c]
mov eax, 0x1f3
push ebx
sub eax, ebp
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10123d69
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x25c
ret
push edi
mov edi, 1
mov eax, dword [ebx]
test al, 0x10
mov dword [esp + 0x14], eax
je 0x10123ed9
cmp word [ebx + 0x2c], 0x2e
lea ecx, [ebx + 0x2c]
jne 0x10123da5
mov ax, word [ebx + 0x2e]
test ax, ax
je 0x10123ea9
cmp ax, 0x2e
jne 0x10123da5
cmp word [ebx + 0x30], 0
je 0x10123ea9
push ecx
call fcn.100e9a88
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add esp, 4
lea eax, [ebx + 1]
cmp ecx, eax
jb 0x10123ea2
mov ecx, dword [esp + 0x278]
mov word [esi + ebp*2 - 2], 0
lea eax, [ecx + 0x2c]
push eax
push esi
call fcn.100e9a39
mov al, byte [esp + 0x284]
add esp, 8
test al, 0x10
je 0x10123dfe
mov edx, dword [esp + 0x284]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
push esi
call dword [esp + 0x290]
mov edi, eax
test edi, edi
je 0x10123e65
test byte [esp + 0x27c], 0x40
jne 0x10123e65
lea ecx, [ebx + ebp]
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], 0
lea edx, [ebx + ebp + 1]
lea eax, [esi + ecx*2]
mov ecx, 0x93
mov word [eax - 2], 0x5c
mov word [eax], 0x2a
xor eax, eax
mov word [esi + edx*2], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x284]
mov ecx, dword [esp + 0x280]
push eax
mov eax, dword [esp + 0x280]
push ecx
lea ecx, [esp + 0x24]
push eax
push ecx
push edx
push esi
call fcn.10123d20
add esp, 0x18
mov edi, eax
test byte [esp + 0x27c], 0x20
je 0x10123e95
test edi, edi
je 0x10123e95
mov edx, dword [esp + 0x284]
mov eax, dword [esp + 0x14]
push edx
add ebx, ebp
push eax
push 0
push esi
mov word [esi + ebx*2 - 2], 0
call dword [esp + 0x290]
mov edi, eax
mov word [esi + ebp*2 - 2], 0x2a
mov word [esi + ebp*2], 0
mov ebx, dword [esp + 0x278]
test edi, edi
je 0x10123ec1
mov eax, dword [esp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10123d6f
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret
mov ecx, dword [esp + 0x284]
lea edx, [ebx + 0x2c]
push ecx
push eax
push edx
push esi
mov word [esi + ebp*2 - 4], 0
call dword [esp + 0x290]
mov word [esi + ebp*2 - 4], 0x5c
mov edi, eax
mov word [esi + ebp*2 - 2], 0x2a
jmp 0x10123ea9
Function at 0x10125960
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1012597f
push 0x57
mov dword [0x102ac430], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
push 0
push 0x101257d0
push 0x20
push esi
call fcn.10123c20
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test esi, esi
jne 0x101259c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x102ac430], eax
je 0x101259c5
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
ret

Function at 0x1012bce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1012bd2e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1012bd2e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x1012bd33
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x1012bd19
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x1012bd43
test esi, esi
jne 0x1012bd61
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x1012bd5f
mov byte [eax + esi - 1], 0
jne 0x1012bd68
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x10131450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x101314a0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x101314a0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x101314a5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1013148b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x101314b2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x1013bf00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101b4c0c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x1021a2a0]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [edi], eax
mov ecx, dword [0x1021a2a0]
lea ebp, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp], ecx
mov edx, dword [0x1021a2a0]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.10195a8b
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x101c91ac
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call fcn.10196bcc
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x1013bfa3
push eax
mov ecx, ebp
call fcn.10196bcc
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x1013bfc1
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.10196bcc
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x1013fa20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c91f8
push 0x100ea2dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x1013fab2
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x1013faab
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x1013faab
cmp word [eax + 0x14], dx
je 0x1013faab
cmp dword [ebp + 0xc], edx
je 0x1013fa85
cmp word [eax + 4], 0x14c
jne 0x1013faab
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1013fba0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x1013fbed
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1013fbed
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x1013fbed
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x1013fbe5
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x1013fbf4
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x1013fbd6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret