joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101820b0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 8], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0xc]
push ecx
push 0
lea edx, [ebp - 0x24]
push edx
push 0x101894e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101821ba
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x24], 0
je 0x10182109
push 0xffffffffffffffff
push 1
lea eax, [ebp - 4]
push eax
call sym.ruby.dll_rb_w32_wait_events_blocking
add esp, 0xc
test eax, eax
je 0x1018214c
mov dword [ebp - 8], 1
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x1018214c
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x101821af
push 0x1c
push 0
lea eax, [ebp - 0x40]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea ecx, [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10182190
jmp 0x101821a1
push 0x8000
push 0
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 4
jmp 0x101821ba
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
xor edx, edx
jne 0x101820bd
cmp dword [ebp - 4], 0
jne 0x101821d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.failed_to_launch_waiter_thread:_ld
call sym.ruby.dll_rb_fatal
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x101825a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x101825c2
xor eax, eax
jmp 0x10182701
cmp dword [0x1026ce64], 0
je 0x101825e5
mov ecx, dword [0x1026ce64]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [0x1026ce64], 0
cmp dword [0x1026ce60], 0
je 0x10182605
mov edx, dword [0x1026ce60]
push edx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov dword [0x1026ce60], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1018262a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
xor eax, eax
jmp 0x10182701
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 1
jmp 0x1018264d
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*2 + 2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
test edx, edx
je 0x1018266d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x14], edx
jmp 0x10182639
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.10184fb0
add esp, 0x10
mov dword [0x1026ce64], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [0x1026ce64], 0
jne 0x1018269f
xor eax, eax
jmp 0x10182701
mov ecx, dword [0x1026ce64]
mov dword [ebp - 4], ecx
jmp 0x101826c0
mov edx, dword [ebp - 4]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 1]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x101826ff
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x101826fd
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
movsx eax, byte [edx]
cmp eax, 0x3d
jne 0x101826fd
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 1]
jmp 0x10182701
jmp 0x101826aa
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10182e60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push esi
cmp dword [ebp + 8], 0
jne 0x10182e86
cmp dword [ebp + 0xc], 0
jne 0x10182e86
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0xe
xor eax, eax
jmp 0x10182ff4
call fcn.101847d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10182ea7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0xb
xor eax, eax
jmp 0x10182ff4
cmp dword [ebp + 0x10], 0
jne 0x10182ec8
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x14]
mov dword [ebp + 0x10], eax
push 0x44
push 0
lea ecx, [ebp - 0x68]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 0x100
cmp dword [ebp + 0x14], 0
je 0x10182f04
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
jmp 0x10182f0f
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x30], eax
cmp dword [ebp + 0x18], 0
je 0x10182f1d
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], ecx
jmp 0x10182f28
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x2c], eax
cmp dword [ebp + 0x1c], 0
je 0x10182f36
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x28], edx
jmp 0x10182f41
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
or eax, 0x20
mov dword [ebp + 0x20], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x7fff
jle 0x10182f75
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 7
xor eax, eax
jmp 0x10182ff4
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x68]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
xor eax, eax
jne 0x10182f75
cmp dword [ebp - 8], 0
jne 0x10182fd6
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
xor eax, eax
jmp 0x10182ff4
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10183ac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.GetSystemWindowsDirectoryW
push 0x10253bf8
call fcn.10183a50
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10183aee
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x10183afc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x10184350
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10254be4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 2
mov word [ebp - 0x198], ax
lea ecx, [ebp - 0x194]
push ecx
movzx edx, word [ebp - 0x198]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10184392
push str.Unable_to_locate_winsock_library__n
call sym.ruby.dll_rb_fatal
movzx eax, word [ebp - 0x194]
and eax, 0xff
movzx ecx, al
cmp ecx, 2
je 0x101843b0
push str.could_not_find_version_2_of_winsock_dll_n
call sym.ruby.dll_rb_fatal
push 0x1026ce3c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1026ce54], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101949b1
mov esp, ebp
pop ebp
ret

Function at 0x101844d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x10184110
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
add esp, 4
push 0x10184120
call fcn.1019551d
add esp, 4
call fcn.10184550
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10184502
mov eax, dword [ebp - 4]
jmp 0x10184548
call fcn.101835e0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sym.ruby.dll_rb_w32_cmdvector
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__tzset]
call fcn.10183c10
call fcn.10183f00
call fcn.10183f30
push 0x10184280
call fcn.1019519d
add esp, 4
call fcn.10184350
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10187360
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x101873a8
cmp dword [ebp + 0x18], 0
je 0x1018739c
mov eax, dword [ebp + 0x18]
imul ecx, dword [eax], 0x3e8
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 4]
cdq
mov esi, 0x3e8
idiv esi
add ecx, eax
push ecx
call sym.ruby.dll_rb_w32_sleep
add esp, 4
jmp 0x101873a6
push 0xffffffffffffffff
call sym.ruby.dll_rb_w32_sleep
add esp, 4
jmp 0x10187413
cmp dword [0x1026ce54], 0
jne 0x101873b6
call fcn.10184350
push 0x1026ce3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 4], eax
push 0x1026ce3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 4], 0xffffffff
jne 0x1018740f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
mov dword [ebp - 4], 0xffffffff
xor edx, edx
jne 0x101873b6
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10188530
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10184410
add esp, 8
mov edx, dword [ebp - 4]
sar edx, 4
and edx, 0xffff
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
and eax, 0xffff
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
and ecx, 1
je 0x10188589
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 8], 1
jmp 0x10188599
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0x8004667e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x101885d5
mov eax, dword [ebp - 0xc]
shl eax, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
or eax, ecx
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.101843e0
add esp, 8
jmp 0x101885ee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
xor eax, eax
jne 0x10188599
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x101889d0
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10188a1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
or eax, 0xffffffff
jmp 0x10188a8c
cmp dword [ebp - 4], 0xffffffff
je 0x10188a3b
mov edx, dword [ebp - 4]
and edx, 1
je 0x10188a3b
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 3
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10188a56
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp - 8], 0
je 0x10188a77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
jmp 0x10188a85
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
jne 0x10188a1c
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10188e10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x10254be4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10253ec8
mov eax, dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_wcsstr
add esp, 8
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
jne 0x10188e4b
xor eax, eax
jmp 0x10188f86
push 0x10253ed0
mov ecx, dword [ebp - 0x460]
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsspn]
add esp, 8
mov edx, dword [ebp - 0x460]
lea eax, [edx + eax*2]
mov dword [ebp - 0x464], eax
mov ecx, dword [ebp - 0x460]
cmp ecx, dword [ebp + 8]
je 0x10188e96
mov edx, dword [ebp - 0x460]
movzx eax, word [edx - 2]
push eax
push 0x10253ed4
call sub.VCRUNTIME140.dll_wcschr
add esp, 8
test eax, eax
je 0x10188ed2
mov ecx, dword [ebp - 0x464]
movzx edx, word [ecx]
test edx, edx
je 0x10188ebe
mov eax, dword [ebp - 0x464]
movzx ecx, word [eax]
push ecx
push 0x10253edc
call sub.VCRUNTIME140.dll_wcschr
add esp, 8
test eax, eax
je 0x10188ed2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 2
or eax, 0xffffffff
jmp 0x10188f86
lea edx, [ebp - 0x46c]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x10188f11
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
or eax, 0xffffffff
jmp 0x10188f86
mov edx, 2
shl edx, 0
movzx eax, word [ebp + edx - 0x20c]
cmp eax, 0x3a
jne 0x10188f50
mov ecx, 2
imul edx, ecx, 3
movzx eax, word [ebp + edx - 0x20c]
test eax, eax
jne 0x10188f50
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x10188f50
xor eax, eax
jmp 0x10188f86
lea edx, [ebp - 0x45c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.101866e0
add esp, 8
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0xffffffff
jne 0x10188f77
or eax, 0xffffffff
jmp 0x10188f86
mov ecx, dword [ebp - 0x468]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101949b1
mov esp, ebp
pop ebp
ret
Function at 0x10189530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x1018955f
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x1018955f
mov edx, dword [ebp + 8]
push edx
call fcn.10188e10
add esp, 4
test eax, eax
je 0x10189563
xor eax, eax
jmp 0x10189574
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x15
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1018a350
Capabilities:
Check if file exists
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10254be4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x48], 0
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.101832c0
add esp, 8
test eax, eax
je 0x1018a384
or eax, 0xffffffff
jmp 0x1018a4c3
cmp dword [ebp + 0xc], 0
je 0x1018a3d1
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.1018a2f0
add esp, 0xc
test eax, eax
je 0x1018a3ac
or eax, 0xffffffff
jmp 0x1018a4c3
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ecx + 8]
push eax
call fcn.1018a2f0
add esp, 0xc
test eax, eax
je 0x1018a3cf
or eax, 0xffffffff
jmp 0x1018a4c3
jmp 0x1018a3e7
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
je 0x1018a413
mov edx, dword [ebp - 0x40]
and edx, 1
je 0x1018a413
mov eax, dword [ebp - 0x40]
and eax, 0xfffffffe
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x2000000
push 3
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffff
jne 0x1018a45a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
mov dword [ebp - 0x48], 0xffffffff
jmp 0x1018a49c
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x50]
push ecx
push 0
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x1018a492
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
mov dword [ebp - 0x48], 0xffffffff
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x40], 0xffffffff
je 0x1018a4b8
mov ecx, dword [ebp - 0x40]
and ecx, 1
je 0x1018a4b8
mov edx, dword [ebp - 0x40]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ecx, ecx
jne 0x1018a3e7
mov eax, dword [ebp - 0x48]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101949b1
mov esp, ebp
pop ebp
ret
Function at 0x1018a4e0
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xffffffff
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1018a517
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
jmp 0x1018a544
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wchmod]
add esp, 8
cmp eax, 0xffffffff
jne 0x1018a539
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1018a544
mov dword [ebp - 4], 0
xor ecx, ecx
jne 0x1018a4ec
xor edx, edx
jne 0x1018a4ec
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1018a550
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x1018a58a
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x1018a58a
mov edx, dword [ebp - 4]
and edx, 0xfffffffe
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1018a5d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp - 4], 0xffffffff
je 0x1018a5d4
mov edx, dword [ebp - 4]
and edx, 1
je 0x1018a5d4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
jne 0x1018a55e
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1018a5e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x1018a61a
mov ecx, dword [ebp - 4]
and ecx, 1
je 0x1018a61a
mov edx, dword [ebp - 4]
and edx, 0xfffffffe
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1018a664
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sym.ruby.dll_rb_w32_map_errno
add esp, 4
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], esi
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp - 4], 0xffffffff
je 0x1018a664
mov edx, dword [ebp - 4]
and edx, 1
je 0x1018a664
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
jne 0x1018a5ee
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x101923b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 1
push 0xfde9
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.101939c0
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x101923f1
mov ecx, dword [ebp - 0xc]
and ecx, 0x10
je 0x101923fa
mov dword [ebp - 8], 0
jmp 0x10192432
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x1019242b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10192432
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
push ecx
call sym.ruby.dll_ruby_xfree
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret