joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000177c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 0x24]
lea eax, [ebp - 4]
push 4
push 1
push eax
call fcn.1002ee34
add esp, 0x10
cmp eax, 4
jne 0x100017e4
mov eax, dword [ebp - 4]
lea ecx, [eax - 1]
cmp ecx, 0x103
ja 0x100017e4
inc eax
push eax
call fcn.1002bb4d
mov ebx, eax
mov eax, dword [ebp - 4]
inc eax
push eax
push 0
push ebx
call fcn.1002eb70
push dword [esi + 0x24]
push dword [ebp - 4]
push 1
push ebx
call fcn.1002ee34
mov ecx, dword [ebp - 4]
add esp, 0x20
cmp eax, ecx
je 0x100017ed
push ebx
call fcn.1002a660
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
xor eax, eax
test ecx, ecx
jle 0x100017fb
not byte [eax + ebx]
inc eax
cmp eax, ecx
jl 0x100017f3
push ebx
call fcn.1002dd10
mov edi, dword [ebp + 8]
pop ecx
push eax
push ebx
mov ecx, edi
call fcn.100016a1
push ebx
call fcn.1002a660
push 0x14
lea ebx, [edi + 0x1c]
push 0
push ebx
call fcn.1002eb70
push dword [esi + 0x24]
push 0x14
push 1
push ebx
call fcn.1002ee34
add esp, 0x20
cmp eax, 0x14
jne 0x100017e4
xor eax, eax
not byte [ebx + eax]
inc eax
cmp eax, 0x14
jl 0x10001838
push dword [esi + 0x24]
xor ebx, ebx
push 4
inc ebx
lea eax, [edi + 0x30]
push ebx
push eax
call fcn.1002ee34
add esp, 0x10
cmp eax, 4
jne 0x100017e4
push dword [esi + 0x24]
push eax
lea eax, [edi + 0x34]
push ebx
push eax
call fcn.1002ee34
add esp, 0x10
cmp eax, 4
jne 0x100017e4
push dword [esi + 0x24]
lea eax, [edi + 0x38]
push ebx
push ebx
push eax
call fcn.1002ee34
add esp, 0x10
cmp eax, ebx
jne 0x100017e4
push dword [esi + 0x24]
add edi, 0x3c
push 4
push ebx
push edi
call fcn.1002ee34
add esp, 0x10
cmp eax, 4
sete al
jmp 0x100017e6
Function at 0x10001a26
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 0x24]
lea edi, [esi + 0x28]
push 2
push 1
push edi
call fcn.1002ee34
add esp, 0x10
cmp eax, 2
jne 0x10001b21
lea eax, [esi + 0x50]
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x10001a56
mov ecx, dword [eax]
jmp 0x10001a58
mov ecx, eax
movzx edi, byte [edi]
movsx ecx, byte [ecx]
cmp edi, ecx
jne 0x10001b21
cmp edx, 0x10
jb 0x10001a6d
mov eax, dword [eax]
movsx eax, byte [eax + 1]
movzx ecx, byte [esi + 0x29]
cmp ecx, eax
jne 0x10001b21
push dword [esi + 0x24]
lea eax, [esi + 0x2c]
push 4
pop ebx
push ebx
push 1
push eax
call fcn.1002ee34
add esp, 0x10
cmp eax, ebx
jne 0x10001b21
push dword [esi + 0x24]
lea edi, [esi + 0x30]
push 2
push 1
push edi
call fcn.1002ee34
add esp, 0x10
cmp eax, 2
jne 0x10001b21
cmp word [edi], 1
ja 0x10001b21
push dword [esi + 0x24]
lea eax, [esi + 0x32]
push 1
push 1
push eax
call fcn.1002ee34
xor edi, edi
inc edi
add esp, 0x10
cmp eax, edi
jne 0x10001b21
push dword [esi + 0x24]
lea eax, [esi + 0x34]
push ebx
push edi
push eax
call fcn.1002ee34
add esp, 0x10
cmp eax, ebx
jne 0x10001b21
push dword [esi + 0x24]
lea eax, [esi + 0x38]
push ebx
push edi
push eax
call fcn.1002ee34
add esp, 0x10
cmp eax, ebx
jne 0x10001b21
push dword [esi + 0x24]
lea eax, [esi + 0x3c]
push 0xf
push edi
push eax
call fcn.1002ee34
add esp, 0x10
cmp eax, 0xf
jne 0x10001b21
mov ecx, esi
call fcn.100018ab
test al, al
setne al
jmp 0x10001b23
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x10001b91
Capabilities:
Read file on windows

Disassembly:
push 0x5c
mov eax, 0x10042860
call fcn.1002eac6
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x50], bl
lea edx, [ebp - 0x50]
push edx
push eax
mov dword [ebp - 4], ebx
call fcn.100019ca
mov dword [esi], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x64], ebx
mov dword [edi], ebx
cmp dword [ebp - 0x20], ebx
je 0x10001c66
push dword [ebp - 0x20]
call fcn.1002bb4d
mov ecx, dword [ebp - 0x60]
push dword [ecx + 0x24]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x20]
push 1
push eax
call fcn.1002ee34
add esp, 0x14
mov dword [ebp - 0x68], eax
cmp eax, dword [ebp - 0x20]
je 0x10001c1d
push dword [ebp - 0x58]
call fcn.1002a660
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.100012ee
xor al, al
call fcn.1002eb49
ret 0xc
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x4c]
mov eax, dword [ecx]
lea edx, [ebp - 0x64]
push edx
lea edx, [ebp - 0x5c]
push edx
push dword [ebp - 0x68]
push dword [ebp - 0x58]
call dword [eax + 4]
push dword [ebp - 0x58]
test al, al
jne 0x10001c56
call fcn.1002a660
pop ecx
mov byte [ebp - 0x51], bl
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.100012ee
mov al, byte [ebp - 0x51]
jmp 0x10001c15
call fcn.1002a660
mov eax, dword [ebp - 0x5c]
mov dword [esi], eax
mov eax, dword [ebp - 0x64]
pop ecx
mov dword [edi], eax
mov byte [ebp - 0x51], 1
jmp 0x10001c46
Function at 0x10001efc
Capabilities:
Read file on windows

Disassembly:
push 0xac
mov eax, 0x1004296a
call fcn.1002eac6
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, ecx
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xb8], eax
call fcn.10011500
push 0x10047658
lea eax, [ebp - 0x64]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10001cc6
push dword [ebp - 0xb8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10001d34
add esp, 0x18
push ebx
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.100012ee
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0xac]
call fcn.100118a4
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], 4
jae 0x10001f81
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xac]
call fcn.10011661
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x10001f99
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0xac]
call fcn.10011c4b
test al, al
jne 0x10001fd8
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.100012ee
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.100012ee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.10011509
xor al, al
call fcn.1002eb49
ret 8
mov dword [ebp - 0x90], 0xf
mov dword [ebp - 0x94], ebx
mov byte [ebp - 0xa4], bl
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0xb8]
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.100019ca
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xb4], ebx
cmp dword [ebp - 0x74], ebx
je 0x10002075
push dword [ebp - 0x74]
call fcn.1002bb4d
push dword [esi + 0x24]
mov edi, eax
push dword [ebp - 0x74]
push 1
push edi
call fcn.1002ee34
add esp, 0x14
cmp eax, dword [ebp - 0x74]
je 0x10002051
push edi
call fcn.1002a660
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xa4]
call fcn.100012ee
jmp 0x10001fa9
mov ecx, dword [esi + 0x4c]
mov edx, dword [ecx]
lea esi, [ebp - 0xb4]
push esi
lea esi, [ebp - 0xb0]
push esi
push eax
push edi
call dword [edx + 4]
test al, al
je 0x10002037
cmp dword [ebp - 0xb0], ebx
jne 0x10002089
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xac]
call fcn.1001172e
jmp 0x10002111
push dword [ebp - 0xb4]
lea eax, [ebp - 0x2c]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xac]
push eax
call fcn.1001175e
push edi
test al, al
jne 0x100020ff
call fcn.1002a660
push dword [ebp - 0xb0]
call fcn.1002a660
pop ecx
pop ecx
mov byte [ebp - 0xa5], bl
push ebx
push 1
lea ecx, [ebp - 0xa4]
call fcn.100012ee
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.100012ee
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.100012ee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.10011509
mov al, byte [ebp - 0xa5]
jmp 0x10001fd0
call fcn.1002a660
push dword [ebp - 0xb0]
call fcn.1002a660
pop ecx
pop ecx
mov byte [ebp - 0xa5], 1
jmp 0x100020c1
Function at 0x10003cce
Capabilities:
Read file on windows

Disassembly:
push 0x7c
mov eax, 0x10042d62
call fcn.1002eac6
mov dword [ebp - 0x88], ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x84], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x80], ecx
jb 0x10003cfa
mov eax, dword [eax]
push 0x1004764c
push eax
call fcn.1002f013
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10003d14
xor al, al
jmp 0x10003ded
push esi
call fcn.1002f337
xor ebx, ebx
inc ebx
jmp 0x10003ddb
and dword [ebp - 0x78], 0
and dword [ebp - 0x7c], 0
push ebx
lea eax, [ebp - 0x78]
push 4
push eax
mov byte [ebp - 0x72], 0
mov byte [ebp - 0x71], 0
call fcn.1002ee34
push esi
push ebx
lea eax, [ebp - 0x71]
push ebx
push eax
call fcn.1002ee34
push esi
push ebx
lea eax, [ebp - 0x7c]
push 2
push eax
call fcn.1002ee34
push esi
push ebx
lea eax, [ebp - 0x72]
push ebx
push eax
call fcn.1002ee34
movzx eax, byte [ebp - 0x72]
add esp, 0x40
cmp dword [ebp - 0x78], 0
jle 0x10003dd5
cmp byte [ebp - 0x71], 0
je 0x10003d7b
cmp byte [ebp - 0x71], bl
jne 0x10003dd5
push dword [ebp - 0x80]
mov ecx, dword [ebp - 0x88]
push eax
movzx eax, word [ebp - 0x7c]
push eax
movzx eax, byte [ebp - 0x71]
push eax
push dword [ebp - 0x78]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10002a95
test al, al
je 0x10003dd5
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
call fcn.10003bf2
push eax
lea ecx, [ebp - 0x70]
call fcn.10002b43
mov ecx, dword [ebp - 0x84]
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call fcn.10003b87
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.100029d6
push esi
call fcn.1002f337
pop ecx
push esi
test eax, eax
je 0x10003d22
call fcn.1002e4de
pop ecx
mov al, bl
call fcn.1002eb49
ret 0x14

Function at 0x10004670
Capabilities:
Read file via mapping

Disassembly:
push 0x408
mov eax, 0x10046330
call fcn.1002eac6
lea ecx, [ebp - 0x414]
call fcn.1000ad27
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x40f]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x410], bl
call fcn.1002eb70
push 0x17
lea eax, [ebp - 0x410]
push 0x100476e8
push eax
call fcn.1002dda0
add esp, 0x18
push 0x10047700
push 0x17
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x414]
call fcn.1000ad37
mov eax, dword [0x1005b444]
cmp eax, ebx
jne 0x10004715
lea eax, [ebp - 0x410]
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [0x1005b444], eax
cmp eax, ebx
jne 0x10004715
lea eax, [ebp - 0x410]
push eax
push 0x1000
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x1005b444], eax
cmp dword [0x1005b448], ebx
jne 0x1000472e
push ebx
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x1005b448], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.1000ad30
call fcn.1002eb49
ret
Function at 0x1000ad37
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1000ad79
cmp byte [edi], 0
je 0x1000ad79
push ebx
push edi
call fcn.1002dd10
pop ecx
xor ecx, ecx
mov ebx, eax
cmp dword [ebp + 0xc], ecx
jle 0x1000ad74
push esi
mov eax, dword [ebp + 8]
lea esi, [ecx + eax]
mov eax, ecx
cdq
idiv ebx
mov al, byte [esi]
sub al, cl
xor al, byte [edx + edi]
inc ecx
mov byte [esi], al
cmp ecx, dword [ebp + 0xc]
jl 0x1000ad59
pop esi
mov al, 1
pop ebx
jmp 0x1000ad7b
xor al, al
pop edi
pop ebp
ret 0xc

Function at 0x1000ad80
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x58], eax
ret
Function at 0x1000c5b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp + 8], 0x100575fc
mov dword [ebp + 0xc], 0x10
mov ecx, dword [ebp + 8]
xor eax, dword [ecx]
push eax
mov dword [ebp - 4], eax
call fcn.1000c574
sub dword [ebp + 8], 4
xor eax, esi
dec dword [ebp + 0xc]
mov esi, dword [ebp - 4]
pop ecx
jne 0x1000c5d5
mov ecx, eax
mov eax, dword [0x100575bc]
xor eax, ecx
mov ecx, dword [0x100575b8]
xor ecx, esi
mov dword [edi], ecx
pop edi
pop esi
mov dword [ebx], eax
pop ebx
leave
ret
Function at 0x1000e239
Capabilities:
Download url
Receive data

Disassembly:
push 0x88
mov eax, 0x10043f53
call fcn.1002eac6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x74]
push 0x10047d14
push eax
call fcn.1002ff5d
add esp, 0xc
xor ebx, ebx
push 0xffffffffffffffff
push ebx
push 0x1009c234
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x7c], 0xf
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x90], bl
call fcn.10001608
mov esi, str._kehw
push esi
mov dword [ebp - 4], ebx
call fcn.1002dd10
pop ecx
push eax
push esi
lea ecx, [ebp - 0x90]
call fcn.1000156f
lea eax, [ebp - 0x74]
push eax
call fcn.1002dd10
pop ecx
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
call fcn.1000156f
cmp dword [0x1009c458], 0x10
mov ecx, dword [0x1009c444]
mov esi, 0x1009c444
jae 0x1000e2d1
mov ecx, esi
cmp dword [ebp - 0x7c], 0x10
mov eax, dword [ebp - 0x90]
jae 0x1000e2e3
lea eax, [ebp - 0x90]
push ebx
push ebx
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
je 0x1000e311
mov byte [ebp - 0x91], bl
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.100012ee
mov al, byte [ebp - 0x91]
call fcn.1002eb49
ret
push esi
mov ecx, 0x10057464
call fcn.1000a1b1
mov byte [ebp - 0x91], al
jmp 0x1000e2f7

Function at 0x1000e324
Capabilities:
Download url
Receive data

Disassembly:
push 0x84
mov eax, 0x10043f86
call fcn.1002eac6
xor ebx, ebx
mov edi, 0x1009c498
cmp dword [0x1009c260], ebx
je 0x1000e403
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x74]
push 0x10047d14
push eax
call fcn.1002ff5d
add esp, 0xc
push 0xffffffffffffffff
push ebx
push 0x1009c250
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x7c], 0xf
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x90], bl
call fcn.10001608
mov esi, str._kehw
push esi
mov dword [ebp - 4], ebx
call fcn.1002dd10
pop ecx
push eax
push esi
lea ecx, [ebp - 0x90]
call fcn.1000156f
lea eax, [ebp - 0x74]
push eax
call fcn.1002dd10
pop ecx
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
call fcn.1000156f
cmp dword [0x1009c4ac], 0x10
mov ecx, dword [0x1009c498]
jae 0x1000e3c8
mov ecx, edi
cmp dword [ebp - 0x7c], 0x10
mov eax, dword [ebp - 0x90]
jae 0x1000e3da
lea eax, [ebp - 0x90]
push ebx
push ebx
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
push ebx
lea ecx, [ebp - 0x90]
push 1
test eax, eax
je 0x1000e3fa
call fcn.100012ee
xor al, al
jmp 0x1000e40e
or dword [ebp - 4], 0xffffffff
call fcn.100012ee
push edi
mov ecx, 0x1005c0f0
call fcn.1001a485
call fcn.1002eb49
ret
Function at 0x1000f9e6
Capabilities:
Download url
Receive data

Disassembly:
push 0xd4
mov eax, 0x1004435e
call fcn.1002eac6
mov dword [ebp - 0xe0], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x74]
push 0x10047d14
push eax
call fcn.1002ff5d
add esp, 0xc
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov esi, 0x1009c288
push esi
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x7c], 0xf
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x90], bl
call fcn.10001608
mov edi, str._kehw
push edi
mov dword [ebp - 4], ebx
call fcn.1002dd10
pop ecx
push eax
push edi
lea ecx, [ebp - 0x90]
call fcn.1000156f
lea eax, [ebp - 0x74]
push eax
call fcn.1002dd10
pop ecx
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
call fcn.1000156f
cmp dword [0x1009c4c8], 0x10
mov ecx, dword [0x1009c4b4]
mov edi, 0x1009c4b4
jae 0x1000fa85
mov ecx, edi
cmp dword [ebp - 0x7c], 0x10
mov eax, dword [ebp - 0x90]
jae 0x1000fa97
lea eax, [ebp - 0x90]
push ebx
push ebx
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
je 0x1000fabb
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.100012ee
xor al, al
call fcn.1002eb49
ret
lea ecx, [ebp - 0xd8]
call fcn.10001039
push 2
push edi
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 1
call fcn.10002139
test al, al
jne 0x1000faec
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], bl
call fcn.100012c2
jmp 0x1000faa5
mov edi, 0x10047ba8
push edi
mov dword [ebp - 0xd0], ebx
call fcn.1002dd10
pop ecx
push eax
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.1000a10b
push 0x24
inc eax
push eax
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
call fcn.10002bcc
mov eax, dword [ebp - 0x9c]
add eax, 0xfffffffe
push eax
push ebx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 2
call fcn.10002bcc
push eax
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 3
call fcn.10001979
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 2
call fcn.100012ee
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xdc], ebx
call fcn.10001db7
test al, al
jne 0x1000fbb8
push dword [ebp - 0xd0]
call fcn.1002e59e
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.100012ee
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], bl
call fcn.100012c2
push ebx
push esi
jmp 0x1000faa8
push dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xe0]
push dword [ebp - 0xd0]
call fcn.1000e4ab
test al, al
jne 0x1000fc18
mov byte [ebp - 0xc9], bl
push dword [ebp - 0xd0]
call fcn.1002e59e
pop ecx
push ebx
push esi
lea ecx, [ebp - 0xac]
call fcn.100012ee
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], bl
call fcn.100012c2
push ebx
push esi
lea ecx, [ebp - 0x90]
call fcn.100012ee
mov al, byte [ebp - 0xc9]
jmp 0x1000fab5
mov byte [ebp - 0xc9], 1
jmp 0x1000fbd9
Function at 0x100105bb
Capabilities:
Create directory

Disassembly:
push 0x18
mov eax, 0x100438b6
call fcn.1002eac6
xor ebx, ebx
mov edi, ecx
cmp byte [0x1009c4f0], bl
jne 0x100105da
push 2
jmp 0x100106ba
cmp dword [0x1009c420], 0x10
mov eax, dword [0x1009c40c]
jae 0x100105ed
mov eax, 0x1009c40c
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push eax
call esi
cmp dword [0x1009c43c], 0x10
mov eax, dword [0x1009c428]
jae 0x1001060a
mov eax, 0x1009c428
push ebx
push eax
call esi
push ebx
push ebx
push ebx
mov ecx, edi
call fcn.1000fc21
test al, al
jne 0x10010624
inc dword [0x1009c184]
jmp 0x100105d3
mov ecx, edi
call fcn.1000f9e6
test al, al
je 0x1001061c
mov ecx, edi
call fcn.1000e239
test al, al
je 0x1001061c
mov ecx, edi
call fcn.1000e324
test al, al
je 0x1001061c
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.1002eb70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x24]
call fcn.10027b2b
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.10027baf
mov edi, 0x1009c138
push eax
mov ecx, edi
call fcn.1001b82b
mov esi, 0x1005b47c
mov ecx, esi
call fcn.10006f57
push 0x1009c47c
mov ecx, edi
call fcn.1001b919
push 0x1009c460
mov ecx, esi
call fcn.10007523
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
mov dword [0x1009c184], ebx
call fcn.10027b34
push 0xa
pop eax
call fcn.1002eb49
ret
Function at 0x1001152b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x1005a2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x24c], ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str..
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x248], eax
cmp eax, 0xffffffff
je 0x10011636
push 0x100476bc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1001161b
push 0x100482fc
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1001161b
push ebx
lea eax, [ebp - 0x104]
push eax
call edi
push 0x10047658
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call esi
test byte [ebp - 0x244], 0x10
lea eax, [ebp - 0x104]
je 0x10011602
mov ecx, dword [ebp - 0x24c]
push eax
call fcn.1001152b
jmp 0x1001161b
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10011591
push dword [ebp - 0x248]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
dec eax
neg eax
pop edi
sbb al, al
pop esi
xor ecx, ebp
inc al
pop ebx
call fcn.1002ea4e
leave
ret 4

Function at 0x1001175e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x1001176c
mov eax, dword [eax]
push esi
push 0x10048308
push eax
call fcn.1002f013
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10011784
xor al, al
jmp 0x100117a7
push edi
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.1002fd32
push esi
mov edi, eax
call fcn.1002e4de
add esp, 0x14
xor eax, eax
cmp edi, dword [ebp + 0x10]
pop edi
sete al
pop esi
pop ebp
ret 0xc
Function at 0x10011919
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1005a2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100586f8]
push ebx
xor ebx, ebx
cmp dword [0x1005870c], 0x10
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x110], ebx
mov byte [ebp - 0x108], bl
mov byte [ebp - 0x109], bl
jae 0x10011959
mov eax, 0x100586f8
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x100119ad
cmp dword [0x10058728], 0x10
mov eax, dword [0x10058714]
jae 0x10011979
mov eax, 0x10058714
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1001199e
lea ecx, [ebp - 0x108]
push ecx
push ebx
push ebx
push 0x23
push ebx
call eax
test eax, eax
js 0x1001199e
mov byte [ebp - 0x109], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x109], bl
jne 0x100119d5
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x100119d5
push str.All_UsersApplication_Data
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
mov ecx, edi
call fcn.10002b9d
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002ea4e
leave
ret 4

Function at 0x10011ad8
Capabilities:
Query environment variable

Disassembly:
push 0x12c
mov eax, 0x10044672
call fcn.1002eac6
mov dword [ebp - 0x134], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0xf
pop edi
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], bl
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x114], bl
call fcn.1002eb70
add esp, 0xc
push 0x104
lea eax, [ebp - 0x114]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10011b54
mov ecx, dword [ebp - 0x134]
push esi
call fcn.10011919
jmp 0x10011b8a
lea eax, [ebp - 0x114]
push eax
call fcn.1002dd10
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x130]
call fcn.100016a1
lea eax, [ebp - 0x130]
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.10001979
push ebx
push 1
lea ecx, [ebp - 0x130]
call fcn.100012ee
mov eax, esi
call fcn.1002eb49
ret 4