joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002def0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10160fd0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
lea ecx, [ebp - 0x18]
push ecx
push esi
mov dword [ebp - 0x18], ebx
call edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
push ecx
push edi
call edx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
lea ecx, [ebp - 0x14]
push ecx
push esi
call edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ecx
push edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
lea ecx, [ebp - 0x10]
push ecx
push esi
call edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push ecx
push edi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
lea ecx, [ebp - 0x10]
push ecx
push esi
call edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [edi]
mov edx, dword [eax + 0x20]
push ecx
push edi
call edx
mov eax, esi
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
call fcn.1002e400
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
lea ecx, [ebp - 0x10]
push ecx
push esi
call edx
mov byte [ebp - 4], 1
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, edi
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
call fcn.1002e400
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x1c]
mov edx, dword [esi]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + 0x30]
push eax
push esi
call ecx
mov byte [ebp - 4], 1
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x1002dfee
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x1002e004
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002e5c0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [edi + 8]
test esi, esi
je 0x1002e60a
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1002e5de
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x1002e5f0
mov eax, dword [esi]
push eax
call ebx
mov esi, dword [edi + 8]
test esi, esi
je 0x1002e5fc
call fcn.1002e860
mov ecx, dword [edi + 4]
push ecx
mov dword [edi + 8], 0
call ebx
pop ebx
mov eax, dword [edi + 4]
pop esi
test eax, eax
je 0x1002e628
lea edx, [eax - 0xc]
test edx, edx
je 0x1002e628
add eax, 0xfffffff4
dec dword [eax]
jne 0x1002e628
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
pop ecx
ret
Function at 0x1002e630
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016293c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
cmp dword [ebx + 0xc], edi
jne 0x1002e74a
mov esi, dword [ebx + 8]
cmp esi, edi
je 0x1002e69f
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1002e681
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x1002e690
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebx + 8]
cmp esi, edi
je 0x1002e69c
call fcn.1002e860
mov dword [ebx + 8], edi
push 0x10
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x1002e6d3
push edi
mov edi, dword [ebx + 4]
call fcn.100164f0
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
jmp 0x1002e6d5
xor esi, esi
push 2
mov dword [ebp - 4], 0xffffffff
push 1
mov dword [ebx + 8], esi
mov bl, byte [ebx + 0x10]
push 0xc0000000
call fcn.10023350
mov edx, dword [ebp + 8]
test al, al
jne 0x1002e717
mov eax, dword [edx + 8]
mov eax, dword [eax + 8]
test eax, eax
jle 0x1002e70b
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [edx]
cmp ecx, 4
je 0x1002e717
cmp ecx, 1
jne 0x1002e74f
mov ecx, dword [edx]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.1002ec80
test al, al
jne 0x1002e747
mov edi, dword [ebp + 8]
call fcn.1002e810
mov eax, 0x8004022d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 8]
inc dword [ebx + 0xc]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1002e770
Capabilities:
Delete file

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi + 0xc]
test eax, eax
jg 0x1002e781
mov eax, 0x80040218
pop edi
ret
dec eax
mov dword [edi + 0xc], eax
jne 0x1002e7a8
mov eax, dword [edi + 8]
test eax, eax
je 0x1002e7a8
cmp dword [eax + 4], 0xffffffff
setne al
test al, al
je 0x1002e7a8
call fcn.1002e810
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop edi
ret

Function at 0x1002e7b0
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, dword [edi + 8]
test esi, esi
je 0x1002e7f3
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1002e7d5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x1002e7e0
mov eax, dword [esi]
push eax
call ebx
mov esi, dword [edi + 8]
test esi, esi
je 0x1002e7ec
call fcn.1002e860
mov dword [edi + 8], 0
mov ecx, dword [edi + 4]
push ecx
call ebx
pop esi
mov dword [edi + 0xc], 0
xor eax, eax
pop ebx
ret
Function at 0x1002e810
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [edi + 8]
test esi, esi
je 0x1002e850
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1002e82e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x1002e83d
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [edi + 8]
test esi, esi
je 0x1002e849
call fcn.1002e860
mov dword [edi + 8], 0
pop esi
ret

Function at 0x1002e860
Capabilities:
Delete file

Disassembly:
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1002e876
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x1002e885
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi]
test eax, eax
je 0x1002e8a3
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x1002e8a3
add eax, 0xfffffff4
dec dword [eax]
jne 0x1002e8a3
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
ret

Function at 0x1002eb70
Capabilities:
Delete file

Disassembly:
push edi
cmp ecx, 1
jne 0x1002ebab
lea edi, [eax + 0x60]
mov eax, dword [edi + 0xc]
test eax, eax
jle 0x1002eba7
dec eax
mov dword [edi + 0xc], eax
jne 0x1002eba7
mov eax, dword [edi + 8]
test eax, eax
je 0x1002eba7
cmp dword [eax + 4], 0xffffffff
setne al
test al, al
je 0x1002eba7
call fcn.1002e810
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
pop edi
ret
cmp ecx, 2
jne 0x1002ebc6
lea ecx, [eax + 0x60]
push eax
push ecx
call fcn.1002e630
xor ecx, ecx
test eax, eax
setns cl
dec ecx
and eax, ecx
pop edi
ret
mov eax, 0x80040218
pop edi
ret

Function at 0x1002ebd0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi + 0x1c], 0
jg 0x1002ebe2
mov eax, 0x80040218
pop ebp
ret 4
mov eax, dword [esi + 0x1c]
push edi
lea edi, [esi + 0x10]
test eax, eax
jle 0x1002ec41
dec eax
mov dword [edi + 0xc], eax
jne 0x1002ec14
mov eax, dword [edi + 8]
test eax, eax
je 0x1002ec14
cmp dword [eax + 4], 0xffffffff
setne al
test al, al
je 0x1002ec14
call fcn.1002e810
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 8], 2
jne 0x1002ec26
lea eax, [esi + 0x60]
call fcn.1002e770
test eax, eax
js 0x1002ec3c
cmp dword [esi + 0x1c], 0
jg 0x1002ec3a
cmp dword [esi + 0x6c], 0
jle 0x1002ec3a
lea edi, [esi + 0x60]
call fcn.1002e7b0
xor eax, eax
pop edi
pop ebp
ret 4
mov eax, 0x80040218
pop edi
pop ebp
ret 4

Function at 0x1002ec50
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0xc], 0
jg 0x1002ec7a
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1002ec7a
mov esi, dword [esi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1002ec7a
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x10030080
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164c4c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push eax
lea ecx, [esi + 0xc]
mov dword [esi], vtable.Catalog.0
mov dword [esi + 8], ebx
call fcn.10017430
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov ecx, dword [0x10196680]
mov dword [esi + 0x18], ecx
mov edx, dword [0x10196684]
mov dword [esi + 0x1c], edx
mov eax, dword [0x10196688]
mov dword [esi + 0x20], eax
mov ecx, dword [0x1019668c]
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ebx
xor ecx, ecx
mov eax, 0x11
mov dword [esi + 0x2c], eax
mov edx, 4
mul edx
seto cl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
neg ecx
or ecx, eax
push ecx
call fcn.101484dd
push 0x44
push ebx
push eax
mov dword [esi + 0x34], eax
call sub.MSVCR100.dll_memset
mov byte [ebp - 4], 1
xor ecx, ecx
mov eax, 0x11
mov dword [esi + 0x38], eax
mov edx, 4
mul edx
seto cl
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
neg ecx
or ecx, eax
push ecx
call fcn.101484dd
push 0x44
push ebx
push eax
mov dword [esi + 0x40], eax
call sub.MSVCR100.dll_memset
push 0x190
lea eax, [esi + 0x48]
push 0xffffffffffffffff
push eax
mov dword [esi + 0x44], ebx
mov byte [esi + 0x1d8], bl
call sub.MSVCR100.dll_memset
add esp, 0x2c
mov byte [ebp - 4], 3
mov edx, dword [esi + 0xc]
lea ebx, [esi + 0x1e0]
call fcn.100243b0
mov ecx, dword [0x10196680]
mov dword [esi + 0x218], ecx
mov edx, dword [0x10196684]
mov dword [esi + 0x21c], edx
mov eax, dword [0x10196688]
mov dword [esi + 0x220], eax
mov ecx, dword [0x1019668c]
mov dword [esi + 0x224], ecx
mov byte [esi + 0x228], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10030220
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164bfb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.Catalog.0
push edi
mov dword [ebp - 4], 4
call fcn.10031780
mov esi, dword [edi + 0x14]
test esi, esi
je 0x10030274
call fcn.10034a80
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea eax, [edi + 0x1e0]
push eax
mov byte [ebp - 4], 3
call fcn.100244a0
mov esi, dword [edi + 0x44]
test esi, esi
je 0x100302c3
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100302a1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x100302b0
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [edi + 0x44]
test esi, esi
je 0x100302bc
call fcn.1002e860
mov dword [edi + 0x44], 0
lea ebx, [edi + 0x38]
call fcn.10036850
mov edx, dword [ebx + 8]
mov esi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
push edx
call esi
add esp, 4
lea ebx, [edi + 0x2c]
call fcn.10036850
mov eax, dword [ebx + 8]
push eax
call esi
mov edi, dword [edi + 0xc]
add esp, 4
test edi, edi
je 0x10030307
lea ecx, [edi - 0xc]
test ecx, ecx
je 0x10030307
dec dword [edi - 0xc]
lea eax, [edi - 0xc]
jne 0x10030307
push eax
call esi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031780
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10164ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push ebx
push ebx
lea esi, [esp + 0x20]
mov dword [esp + 0x20], ebx
call fcn.100163a0
mov edi, dword [ebp + 8]
add edi, 0x2c
mov dword [esp + 0x30], ebx
mov ecx, dword [edi]
xor eax, eax
cmp ecx, ebx
jle 0x100317e5
mov esi, dword [edi + 8]
mov edx, esi
cmp dword [edx], ebx
jne 0x1003186b
inc eax
add edx, 4
cmp eax, ecx
jl 0x100317d5
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x1c], 0xffffffff
jne 0x100317ff
cmp dword [esp + 0x20], 0
je 0x1003187b
lea eax, [esp + 0x18]
push eax
push edi
lea ebx, [esp + 0x1c]
lea esi, [esp + 0x24]
mov dword [esp + 0x20], 0
call fcn.100364f0
mov esi, dword [esp + 0x18]
test esi, esi
je 0x10031840
mov ecx, dword [esi]
test ecx, ecx
je 0x10031836
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi], 0
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
cmp dword [esp + 0x14], 0
je 0x100317f1
mov eax, dword [0x1044ebf8]
test eax, eax
je 0x100317f1
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x100317f1
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
jmp 0x100317f1
mov ecx, dword [esi + eax*4]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jmp 0x100317f1
mov ebx, edi
call fcn.10036850
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x44]
xor edi, edi
cmp esi, edi
je 0x100318c5
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100318a4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x100318b3
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x44]
cmp esi, edi
je 0x100318c2
call fcn.1002e860
mov dword [ebx + 0x44], edi
push 4
push str._gdb
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov eax, dword [ebp + 8]
add eax, 0x1e0
mov byte [esp + 0x30], 1
cmp byte [eax + 0x31], 0
je 0x1003190b
lea ecx, [esp + 0x18]
push ecx
push eax
mov ecx, ebx
mov dword [esp + 0x20], edi
call fcn.10024840
test eax, eax
je 0x1003190b
mov esi, dword [esp + 0x18]
push 1
call fcn.1002ebd0
cmp ebx, edi
je 0x10031916
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x10031936
lea edx, [eax - 0xc]
test edx, edx
je 0x10031936
add eax, 0xfffffff4
dec dword [eax]
jne 0x10031936
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10031980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10166e58
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
push str._gdb
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
add eax, 0x1e0
cmp byte [eax + 0x31], bl
jne 0x100319d0
xor edi, edi
jmp 0x100319f9
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x14], ebx
call fcn.10024840
test eax, eax
jne 0x100319ea
mov edi, 0x80040218
jmp 0x100319f9
mov eax, dword [ebp - 0x14]
mov ecx, 2
call fcn.1002eb70
mov edi, eax
cmp edi, ebx
setl bl
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10031a10
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test bl, bl
je 0x10031a2a
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
push ebx
call fcn.10031780
mov eax, dword [ebx + 0xc]
lea esi, [ebx + 0xc]
push eax
call fcn.10023900
add esp, 4
test al, al
je 0x10031a5c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
lea ecx, [ebp - 0x10]
call fcn.10017430
push 0
mov edi, 0x10414568
lea eax, [ebp + 8]
mov dword [ebp - 4], 2
call fcn.100164f0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 4]
movzx eax, word [eax + ecx*2 - 2]
cmp eax, 0x5c
je 0x10031aa2
cmp eax, 0x2f
je 0x10031aa2
lea edx, [ebp - 0x10]
push edx
mov eax, 0x10197e18
call fcn.10016730
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.10016730
mov byte [ebp - 4], 2
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
test esi, esi
je 0x10031ad3
lea ecx, [esi - 0xc]
test ecx, ecx
je 0x10031ad3
dec dword [esi - 0xc]
lea eax, [esi - 0xc]
jne 0x10031ad3
push eax
call edi
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10031b16
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10031afd
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x10031afd
add eax, 0xfffffff4
dec dword [eax]
jne 0x10031afd
push eax
call edi
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10031b3a
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x10031b3a
add eax, 0xfffffff4
dec dword [eax]
jne 0x10031b3a
push eax
call edi
add esp, 4
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10035450
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [edi]
test esi, esi
je 0x1003548d
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1003546d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
cmp byte [esi + 0xc], 0
je 0x1003547c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [edi]
test esi, esi
je 0x10035487
call fcn.1002e860
mov dword [edi], 0
xor eax, eax
pop esi
ret

Function at 0x100354e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi]
test esi, esi
je 0x100354f6
cmp dword [esi + 4], 0xffffffff
setne al
test al, al
jne 0x10035500
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x10035511
mov dword [esi + 8], 6
jmp 0x1003552d
xor edx, edx
push edx
push edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x19
mov dword [esi + 8], eax
mov esi, dword [edi]
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x1003555d
mov dword [esi + 8], 6
mov eax, dword [edi]
mov eax, dword [eax + 8]
test eax, eax
jle 0x10035598
and eax, 0xffff
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
push ecx
push 0x190
lea edx, [edi + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10035580
mov dword [esi + 8], 0xfffffffe
jmp 0x10035545
mov dword [esi + 8], 0
mov eax, dword [ebp - 4]
sub eax, 0x190
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100355a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [edi]
test esi, esi
je 0x100355b6
cmp dword [esi + 4], 0xffffffff
setne al
test al, al
jne 0x100355c0
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x100355d1
mov dword [esi + 8], 6
jmp 0x100355ed
xor edx, edx
push edx
push edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x19
mov dword [esi + 8], eax
mov esi, dword [edi]
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x1003561d
mov dword [esi + 8], 6
mov eax, dword [edi]
mov eax, dword [eax + 8]
test eax, eax
jle 0x10035658
and eax, 0xffff
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 4]
push ecx
push 0x190
lea edx, [edi + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10035640
mov dword [esi + 8], 0xfffffffd
jmp 0x10035605
mov dword [esi + 8], 0
mov eax, dword [ebp - 4]
sub eax, 0x190
neg eax
sbb eax, eax
and eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret