joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b7db
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
mov ebx, ecx
lea ecx, [ebp - 8]
push esi
push edi
push str.Users
lea edi, [ebx + 4]
mov edx, edi
call fcn.1001087d
pop ecx
lea ecx, [ebp - 0x264]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 8]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.100110af
cmp esi, 0xffffffff
je 0x1000b8e8
test byte [ebp - 0x264], 0x10
je 0x1000b8d2
lea ecx, [ebp - 0x238]
call fcn.1001144c
test al, al
jne 0x1000b8d2
test dword [ebp - 0x264], 0x400
je 0x1000b859
test dword [ebp - 0x240], 0x20000000
jne 0x1000b8d2
push str.Default
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x1000b8d2
push str.NTUSER.DAT
lea eax, [ebp - 0x238]
mov edx, edi
push eax
push str.Users_
lea ecx, [ebp - 0x14]
call fcn.1001087d
pop ecx
mov edx, eax
lea ecx, [ebp - 0x10]
call fcn.1001087d
pop ecx
mov edx, eax
lea ecx, [ebp - 0xc]
call fcn.1001087d
pop ecx
mov ecx, dword [eax]
call fcn.10011f76
mov ecx, dword [ebp - 0xc]
mov edi, eax
add ecx, 0xfffffff0
call fcn.100110af
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.100110af
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.100110af
test edi, edi
jne 0x1000b912
lea edi, [ebx + 4]
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000b821
push dword [ebp + 8]
push dword [ebx + 0x3c]
call dword [ebx + 0x40]
mov edi, eax
cmp esi, 0xffffffff
je 0x1000b909
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x1000b909
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [eax], 1
jmp 0x1000b8f3
Function at 0x1000bfad
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x38]
cmp dword [eax], 0
mov dword [ebp - 8], eax
jne 0x1000c0b9
mov edx, str.AppxAllUserStore.dll
call fcn.100057ee
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x1000c06a
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DoesPerUserStoreExist
push edi
call ebx
mov dword [esi + 0x40], eax
test eax, eax
je 0x1000c06a
push str.GetAllStagedPackagesForMainPackageFromRegistryStore
push edi
call ebx
mov dword [esi + 0x44], eax
test eax, eax
je 0x1000c06a
push str.PackageIdBasicFromFullName
push edi
call ebx
mov dword [esi + 0x48], eax
test eax, eax
je 0x1000c06a
push str.GetAllNonInboxPackagesFromRegistryStore
push edi
call ebx
mov dword [esi + 0x4c], eax
test eax, eax
je 0x1000c06a
push str.DeleteAllPackagesFromPackageArray
push edi
call ebx
mov dword [esi + 0x50], eax
test eax, eax
je 0x1000c06a
push str.RemovePackageFromRegistryStore
push edi
call ebx
mov dword [esi + 0x54], eax
test eax, eax
je 0x1000c06a
push str.PackageFamilyNameFromId
push edi
call ebx
mov dword [esi + 0x58], eax
test eax, eax
je 0x1000c06a
push str.RemoveStagedPackageFromRegistryStore
push edi
call ebx
mov dword [esi + 0x5c], eax
test eax, eax
je 0x1000c06a
push str.GetAppxProvisionFactory
push edi
call ebx
mov dword [esi + 0x60], eax
test eax, eax
jne 0x1000c073
call fcn.100113e7
mov esi, eax
jmp 0x1000c095
mov ecx, dword [esi + 0x18]
lea eax, [esi + 0x3c]
push eax
push 0x2001f
push str.SOFTWARE
mov edx, dword [ecx]
push 0x80000002
push ecx
call dword [edx + 0xc]
mov esi, eax
test esi, esi
je 0x1000c0a1
lea ecx, [ebp - 4]
call fcn.10010922
mov eax, esi
jmp 0x1000c0bb
mov esi, dword [ebp - 8]
mov ecx, esi
and dword [ebp - 4], 0
call fcn.10010922
lea ecx, [ebp - 4]
mov dword [esi], edi
call fcn.10010922
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000d943
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
push 0x2a
lea edx, [ebp + 8]
mov dword [ebp - 4], edi
lea ecx, [ebp - 8]
call fcn.1000a853
pop ecx
lea ecx, [ebp - 0x260]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 8]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.100110af
cmp esi, 0xffffffff
jne 0x1000d98e
call fcn.100113e7
mov edi, eax
jmp 0x1000da0c
test byte [ebp - 0x260], 0x10
je 0x1000d9f8
lea ecx, [ebp - 0x234]
call fcn.1001144c
test al, al
jne 0x1000d9f8
lea eax, [ebp - 0x468]
mov edx, ecx
push eax
mov ecx, edi
call fcn.1000d8d5
mov edi, eax
test edi, edi
jne 0x1000da36
push ebx
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1000d9f5
lea eax, [ebp - 0x234]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.1001087d
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.1000a7db
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.100110af
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000d98e
xor edi, edi
cmp esi, 0xffffffff
je 0x1000da22
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x1000da22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.100110af
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
jle 0x1000da0c
movzx edi, di
or edi, 0x80070000
jmp 0x1000da0c
Function at 0x1000dc50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
push 0x10019494
lea edx, [ebp + 8]
lea ecx, [ebp - 8]
call fcn.1001087d
pop ecx
lea ecx, [ebp - 0x26c]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 8]
mov edi, eax
add ecx, 0xfffffff0
call fcn.100110af
cmp edi, 0xffffffff
je 0x1000ddaf
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, 0x2a69c000
test byte [ebp - 0x26c], 0x10
je 0x1000dd92
lea ecx, [ebp - 0x240]
call fcn.1001144c
test al, al
jne 0x1000dd92
test byte [ebp + 0xc], 8
je 0x1000dcd4
call fcn.1000ddc3
test al, al
jne 0x1000dd92
test byte [ebp + 0xc], 1
je 0x1000dd1f
mov ecx, dword [ebp - 0x1c]
mov esi, ecx
sub esi, dword [ebp - 0x258]
mov edx, dword [ebp - 0x18]
mov eax, edx
sbb eax, dword [ebp - 0x254]
cmp eax, 0xc9
jb 0x1000dd92
ja 0x1000dd05
cmp esi, ebx
jb 0x1000dd92
sub ecx, dword [ebp - 0x268]
sbb edx, dword [ebp - 0x264]
cmp edx, 0xc9
jb 0x1000dd92
ja 0x1000dd1f
cmp ecx, ebx
jb 0x1000dd92
test byte [ebp + 0xc], 2
je 0x1000dd6b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1000de00
test eax, eax
je 0x1000dd65
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0xc]
push 0x10019498
push eax
call fcn.10011126
add esp, 0x10
push dword [eax]
push 0x10018ea0
push 1
call sym.CBSHost.dll_DismWriteLog
mov ecx, dword [ebp - 0xc]
jmp 0x1000dd8a
cmp dword [ebp - 0x10], 0
jne 0x1000dd92
lea eax, [ebp - 0x240]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.1001087d
pop ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1000a7db
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.100110af
lea eax, [ebp - 0x26c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000dca1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.100110af
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0xc

Function at 0x1001029c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, ecx
call fcn.10010a1b
push str.WindowsSystem32_ntdll.dll
mov edx, ebx
lea ecx, [ebp + 8]
call fcn.1001087d
mov esi, dword [ebp + 8]
pop ecx
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp + 8], eax
test eax, eax
jne 0x100102de
call fcn.10011404
jmp 0x100102ea
push ecx
lea edx, [ebx + 4]
mov ecx, eax
call fcn.10011d23
pop ecx
lea ecx, [ebp + 8]
mov edi, eax
call fcn.10010922
test edi, edi
jne 0x10010330
mov ecx, esi
call fcn.1001132c
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x208]
push 0x104
push eax
push str._SystemDrive_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x208]
push eax
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
neg eax
sbb eax, eax
inc eax
mov dword [ebx + 0x10], eax
lea ecx, [esi - 0x10]
call fcn.100110af
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10010677
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100106cd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100106cd
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x100106bf
cmp esi, ecx
jae 0x100106cd
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x100106ad
cmp esi, ecx
jae 0x100106cd
cmp word [esi], 0
je 0x100106cd
mov eax, esi
jmp 0x100106cf
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10011296
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push ecx
lea ecx, [ebp - 4]
call fcn.100107cc
mov esi, dword [ebp - 4]
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x100112b5
push 0x57
pop edi
jmp 0x1001131d
dec eax
lea ecx, [ebp - 4]
push eax
call fcn.10010278
push 0x5c
pop edi
cmp ax, di
je 0x100112da
push ecx
lea ecx, [ebp - 4]
call fcn.1000a910
inc eax
lea ecx, [ebp - 4]
push eax
call fcn.10010bfd
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
jmp 0x1001130e
xor eax, eax
push eax
push esi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10011307
call fcn.10011404
mov edi, eax
cmp edi, 0xb7
jne 0x1001131d
push 0x5c
pop edi
mov word [ebx], di
lea eax, [ebx + 2]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ebx, eax
test ebx, ebx
jne 0x100112e4
xor edi, edi
lea ecx, [esi - 0x10]
call fcn.100110af
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001132c
Capabilities:
Access pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x2000000
push 3
push ebx
push 5
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x1001135b
mov esi, 0xffff
jmp 0x100113d9
push edi
push ebx
push ebx
push ebx
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 4
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov esi, 0xffff
test edi, edi
je 0x100113d0
push edi
mov ebx, esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x10011394
movzx ebx, word [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx eax, bx
sub eax, 0x14c
je 0x100113ce
sub eax, 0x78
je 0x100113ca
sub eax, 0x3c
je 0x100113c6
sub eax, 0x8464
je 0x100113c1
sub eax, 0x2400
jne 0x100113d0
push 0xc
jmp 0x100113c3
push 9
pop esi
jmp 0x100113d0
push 6
jmp 0x100113c3
push 5
jmp 0x100113c3
xor esi, esi
lea ecx, [ebp - 4]
call fcn.1001064b
pop edi
lea ecx, [ebp - 8]
call fcn.1001064b
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100114d7
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x10]
push ebx
push esi
push 0x204020
push 7
push eax
push ecx
push 0x100000
lea eax, [ebp - 8]
mov ebx, edx
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
test esi, esi
jne 0x10011545
test ebx, ebx
je 0x1001151e
push 5
push 0x18
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test esi, esi
jne 0x1001153a
cmp dword [ebp + 8], 0
je 0x1001153a
push 6
push 8
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x1001154b
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
push 0x4021
push 7
push eax
lea eax, [ebp + 8]
push eax
push 0x100001
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ebx, eax
test ebx, ebx
jne 0x10011691
xor edi, edi
mov dword [ebp - 0xc], eax
push edi
push edi
push 0xff
push 2
push 0x248
lea ecx, [ebp - 0xc]
mov dword [ebp + 0x10], ecx
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x260]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp + 0xc], eax
push ecx
push edi
push edi
push edi
push eax
jmp 0x10011678
mov eax, dword [ebp - 0x224]
mov edx, dword [ebp - 0x228]
mov word [ebp - 0xa], ax
mov word [ebp - 0xc], ax
test dl, 0x10
je 0x1001161e
test edx, 0x400
je 0x100115ea
test dword [ebp - 0x220], 0x20000000
jne 0x1001161e
jmp 0x100115fb
mov edx, eax
lea ecx, [ebp - 0x21c]
call fcn.10011424
test al, al
jne 0x10011659
sub esp, 0x18
lea esi, [ebp + 8]
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.1001154b
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x10011655
mov edx, dword [ebp - 0x228]
xor edi, edi
test dl, 1
je 0x10011634
xor edx, 1
lea ecx, [ebp + 8]
call fcn.10011a3d
mov esi, eax
test esi, esi
jne 0x10011655
lea ecx, [ebp + 8]
call fcn.100118c6
mov esi, eax
test esi, esi
je 0x10011659
mov edx, dword [ebp - 0x228]
test dl, 1
je 0x10011655
lea ecx, [ebp + 8]
call fcn.10011a3d
mov ebx, esi
xor edi, edi
push edi
push edi
push 0xff
push 2
push 0x248
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
je 0x100115bb
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10011723
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
lea eax, [ebp - 0x18]
push ebx
push esi
push edi
push 0x4021
push 7
push eax
lea eax, [ebp + 8]
push eax
push 0x100001
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
je 0x1001175a
xor eax, eax
xor edx, edx
jmp 0x1001183e
xor edi, edi
lea ecx, [ebp - 0x10]
push edi
push edi
push 0xff
push 2
push 0x248
mov dword [ebp + 0x10], ecx
xor eax, eax
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 0x18]
mov esi, edi
push ecx
push edi
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], esi
push edi
mov dword [ebp - 0xc], eax
mov ebx, edi
mov eax, dword [ebp - 8]
push edi
mov dword [ebp + 0xc], eax
push eax
jmp 0x10011823
test byte [ebp - 0x228], 0x10
je 0x10011843
test dword [ebp - 0x228], 0x400
mov edi, dword [ebp - 0x224]
je 0x100117ca
test dword [ebp - 0x220], 0x20000000
jmp 0x100117d9
mov edx, edi
lea ecx, [ebp - 0x21c]
call fcn.10011424
test al, al
jne 0x10011802
sub esp, 0x18
mov word [ebp - 0xe], di
mov word [ebp - 0x10], di
lea esi, [ebp + 8]
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10011723
mov esi, dword [ebp - 4]
add esp, 0x18
add ebx, eax
adc esi, edx
mov dword [ebp - 4], esi
xor edi, edi
push edi
push edi
push 0xff
push 2
push 0x248
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push edi
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
je 0x1001179f
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret
add ebx, dword [ebp - 0x230]
adc esi, dword [ebp - 0x22c]
mov dword [ebp - 4], esi
jmp 0x10011804
Function at 0x100118c6
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0x204000
push 5
lea eax, [ebp - 0x20]
mov esi, ecx
push eax
push esi
push 0x110000
lea eax, [ebp - 8]
mov dword [ebp - 0xc], esi
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jne 0x10011a38
push 0xd
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 1
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push dword [ebp - 8]
mov ebx, eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jne 0x10011929
xor eax, eax
jmp 0x10011a38
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
movzx ecx, word [eax]
add ecx, 4
movzx eax, cx
push ecx
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
call edi
mov edx, dword [esi + 8]
mov dword [ebp - 0x14], eax
movzx ecx, word [edx]
push ecx
push dword [edx + 4]
push eax
call dword [sym.imp.msvcrt.dll_memcpy]
mov eax, dword [esi + 8]
add esp, 0x10
movzx ecx, word [eax]
mov eax, dword [ebp - 0x14]
push 0x7e
pop edx
push 0x24
mov word [ecx + eax], dx
mov eax, dword [esi + 8]
pop edx
movzx ecx, word [eax]
mov eax, dword [ebp - 0x14]
mov word [ecx + eax + 2], dx
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], eax
xor eax, eax
push eax
push eax
push 0x5000
push 2
push eax
push 0x80
push eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x18
push eax
push 0x110000
lea eax, [ebp - 8]
mov dword [ebp - 0x2c], 0x40
push eax
call dword [sym.imp.ntdll.dll_NtCreateFile]
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
call ebx
mov eax, dword [esi + 8]
movzx esi, word [eax]
add esi, 0x10
push esi
call edi
mov edx, dword [ebp - 0xc]
mov edi, eax
mov edx, dword [edx + 8]
movzx ecx, word [edx]
push ecx
push dword [edx + 4]
lea ecx, [edi + 0xc]
push ecx
call dword [sym.imp.msvcrt.dll_memcpy]
mov ecx, dword [ebp - 0xc]
add esp, 0x14
mov byte [edi], 1
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
push 0xa
push esi
push edi
movzx eax, word [eax]
mov dword [edi + 8], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push edi
mov esi, eax
call ebx
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
neg esi
sbb esi, esi
and esi, dword [ebp - 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10011a3d
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0xc]
push esi
push edi
push 0x204020
push 7
push eax
push ecx
push 0x100100
lea eax, [ebp - 4]
mov esi, edx
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jne 0x10011a93
push 8
pop ecx
push 4
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
push 0x28
lea eax, [ebp - 0x38]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x10011d23
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0
push 1
mov edi, ecx
mov esi, edx
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x10011d46
call fcn.10011404
jmp 0x10011d7e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10011d3f
and dword [ebp - 4], 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0x1001d034
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10011d3f
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xc]
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x10011d82
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
push ebx
push esi
push edi
push 0x4021
push 7
lea eax, [ebp - 0x28]
mov edi, ecx
push eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], edi
push eax
push 0x100001
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
je 0x10011dbe
xor eax, eax
xor edx, edx
jmp 0x10011f02
xor edx, edx
lea ecx, [ebp - 0x10]
push edx
push edx
push 0xff
push 2
push 0x248
mov dword [ebp + 0x10], ecx
xor eax, eax
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 0x28]
mov esi, edx
push ecx
push edx
lea eax, [ebp - 0x25c]
mov dword [ebp - 4], esi
push edx
mov dword [ebp - 0xc], eax
mov ebx, edx
mov eax, dword [ebp - 8]
push edx
mov dword [ebp + 0xc], eax
push eax
jmp 0x10011ee7
test byte [ebp - 0x268], 0x10
mov edx, dword [ebp - 0x264]
mov word [ebp - 0xe], dx
mov word [ebp - 0x10], dx
je 0x10011e68
test dword [ebp - 0x268], 0x400
je 0x10011e32
test dword [ebp - 0x260], 0x20000000
jmp 0x10011e3f
lea ecx, [ebp - 0x25c]
call fcn.10011424
test al, al
jne 0x10011ec6
sub esp, 0x18
lea esi, [ebp + 8]
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x14]
mov ecx, edi
call fcn.10011d82
mov esi, dword [ebp - 4]
add esp, 0x18
add ebx, eax
adc esi, edx
jmp 0x10011ec3
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x58]
lea ecx, [ebp + 8]
call fcn.100114d7
test eax, eax
jne 0x10011ec6
mov ecx, dword [ebp - 0x48]
cmp ecx, 1
je 0x10011eb7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], ecx
mov ecx, edi
push eax
call fcn.100128ab
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.1001290d
mov eax, dword [ebp - 0x30]
sub dword [eax + 0x18], 1
jne 0x10011ec6
add ebx, dword [ebp - 0x270]
adc esi, dword [ebp - 0x26c]
mov dword [ebp - 4], esi
xor ecx, ecx
lea eax, [ebp - 0x2a0]
push ecx
push ecx
push 0xff
push 2
push 0x248
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
push ecx
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
je 0x10011e03
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret