joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103a3fb
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x108e012
call fcn.01026ef8
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], ebx
call fcn.01042ac1
mov esi, eax
cmp esi, ebx
jl 0x103a479
mov eax, dword [ebp - 0x18]
cmp eax, ebx
push edi
mov edi, 0x1001ea8
jne 0x103a436
mov eax, edi
push ebx
push 1
push eax
push dword [ebp + 8]
call fcn.0101e92a
mov esi, eax
cmp esi, ebx
jl 0x103a478
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x103a451
mov eax, edi
push 7
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp + 0xc], ebx
je 0x103a476
cmp dword [ebp - 0x18], ebx
je 0x103a467
mov edi, dword [ebp - 0x18]
push edi
push dword [ebp + 0xc]
call fcn.01074bea
mov esi, eax
cmp esi, ebx
jl 0x103a478
xor esi, esi
pop edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.0101930d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x1043a0e
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
push edi
mov byte [esi + 0x10], 1
mov dword [esi + 0x14], eax
call fcn.010439a1
mov edi, eax
test edi, edi
jl 0x1043ac6
push 0
push 1
push esi
call fcn.0101ec6e
mov edi, eax
test edi, edi
jl 0x1043ac6
cmp dword [ebp + 0x14], 0
mov eax, dword [esi + 4]
mov ebx, 0x1001ea8
je 0x1043a69
test eax, eax
jne 0x1043a59
mov eax, ebx
push 1
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
call fcn.010330e8
jmp 0x1043a7c
test eax, eax
jne 0x1043a6f
mov eax, ebx
push 0
push 1
push eax
push dword [ebp + 0xc]
call fcn.0101e92a
mov edi, eax
test edi, edi
jl 0x1043ac6
mov eax, dword [esi + 4]
test eax, eax
jne 0x1043a8b
mov eax, ebx
push eax
lea eax, [esi + 0x18]
push eax
call fcn.01074bea
mov edi, eax
test edi, edi
jl 0x1043ac6
mov esi, dword [esi + 4]
test esi, esi
jne 0x1043aa4
mov esi, ebx
push 7
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 0xc]
push 0x100b680
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0103d2be
add esp, 0x10
xor edi, edi
jmp 0x1043ada
push dword [ebp + 0xc]
push 0x100b630
push edi
push dword [ebp + 8]
call fcn.0103d2be
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x104fc06
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x108f416
call fcn.01026ef8
sub esp, 0x874
mov eax, dword [0x10a1e18]
and dword [ebp - 0x814], 0
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x819]
push eax
mov ebx, ecx
push 0x100d1e0
lea ecx, [ebp - 0x83c]
call fcn.0101a57c
and dword [ebp - 4], 0
lea eax, [ebp - 0x83c]
push eax
call fcn.010218ef
xor eax, eax
lea edi, [ebp - 0x82c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x11
pop ecx
xor eax, eax
lea edi, [ebp - 0x880]
rep stosd dword es:[edi], eax
lea edi, [ebx + 0x10]
push edi
mov dword [ebp - 0x880], 0x44
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov esi, eax
xor eax, eax
cmp esi, eax
jl 0x104fd6d
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x818]
xor esi, esi
cmp eax, esi
mov dword [ecx], eax
je 0x104fd3a
push edi
lea ecx, [ebp - 0x818]
call fcn.0104f430
mov eax, dword [ebp - 0x838]
cmp eax, esi
jne 0x104fcca
mov eax, 0x1001ea8
push dword [ebp - 0x818]
push eax
lea eax, [ebp - 0x810]
push 0x100d24c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
push dword [ebp - 0x818]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 1
push dword [ebx + 0x24]
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x104fd3a
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x880]
push eax
push esi
push dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push 0x420
push esi
push esi
push esi
push eax
push esi
push dword [ebx + 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x104fd5e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x104fd4c
call esi
mov esi, eax
jmp 0x104fd6d
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x104fd6d
mov eax, dword [ebp - 0x82c]
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x82c], esi
cmp dword [ebp - 0x814], 0
je 0x104fd82
push dword [ebp - 0x814]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
cmp dword [ebp - 0x82c], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x104fd99
push dword [ebp - 0x82c]
call edi
cmp dword [ebp - 0x828], 0
je 0x104fdaa
push dword [ebp - 0x828]
call edi
push 1
lea ecx, [ebp - 0x83c]
call fcn.0101930d
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101cf4f
leave
ret 4

Function at 0x104ffea
Capabilities:
Add user account group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 1
push 0
call sub.NETAPI32.dll_NetLocalGroupAdd
test eax, eax
pop edi
je 0x1050037
cmp eax, 0x8af
je 0x1050037
cmp eax, 0x563
je 0x1050037
test eax, eax
jle 0x1050039
and eax, 0xffff
or eax, 0x80070000
jmp 0x1050039
xor eax, eax
leave
ret 8
Function at 0x1050042
Capabilities:
Delete user account group

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0
call sub.NETAPI32.dll_NetLocalGroupDel
test eax, eax
je 0x1050063
jle 0x1050065
and eax, 0xffff
or eax, 0x80070000
jmp 0x1050065
xor eax, eax
pop ebp
ret 4

Function at 0x105006e
Capabilities:
Delete user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0
call sub.NETAPI32.dll_NetUserDel
test eax, eax
je 0x105008f
jle 0x1050091
and eax, 0xffff
or eax, 0x80070000
jmp 0x1050091
xor eax, eax
pop ebp
ret 4

Function at 0x10501ef
Capabilities:
Add user account
Add user account to group

Disassembly:
mov eax, 0x108f45b
call fcn.01026ef8
sub esp, 0x78
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
xor eax, eax
push 0x18
pop ecx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea edi, [ebp - 0x84]
rep stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x9c6
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call fcn.0101d495
mov esi, eax
cmp esi, ebx
jl 0x105034b
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
or dword [ebp - 0x48], 0xffffffff
or dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x84]
push eax
push 2
push ebx
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x6c], 0x10041
call sub.NETAPI32.dll_NetUserAdd
mov esi, eax
cmp esi, 0x8b0
jne 0x10502c1
lea eax, [ebp - 0x10]
push eax
push 0xa
push edi
push ebx
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x10502cb
push dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
call fcn.01018b12
test eax, eax
jne 0x10502cb
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push 0x3eb
push edi
push ebx
call sub.NETAPI32.dll_NetUserSetInfo
mov esi, eax
cmp esi, ebx
je 0x10502d9
jle 0x105034b
and esi, 0xffff
or esi, 0x80070000
jmp 0x105034b
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov dword [ebp - 0x14], edi
jne 0x10502e8
mov eax, 0x1001ea8
push 1
lea ecx, [ebp - 0x14]
push ecx
push 3
push eax
push ebx
call sub.NETAPI32.dll_NetLocalGroupAddMembers
cmp eax, ebx
je 0x1050316
cmp eax, 0x562
je 0x1050316
cmp eax, ebx
jg 0x105030a
mov esi, eax
jmp 0x105034b
and eax, 0xffff
or eax, 0x80070000
jmp 0x1050306
push 0x100d2d0
push edi
call fcn.01024d52
mov esi, eax
cmp esi, ebx
jl 0x105034b
push 0x100d2a0
push edi
call fcn.01024d52
mov esi, eax
cmp esi, ebx
jl 0x105034b
push 0x100d268
push edi
call fcn.01024d52
mov esi, eax
cmp esi, ebx
jl 0x105034b
xor esi, esi
cmp dword [ebp - 0x10], ebx
je 0x1050358
push dword [ebp - 0x10]
call sub.NETAPI32.dll_NetApiBufferFree
push 1
lea ecx, [ebp - 0x24]
call fcn.0101930d
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1054aeb
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.01054ab9
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0x40
push 1
push 0
push 0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1054b60
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x80090016
je 0x1054b31
test eax, eax
jle 0x1054b4a
and eax, 0xffff
or eax, 0x80070000
jmp 0x1054b4a
push 0x48
push 1
push 0
push 0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1054b60
call edi
test eax, eax
jg 0x1054b4e
call edi
mov esi, eax
jmp 0x1054b62
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1054b62
xor esi, esi
test esi, esi
jge 0x1054b6e
mov ecx, dword [ebp - 4]
call fcn.01054ab9
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x1054c08
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov eax, 0x80070057
jne 0x1054c2a
mov esi, eax
cmp dword [ebp + 0xc], ebx
jne 0x1054c31
mov esi, eax
cmp esi, ebx
jl 0x1054cd8
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.010206c6
mov esi, eax
cmp esi, ebx
jl 0x1054cbc
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8003
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1054c96
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1054c96
push ebx
push ebx
push dword [edi + 4]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
jne 0x1054cba
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1054ca8
call esi
mov esi, eax
jmp 0x1054cbc
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1054cbc
xor esi, esi
cmp dword [ebp - 4], ebx
je 0x1054cca
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], ebx
je 0x1054cd8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1059085
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x108fd95
call fcn.01026ef8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0xc]
mov dword [ebp - 0x10], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
call fcn.0105ab87
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 3
call fcn.0105abfa
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
or dword [esi + 8], 0xffffffff
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov byte [ebp - 4], 4
mov dword [esi + 4], eax
call fcn.0101d46d
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x105abfa
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x108fe22
call fcn.01026ef8
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.0105ab87
or dword [esi], 0xffffffff
or dword [esi + 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x105b33e
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0105c5ca
push 0
push 1
mov ecx, ebx
call fcn.0105b125
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.0101dbb6
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
je 0x105b38e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push 1
push esi
push esi
mov byte [ebx + 0x44], 0
mov byte [ebx + 0x38], 0
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x105b3d4
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x105b3d4
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x105b1cb
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
jne 0x105b3f8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x105b3e6
call esi
mov esi, eax
jmp 0x105b3fc
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x105b3fc
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18

Function at 0x105d847
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0105c5ca
push 0
push 1
mov ecx, ebx
call fcn.0105d6a5
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.0105d117
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
je 0x105d897
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push 1
push esi
push esi
mov byte [ebx + 0x44], 0
mov byte [ebx + 0x38], 0
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x105d8dd
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x105d8dd
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x105d74b
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
jne 0x105d901
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x105d8ef
call esi
mov esi, eax
jmp 0x105d905
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x105d905
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x1066854
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0105c5ca
push 0
push 1
mov ecx, ebx
call fcn.010627c2
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push dword [ebp + 0x1c]
lea edi, [ebx + 0x20]
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x18], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x30]
movsd dword es:[edi], dword [esi]
call fcn.01062015
mov eax, dword [ebp + 8]
xor esi, esi
cmp eax, esi
je 0x10668a4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push 1
push esi
push esi
mov byte [ebx + 0x44], 0
mov byte [ebx + 0x38], 0
call edi
cmp eax, esi
mov dword [ebx + 0x3c], eax
je 0x10668ea
push esi
push esi
push esi
push esi
call edi
cmp eax, esi
mov dword [ebx + 0x40], eax
je 0x10668ea
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x10667bb
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, esi
mov dword [ebx + 0x34], eax
jne 0x106690e
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10668fc
call esi
mov esi, eax
jmp 0x1066912
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1066912
mov byte [ebx + 0x38], 1
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x106802d
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x109105e
call fcn.01026ef8
sub esp, 0x440
mov eax, dword [0x10a1e18]
or dword [ebp - 0x42c], 0xffffffff
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp byte [edi + 0x4a], bl
mov dword [ebp - 0x10], eax
je 0x1068164
lea eax, [ebp - 0x42d]
push eax
push 0x1010160
lea ecx, [ebp - 0x440]
call fcn.0101a57c
lea eax, [ebp - 0x440]
push eax
mov dword [ebp - 4], ebx
call fcn.010218ef
mov eax, dword [ebp - 0x43c]
cmp eax, ebx
jne 0x1068091
mov eax, 0x1001ea8
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x42c], eax
jne 0x10680e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1068148
cmp eax, ebx
jle 0x10680cf
and eax, 0xffff
or eax, 0x80070000
push 1
lea ecx, [ebp - 0x440]
mov esi, eax
call fcn.0101930d
jmp 0x1068188
push eax
lea ecx, [ebp - 0x44c]
call fcn.01075026
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 1
call fcn.01074ead
lea eax, [ebp - 0x428]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.01067dc6
lea ecx, [ebp - 0x428]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.01074edd
cmp esi, ebx
jge 0x1068145
push 1
lea ecx, [ebp - 0x440]
mov dword [ebp - 0x44c], 0x100a94c
call fcn.0101930d
jmp 0x1068173
mov byte [ebp - 4], bl
mov ecx, edi
call fcn.0106701a
lea ecx, [ebp - 0x440]
push 1
mov esi, eax
call fcn.0101930d
cmp esi, ebx
jl 0x1068173
jmp 0x1068171
mov ecx, edi
call fcn.01067f3f
mov esi, eax
cmp esi, ebx
jl 0x1068188
xor esi, esi
cmp dword [ebp - 0x42c], 0xffffffff
je 0x1068188
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101cf4f
leave
ret

Function at 0x106bdfa
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x109166f
call fcn.01026ef8
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [ebp - 0x14], esi
call fcn.0101d8ba
xor ebx, ebx
lea edi, [esi + 0x20]
mov dword [esi], 0x1010740
mov dword [ebp - 4], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea eax, [ebp - 0xd]
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0106b011
push 0x1010508
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0101a4bd
push edi
call fcn.010218ef
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x106e6e3
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x109197d
call fcn.01026ef8
sub esp, 0x74
or dword [ebp - 0x14], 0xffffffff
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
push edi
jne 0x106e81d
lea eax, [ebp - 0xd]
push eax
push 0x1010918
lea ecx, [ebp - 0x38]
call fcn.0101a57c
and dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
call fcn.010218ef
lea ebx, [esi + 0x24]
and dword [ebx], 0
push 0xffffffffffffffff
mov ecx, esi
call fcn.010733af
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jl 0x106e781
mov eax, dword [ebp - 0x34]
cmp eax, ecx
jne 0x106e744
mov eax, 0x1001ea8
push ecx
push 0x80
push 3
push ecx
push ecx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
jne 0x106e790
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x106e813
test eax, eax
jle 0x106e77f
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push 1
lea ecx, [ebp - 0x38]
call fcn.0101930d
jmp 0x106e836
push eax
lea ecx, [ebp - 0x28]
call fcn.01075026
push 0
push 4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call dword [eax + 4]
test eax, eax
jl 0x106e813
cmp dword [ebp - 0x18], 0x100af05
jne 0x106e813
push ebx
lea ecx, [ebp - 0x28]
call fcn.0103436c
test eax, eax
jl 0x106e813
lea ebx, [esi + 0x28]
lea ecx, [ebp - 0x80]
call fcn.0106e139
mov ecx, dword [esi + 0x2c]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.0106e506
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 1
call fcn.0106cc41
mov edi, dword [ebp - 0x1c]
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0106e173
test eax, eax
jge 0x106e7cb
push edi
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.0106e546
push 1
lea ecx, [ebp - 0x38]
call fcn.0101930d
xor edi, edi
cmp dword [ebp - 0x14], 0xffffffff
mov byte [esi + 0x20], 1
mov byte [esi + 0x21], 0
je 0x106e836
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret