joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d594d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xa0]
mov eax, dword [eax + 0xc]
mov ecx, dword fs:[0x18]
cmp eax, dword [ecx + 0x24]
sete al
pop ebp
ret

Function at 0x1d59630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2010
call fcn.01cc4600
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x1d934e8]
cmp eax, 0xffffffff
je 0x1d59781
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x1d59781
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.01cc6c30
add esp, 0xc
mov ecx, dword [0x1d934e8]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x2018], ecx
push ecx
call fcn.01d67990
add esp, 8
test ebx, ebx
je 0x1d596ab
push ebx
call fcn.01cc31bc
add esp, 4
mov edi, 0x101
lea esi, [ebp - 0x2010]
call fcn.01d599f0
mov ebx, eax
push eax
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1d597ff
push 0x1000
push 0x1da34bc
lea eax, [ebp - 0x1810]
push eax
call fcn.01cc6c30
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push 0x800
push 0xff
push esi
call fcn.01cc71b0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1804]
mov edx, dword [ecx]
mov dword [ebp + eax*8 - 0x2010], edx
mov word [ebp + eax*8 - 0x200c], ax
inc eax
add ecx, 0x10
cmp eax, 0x100
jne 0x1d59707
mov ecx, esi
lea edx, [ebp - 0x1810]
push 1
push 0x10
call fcn.01d59b00
add esp, 8
mov ebx, 4
xor eax, eax
movzx edx, word [ebp + ebx - 0x2010]
mov esi, dword [ebp + edx*8 - 0x810]
test esi, esi
jne 0x1d59796
add ebx, 8
cmp ebx, 0x804
jne 0x1d5973e
dec edi
je 0x1d597f5
test al, 1
lea esi, [ebp - 0x2010]
jne 0x1d596b6
push 2
push dword [ebp - 0x2018]
call fcn.01d67990
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
add esp, 0x2010
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x2014], eax
mov ecx, edx
shl ecx, 4
cmp dword [ebp + ecx - 0x1810], 0
je 0x1d597ea
mov eax, dword [ebp + edx*8 - 0x80c]
cmp eax, dword [ebp + ecx - 0x1808]
jne 0x1d597ea
mov ecx, dword [ebp + ecx - 0x180c]
test ecx, ecx
mov eax, dword [ebp - 0x2014]
je 0x1d59751
mov dword [ebp + edx*8 - 0x810], 0
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov al, 1
jmp 0x1d59751
mov eax, dword [ebp - 0x2014]
jmp 0x1d59751
call fcn.01d3ba90
jmp 0x1d59771
mov ecx, ebx
call fcn.01d28d80
jmp 0x1d596cc
Function at 0x1d59810
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x1d934e8]
cmp eax, 0xffffffff
je 0x1d598a1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x1d598a1
call fcn.01d599f0
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1d598a8
mov ecx, dword [0x1da34b8]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x1da34bc], 0
jne 0x1d598b1
lea ecx, [ebx + 0x1da34bc]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x1da44bc]
inc edx
mov dword [0x1da44bc], edx
mov dword [ecx + 0xc], edx
mov dword [0x1da34b8], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x1d598bc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.01d598c0
jmp 0x1d5982d
mov ecx, edi
call fcn.01d28d80
jmp 0x1d5983f
inc edx
cmp edx, 0x100
jne 0x1d59848
jmp 0x1d5988b
int3

Function at 0x1d598c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x1d934e8]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x1d5996d
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1d599de
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.01cc71b0
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.01d67990
add esp, 8
push edi
call fcn.01cc31b3
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.01cc6c30
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.01d67990
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.01d67960
add esp, 4
test al, al
je 0x1d599e1
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x1d599b6
xor eax, eax
dec eax
lock cmpxchg dword [0x1d934e8], ecx
je 0x1d598f1
push ecx
call fcn.01d67980
add esp, 4
mov ecx, dword [0x1d934e8]
mov dword [ebp - 0x814], ecx
jmp 0x1d598f1
push esi
call fcn.01d67960
add esp, 4
test al, al
je 0x1d599e4
cmp dword [ebp - 0x814], 0xffffffff
je 0x1d599e4
push 0xffffffffffffffff
call fcn.01d67980
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x1d5998b
int3
int3
int3
Function at 0x1d5c120
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1d8f008]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x1d5c150
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x1d5c2d0
push 0
push eax
push 0x1d5c100
push 0x1da44dc
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1d5c24b
cmp dword [0x1da44e0], 0
jne 0x1d5c13c
push dword [0x1da44e4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1d5c13c
mov esi, eax
mov eax, 0x1da44e8
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x1da44ec]
mov ebx, dword [0x1da44f0]
mov eax, dword [0x1da44f4]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1da44f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1da44fc]
mov dword [ebp - 0x24], eax
mov eax, 0x1da44e8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x1d5c1e4
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x1d5c1f9
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1d5c20f
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x1d5c228
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x1d5c23d
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.01cf8a40
add esp, 4
jmp 0x1d5c13c
call fcn.01cd6e38

Function at 0x1d5c250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x1d5c2d0
push 0
push eax
push 0x1d5c100
push 0x1da44dc
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1d5c2c9
xor esi, esi
cmp dword [0x1da44e0], 0
jne 0x1d5c2b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1da44e4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1d5c2b5
mov eax, dword [ebp + 8]
mov esi, dword [edi + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01cd6e38
int3
Function at 0x1d5c2f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x1d5c2d0
push 0
push eax
push 0x1d5c100
push 0x1da44dc
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1d5c3d4
mov esi, dword [ebp + 0xc]
cmp dword [0x1da44e0], 0
jne 0x1d5c3c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x1da44e4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1d5c37b
push 0x14
push 1
call fcn.01cf8ac0
add esp, 8
test eax, eax
je 0x1d5c3c1
mov edi, eax
push eax
push dword [0x1da44e4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1d5c3b8
mov ebx, dword [ebp + 8]
mov esi, 0x1da44e8
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x1da44ec], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call fcn.01cf8a40
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x1d5c3a4
call fcn.01cd6e38
int3

Function at 0x1d5c460
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01d5c410
Function at 0x1d5d780
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
cmp byte [ecx + 0xb], 0
jns 0x1d5d799
mov ecx, dword [ecx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x1d5d7b5
cmp byte [esi + 0x28], 0
jne 0x1d5d838
or ebx, 0x20000000
test bl, 8
mov dword [ebp - 0x18], ecx
jne 0x1d5d84c
xor edi, edi
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x1d5d7d1
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov ecx, 0
je 0x1d5d7df
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp byte [esi + 0x1c], 0
je 0x1d5d7f5
lea ecx, [esi + 0x10]
call fcn.01d29af0
mov edi, eax
cmp byte [esi + 0xc], 0
je 0x1d5d834
mov ecx, esi
call fcn.01d29af0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x1d5d868
xor ecx, ecx
inc ecx
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push edi
push eax
push ebx
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x1d5d843
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
xor eax, eax
jmp 0x1d5d802
or ebx, 0x80000000
jmp 0x1d5d7b5
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1d5d825
cmp byte [esi + 0x34], 0
je 0x1d5d85d
or ebx, 0x40000000
jmp 0x1d5d7c1
or ebx, 0x10000000
jmp 0x1d5d7c1
cmp ecx, 4
jne 0x1d5d874
mov ecx, 6
jmp 0x1d5d80c
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x1d5d883
mov ecx, 7
jmp 0x1d5d80c
cmp dword [ebp + 0xc], 1
jne 0x1d5d893
mov ecx, 4
jmp 0x1d5d80c
xor ecx, ecx
jmp 0x1d5d80c

Function at 0x1d5d8a0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x1d5d8ca
cmp byte [esi + 0x28], 0
jne 0x1d5d95f
or ebx, 0x20000000
test bl, 8
jne 0x1d5d973
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x1d5d8e3
mov ecx, dword [esi + 0x2c]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x1d5d8f4
mov edi, dword [esi + 0x20]
cmp byte [esi + 0x1c], 0
je 0x1d5d902
lea ecx, [esi + 0x10]
call fcn.01d29af0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
je 0x1d5d91b
mov ecx, esi
mov esi, edx
call fcn.01d29af0
mov edx, esi
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x1d5d94e
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x1d5d96a
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x1d5d98f
mov edx, 7
jmp 0x1d5d928
or ebx, 0x80000000
jmp 0x1d5d8ca
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1d5d93f
cmp byte [esi + 0x34], 0
je 0x1d5d984
or ebx, 0x40000000
jmp 0x1d5d8d3
or ebx, 0x10000000
jmp 0x1d5d8d3
test esi, esi
jne 0x1d5d998
xor edx, edx
inc edx
jmp 0x1d5d928
mov edx, esi
cmp esi, 1
jne 0x1d5d9a6
mov edx, 4
jmp 0x1d5d928
xor edx, edx
jmp 0x1d5d928
Function at 0x1d65870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x1d8f008]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1d658c8
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x1d658cd
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
xor esi, esi
dec esi
jmp 0x1d658b6
int3

Function at 0x1d658d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1d8f008]
xor ecx, ebp
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x14], 0xffffffff
push 0
push eax
push esi
push edx
mov edi, ebx
push ebx
call ecx
test eax, eax
je 0x1d65948
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1d65935
cmp ebx, 0xffffffff
je 0x1d6595f
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x1d6595a
mov ebx, dword [ebp - 0x14]
jmp 0x1d65921
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1d65921
mov edx, dword [ebp + 0xc]
jmp 0x1d658f7
int3

Function at 0x1d65fe0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.01d65ed0
add esp, 0x10
or edx, eax
jne 0x1d66017
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
je 0x1d6602d
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0xac
pop esi
pop ebx
pop ebp
ret
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d6603f
xor ebx, ebx
jmp 0x1d66017
call fcn.01d37a60
lea esi, [ebp - 0xb4]
mov ecx, esi
push eax
push 2
push 0xfc
push str.file_io_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xac]
push 0xc
push 0x1d87afc
push eax
call fcn.01cfbdd0
add esp, 0xc
mov ecx, esi
call fcn.01d37bf0
jmp 0x1d6603b
Function at 0x1d67270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1d67293
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1d672b5
mov ebx, eax
bt eax, 0xa
jae 0x1d672ad
cmp byte [ebp + 0xc], 0
je 0x1d672c3
and ebx, 0x10
shr ebx, 4
jmp 0x1d672c5
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d672dc
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01d37a60
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x80
push str.filesystem_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cfbdd0
add esp, 0xc
push edi
push eax
call fcn.01d39b30
add esp, 8
mov ecx, esi
call fcn.01d37bf0
jmp 0x1d672c3

Function at 0x1d67330
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1d67353
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1d6737e
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d67390
xor ebx, ebx
jmp 0x1d67367
call fcn.01d37a60
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0x73
push str.filesystem_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01cfbdd0
add esp, 0xc
push edi
push eax
call fcn.01d39b30
add esp, 8
mov ecx, esi
call fcn.01d37bf0
jmp 0x1d6738c
Function at 0x1d673e0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, dword [ebp + 8]
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1d67403
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1d6741b
and eax, 0x410
cmp eax, 0x410
je 0x1d67459
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1d67425
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x1d67442
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d67474
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov ecx, esi
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01d674c0
call fcn.01d37a60
lea edi, [ebp - 0xb8]
mov ecx, edi
push eax
push 2
push 0x93
push str.filesystem_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0xb
push str.DeleteFile
push eax
call fcn.01cfbdd0
add esp, 0xc
push esi
push eax
call fcn.01d39b30
add esp, 8
mov ecx, edi
call fcn.01d37bf0
jmp 0x1d67440

Function at 0x1d674c0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov esi, ecx
mov eax, dword [0x1d8f008]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1d674e2
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x1d674fd
push 2
call fcn.01d36f50
add esp, 4
test al, al
jne 0x1d67519
test edi, edi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01cc3f9d
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.01d37a60
lea ebx, [ebp - 0xb8]
mov ecx, ebx
push eax
push 2
push 0x2f
push str.filesystem_win.cc
call fcn.01d37b90
lea eax, [ebp - 0xb0]
push 0x10
push str.RemoveDirectory
push eax
call fcn.01cfbdd0
add esp, 0xc
push esi
push eax
call fcn.01d39b30
add esp, 8
mov ecx, ebx
call fcn.01d37bf0
jmp 0x1d674fd

Function at 0x1d6b270
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01d673e0
Function at 0x460130
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0xe5
adc dword [esi], ebx
mov dword [esi], 0xc48cccc
jmp 0x46012f
xchg esi, eax
Function at 0x100250d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100250e3
pop dword [ebp - 0x44]
mov eax, 0x6a4eb0d7
sub eax, 0x5a4c5ff4
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xae94e0e8
add dword [ebp - 0x54], 0x9fbd6463
mov dword [ebp - 0x50], 0x9de083ed
sub dword [ebp - 0x50], 0x6bad37a8
mov dword [ebp - 0x4c], 0x9f6e4157
add dword [ebp - 0x4c], 0xacde02d7
mov dword [ebp - 0x48], 0x7d6f079a
add dword [ebp - 0x48], 0x8290f866
lea eax, [ebp - 0x54]
push eax
mov eax, 0x1ac65be
add eax, 0xe56eb5a
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x9dce3ed0
add dword [ebp - 0x54], 0xd6a42a86
mov dword [ebp - 0x50], 0xf788e216
add dword [ebp - 0x50], 0x49e37f5f
mov dword [ebp - 0x4c], 0x465b6d99
add dword [ebp - 0x4c], 0x1d13fed3
mov dword [ebp - 0x48], 0xf9da977c
sub dword [ebp - 0x48], 0xf9da977c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3de8e
push 0
call eax
mov ecx, 0xd85db3ca
sub ecx, 0xd85d607a
mov edx, eax
mov ebx, 0x4235b298
sub ebx, 0x322d2e98
add ebx, dword [ebp - 0x44]
mov edi, 0xe9e14281
sub dword [ebp - 4], ecx
mov esi, dword [ebx]
sub dword [ebp - 0x10], 0x9996d129
sub esi, edi
add dword [ebp - 0x2c], 0x534a29db
mov dword [edx], esi
xor dword [ebp - 0x10], esi
add edx, 0x68587975
sub edx, 0x68587971
add ebx, 0x2ab33091
add ebx, 0xd54ccf73
loop 0x100251fa
add eax, 0x14013
xor ebx, ebx
add ebx, eax
add eax, 0x16b563dc
add eax, 0xe94a9c29
mov ecx, 0x9559f8be
add ecx, 0x7aa60742
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x402250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40226b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4022a2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x40229e
jmp 0x402290
cmp esi, eax
jae 0x4022a2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402290
cmp esi, eax
jb 0x4022a9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402aa0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x402ac8
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402ac8
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret