joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100236e6
Capabilities:
Get disk information

Disassembly:
push 0x20
mov eax, 0x1004232f
call fcn.1002a641
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
push dword [ebp + 8]
call fcn.1000e53d
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
jmp 0x1002371c
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
xor eax, eax
inc eax
shl eax, cl
mov ecx, dword [ebp - 0x1c]
test ecx, eax
je 0x1002375d
mov byte [ebp - 0xd], bl
mov bl, byte [ebp - 0x14]
add bl, 0x61
lea esi, [ebp - 0xd]
call fcn.10023675
test al, al
je 0x1002375d
cmp byte [ebp - 0xd], 0
je 0x1002375d
mov al, byte [ebp - 0x14]
mov ebx, dword [ebp + 8]
add al, 0x41
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push eax
lea edi, [ebp - 0x28]
call fcn.100113c8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
jl 0x1002371a
mov eax, dword [ebp + 8]
call fcn.1002a719
ret

Function at 0x1002376f
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp + 0x1a4], eax
movsx eax, byte [ebp + 0x1b0]
push ebx
push esi
push eax
push str.._c:
lea esi, [ebp - 0x78]
call fcn.100141ea
cmp dword [ebp - 0x60], 0x10
mov eax, dword [ebp - 0x74]
pop ecx
pop ecx
jae 0x100237af
lea eax, [ebp - 0x74]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp esi, ebx
je 0x100237d2
cmp esi, 0xffffffff
jne 0x10023800
lea eax, [ebp - 0x7c]
call fcn.1000a76d
push ebx
push 1
lea ecx, [ebp - 0x78]
call fcn.10001d94
xor eax, eax
mov ecx, dword [ebp + 0x1a4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
add ebp, 0x1a8
leave
ret 4
push 0x1ff
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], bl
call fcn.1002bdc0
add esp, 0xc
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x200
lea eax, [ebp - 0x5c]
push eax
push esi
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002384a
xor esi, esi
lea eax, [ebp - 0x7c]
call fcn.1000a76d
push ebx
push 1
lea ecx, [ebp - 0x78]
call fcn.10001d94
mov eax, esi
jmp 0x100237e7
cmp dword [ebp + 0x184], 0x1a6c0089
jne 0x10023831
mov esi, dword [ebp + 0x188]
jmp 0x10023833
Function at 0x10023891
Capabilities:
Check if file exists
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push 0x38
mov eax, 0x100422f1
call fcn.1002a6aa
push dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push dword [ebp + 8]
call fcn.1002385e
pop ecx
pop ecx
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
pop esi
cmp dword [ebp + 0x10], ebx
jne 0x100238cb
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x100238c5
lea eax, [ebp - 0x28]
push eax
call fcn.100120d7
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x100238d6
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002390e
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x100238ec
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1002390e
mov ecx, dword [ebp - 0x28]
or eax, 6
cmp dword [ebp - 0x14], esi
jae 0x10023906
lea ecx, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x10023919
lea eax, [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
push ebx
push ebx
neg ecx
push 3
sbb ecx, ecx
push ebx
and ecx, 0x70000000
push ebx
add ecx, 0x10000000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x40], esi
cmp esi, ebx
je 0x10023994
cmp esi, 0xffffffff
je 0x10023994
xor eax, eax
mov byte [ebp - 0x30], bl
lea edi, [ebp - 0x2f]
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
lea eax, [ebp - 0x38]
push eax
push 4
pop edi
push edi
lea eax, [ebp - 0x30]
push eax
push esi
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x38], edi
jne 0x1002398f
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x40]
call fcn.1000a76d
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001d94
mov eax, esi
call fcn.1002a72d
ret 0xc
cmp dword [ebp + 0x10], ebx
je 0x10023998
xor esi, esi
jmp 0x10023972
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call fcn.1001317a
push ebx
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x3c]
push eax
push esi
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x34], edi
jne 0x10023994
mov esi, dword [ebp - 0x3c]
jmp 0x10023972
Function at 0x100239c8
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push 0x3c
mov eax, 0x10041e06
call fcn.1002a6aa
xor edi, edi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
call fcn.1002385e
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x48]
mov dword [ebp - 4], edi
call fcn.1002385e
mov ecx, dword [ebp - 0x28]
add esp, 0x10
cmp dword [ebp - 0x14], 0x10
jae 0x10023a01
lea ecx, [ebp - 0x28]
cmp dword [eax + 0x18], 0x10
jb 0x10023a0c
mov eax, dword [eax + 4]
jmp 0x10023a0f
add eax, 4
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.10001d94
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x10023a2f
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10023a52
mov ecx, dword [ebp - 0x28]
or eax, 6
cmp dword [ebp - 0x14], 0x10
jae 0x10023a4a
lea ecx, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001d94
call fcn.1002a72d
ret

Function at 0x10023c3c
Capabilities:
Get disk information

Disassembly:
push 0x228
mov eax, 0x10042ec9
call fcn.1002a6aa
test edi, edi
je 0x10023d4a
mov bl, byte [ebp + 8]
lea esi, [ebp - 0x231]
mov byte [ebp - 0x231], 0
call fcn.10023675
test al, al
je 0x10023d4a
xor ebx, ebx
cmp byte [ebp - 0x231], bl
je 0x10023d4a
movsx ax, byte [ebp + 8]
movzx eax, ax
push eax
push 0x10048ebc
lea ecx, [ebp - 0x230]
call fcn.1001418c
xor eax, eax
mov esi, 0xfe
mov dword [ebp - 4], ebx
push esi
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.1002bdc0
add esp, 0x14
xor eax, eax
push esi
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x112]
push ebx
push eax
call fcn.1002bdc0
mov ecx, dword [ebp - 0x22c]
add esp, 0xc
cmp dword [ebp - 0x218], 8
jae 0x10023ce8
lea ecx, [ebp - 0x22c]
mov eax, 0x80
push eax
lea edx, [ebp - 0x114]
push edx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x214]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp word [ebp - 0x114], bx
je 0x10023d3c
push dword [ebp + 8]
call fcn.1002376f
cmp eax, ebx
je 0x10023d30
push ebx
push 1
lea esi, [ebp - 0x230]
mov dword [edi], eax
call fcn.10001e8c
mov al, 1
jmp 0x10023d4c
push dword [ebp + 8]
call fcn.10023aeb
cmp eax, ebx
jne 0x10023d1c
push ebx
push 1
lea esi, [ebp - 0x230]
call fcn.10001e8c
xor al, al
call fcn.1002a72d
ret
Function at 0x10024594
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x60
mov eax, 0x10044015
call fcn.1002a6aa
push dword [ebp + 8]
mov ebx, ecx
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x4c], ebx
call fcn.10023da2
pop ecx
xor edi, edi
push 8
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x28]
pop esi
cmp dword [ebp - 0x14], esi
jae 0x100245c4
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100245f5
mov eax, 0x1392
push eax
mov dword [0x10058a14], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push edi
push 1
lea esi, [ebp - 0x2c]
call fcn.10001e8c
mov eax, ebx
jmp 0x100246c4
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
call fcn.10023e7b
add esp, 0xc
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x10024616
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x100246a3
mov ecx, dword [ebp - 0x44]
mov eax, ecx
cmp dword [ebp - 0x30], esi
jae 0x1002462b
lea eax, [ebp - 0x44]
cmp eax, edi
je 0x100246a3
cmp dword [ebp - 0x30], esi
jae 0x10024637
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x10024642
lea eax, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100246a3
cmp dword [ebp + 0x10], edi
je 0x1002465f
push edi
push ebx
lea esi, [ebp - 0x48]
call fcn.10001e8c
jmp 0x100245e3
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.1000a7c3
pop ecx
pop ecx
mov byte [ebp - 4], 2
cmp dword [eax + 0x18], 0x10
jb 0x1002467d
mov eax, dword [eax + 4]
jmp 0x10024680
add eax, 4
push dword [ebp + 0xc]
mov ebx, dword [ebp - 0x4c]
push eax
call fcn.10026698
mov ebx, eax
neg ebx
push edi
sbb ebx, ebx
push 1
lea ecx, [ebp - 0x68]
inc ebx
call fcn.10001d94
push edi
push 1
jmp 0x10024655
push 0x1397
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push ebx
lea esi, [ebp - 0x48]
call fcn.10001e8c
push edi
push ebx
lea esi, [ebp - 0x2c]
call fcn.10001e8c
xor eax, eax
call fcn.1002a72d
ret 0xc
Function at 0x100253d9
Capabilities:
Check if file exists
Create service

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x78], ax
xor esi, esi
lea eax, [ebp - 0x76]
push esi
push eax
call fcn.1002bdc0
add esp, 0xc
call fcn.10025361
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x10025482
push 0x104
lea eax, [ebp - 0x78]
push eax
call fcn.10025361
mov ebx, eax
xor ecx, ecx
call fcn.10012cec
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
jne 0x10025482
cmp word [0x10058e28], si
je 0x10025474
push 0x104
push 0x10058e28
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
call fcn.10025361
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x1002551d
lea eax, [ebp - 0x78]
push eax
call edi
test eax, eax
je 0x1002551d
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
cmp ebx, esi
je 0x1002551d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..sys
push ebx
call edi
test eax, eax
jne 0x100254b7
xor edi, edi
inc edi
jmp 0x100254c6
push str..exe
push ebx
call edi
test eax, eax
jne 0x1002551d
push 0x10
pop edi
push 0xf003f
push esi
push esi
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x80], eax
cmp eax, esi
je 0x10025515
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
push 1
push 3
push edi
push 0xf01ff
mov eax, str.swvv
push eax
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x80]
call fcn.100146e8
xor eax, eax
cmp dword [ebp - 0x7c], esi
setne al
jmp 0x1002551f
lea eax, [ebp - 0x80]
call fcn.100146e8
xor eax, eax
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
add ebp, 0x194
leave
ret
Function at 0x10025dd3
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0x134
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
push edi
push 0x110
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
xor edi, edi
mov dword [ebp - 0x64], 0x114
call fcn.1002bdc0
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp + 0xbc], 0x8000
jne 0x10025e2b
mov edi, 0x100
jmp 0x10025e54
cmp dword [ebp + 0xbc], 0x8004
je 0x10025e4f
cmp dword [ebp - 0x60], 6
jb 0x10025e54
cmp dword [ebp - 0x5c], 1
jb 0x10025e54
cmp dword [ebp + 0xbc], 0x8003
jne 0x10025e54
mov edi, 0x80
mov ecx, dword [ebp + 0xc0]
xor esi, esi
inc esi
shl esi, cl
cmp edi, ebx
je 0x10025e96
xor eax, eax
inc eax
mov ecx, ebx
shl eax, cl
test esi, eax
je 0x10025e90
mov al, bl
add al, 0x41
push 0
mov byte [ebp - 0x68], al
lea eax, [ebp - 0x68]
push eax
push 5
push edi
mov byte [ebp - 0x67], 0x3a
mov byte [ebp - 0x66], 0x5c
mov byte [ebp - 0x65], 0
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
inc ebx
cmp ebx, 0x1a
jl 0x10025e63
and dword [ebp - 0x78], 0
xor ecx, ecx
cmp dword [ebp - 0x60], 6
push 2
pop eax
mov word [ebp - 0x70], cx
mov dword [ebp - 0x80], 0x14
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], esi
mov ecx, 0x3e8
jb 0x10025ebe
push 0x64
pop ecx
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea edx, [ebp - 0x6c]
push edx
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xbc]
mov ebx, 0x219
push ebx
mov edi, 0xffff
push edi
call esi
cmp dword [ebp - 0x60], 6
jae 0x10025f09
mov eax, 0x8000
cmp dword [ebp + 0xbc], eax
jne 0x10025f09
lea ecx, [ebp - 0x6c]
push ecx
push 0xc8
push 2
lea ecx, [ebp - 0x80]
push ecx
push eax
push ebx
push edi
call esi
mov ecx, dword [ebp + 0xb0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
add ebp, 0xb4
leave
ret 8
Function at 0x10026804
Capabilities:
Check if file exists

Disassembly:
push 0x15c
mov eax, 0x10042285
call fcn.1002a6aa
push 0x118
xor ebx, ebx
lea eax, [ebp - 0x164]
push ebx
push eax
mov dword [ebp - 0x168], 0x11c
call fcn.1002bdc0
add esp, 0xc
call fcn.10012f30
mov edi, str.swvv
test eax, eax
je 0x100268e9
push edi
call fcn.10014832
test eax, eax
je 0x100268e9
push edi
call fcn.100148ec
test eax, eax
jne 0x100268e9
lea esi, [ebp - 0x168]
call fcn.10012f84
test eax, eax
je 0x100268e9
cmp dword [ebp - 0x164], 6
jne 0x100268e9
push edi
push str.SYSTEMCurrentControlSetServices_s
lea ecx, [ebp - 0x48]
call fcn.1001418c
pop ecx
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], 8
mov ecx, dword [ebp - 0x44]
jae 0x10026899
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
push eax
mov edx, str.ImagePath
call fcn.10014437
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x100268cf
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x100268b9
lea eax, [ebp - 0x28]
push str.swvv64_win7.sys
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x100268cf
push edi
call fcn.10014896
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.10001e8c
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.10001e8c
push edi
call fcn.10014832
test eax, eax
je 0x1002691f
push edi
call fcn.100147cb
test eax, eax
je 0x10026902
xor eax, eax
inc eax
jmp 0x10026934
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10026919
cmp eax, 3
je 0x10026919
cmp eax, 0x241
jne 0x10026932
push edi
call fcn.10014896
call fcn.100253d9
test eax, eax
je 0x10026932
push edi
call fcn.100147cb
test eax, eax
jne 0x100268fd
xor eax, eax
call fcn.1002a72d
ret
Function at 0x10026b34
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x52c], ecx
cmp eax, ebx
je 0x10026c5c
cmp ecx, ebx
je 0x10026c5c
cmp dword [ebp + 0xc], ebx
je 0x10026c5c
call fcn.10026804
test eax, eax
jne 0x10026b85
push 2
pop eax
jmp 0x10026c5f
mov edi, 0x103
push edi
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.1002bdc0
add esp, 0xc
lea ecx, [ebp - 0x110]
call fcn.100252a8
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x110]
push eax
call esi
test eax, eax
jne 0x10026bdc
lea eax, [ebp - 0x110]
push eax
call fcn.10012d9e
lea eax, [ebp - 0x110]
push eax
call esi
test eax, eax
jne 0x10026bdc
push 0x65
jmp 0x10026b7f
push 0x40f
lea eax, [ebp - 0x51f]
push ebx
push eax
mov byte [ebp - 0x520], bl
call fcn.1002bdc0
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x110]
push dword [ebp - 0x52c]
push dword [ebp - 0x528]
push eax
push str.__s____s___s__d
lea eax, [ebp - 0x520]
push 0x410
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x1c
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x520]
push eax
mov dword [ebp - 0x524], ebx
call fcn.1002516a
test eax, eax
jne 0x10026c4b
push 0x66
jmp 0x10026b7f
mov eax, dword [ebp - 0x524]
cmp eax, edi
jne 0x10026c5f
push 0x67
jmp 0x10026b7f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
leave
ret 8

Function at 0x10027c28
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.10012564
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
lea edi, [ebp - 0x10]
lea esi, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.10015150
test al, al
jne 0x10027c85
call fcn.1000e803
cmp dword [eax + 0x18], 8
jb 0x10027c71
mov eax, dword [eax + 4]
jmp 0x10027c74
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 8]
call fcn.10002aa8
jmp 0x10027c46
lea eax, [ebp - 0x30]
push eax
call fcn.100052ba
pop edi
pop esi
leave
ret
Function at 0x10028003
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
call fcn.100133c2
mov dword [ebp - 0x230], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.1002bdc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.drivers
lea eax, [ebp - 0x210]
push eax
call esi
lea edx, [ebp - 0x210]
call fcn.10027c28
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100280b2
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x10028143
push edi
lea ecx, [ebp - 0x210]
call fcn.10012af7
test eax, eax
jne 0x10028141
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call esi
test eax, eax
jne 0x10028141
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.10027c02
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
pop ecx
pop ecx
jae 0x10028103
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1002812e
push ebx
lea eax, [ebp - 0x210]
push eax
push edi
call esi
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x10028131
push 9
pop edi
push ebx
push 1
lea esi, [ebp - 0x22c]
call fcn.10001e8c
jmp 0x10028143
xor edi, edi
push dword [ebp - 0x230]
call fcn.10013402
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
leave
ret

Function at 0x100286c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x100286dc
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x100286d8
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100287f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.100289bd
mov bl, al
mov al, dl
call fcn.100289bd
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.100289bd
mov bl, al
mov al, byte [esi - 4]
call fcn.100289bd
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.100289bd
mov bl, al
mov al, byte [esi]
call fcn.100289bd
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.100289bd
mov bl, al
mov al, byte [esi - 0xc]
call fcn.100289bd
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1002881f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
leave
ret 4

Function at 0x100288ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10055330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.10028a39
push ebx
mov dl, al
call fcn.10028a12
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.100289cd
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.100289eb
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.100289cd
push ebx
mov byte [ebp - 0x15], al
call fcn.100289eb
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.10028a12
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.10028a39
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.10028a12
mov bl, al
mov al, byte [edi + 4]
call fcn.10028a39
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.100289eb
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.100289cd
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.100289eb
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.100289cd
xor bl, al
mov al, dl
call fcn.10028a39
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10028a12
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x100288d8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029677
leave
ret 4