joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052660
Capabilities:
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1005266d
xor eax, eax
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10052690
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
push 0x10227334
call fcn.10029940
add esp, 8
call fcn.10051e60
call fcn.10051ff0
push esi
call fcn.10052100
push esi
call fcn.100523a0
add esp, 8
mov eax, 1
pop esi
ret

Function at 0x10052cc0
Capabilities:
Delete file

Disassembly:
sub esp, 0x804
lea eax, [esp + 0x404]
push esi
push edi
mov edi, dword [esp + 0x814]
push eax
push edi
call sub.platform.dll_Ordinal_13
add esp, 8
test eax, eax
jne 0x10052d06
or ecx, 0xffffffff
lea edx, [esp + 0x40c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x810]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x410]
push edx
push eax
push esi
push ecx
call fcn.10027f40
add esp, 0x14
test eax, eax
jne 0x10052d3c
pop edi
pop esi
add esp, 0x804
ret
push 0
lea edx, [esp + 0x10]
push 0
push edx
call fcn.10028810
add esp, 0xc
test eax, eax
jne 0x10052d5a
pop edi
pop esi
add esp, 0x804
ret
mov ecx, dword [0x107ab964]
push esi
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x18]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
cmp eax, 0xffffffff
jne 0x10052d97
lea ecx, [esp + 0xc]
push ecx
push 0x10227334
call fcn.10029940
add esp, 8
mov edx, dword [esp + 0x818]
mov eax, dword [esp + 0x820]
mov ecx, dword [esp + 0x81c]
push 0
push 1
push edx
push eax
mov eax, dword [0x107ab964]
lea edx, [esp + 0x41c]
push ecx
push edx
push eax
push 0x10227334
call fcn.10029df0
add esp, 0x20
mov eax, 1
pop edi
pop esi
add esp, 0x804
ret
Function at 0x10054d70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
test ecx, ecx
push edi
je 0x10054eee
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10054eee
mov edx, dword [esp + 0x28]
mov eax, 1
cmp edx, eax
jne 0x10054db1
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x10054eee
mov edx, dword [esp + 0x20]
test edx, edx
je 0x10054eee
mov edx, dword [esp + 0x24]
mov ebp, ecx
cmp edx, eax
jne 0x10054e26
lea edx, [ecx - 4]
xor eax, eax
xor ebp, ebp
test edx, edx
jbe 0x10054e15
lea edi, [ecx - 5]
cmp eax, edi
jae 0x10054e15
mov ecx, eax
inc eax
mov cl, byte [ecx + esi]
cmp cl, 0x33
jne 0x10054ddb
inc eax
jmp 0x10054e11
cmp cl, 0x66
jne 0x10054df1
mov cx, word [eax + esi + 1]
mov word [esi + ebp], cx
add ebp, 2
add eax, 3
jmp 0x10054e11
cmp cl, 0xb0
jne 0x10054e00
mov cl, byte [eax + esi]
inc eax
mov byte [esi + ebp], cl
inc ebp
jmp 0x10054e11
cmp cl, 0xb8
jne 0x10054e11
mov ecx, dword [eax + esi]
mov dword [esi + ebp], ecx
add ebp, 4
add eax, 4
cmp ebp, edx
jb 0x10054dc9
cmp ebp, edx
jae 0x10054eee
cmp ebp, 4
jl 0x10054eee
mov eax, dword [esi + ebp - 8]
mov dl, byte [esi + ebp - 4]
mov ebx, ebp
mov dword [esp + 0x24], eax
shr ebx, 2
lea eax, [ebp - 8]
sub ebx, 2
xor edi, edi
mov byte [esp + 0x18], dl
test eax, eax
jbe 0x10054e79
mov dl, byte [esp + 0x18]
mov cl, bl
add cl, dl
mov edx, dword [edi + esi]
and ecx, 0xff
push ecx
push edx
call fcn.100185b0
mov edx, dword [esp + 0x2c]
add esp, 8
xor eax, edx
add edi, 4
sub eax, ebx
dec ebx
mov dword [edi + esi - 4], eax
lea eax, [ebp - 8]
cmp edi, eax
jb 0x10054e47
cmp dword [esp + 0x28], 1
jne 0x10054ee4
mov ebx, dword [esp + 0x2c]
test ebx, ebx
je 0x10054eee
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x1c]
and ecx, 3
mov dword [esp + 0x14], 0
rep stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push 7
push ecx
push edx
push ebp
push esi
push 0x10227334
call fcn.10011a90
add esp, 0x1c
test eax, eax
jne 0x10054eda
mov eax, dword [esp + 0x14]
cmp eax, 3
je 0x10054eda
cmp eax, 2
jne 0x10054eee
mov eax, dword [esp + 0x20]
test eax, eax
jbe 0x10054eee
mov dword [ebx], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x1005aae0
Capabilities:
Set file attributes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x400
test edx, edx
push esi
push edi
je 0x1005abcb
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 8]
push ebx
rep stosd dword es:[edi], eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0x5c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
pop ebx
je 0x1005abcb
mov cl, byte [eax + 1]
inc eax
test cl, cl
mov edx, eax
je 0x1005ab51
mov byte [eax], 0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1005ab46
mov edi, str.Uninstall.exe
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x107ab964]
mov edx, dword [ecx]
call dword [edx]
test eax, eax
jne 0x1005abcb
mov ecx, dword [0x107ab964]
lea eax, [esp + 8]
push 0x180
push eax
mov edx, dword [ecx]
call dword [edx + 0x38]
lea ecx, [esp + 8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [0x107ab964]
lea eax, [esp + 8]
push eax
mov edx, dword [ecx]
call dword [edx + 0x3c]
pop edi
mov eax, 1
pop esi
add esp, 0x400
ret
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret
Function at 0x1005d920
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0xd40
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x140]
push esi
push edi
mov edi, dword [esp + 0xd4c]
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14c]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
jne 0x1005d973
pop edi
pop esi
add esp, 0xd40
ret
mov byte [eax + 1], 0
or ecx, 0xffffffff
lea edi, [esp + 0x148]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x548]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x948]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..bat
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1005dac2
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 3
lea edx, [esp + 0x40]
push 0x102660e8
push edx
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1005daba
lea edi, [esp + 0x950]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x550]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x550]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x550]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x107ab964]
mov eax, dword [ecx]
call dword [eax + 0x3c]
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
cmp eax, 1
je 0x1005da24
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0xd40
ret
Function at 0x1005fb90
Capabilities:
Delete file
Move file

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
sub esp, 0x400
mov edx, dword [esp + 0x410]
push ebx
push esi
mov esi, dword [esp + 0x40c]
push edi
push 0
push 0
push eax
mov eax, dword [0x107ab964]
push ecx
push edx
push esi
push eax
push 0x10227334
call fcn.10029df0
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1005fbed
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
push 0x10227334
call fcn.10029940
add esp, 8
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0xc]
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, str.SYSTEMCurrentControlSetServices
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.cherimoya
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push reloc.platform.dll_Ordinal_2
call dword [0x107ab9d4]
lea ecx, [esp + 0x18]
push str.bsdriver
push ecx
push reloc.platform.dll_Ordinal_2
call dword [0x107ab9d4]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x400
ret
Function at 0x100600d0
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x400
push esi
mov esi, dword [esp + 0x408]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10060102
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
push 0x10227334
call fcn.10029940
add esp, 8
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 8]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
mov edi, str.C:WINDOWS_system32_binaries_burst6y5
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xc]
push ecx
call fcn.1005fdd0
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x10]
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, str.C:WINDOWS_system32iqznczmv
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x14]
push ecx
call fcn.1005fdd0
add esp, 0x10
xor eax, eax
pop edi
pop esi
add esp, 0x400
ret
Function at 0x10061180
Capabilities:
Delete file

Disassembly:
sub esp, 0x400
mov ecx, 0x100
xor eax, eax
push ebx
push esi
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push 0x28
call fcn.100286d0
add esp, 8
test eax, eax
je 0x10061299
mov esi, dword [sym.imp.MSVCRT.dll_strncmp]
push 7
lea ecx, [esp + 0x12]
push str.Users_
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x100611d3
lea edx, [esp + 0xc]
mov edi, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_run.lnk
jmp 0x100611f5
push 0x18
lea eax, [esp + 0x12]
push str.Documents_and_Settings_
push eax
call esi
add esp, 0xc
test eax, eax
jne 0x10061299
lea edx, [esp + 0xc]
mov edi, str.Start_MenuProgramsStartup_run.lnk
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call edi
test eax, eax
jne 0x1006123d
lea ecx, [esp + 0xc]
push ecx
push 0x10227334
call fcn.10029940
add esp, 8
mov edx, dword [esp + 0x418]
mov eax, dword [esp + 0x414]
mov ecx, dword [esp + 0x41c]
mov esi, dword [esp + 0x410]
push 0
push 0
push edx
mov edx, dword [0x107ab964]
push eax
push ecx
push esi
push edx
push 0x10227334
call fcn.10029df0
add esp, 0x20
push esi
call edi
test eax, eax
jne 0x1006128a
push esi
push 0x10227334
call fcn.10029940
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x400
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
Function at 0x10062e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x50
mov ecx, dword [0x107ab964]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x60]
mov al, 0xd
push edi
mov byte [esp + 0x28], al
mov byte [esp + 0x29], 0xa
mov byte [esp + 0x2a], 5
mov byte [esp + 0x2b], 0xf
mov byte [esp + 0x2c], 0x59
mov byte [esp + 0x2d], 0x7b
mov byte [esp + 0x2e], 0x38
mov byte [esp + 0x2f], 0x5a
mov byte [esp + 0x30], 0x5b
mov byte [esp + 0x31], 0x36
mov byte [esp + 0x32], 0x31
mov byte [esp + 0x33], 0x69
mov byte [esp + 0x34], 0x7e
mov byte [esp + 0x35], al
mov byte [esp + 0x36], al
mov byte [esp + 0x37], 9
mov eax, dword [ecx]
push 0
push 0x8002
push esi
call dword [eax + 4]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10063062
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x38]
lea edx, [esp + 0x38]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
push edx
mov dword [esp + 0x24], ecx
push eax
mov byte [esp + 0x2c], cl
mov ecx, dword [0x107ab964]
push ebx
push ecx
call fcn.100f6720
mov ecx, dword [0x107ab964]
add esp, 0x10
test eax, eax
je 0x1006305c
mov eax, dword [ecx]
push ebx
call dword [eax + 0x20]
test eax, eax
mov dword [esp + 0x14], eax
jle 0x10063056
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
add ecx, edx
sub eax, ecx
mov dword [esp + 0x10], ecx
cmp eax, 0x20
jge 0x10062f91
mov ecx, dword [0x107ab964]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [esp + 0x68]
mov edx, dword [0x107ab964]
push ecx
push esi
push edx
call fcn.1002bac0
add esp, 0xc
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x50
ret
lea ebp, [eax - 0x11]
push ebp
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10062fba
mov ecx, dword [0x107ab964]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x14]
and ecx, 3
push 1
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [0x107ab964]
push esi
push ebp
add ecx, 0x11
push ebp
push ecx
push edx
push ebx
push eax
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x1006304c
cmp dword [esp + 0x18], ebp
jne 0x1006304c
push 1
push 1
push 1
lea ecx, [esp + 0x34]
push 0x10
push ecx
push ebp
push esi
call fcn.10028d60
add esp, 0x1c
test eax, eax
je 0x1006304c
mov ecx, dword [0x107ab964]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [esp + 0x64]
push ebp
push esi
push ecx
call fcn.1020ce20
push esi
mov edi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x10
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
pop ebx
setne al
add esp, 0x50
ret
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [0x107ab964]
mov edx, dword [ecx]
push ebx
call dword [edx + 0x18]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
Function at 0x10063070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x4c
mov ecx, dword [0x107ab964]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x5c]
mov al, 0x21
push edi
mov byte [esp + 0x24], 0x32
mov byte [esp + 0x25], 0x5a
mov byte [esp + 0x26], 3
mov byte [esp + 0x27], 0xb
mov byte [esp + 0x28], 9
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], 0x2c
mov byte [esp + 0x2c], 8
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0x12
mov byte [esp + 0x2f], 0x36
mov byte [esp + 0x30], 0x42
mov byte [esp + 0x31], 0x1f
mov byte [esp + 0x32], 0xc
mov byte [esp + 0x33], 0xd
mov eax, dword [ecx]
push 0
push 0x8002
push esi
call dword [eax + 4]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1006322a
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x34]
lea edx, [esp + 0x34]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ecx
push edx
mov dword [esp + 0x20], ecx
push eax
mov byte [esp + 0x28], cl
mov ecx, dword [0x107ab964]
push ebx
push ecx
call fcn.100f6720
mov ecx, dword [0x107ab964]
add esp, 0x10
test eax, eax
je 0x10063224
mov eax, dword [ecx]
push ebx
call dword [eax + 0x20]
mov ebp, eax
test ebp, ebp
jle 0x1006321e
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
add ecx, eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x10], ecx
cmp eax, 0x20
jge 0x10063182
mov ecx, dword [0x107ab964]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
mov eax, dword [esp + 0x64]
mov ecx, dword [0x107ab964]
push eax
push esi
push ecx
call fcn.1002bac0
add esp, 0xc
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x4c
ret
lea edi, [eax - 0x11]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1006321e
mov ecx, dword [esp + 0x10]
mov edx, dword [0x107ab964]
lea eax, [esp + 0x14]
push 1
push eax
push esi
push edi
add ecx, 0x11
push edi
push ecx
push ebp
push ebx
push edx
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x10063214
cmp dword [esp + 0x14], edi
jne 0x10063214
push 1
push 1
push 1
lea eax, [esp + 0x30]
push 0x10
push eax
push edi
push esi
call fcn.10028d60
add esp, 0x1c
test eax, eax
je 0x10063214
mov ecx, dword [0x107ab964]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [esp + 0x60]
push edi
push esi
push ecx
call fcn.1020ce20
push esi
mov edi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x10
xor eax, eax
test edi, edi
pop edi
pop esi
pop ebp
pop ebx
setne al
add esp, 0x4c
ret
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov ecx, dword [0x107ab964]
mov edx, dword [ecx]
push ebx
call dword [edx + 0x18]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
Function at 0x10063870
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x40c
push ebx
mov ebx, dword [esp + 0x418]
push ebp
mov ebp, dword [esp + 0x418]
push esi
push edi
mov dword [ebx], 0
mov eax, dword [0x107ab964]
push ebx
push ebp
push eax
call fcn.1002bac0
add esp, 0xc
test eax, eax
je 0x10063a74
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x1c]
mov esi, ebp
rep stosd dword es:[edi], eax
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffb
lea edi, [esp + 0x1c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..WAR
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.1013ef70
add esp, 4
test eax, eax
jne 0x10063920
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40c
ret
mov ecx, dword [0x107ab964]
push 0
lea eax, [esp + 0x20]
push 0x8000
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, eax
cmp esi, 0xffffffff
je 0x10063a74
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x20]
cmp eax, 7
je 0x1006396f
mov ecx, dword [0x107ab964]
push esi
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40c
ret
mov eax, dword [0x107ab964]
lea ecx, [esp + 0x10]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push 7
push 7
push 0
push 7
push esi
push eax
mov dword [esp + 0x34], 0
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x10063a68
cmp dword [esp + 0x10], 7
jne 0x10063a68
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x18]
mov ecx, dword [0x107ab964]
lea eax, [esp + 0x1c]
push ebx
push eax
push ecx
call fcn.1002bac0
lea edx, [esp + 0x28]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edx, eax
add esp, 0x14
test edx, edx
je 0x10063a74
inc edx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov byte [edx], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebp
mov esi, ecx
or ecx, 0xffffffff
add esi, 7
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jle 0x10063a1a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40c
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
jle 0x10063a34
mov cl, byte [esp + eax + 0x14]
mov byte [edx], cl
mov ecx, dword [esp + 0x10]
inc edx
inc eax
cmp eax, ecx
jl 0x10063a24
mov byte [edx], 0
lea edx, [esp + 0x1c]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [0x107ab964]
lea edx, [esp + 0x1c]
push ebp
push edx
mov eax, dword [ecx]
call dword [eax + 0x4c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x40c
ret
mov ecx, dword [0x107ab964]
push esi
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40c
ret
Function at 0x100641c0
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x400
push esi
mov esi, dword [esp + 0x408]
push edi
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [0x107ab964]
push 0x180
push esi
mov eax, dword [ecx]
call dword [eax + 0x38]
mov ecx, dword [0x107ab964]
push esi
mov edx, dword [ecx]
call dword [edx + 0x3c]
test eax, eax
je 0x10064214
mov eax, dword [esp + 0x410]
pop edi
pop esi
mov dword [eax], 1
xor eax, eax
add esp, 0x400
ret
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 8]
lea edx, [esp + 8]
rep stosd dword es:[edi], eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
test eax, eax
jne 0x1006425f
pop edi
pop esi
add esp, 0x400
ret
mov byte [eax], 0
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 8]
push ecx
push edx
call fcn.1005fdd0
add esp, 8
mov eax, 1
pop edi
pop esi
add esp, 0x400
ret