joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102a913
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10ed030]
mov esi, 0x10ed030
mov edi, 0x10029d4
cmp eax, esi
je 0x102a95b
test byte [eax + 0x1c], 1
je 0x102a95b
cmp byte [eax + 0x19], 5
jb 0x102a95b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102948f
mov eax, dword [0x10ed030]
and dword [ebp - 4], 0
cmp eax, esi
je 0x102a9a5
test byte [eax + 0x1c], 2
je 0x102a982
cmp byte [eax + 0x19], 5
jb 0x102a982
push edi
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102a9a5
test byte [eax + 0x1c], 2
je 0x102a9a5
cmp byte [eax + 0x19], 5
jb 0x102a9a5
push 0x1f4
push edi
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102a9d3
test byte [eax + 0x1c], 2
je 0x102a9d3
cmp byte [eax + 0x19], 5
jb 0x102a9d3
push edi
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x102aa1a
mov dword [ebp - 8], 1
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aa11
test byte [eax + 0x1c], 2
je 0x102aa11
cmp byte [eax + 0x19], 5
jb 0x102aa11
push edi
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x102aa41
and dword [ebp - 8], 0
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aa41
test byte [eax + 0x1c], 2
je 0x102aa41
cmp byte [eax + 0x19], 5
jb 0x102aa41
push edi
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x14]
ja 0x102aa5d
cmp dword [ebp - 8], 0
jne 0x102a97d
jmp 0x102aa95
mov dword [ebp - 4], 0x5b4
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aaca
test byte [eax + 0x1c], 2
je 0x102aa9a
cmp byte [eax + 0x19], 2
jb 0x102aa9a
push dword [ebp + 0x14]
call ebx
push eax
push dword [ebp + 0x10]
mov eax, dword [0x10ed030]
push edi
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01047210
mov eax, dword [0x10ed030]
cmp eax, esi
je 0x102aaca
test byte [eax + 0x1c], 1
je 0x102aaca
mov edx, dword [ebp - 4]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x102aaca
push dword [ebp - 4]
push edi
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.010280a5
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x102da2c
Capabilities:
Get session information
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10ed030]
mov edi, 0x10ed030
cmp eax, edi
je 0x102da60
test byte [eax + 0x1c], 1
je 0x102da60
push 0x1002b50
push 0x13e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
lea ecx, [ebp - 8]
push ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
inc eax
xor esi, esi
push eax
push esi
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
mov ebx, eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x102dab6
test byte [eax + 0x1c], 2
je 0x102dab6
cmp byte [eax + 0x19], 5
jb 0x102dab6
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push 0x1002b50
push 0x13f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01047210
mov eax, dword [0x10ed030]
cmp ebx, esi
je 0x102db99
cmp dword [ebp - 8], esi
je 0x102db86
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], esi
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
jae 0x102db7c
mov eax, dword [ebp - 4]
add eax, ebx
mov ecx, dword [eax + 8]
cmp ecx, esi
je 0x102daf4
cmp ecx, 2
jle 0x102db6d
cmp ecx, 4
jg 0x102db6d
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 5
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
push dword [eax]
push esi
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov dword [ebp - 0x1c], eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x102db48
test byte [eax + 0x1c], 2
je 0x102db48
cmp byte [eax + 0x19], 5
jb 0x102db48
push dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
push dword [ebp - 0x1c]
push dword [ebx + ecx]
push dword [ebp - 0xc]
push 0x1002b50
push 0x140
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102cae0
cmp dword [ebp - 0x1c], esi
je 0x102db66
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x102db66
xor ecx, ecx
cmp cx, word [eax]
je 0x102db5e
inc dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x102db6d
mov dword [ebp - 0x20], 1
inc dword [ebp - 0xc]
add ebx, 0xc
cmp dword [ebp - 0x10], esi
je 0x102dad2
cmp dword [ebp - 0x20], esi
jne 0x102db89
cmp dword [ebp - 0x10], esi
jne 0x102db89
mov dword [ebp - 0x14], esi
push dword [ebp - 4]
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [0x10ed030]
mov dword [ebp - 4], esi
cmp eax, edi
pop edi
pop esi
pop ebx
je 0x102dbc4
test byte [eax + 0x1c], 1
je 0x102dbc4
cmp byte [eax + 0x19], 5
jb 0x102dbc4
push dword [ebp - 0x14]
push 0x1002b50
push 0x141
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x102e2c5
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10ed030]
mov edi, dword [ebp + 0x18]
mov esi, 0x1002b50
cmp eax, 0x10ed030
je 0x102e314
test byte [eax + 0x1c], 1
je 0x102e314
cmp byte [eax + 0x19], 5
jb 0x102e314
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102ccce
mov eax, dword [0x10ed030]
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
cmp ecx, 0xffffffff
je 0x102e345
cmp ecx, ebx
je 0x102e345
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
je 0x102e345
xor edx, edx
cmp dx, word [ecx]
jne 0x102e386
mov ecx, 0x80070057
mov dword [ebp + 0x18], ecx
cmp eax, 0x10ed030
je 0x102e493
test byte [eax + 0x1c], 2
je 0x102e45f
cmp byte [eax + 0x19], 2
jb 0x102e45f
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push esi
push 0x1d
jmp 0x102e44f
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x102e3ae
xor ecx, ecx
cmp cx, word [eax]
je 0x102e3ae
push 0x2011f
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.010292c5
mov ebx, eax
jmp 0x102e3ba
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0102e256
test ebx, ebx
jne 0x102e3ef
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
call fcn.0102c5da
mov ebx, eax
test ebx, ebx
jne 0x102e3db
mov eax, dword [ebp - 4]
mov dword [edi], eax
cmp dword [ebp + 0x1c], 1
jne 0x102e3ef
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
cmp ebx, 0x490
je 0x102e3fc
cmp ebx, 2
jne 0x102e3fe
xor ebx, ebx
test ebx, ebx
je 0x102e45a
jle 0x102e410
and ebx, 0xffff
or ebx, 0x80070000
mov dword [ebp + 0x18], ebx
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x102e493
test byte [eax + 0x1c], 2
je 0x102e45f
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp ebx, edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x102e45f
push dword [ebp + 0x1c]
push dword [edi]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push esi
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0102cb82
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x102e493
test byte [eax + 0x1c], 1
je 0x102e493
movzx ecx, byte [eax + 0x19]
xor edx, edx
cmp dword [ebp + 0x18], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp ecx, edx
jl 0x102e493
push dword [ebp + 0x18]
push esi
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
lea ecx, [ebp - 0x1c]
call fcn.010292a7
lea ecx, [ebp - 0x10]
call fcn.010292a7
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x102f573
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push 0x1c
mov eax, 0x10da3d2
call fcn.010a0b4c
mov esi, ecx
mov eax, dword [0x10ed030]
mov ebx, 0x10ed030
cmp eax, ebx
je 0x102f5a7
test byte [eax + 0x1c], 1
je 0x102f5a7
push 0x1002b50
push 0x4f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
xor edi, edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
push 0x20119
push 0x10027a0
push 0x80000002
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.010292c5
test eax, eax
jne 0x102f627
lea eax, [ebp - 0x10]
push eax
push 0x1003054
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], edi
call fcn.0102c5da
test eax, eax
jne 0x102f627
mov eax, dword [0x10ed030]
cmp eax, ebx
je 0x102f751
test byte [eax + 0x1c], 2
je 0x102f751
cmp byte [eax + 0x19], 5
jb 0x102f751
push 0x1002b50
push 0x50
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
jmp 0x102f751
push 1
lea eax, [esi + 0x1dc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0102ed97
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, dword [esi + 0x200]
mov ecx, dword [0x10ed050]
sbb edx, dword [esi + 0x204]
xor edi, edi
cmp edx, edi
ja 0x102f66e
jb 0x102f660
cmp eax, ecx
jae 0x102f66e
mov eax, dword [esi + 0x1fc]
mov dword [ebp - 0x14], eax
jmp 0x102f73e
lea edi, [esi + 0x1f8]
cmp dword [edi], 0
jne 0x102f6d3
push edi
push 0x1003044
push 1
push 0
push 0x1003034
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10ed030]
cmp ecx, ebx
je 0x102f6d3
test byte [ecx + 0x1c], 2
je 0x102f6d3
movzx eax, byte [ecx + 0x19]
xor edx, edx
cmp dword [ebp - 0x10], edx
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x102f6ce
push dword [edi]
push dword [ebp - 0x10]
push 0x1002b50
push 0x51
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0102cde9
mov ebx, 0x10ed030
mov edi, dword [edi]
test edi, edi
je 0x102f73e
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push ecx
push 0x1003004
push edi
call dword [eax + 0x6c]
test eax, eax
jl 0x102f6f9
or eax, 0xffffffff
cmp ax, word [ebp - 0x10]
je 0x102f6f9
and dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [esi + 0x200], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x204], edx
mov dword [esi + 0x1fc], eax
mov eax, dword [0x10ed030]
cmp eax, ebx
je 0x102f73e
test byte [eax + 0x1c], 2
je 0x102f73e
cmp byte [eax + 0x19], 5
jb 0x102f73e
push dword [ebp - 0x14]
push 0x1002b50
push 0x52
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
cmp byte [ebp - 0x18], 0
mov byte [ebp - 4], 0
je 0x102f751
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x204]
add esi, 0x58
push dword [esi + 0x1a8]
push esi
call fcn.0102a31a
mov eax, dword [0x10ed030]
cmp eax, ebx
je 0x102f790
test byte [eax + 0x1c], 1
je 0x102f790
cmp byte [eax + 0x19], 5
jb 0x102f790
push dword [ebp - 0x14]
push 0x1002b50
push 0x53
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
lea ecx, [ebp - 0x28]
call fcn.010292a7
mov eax, dword [ebp - 0x14]
call fcn.010a0c38
ret
Function at 0x104de47
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x104de7e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x104de73
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x104de80
test al, 0x10
jne 0x104de7e
mov eax, 0x10b
jmp 0x104de80
xor eax, eax
pop ebp
ret 4
Function at 0x104e2de
Capabilities:
Delete directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x10ed860]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x254], ebx
call fcn.01057138
test eax, eax
je 0x104e4cf
call fcn.010570dd
test eax, eax
je 0x104e4cf
cmp esi, ebx
je 0x104e4ca
cmp dword [ebp + 0xc], 0x104
jb 0x104e4ca
push edi
push esi
push ebx
push ebx
push 0x1c
xor eax, eax
push ebx
mov word [esi], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jl 0x104e46c
push 0x1005020
push dword [ebp + 0xc]
push esi
call fcn.0104e248
cmp eax, ebx
jl 0x104e46c
push esi
call fcn.0104de47
mov edi, eax
cmp edi, ebx
jne 0x104e4b3
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x104e380
sub eax, edx
push 0x1004fe4
push dword [ebp + 0xc]
sar eax, 1
lea eax, [esi + eax*2]
push esi
mov dword [ebp - 0x258], eax
call fcn.0104e248
cmp eax, ebx
jl 0x104e46c
push esi
mov edi, 0x124
push edi
lea eax, [ebp - 0x24c]
push eax
call fcn.0104e20e
cmp eax, ebx
jl 0x104e46c
push 0x1004fcc
push edi
lea eax, [ebp - 0x24c]
push eax
call fcn.0104e248
cmp eax, ebx
jl 0x104e46c
push esi
call fcn.0104de47
mov edi, eax
cmp edi, ebx
jne 0x104e49d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x104e3f7
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2]
push esi
mov dword [ebp - 0x250], eax
call fcn.0104e0b7
mov edi, eax
cmp edi, ebx
jne 0x104e487
push 0x1004fc0
push dword [ebp + 0xc]
push esi
call fcn.0104e248
cmp eax, ebx
jl 0x104e46c
push esi
call fcn.0104de47
mov edi, eax
cmp edi, ebx
jne 0x104e487
push esi
call fcn.0104dfa0
mov edi, eax
cmp edi, ebx
jne 0x104e487
lea eax, [ebp - 0x24c]
push eax
call fcn.0104de47
mov edi, eax
cmp edi, ebx
jne 0x104e487
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x254], 1
call fcn.0104de89
mov edi, eax
cmp edi, ebx
je 0x104e4ba
cmp dword [ebp - 0x254], ebx
je 0x104e487
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x250]
cmp eax, ebx
je 0x104e49d
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x258]
cmp eax, ebx
je 0x104e4b3
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [esi], ax
jmp 0x104e4c5
mov ecx, dword [ebp - 0x250]
xor eax, eax
mov word [ecx], ax
mov eax, edi
pop edi
jmp 0x104e4d4
push 0x57
pop eax
jmp 0x104e4d4
mov eax, 0x8000ffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010a0b37
leave
ret 8
Function at 0x105224c
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.01057138
test eax, eax
je 0x105238f
call fcn.010570dd
test eax, eax
je 0x105238f
push ebx
push edi
mov ebx, 0x10efed8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov edi, 0x10efec4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
mov dword [0x10eff04], esi
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
xor edi, edi
inc edi
mov dword [0x10efed4], eax
cmp eax, esi
je 0x10522c6
push esi
push 0xffffffffffffffff
push esi
push 0x1051f39
push eax
push 0x10eff00
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x10522d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x105230c
push 0x10efec4
push 0x10efefc
mov dword [ebp - 8], edi
call sub.IPHLPAPI.DLL_NotifyAddrChange
mov dword [ebp - 4], eax
cmp eax, 0x3e5
jne 0x105230c
mov esi, 0x10efef8
mov dword [ebp - 0xc], edi
call fcn.0104f3ad
mov dword [ebp - 4], eax
test eax, eax
jne 0x1052313
and dword [ebp - 4], eax
mov dword [0x10eff20], edi
xor esi, esi
cmp dword [ebp - 4], esi
je 0x1052381
jmp 0x1052315
xor esi, esi
push ebx
mov dword [0x10eff04], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 8], esi
je 0x105232d
mov dword [0x10eff00], esi
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0xc], esi
je 0x1052343
push 0x10efec4
call sub.IPHLPAPI.DLL_CancelIPChangeNotify
mov eax, dword [0x10efed4]
cmp eax, esi
je 0x1052353
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, 0x10efec4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x10efef8]
cmp eax, esi
je 0x1052375
push eax
call fcn.010a093d
pop ecx
mov dword [0x10efef8], esi
mov dword [0x10efefc], esi
mov dword [0x10eff20], esi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
pop edi
pop ebx
jmp 0x10523c1
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x10523bc
test byte [eax + 0x1c], 4
je 0x10523bc
cmp byte [eax + 0x19], 2
jb 0x10523bc
push 0x1005038
push 0x88
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov eax, 0x8000ffff
pop esi
leave
ret
Function at 0x1052629
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x268
mov eax, 0x10dbe24
call fcn.010a0bbf
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x26c], ecx
mov eax, dword [0x10ed030]
mov ebx, 0x1005038
cmp eax, 0x10ed030
je 0x1052685
test byte [eax + 0x1c], 1
je 0x1052685
cmp byte [eax + 0x19], 5
jb 0x1052685
mov ecx, dword [ecx + 4]
mov edx, dword [esi]
mov edi, dword [edi]
push ecx
push edx
push edi
push ebx
push 0xd1
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0103adb1
and dword [ebp - 0x260], 0
push 0x24c
lea eax, [ebp - 0x25c]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi]
add esp, 0xc
lea ecx, [ebp - 0x260]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x268], eax
xor eax, eax
cmp dword [ebp - 0x268], 0xffffffff
jne 0x10526c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x10ed030]
mov edi, 0x10ed030
cmp ecx, edi
je 0x105271f
test byte [ecx + 0x1c], 2
je 0x105271f
movzx edx, byte [ecx + 0x19]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffffd
add edi, 5
cmp edx, edi
jl 0x105271a
push dword [ebp - 0x268]
mov esi, dword [esi]
lea edx, [ebp - 0x234]
push edx
push esi
push eax
push ebx
push 0xd2
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0103aeed
mov ecx, dword [0x10ed030]
mov edi, 0x10ed030
cmp dword [ebp - 0x268], 0xffffffff
je 0x1052838
push 0x10f1178
lea ecx, [ebp - 0x264]
call fcn.0104bdc3
and dword [ebp - 4], 0
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x105276d
test byte [eax + 0x1c], 2
je 0x105276d
cmp byte [eax + 0x19], 5
jb 0x105276d
lea ecx, [ebp - 0x234]
push ecx
push ebx
push 0xd3
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e3b
push dword [ebp - 0x26c]
lea eax, [ebp - 0x234]
push eax
call fcn.01050642
test eax, eax
jne 0x1052809
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x274]
lea eax, [ebp - 0x270]
push eax
call fcn.0103f40c
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 1
call fcn.01028a2a
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.010280a5
push dword [ebp - 0x264]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10527dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x10ed030]
cmp eax, edi
je 0x1052809
test byte [eax + 0x1c], 2
je 0x1052809
cmp byte [eax + 0x19], 5
jb 0x1052809
push esi
push dword [ebp - 0x264]
push ebx
push 0xd4
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104adee
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x268]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1052740
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.010280a5
mov ecx, dword [0x10ed030]
cmp ecx, edi
je 0x1052853
test byte [ecx + 0x1c], 1
je 0x1052853
push ebx
push 0xd5
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01027e15
call fcn.010a0c51
ret 0xc
Function at 0x1053636
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x10dbf6b
call fcn.010a0b4c
mov eax, dword [0x10ed030]
mov edi, dword [ebp + 8]
cmp eax, 0x10ed030
je 0x1053675
test byte [eax + 0x1c], 1
je 0x1053675
cmp byte [eax + 0x19], 5
jb 0x1053675
push dword [edi + 4]
push 0x1005038
push 0xcb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027ecb
push 0x10f1178
lea ecx, [ebp + 8]
call fcn.0104bdc3
mov esi, 0x104
xor ebx, ebx
push esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0102869f
push esi
push eax
call fcn.0104e2de
test eax, eax
jne 0x1053824
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.0102f001
push 0x1001900
lea ecx, [ebp + 8]
call fcn.01028a81
push 0x100550c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0103f40c
cmp dword [edi + 4], ebx
mov byte [ebp - 4], 1
jle 0x1053819
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
mov ecx, edi
call fcn.010503fb
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0105258b
push 0x1005500
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.0103f40c
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.010280a5
push dword [ebp - 0x18]
call esi
xor edx, edx
test eax, eax
jne 0x105372b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x105375e
test byte [ecx + 0x1c], 2
je 0x105375e
cmp byte [ecx + 0x19], 5
jb 0x105375e
push edx
push dword [ebp - 0x18]
push 0x1005038
push 0xcc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0104adee
mov dword [ebp - 0x14], 0x1005108
mov dword [ebp - 0x1c], 6
push ebx
mov ecx, edi
call fcn.010503fb
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0105258b
push dword [ebp - 0x14]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0103f40c
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.010280a5
push dword [ebp - 0x10]
call esi
xor edx, edx
test eax, eax
jne 0x10537b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, dword [0x10ed030]
cmp ecx, 0x10ed030
je 0x10537e8
test byte [ecx + 0x1c], 2
je 0x10537e8
cmp byte [ecx + 0x19], 5
jb 0x10537e8
push edx
push dword [ebp - 0x10]
push 0x1005038
push 0xcd
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0104adee
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.010280a5
add dword [ebp - 0x14], 0xa
dec dword [ebp - 0x1c]
jne 0x105376c
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.010280a5
inc ebx
cmp ebx, dword [edi + 4]
jl 0x10536e0
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.010280a5
mov eax, dword [0x10ed030]
cmp eax, 0x10ed030
je 0x105384b
test byte [eax + 0x1c], 1
je 0x105384b
push 0x1005038
push 0xce
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01027e15
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.010280a5
call fcn.010a0c38
ret 4