joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret
Function at 0x10031d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebp + 0x10]
mov esi, eax
push 0
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x31
push dword [ebp + 0x14]
push dword [ebp + 8]
call esi
test eax, eax
je 0x1003249
lea ecx, [ebp - 0x3c]
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x1003249
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
test eax, eax
je 0x1003249
push 1
push eax
push 0x30
push dword [ebp + 0x14]
push dword [ebp + 8]
call esi
pop esi
leave
ret 0x14

Function at 0x10034bc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
je 0x10034ef
cmp eax, 1
jle 0x1003566
cmp eax, 3
jg 0x1003566
xor eax, eax
jmp 0x1003566
push ebx
push esi
xor ebx, ebx
mov esi, 0x100f1c0
push 0x104
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1003522
push esi
push dword [ebp - 4]
call fcn.010034bc
test eax, eax
je 0x10034f8
inc edi
test ebx, ebx
jne 0x10034f8
mov ebx, eax
jmp 0x10034f8
cmp eax, 1
jle 0x1003533
cmp eax, 3
jle 0x1003539
cmp eax, 0x103
je 0x1003539
test ebx, ebx
jne 0x1003539
mov ebx, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x1003562
cmp eax, 1
jle 0x100355c
cmp eax, 3
jle 0x1003562
test ebx, ebx
jne 0x1003562
mov ebx, eax
pop esi
mov eax, ebx
pop ebx
pop edi
leave
ret 8

Function at 0x1003cd3
Capabilities:
Copy file
Set file attributes

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
push esi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003cdd
sub eax, esi
lea eax, [eax + ecx - 4]
cmp eax, ecx
pop esi
jbe 0x1003d23
mov eax, dword [eax]
or eax, 0x20202000
cmp eax, 0x6261632e
jne 0x1003d23
push 0
push dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1003d3a
push 0x80
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
inc eax
ret 8
push 0
push dword [esp + 0xc]
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupDecompressOrCopyFileA]
test eax, eax
je 0x1003d0e
push eax
call fcn.01003bbf
xor eax, eax
jmp 0x1003d20
Function at 0x10045cf
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
xor ebx, ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10045e4
sub eax, ecx
cmp eax, 0x104
jbe 0x10045fb
xor eax, eax
jmp 0x10046a5
push esi
lea esi, [ebp - 0x104]
mov eax, edi
sub esi, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x1004606
lea eax, [ebp - 0x104]
push 0x5c
push eax
call dword [sym.imp.ntdll.dll_strrchr]
test eax, eax
pop ecx
pop ecx
je 0x10046a4
and byte [eax], 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1004648
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.010091de
mov eax, edi
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x100464a
lea eax, [ebp - 0x104]
push eax
call fcn.0100774e
push dword [0x100f300]
push 0x10015ac
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.01003cd3
cmp eax, 1
jne 0x100469c
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebx, eax
inc dword [0x100f300]
mov eax, ebx
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x10072c2
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0xa
pop eax
cmp dword [ebp + 0x18], eax
jbe 0x10072d3
mov dword [ebp + 0x18], eax
push esi
push edi
xor edi, edi
xor eax, eax
cmp dword [ebp + 0x18], edi
jbe 0x10072f0
lea ecx, [ebp + 0x18]
add ecx, 4
mov edx, dword [ecx]
mov dword [ebp + eax*4 - 0x28], edx
inc eax
cmp eax, dword [ebp + 0x18]
jb 0x10072e1
push dword [ebp + 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
cmp esi, edi
je 0x1007323
push edi
lea eax, [ebp - 0x28]
push eax
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10074f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [ebp + 8]
push ebx
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1007507
sub eax, edx
cmp eax, 0x104
jb 0x100751e
xor eax, eax
jmp 0x10075a5
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x158]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1007529
push edi
push 0x11
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
xor edi, edi
inc edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x54], 0x44
je 0x1007554
mov dword [ebp - 0x28], edi
mov word [ebp - 0x24], bx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10075a4
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], ebx
je 0x1007590
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x10076f8
Capabilities:
Delete file
Set file attributes

Disassembly:
and dword [0x101029c], 0
cmp dword [esp + 4], 0
push esi
mov esi, 0x80
je 0x1007721
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
push 4
push 0
push 3
push 0xc0000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x101029c], eax
pop esi
jne 0x100774b
xor eax, eax
mov dword [0x101029c], eax
ret 8
Function at 0x1007803
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x10019d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1007851
cmp dword [ebp + 8], eax
push 4
setne al
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x10019b8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret 4

Function at 0x100785d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov ecx, dword [ebp + 0x10]
push ebx
push esi
xor ebx, ebx
cmp ecx, ebx
push edi
mov edi, 0x1010198
jne 0x1007879
mov ecx, edi
lea edx, [ebp - 0x104]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x100787f
cmp dword [ebp + 0x14], ebx
mov esi, 0x104
je 0x10078aa
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x104]
push eax
call fcn.0100777d
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10078c1
xor eax, eax
inc eax
jmp 0x100791c
cmp dword [ebp + 0x24], ebx
je 0x10078ca
xor eax, eax
jmp 0x100791c
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push dword [ebp + 0x20]
or eax, 1
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push ebx
push dword [ebp + 8]
call dword [sym.imp.SETUPAPI.dll_SetupPromptForDiskA]
sub eax, ebx
je 0x1007908
dec eax
je 0x1007901
dec eax
je 0x10078fd
push 8
call fcn.01003bbf
jmp 0x10078c6
push 2
jmp 0x100791b
push 0x4c7
jmp 0x10078f6
mov eax, dword [ebp + 0x20]
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x100790f
push 4
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x20

Function at 0x1007bf5
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x244]
push eax
push 0x1001a0c
push dword [ebp + 8]
call fcn.0100777d
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1007c7f
test byte [ebp - 0x140], 0x10
jne 0x1007c66
push 2
mov edi, 0x1001a08
lea esi, [ebp - 0x114]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1007c66
push 3
mov edi, 0x1001a04
lea esi, [ebp - 0x114]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1007c89
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1007c35
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1007c82
Function at 0x1007cf8
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1007d23
xor eax, eax
jmp 0x1007e96
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1007d2c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub eax, ecx
lea ecx, [ebp + 8]
push ecx
push ebx
neg eax
lea ecx, [ebp - 8]
push ecx
sbb eax, eax
and eax, dword [ebp + 0xc]
push ebx
push eax
push dword [ebp - 4]
call edi
cmp eax, ebx
je 0x1007d65
cmp eax, 0xea
je 0x1007d65
xor eax, eax
jmp 0x1007e95
push esi
push dword [ebp + 8]
call sub.msvcrt.dll_malloc
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x1007d7c
xor esi, esi
jmp 0x1007e89
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call edi
test eax, eax
push esi
jne 0x1007e69
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1007ddc
cmp dword [ebp - 8], 2
jne 0x1007ddc
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
push ebx
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1007dda
push ebx
call sub.msvcrt.dll_malloc
test eax, eax
pop ecx
mov dword [ebp + 0xc], eax
je 0x1007dda
push ebx
push eax
push esi
call edi
test eax, eax
je 0x1007dda
push esi
call sub.msvcrt.dll_free
mov esi, dword [ebp + 0xc]
pop ecx
xor ebx, ebx
push 0x2c
push esi
call sub.ntdll.dll_strchr
cmp eax, ebx
pop ecx
pop ecx
je 0x1007ded
and byte [eax], 0
push 0x3b
push esi
call sub.ntdll.dll_strchr
cmp eax, ebx
pop ecx
pop ecx
je 0x1007dfe
and byte [eax], 0
cmp esi, ebx
je 0x1007e5c
cmp byte [esi], 0x22
jne 0x1007e5c
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1007e0c
sub eax, edx
cmp byte [eax + esi - 1], 0x22
jne 0x1007e5c
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1007e21
sub eax, ecx
and byte [eax + esi - 1], dl
lea ecx, [esi + 1]
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1007e36
sub eax, edi
push eax
push ecx
push esi
call sub.msvcrt.dll_memmove
mov eax, esi
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1007e4f
sub eax, ecx
and byte [eax + esi - 1], dl
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1007e74
push esi
call sub.msvcrt.dll_free
pop ecx
jmp 0x1007d75
test al, 0x10
jne 0x1007e89
push 0x5c
push esi
call sub.ntdll.dll_strrchr
cmp eax, ebx
pop ecx
pop ecx
je 0x1007e89
and byte [eax], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x1007f35
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
xor eax, eax
push eax
mov ebx, 0x20000000
push ebx
push 3
push eax
push 3
mov edi, 0xc0000000
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x10080e3
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push ebx
push 3
push 0
push 3
push edi
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x10080e3
xor edi, edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x10], esi
je 0x10080da
lea eax, [esi + 0x1ff]
and eax, 0xfffffe00
mov ebx, 0x10000
cmp eax, ebx
jbe 0x1007fc5
mov eax, ebx
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [0x10239c0]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10080da
mov eax, dword [0x10239c0]
cmp word [eax], 0x5a4d
mov edx, dword [eax + 0x3c]
lea ecx, [edx + eax]
jne 0x10080d3
cmp edx, 0xf000
jg 0x10080d3
add edx, 0xf8
cmp dword [ebp - 4], edx
jb 0x10080d3
cmp dword [ecx], 0x4550
jne 0x10080d3
mov eax, dword [ecx + 0x58]
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x10080d3
mov dword [ecx + 0x58], edi
mov eax, dword [ebp - 4]
test al, 1
je 0x1008041
mov ecx, dword [0x10239c0]
and byte [ecx + eax], 0
push dword [ebp - 4]
push dword [0x10239c0]
push edi
call fcn.0100d1a8
sub esi, dword [ebp - 4]
push 1
pop edi
mov dword [ebp + 8], eax
je 0x10080bb
test edi, edi
je 0x10080da
lea eax, [esi + 0x1ff]
and eax, 0xfffffe00
cmp eax, ebx
jbe 0x1008070
mov eax, ebx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [0x10239c0]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test edi, edi
je 0x10080b3
mov eax, dword [ebp - 4]
sub esi, eax
test al, 1
je 0x100809f
mov ecx, dword [0x10239c0]
and byte [ecx + eax], 0
push dword [ebp - 4]
push dword [0x10239c0]
push dword [ebp + 8]
call fcn.0100d1a8
mov dword [ebp + 8], eax
test esi, esi
jne 0x100805b
test edi, edi
je 0x10080da
movzx eax, word [ebp + 8]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
je 0x10080d3
push 0x570
call fcn.01003bbf
jmp 0x10080da
mov dword [ebp - 0xc], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10081a4
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x108
push esi
mov esi, dword [esp + 0x110]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10081b7
sub eax, edx
cmp eax, 0x104
jb 0x10081ce
xor eax, eax
jmp 0x10082b3
lea edx, [esp + 8]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10081d6
push ebx
push ebp
push edi
lea eax, [esp + 0x14]
push eax
call fcn.0100774e
mov ebp, dword [esp + 0x120]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x10], eax
mov ebx, 0x80
mov eax, dword [ebp]
push eax
push 0x1001a10
push dword [esp + 0x18]
lea ecx, [eax + 1]
mov dword [ebp], ecx
call sub.ntdll.dll_sprintf
add esp, 0xc
push ebx
lea eax, [esp + 0x18]
push eax
call esi
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1008209
mov ebp, dword [esp + 0x11c]
push 1
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
push ebx
je 0x100828f
lea eax, [esp + 0x18]
push eax
call esi
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100828a
push 4
push 0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
xor eax, eax
inc eax
jmp 0x10082b0
push ebp
call esi
push ebp
call edi
mov esi, eax
test esi, esi
jne 0x10082ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10082ab
cmp eax, 3
jne 0x10082ae
xor esi, esi
inc esi
mov eax, esi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x108
ret 8

Function at 0x10082bd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1008324
push esi
lea eax, [ebp + 8]
push eax
push 0xc
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100831d
cmp dword [ebp + 8], 0xc
jne 0x100831d
cmp dword [ebp - 4], 0x66626473
jne 0x100831d
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor ecx, ecx
or ecx, eax
mov eax, dword [ebp + 0xc]
or edx, esi
mov dword [eax], ecx
mov dword [eax + 4], edx
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x1008343
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [0x101029c]
xor ebx, ebx
cmp eax, ebx
je 0x10083bb
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100836f
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp + 8]
push dword [0x101029c]
call esi
test eax, eax
je 0x10083be
mov ecx, 0x1001a1c
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100839e
push ebx
lea edx, [ebp - 4]
push edx
sub eax, edi
push eax
push ecx
push dword [0x101029c]
call esi
test eax, eax
pop edi
je 0x10083be
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x10083cf
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10083de
sub eax, edx
cmp eax, 0x104
jb 0x10083f5
xor eax, eax
jmp 0x10084d4
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x104]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1008400
push ebx
push esi
push edi
lea eax, [ebp - 0x104]
push eax
call fcn.0100774e
mov esi, dword [ebp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, eax
mov eax, dword [esi]
push eax
lea ecx, [eax + 1]
push 0x1001a10
push ebx
mov dword [esi], ecx
call sub.ntdll.dll_sprintf
add esp, 0xc
push 0x80
lea eax, [ebp - 0x104]
push eax
call edi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1008424
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.01003cd3
test eax, eax
je 0x10084cf
lea eax, [ebp - 0x104]
push eax
call fcn.01007f35
test eax, eax
je 0x10084cf
cmp dword [ebp + 0x14], 0
je 0x10084a9
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10084a9
push dword [ebp + 0x14]
push dword [eax]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10084bb
push dword [eax]
lea eax, [ebp - 0x104]
push eax
call edi
push 4
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x10084d1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18