joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10da857
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x138aa00]
push esi
push edi
lea edx, [ebp - 0xc]
push edx
push dword [ebx + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x68]
call fcn.0103c38b
ror byte [esi], 1
xor byte ss:[edi], ah
add byte [eax], al
nop
or dl, byte [edx]
sub esp, dword [eax + 0x40360ecc]
mov esi, eax
cmp esi, edi
jl 0x10daad4
and al, byte [edx]
add byte [eax], al
call fcn.01347b48
out 0x9d, al
mov dl, 0x40
cmp al, 0
add byte [eax], dh
js 0x10da8ae
xor eax, 0x35ed7c60
pushal
call fcn.0110c578
add ah, 0x35
xor byte [esi - 0x7c000000], ch
les esi, [0x2ecdba70]
add byte [ebx + 0x4d8df445], cl
cld
push ecx
push edi
push eax
call fcn.010a2166
call fcn.0103bfc7
cld
push cs
and al, 0
add byte [eax - 0x1fc9f100], dh
jg 0x10da90b
sub eax, dword [eax - 0x18]
dec edx
adc esi, esi
invalid
loopne 0x10da8e1
call 0xe102b947
sub al, 0x60
mov esi, eax
cmp esi, edi
jl 0x10daad4
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x1002e94
push eax
call dword [ecx]
call fcn.0103c773
push ss
add byte [eax], al
loopne 0x10da975
retf
imul esi, dword [esi], 0x164ae810
idiv bh
sbb al, 0x95
xor eax, 0x3ed0
jo 0x10da9a6
xchg ebp, eax
xor eax, 0x30f17ad0
push eax
mov eax, dword [ebx + 8]
push 1
xor byte [eax - 0x75], dl
inc ebx
or byte [edx + 1], ch
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], 0x1007124
mov dword [ebp - 0x1c], 2
add al, byte [eax]
add byte [eax], al
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
call fcn.0103c38b
jo 0x10da98b
push ecx
and al, 0xe8
salc
sbb esi, esi
push dword [eax - 0x2c]
pushal
mov byte [eax], al
add byte [eax + 0x1d], ah
pop ebx
push es
and byte [esp + edx*8 + 0x36], ch
loopne 0x10da9ae
nop
jecxz 0x10da9e4
add al, cl
sti
xor eax, 0x37c0
add ah, al
sti
xor eax, 0x2c093ed0
pushal
mov esi, eax
cmp esi, edi
jl 0x10daad4
call fcn.010906e8
sub ebx, ebx
sub dl, byte [eax - 0x1fc9ed10]
in al, dx
adc dh, byte [esi]
invalid
call fcn.0110c578
mov eax, 0x5dc036a0
add byte [eax], al
xor byte [eax - 0x70677fca], bh
or edx, dword [eax - 0x18]
cli
pop ebx
sti
jmp [edi + edi*2 + 0xf]
Function at 0x10df177
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
push 5
pop eax
xor edi, edi
cmp dword [ebp + 0x18], eax
jbe 0x10df18d
mov dword [ebp + 0x18], eax
xor eax, eax
cmp dword [ebp + 0x18], eax
jbe 0x10df1a6
lea ecx, [ebp + 0x18]
add ecx, 4
mov edx, dword [ecx]
mov dword [ebp + eax*4 - 0x14], edx
inc eax
cmp eax, dword [ebp + 0x18]
jb 0x10df197
push esi
push 0x100a100
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
jne 0x10df1d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10df1ce
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x10df211
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x10df20a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10df208
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
test edi, edi
jge 0x10df23b
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10df23b
test byte [eax + 0x3c], 2
je 0x10df23b
push edi
push 0x100a14c
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov eax, edi
pop edi
leave
ret

Function at 0x10e1329
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x90
lea eax, [ebp - 0x94]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
xor edi, edi
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x10e1386
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov edi, eax
jmp 0x10e13ab
cmp dword [ebp - 0x88], 2
jne 0x10e13a7
cmp dword [ebp - 0x94], 5
ja 0x10e13a2
jne 0x10e13a7
cmp dword [ebp - 0x90], edi
jbe 0x10e13a7
xor eax, eax
inc eax
jmp 0x10e13a9
xor eax, eax
mov dword [esi], eax
test edi, edi
jge 0x10e13d4
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10e13d4
test byte [eax + 0x3c], 2
je 0x10e13d4
push edi
push 0x100a390
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0103e3fb
leave
ret 4
Function at 0x10e2275
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
call fcn.01047bfc
cmp eax, edi
mov dword [ebp + 0xc], eax
jl 0x10e22ec
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 8]
push ecx
push edi
lea ecx, [ebp + 8]
push ecx
push edi
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
xor esi, esi
sub ecx, edi
je 0x10e22d2
dec ecx
dec ecx
je 0x10e22ce
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.0103ecb3
test eax, eax
je 0x10e22e6
jmp 0x10e22d5
xor esi, esi
jmp 0x10e22d5
xor esi, esi
inc esi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x10e22e6
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp + 0xc], edi
pop esi
jge 0x10e2313
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10e2313
test byte [eax + 0x3c], 2
je 0x10e2313
push dword [ebp + 0xc]
push 0x100a3a0
push 0x2d
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0103f528
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 0x14
Function at 0x10e492a
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 4
push 1
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call esi
test eax, eax
jne 0x10e4998
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov dword [ebp - 0x10], eax
jmp 0x10e4a4f
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 6
push 1
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x10e4984
lea eax, [ebp - 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10e4984
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push ecx
push 2
push eax
call fcn.010e4628
cmp eax, ebx
mov dword [ebp - 0x10], eax
jl 0x10e4a54
push edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
cmp dword [edi], ebx
jbe 0x10e4a3f
lea esi, [edi + 4]
push dword [esi]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10e4a0e
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x14], ebx
jmp 0x10e4a28
push dword [esi]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10e4a28
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], 1
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add esi, 8
cmp eax, dword [edi]
jb 0x10e49f2
cmp dword [ebp - 0x14], ebx
jne 0x10e4a46
cmp dword [ebp - 0x28], ebx
jne 0x10e4a46
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
pop edi
cmp dword [ebp - 0x10], ebx
jge 0x10e4a7b
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10e4a7b
test byte [eax + 0x3c], 2
je 0x10e4a7b
push dword [ebp - 0x10]
push 0x100a390
push 0x2f
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0x18]
call fcn.010458a0
lea ecx, [ebp - 0x24]
call fcn.010458a0
lea ecx, [ebp - 0x1c]
call fcn.010e12f0
lea ecx, [ebp - 0x20]
call fcn.0103f4fa
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 4
Function at 0x10fc864
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
not eax
jbe 0x10fc89d
push esi
movzx esi, byte [ecx]
dec dword [ebp + 0x10]
mov edx, eax
shr edx, 0x18
xor edx, esi
and edx, 0xff
shl eax, 8
xor eax, dword [edx*4 + 0x100cb28]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x10fc878
pop esi
not eax
pop ebp
ret 0xc
Function at 0x110470c
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edi, ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
call fcn.010fba5e
mov eax, dword [edi]
lea ecx, [ebp - 0x98]
push ecx
push 8
push esi
push eax
push 0x80000002
mov dword [ebp - 0x98], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x94], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x110477f
mov dword [ebp - 0x94], esi
jmp 0x110487e
lea ecx, [ebp - 0x94]
push ecx
push eax
call fcn.0103ecb3
test eax, eax
je 0x110484c
mov dword [ebp - 0x9c], esi
mov eax, dword [ebp - 0x98]
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push dword [ebp - 0x9c]
mov dword [ebp - 0xb0], 0x25
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x9c]
cmp eax, 0x103
je 0x1104832
lea ecx, [ebp - 0x94]
push ecx
push eax
call fcn.0103ecb3
test eax, eax
je 0x110484c
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.01047027
test eax, eax
jl 0x1104842
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.011015b1
cmp eax, esi
mov dword [ebp - 0x94], eax
jl 0x1104854
push esi
push esi
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xa8]
call fcn.011026e9
cmp eax, esi
mov dword [ebp - 0x94], eax
jge 0x110479a
jmp 0x1104854
lea eax, [ebp - 0xa8]
push eax
mov ecx, ebx
call fcn.0110276e
jmp 0x110484c
mov dword [ebp - 0x94], 0x8004f807
cmp dword [ebp - 0x94], esi
jge 0x110487e
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x110487e
test byte [eax + 0x3c], 2
je 0x110487e
push dword [ebp - 0x94]
push 0x100c654
push 0xd
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0xac]
call fcn.0103f6a1
lea ecx, [ebp - 0x98]
call fcn.0103f528
lea ecx, [ebp - 0x80]
call fcn.010fba80
push esi
lea ecx, [ebp - 0xa8]
call fcn.011016ff
lea ecx, [ebp - 0xa0]
call fcn.010fa659
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 4
Function at 0x1106da6
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.01053d60
mov esi, eax
cmp esi, edi
jl 0x1106ecd
mov eax, dword [ebp - 0xc]
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.0108dd07
push dword [ebp - 4]
call fcn.0108dcb6
test al, al
jne 0x1106e09
cmp dword [ebp - 4], edi
jne 0x1106e1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
jmp 0x1106ec7
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x1106e09
cmp dword [ebp - 0x14], edi
je 0x1106e3d
mov esi, 0x80070057
jmp 0x1106ecd
cmp esi, 0x100000
ja 0x1106e33
push esi
call fcn.0103e460
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.0104596a
cmp ebx, edi
jne 0x1106e63
mov dword [ebp - 8], edi
mov esi, 0x8007000e
jmp 0x1106ecd
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1106e09
cmp dword [ebp - 0x18], esi
je 0x1106e86
mov esi, 0x8000ffff
jmp 0x1106ecd
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x74]
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
push esi
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, edi
jl 0x1106ecd
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x20]
push eax
call fcn.01106741
mov esi, eax
cmp esi, edi
jl 0x1106ecd
add ebx, 0x2c
push ebx
push dword [ebp + 8]
call fcn.01040a41
mov esi, eax
cmp esi, edi
jge 0x1106ef2
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1106ef2
test byte [eax + 0x3c], 2
je 0x1106ef2
push esi
push 0x100c664
push 0x21
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0xc]
call fcn.0103f6a1
lea ecx, [ebp - 0x10]
call fcn.010465ec
lea ecx, [ebp - 8]
call fcn.0104596a
lea ecx, [ebp - 4]
call fcn.0108dce8
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1108874
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 4]
push edi
xor ebx, ebx
call fcn.0108dcb6
test al, al
jne 0x1108891
test edi, edi
jne 0x1108898
mov ebx, 0x80004005
jmp 0x11088d2
mov esi, edi
push esi
call fcn.0108dcb6
movzx eax, al
neg eax
sbb eax, eax
not eax
and eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x11088c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov ebx, eax
jmp 0x11088ce
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test ebx, ebx
jge 0x11088f7
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x11088f7
test byte [eax + 0x3c], 2
je 0x11088f7
push ebx
push 0x100d230
push 0x13
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x1108900
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
stosd dword es:[edi], eax
mov edi, dword [esi + 4]
push edi
call fcn.0108dcb6
test al, al
jne 0x110892c
test edi, edi
jne 0x1108933
mov ebx, 0x80004005
jmp 0x110898d
mov eax, dword [ebp + 0x14]
mov esi, edi
push esi
mov dword [ebp - 0xc], eax
call fcn.0108dcb6
mov ecx, dword [ebp + 0x10]
movzx eax, al
neg eax
sbb eax, eax
not eax
and eax, esi
mov esi, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x14]
and ecx, edx
push ecx
lea ecx, [ebp + 0x14]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x110897f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov ebx, eax
jmp 0x1108989
cmp dword [ebp + 0x14], esi
je 0x11089b2
mov ebx, 0x8004e109
test ebx, ebx
jge 0x11089b2
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x11089b2
test byte [eax + 0x3c], 2
je 0x11089b2
push ebx
push 0x100d230
push 0x16
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x1108a4b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 4]
push edi
xor ebx, ebx
call fcn.0108dcb6
test al, al
jne 0x1108a68
test edi, edi
jne 0x1108a6f
mov ebx, 0x80004005
jmp 0x1108ab8
mov esi, edi
push esi
call fcn.0108dcb6
movzx eax, al
neg eax
sbb eax, eax
push 0
not eax
and eax, esi
mov esi, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1108aaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov ebx, eax
jmp 0x1108ab4
cmp dword [ebp + 0xc], esi
je 0x1108add
mov ebx, 0x8004e10a
test ebx, ebx
jge 0x1108add
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1108add
test byte [eax + 0x3c], 2
je 0x1108add
push ebx
push 0x100d230
push 0x17
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x1108d4a
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push dword [ebp + 8]
mov ebx, ecx
xor edi, edi
call esi
test eax, eax
jne 0x1108db5
push dword [ebp + 8]
mov ecx, ebx
call fcn.01108ae6
mov edi, eax
test edi, edi
jl 0x1108d90
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1108d8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov edi, eax
test edi, edi
jge 0x1108db5
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1108db5
test byte [eax + 0x3c], 2
je 0x1108db5
push edi
push 0x100d230
push 0x1f
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x110914e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
cmp dword [ebp + 8], ebx
je 0x11091fe
cmp dword [esi + 0x10], ebx
jne 0x11091fe
mov eax, dword [0x136ec90]
mov ebx, 0x136ec90
mov edi, 0x100d230
cmp eax, ebx
je 0x110919e
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x110919e
push dword [esi + 8]
push edi
push 0xf
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010f9941
lea ecx, [esi + 4]
call fcn.0108dce8
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x11091bc
push dword [esi + 8]
jmp 0x11092bd
mov eax, dword [0x136ec90]
cmp eax, ebx
je 0x11092c4
mov eax, dword [eax + 0x3c]
mov ecx, 0x1000004
and eax, ecx
cmp eax, ecx
jne 0x11092c4
mov ebx, dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x136ec90]
push ebx
push edi
push 0x10
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010c7028
jmp 0x11092c4
mov edi, dword [esi + 4]
push edi
call fcn.0108dcb6
test al, al
jne 0x11092c4
cmp edi, ebx
je 0x11092c4
mov edi, 0x100d230
cmp dword [esi], ebx
jne 0x1109271
cmp dword [esi + 0x10], ebx
jne 0x1109271
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x110924d
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x110924d
push edi
push 0x11
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.011086cc
mov ebx, dword [esi + 4]
push ebx
call fcn.0108dcb6
movzx eax, al
neg eax
sbb eax, eax
not eax
and eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
xor ebx, ebx
lea ecx, [esi + 4]
call fcn.0108dce8
cmp dword [esi + 0x10], ebx
jne 0x11092c4
cmp dword [esi], ebx
je 0x11092ba
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x11091b4
mov edx, dword [eax + 0x3c]
mov ecx, 0x1000004
and edx, ecx
cmp edx, ecx
jne 0x11091b4
push dword [esi + 8]
push edi
push 0x12
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010f9941
jmp 0x11091b4
push dword [esi + 0xc]
mov ecx, esi
call fcn.01108d4a
pop edi
mov dword [esi + 0x10], 1
pop esi
pop ebx
pop ebp
ret 4

Function at 0x110b655
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x110b675
or eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 8
Function at 0x110cd57
Capabilities:
Copy file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x10], ebx
jne 0x110cd70
xor edi, edi
jmp 0x110ce1e
lea eax, [ebp - 4]
push eax
call fcn.011089bb
mov edi, eax
cmp edi, ebx
jl 0x110cdf9
push ebx
mov ecx, esi
call fcn.0110914e
push dword [esi + 0xc]
mov ecx, esi
call fcn.01108d4a
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x110cdb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
jmp 0x110cdf3
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x110cda4
mov eax, dword [esi + 8]
push 0x2000
push eax
mov ecx, esi
call fcn.0110b655
push dword [esi + 8]
mov ecx, esi
call fcn.0110c931
mov edi, eax
cmp edi, ebx
jl 0x110cdf9
push ebx
push dword [ebp - 4]
mov ecx, esi
mov dword [esi + 0x10], ebx
call fcn.01108c62
mov edi, eax
cmp edi, ebx
jge 0x110ce1e
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x110ce1e
test byte [eax + 0x3c], 2
je 0x110ce1e
push edi
push 0x100d230
push 0x18
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x110ce4b
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push 0x100d338
push esi
mov dword [ebp - 4], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
lea ecx, [ebp - 4]
mov edi, eax
call fcn.0110ba46
cmp edi, esi
jne 0x110ce7a
mov dword [ebp - 4], esi
jmp 0x110ce94
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x110cecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov ebx, eax
cmp ebx, esi
jge 0x110cecb
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x110cecb
test byte [eax + 0x3c], 2
je 0x110cecb
push ebx
push 0x100d230
push 0x19
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0110ba46
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8