joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100acbf0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10122d85
mov eax, dword fs:[0]
push eax
sub esp, 0x124
push ebx
push esi
push edi
lea edi, [ebp - 0x70]
mov ecx, 0x19
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x101c27d6
call fcn.1011c410
push 3
call fcn.100b53a0
add esp, 4
push ecx
movss xmm0, dword [0x1012dc58]
movss dword [esp], xmm0
call fcn.100b4620
push ecx
fstp dword [esp]
call fcn.1006d9d0
add esp, 8
call fcn.10046b70
push str.Settings_name:
call fcn.10074b00
add esp, 4
push ecx
movss xmm0, dword [0x10139df4]
movss dword [esp], xmm0
call fcn.1006a280
add esp, 4
push 0
push 0
push 0
push 0x28
push 0x101577d0
push str.SettingsRename
call fcn.1005daa0
add esp, 0x18
call fcn.10069500
lea ecx, [ebp - 0x12c]
call fcn.10007a10
push eax
push 5
call fcn.1006a4d0
add esp, 8
call fcn.10074460
push 0x10157814
push str.Rename
call fcn.10048c80
add esp, 8
movzx eax, al
test eax, eax
je 0x100acdbd
push 0x101577d0
call sub.ucrtbased.dll_strlen
add esp, 4
test eax, eax
jbe 0x100acdbd
push 0x101577d0
mov eax, dword [0x101577f8]
push eax
mov ecx, 0x10157830
call fcn.100af230
mov ecx, eax
call fcn.10014900
push eax
call sub.ucrtbased.dll_strcmp
add esp, 8
test eax, eax
je 0x100acdb8
lea ecx, [ebp - 0x30]
call fcn.100075e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.100075e0
mov byte [ebp - 4], 1
push 0x1015185c
lea ecx, [ebp - 0x30]
call fcn.10014720
mov eax, dword [0x101577f8]
push eax
mov ecx, 0x10157830
call fcn.100af230
push eax
lea ecx, [ebp - 0x30]
call fcn.10014720
push 0x1015185c
lea ecx, [ebp - 0x54]
call fcn.10014720
push 0x101577d0
lea ecx, [ebp - 0x54]
call fcn.10014780
lea ecx, [ebp - 0x54]
call fcn.10014900
mov esi, esp
push eax
lea ecx, [ebp - 0x30]
call fcn.10014900
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp esi, esp
call fcn.1011c3e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.100083c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100083c0
call fcn.1004bb30
push ecx
movss xmm0, dword [0x1012dc58]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.1006d9d0
add esp, 8
push 0x10157814
push str.Cancel
call fcn.10048c80
add esp, 8
movzx eax, al
test eax, eax
je 0x100acdfa
call fcn.1004bb30
push 1
call fcn.100695b0
add esp, 4
call fcn.10054ff0
call fcn.100b45a0
push edx
mov ecx, ebp
push eax
lea edx, [0x100ace48]
call fcn.1011c380
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011c450
add esp, 0x130
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret
Function at 0x100ad0e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10122dbd
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
push ebx
push esi
push edi
lea edi, [ebp - 0x58]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x101c27d6
call fcn.1011c410
push 3
call fcn.100b53a0
add esp, 4
push ecx
movss xmm0, dword [0x1012dc58]
movss dword [esp], xmm0
call fcn.100b4620
push ecx
fstp dword [esp]
call fcn.1006d9d0
add esp, 8
call fcn.10046b70
push str.Settings_name:
call fcn.10074b00
add esp, 4
push ecx
movss xmm0, dword [0x10139df4]
movss dword [esp], xmm0
call fcn.1006a280
add esp, 4
push 0
push 0
push 0
push 0x28
push 0x101577d0
push str.SettingsSaveAs
call fcn.1005daa0
add esp, 0x18
call fcn.10069500
lea ecx, [ebp - 0x114]
call fcn.10007a10
push eax
push 5
call fcn.1006a4d0
add esp, 8
call fcn.10074460
push 0x10157814
push str.Save
call fcn.10048c80
add esp, 8
movzx eax, al
test eax, eax
je 0x100ad2bb
push 0x101577d0
call sub.ucrtbased.dll_strlen
add esp, 4
test eax, eax
jbe 0x100ad2bb
mov esi, esp
push str.Default
push 0x101577d0
call dword [sym.imp.ucrtbased.dll__stricmp]
add esp, 8
cmp esi, esp
call fcn.1011c3e0
test eax, eax
je 0x100ad2b6
lea ecx, [ebp - 0x30]
call fcn.100075e0
mov dword [ebp - 4], 0
push 0x1015185c
lea ecx, [ebp - 0x30]
call fcn.10014720
push 0x101577d0
lea ecx, [ebp - 0x30]
call fcn.10014780
mov esi, esp
push 0
lea ecx, [ebp - 0x30]
call fcn.10014900
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, esp
call fcn.1011c3e0
call fcn.100ab820
mov dword [ebp - 0x3c], 0
jmp 0x100ad262
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, 0x10157830
call fcn.100b04d0
cmp dword [ebp - 0x3c], eax
jae 0x100ad2a2
push 0x101577d0
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, 0x10157830
call fcn.100af230
mov ecx, eax
call fcn.10014900
push eax
call sub.ucrtbased.dll_strcmp
add esp, 8
test eax, eax
jne 0x100ad2a0
mov eax, dword [ebp - 0x3c]
mov dword [0x101577f8], eax
jmp 0x100ad259
call fcn.100abab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100083c0
call fcn.1004bb30
push ecx
movss xmm0, dword [0x1012dc58]
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
call fcn.1006d9d0
add esp, 8
push 0x10157814
push str.Cancel
call fcn.10048c80
add esp, 8
movzx eax, al
test eax, eax
je 0x100ad2f8
call fcn.1004bb30
push 1
call fcn.100695b0
add esp, 4
call fcn.10054ff0
call fcn.100b45a0
push edx
mov ecx, ebp
push eax
lea edx, [0x100ad348]
call fcn.1011c380
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011c450
add esp, 0x118
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret
Function at 0x100ae390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x78]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov ecx, 0x101c270c
call fcn.1011c410
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x100ae3d8
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x100ae3df
mov al, 1
jmp 0x100ae4f8
call fcn.100af670
mov esi, esp
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
call eax
cmp esi, esp
call fcn.1011c3e0
mov dword [ebp - 0x124], eax
call fcn.100af670
mov dword [ebp - 0x130], eax
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x130]
push edx
call fcn.100af6b0
add esp, 8
movzx eax, al
test eax, eax
je 0x100ae430
xor al, al
jmp 0x100ae4f8
mov dword [ebp - 0x18], 0x20
mov esi, esp
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x38]
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
cmp esi, esp
call fcn.1011c3e0
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
je 0x100ae482
cmp dword [ebp - 0x138], 1
je 0x100ae489
cmp dword [ebp - 0x138], 3
je 0x100ae4eb
jmp 0x100ae4f6
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x40]
sub eax, ecx
mov dword [ebp - 0x58], eax
je 0x100ae4c2
mov esi, esp
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x58]
push edx
push 1
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp esi, esp
call fcn.1011c3e0
cmp dword [ebp - 0x58], eax
je 0x100ae4c2
xor al, al
jmp 0x100ae4f8
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x100ae4d9
mov dword [ebp - 0x138], 1
jmp 0x100ae4e3
mov dword [ebp - 0x138], 0
mov al, byte [ebp - 0x138]
jmp 0x100ae4f8
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x100ae4f8
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x100ae528]
call fcn.1011c380
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011c450
add esp, 0x138
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret
Function at 0x100b0e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2c]
mov ecx, 0xb
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c270c
call fcn.1011c410
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x100b0ee6
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
cmp esi, esp
call fcn.1011c3e0
jmp 0x100b0ff8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov esi, esp
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
cmp esi, esp
call fcn.1011c3e0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp + 0x10], 0
jl 0x100b0fa0
jg 0x100b0f20
cmp dword [ebp + 0xc], 0
jbe 0x100b0fa0
cmp dword [ebp - 0x24], 0
jl 0x100b0fa0
jg 0x100b0f2e
cmp dword [ebp - 0x28], 0
jbe 0x100b0fa0
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x24]
jg 0x100b0f4c
jl 0x100b0f40
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x28]
jae 0x100b0f4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov esi, esp
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp esi, esp
call fcn.1011c3e0
push eax
call fcn.100149a0
add esp, 0xc
mov eax, dword [ebp - 0x28]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x24]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0x28]
mov esi, esp
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140D.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp esi, esp
call fcn.1011c3e0
cmp dword [ebp + 0x10], 0
jl 0x100b0fec
jg 0x100b0fae
cmp dword [ebp + 0xc], 0
jbe 0x100b0fec
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x100b0fec
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp esi, esp
call fcn.1011c3e0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
sbb edx, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0xec
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ce6d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
push edi
lea edi, [ebp - 0x74]
mov ecx, 0x1d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x101c3616
call fcn.1011c410
mov esi, esp
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp esi, esp
call fcn.1011c3e0
mov dword [ebp - 0x24], 0x7e3
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x3c], 0xa
mov dword [ebp - 0x48], 8
cmp dword [ebp - 0x3c], 0xc
jle 0x100ce73b
mov dword [ebp - 0x3c], 1
cmp dword [ebp - 0x48], 1
jge 0x100ce748
mov dword [ebp - 0x48], 0xc
movzx eax, word [ebp - 0x18]
cmp eax, 0x7e3
je 0x100ce78f
movzx eax, word [ebp - 0x16]
cmp eax, 9
je 0x100ce78f
movzx eax, word [ebp - 0x16]
cmp eax, dword [ebp - 0x3c]
je 0x100ce78f
movzx eax, word [ebp - 0x16]
cmp eax, dword [ebp - 0x48]
je 0x100ce78f
mov esi, esp
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1011c3e0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.1011c3e0
cmp dword [0x10150304], 0
je 0x100ce837
mov eax, dword [0x10150304]
mov edx, dword [eax]
mov esi, esp
mov ecx, dword [0x10150304]
mov eax, dword [edx + 0xc]
call eax
cmp esi, esp
call fcn.1011c3e0
xor ecx, ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
lea eax, [ebp - 0x58]
push eax
call fcn.100d4090
add esp, 4
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + 0x10]
add ecx, 1
mov dword [ebp - 0x70], ecx
cmp dword [ebp - 0x70], 0xc
jle 0x100ce7e7
mov dword [ebp - 0x70], 1
cmp dword [ebp - 0x70], 1
jge 0x100ce7f4
mov dword [ebp - 0x70], 0xc
mov eax, dword [ebp - 0x64]
cmp dword [eax + 0x14], 0x7e3
je 0x100ce837
cmp dword [ebp - 0x70], 9
je 0x100ce837
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x3c]
je 0x100ce837
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x48]
je 0x100ce837
mov esi, esp
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1011c3e0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.1011c3e0
push edx
mov ecx, ebp
push eax
lea edx, [0x100ce868]
call fcn.1011c380
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011c450
add esp, 0x134
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret
Function at 0x100ce910
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123e31
mov eax, dword fs:[0]
push eax
sub esp, 0x3c0
push ebx
push esi
push edi
lea edi, [ebp - 0x24c]
mov ecx, 0x90
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x101c3616
call fcn.1011c410
lea eax, [ebp - 0x1a4]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
je 0x100ce99a
mov eax, dword [ebp - 0x1b0]
push eax
push str.CreateSocket
push str._s:_WSAStartup_error__i._n
call fcn.100fa670
add esp, 0xc
xor al, al
jmp 0x100cead6
push str.ws:__34.90.101.163:1337_hpp
lea ecx, [ebp - 0x378]
call fcn.1001dd60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x354]
call fcn.100075e0
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3cc], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x3cc]
push ecx
lea edx, [ebp - 0x378]
push edx
call fcn.1003a770
add esp, 8
mov dword [0x101721fc], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x354]
call fcn.100083c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.100083c0
mov dword [0x10151900], 1
cmp dword [0x101721fc], 0
jne 0x100cead4
push str.CreateSocket
push str._s:_failed_connect_to_websocket__Netherlands_._n
call fcn.100fa670
add esp, 8
push str.ws:__185.231.245.77:1337_hpp
lea ecx, [ebp - 0x3c0]
call fcn.1001dd60
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x39c]
call fcn.100075e0
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3cc], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x3cc]
push ecx
lea edx, [ebp - 0x3c0]
push edx
call fcn.1003a770
add esp, 8
mov dword [0x101721fc], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x39c]
call fcn.100083c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c0]
call fcn.100083c0
mov dword [0x10151900], 2
cmp dword [0x101721fc], 0
jne 0x100cead4
push str.CreateSocket
push str._s:_failed_connect_to_proxy_websocket__Russia_._n
call fcn.100fa670
add esp, 8
xor al, al
jmp 0x100cead6
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x100ceb10]
call fcn.1011c380
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011c450
add esp, 0x3cc
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret
Function at 0x100e29c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x70]
mov ecx, 0x1c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c3728
call fcn.1011c410
mov esi, esp
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fseek]
add esp, 0xc
cmp esi, esp
call fcn.1011c3e0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100e2a17
mov eax, 0xfffffffd
jmp 0x100e2b65
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_ftell]
add esp, 4
cmp esi, esp
call fcn.1011c3e0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0x100e2a40
mov eax, 0xfffffffd
jmp 0x100e2b65
cmp dword [ebp - 0x20], 0
jne 0x100e2a4d
xor eax, eax
jmp 0x100e2b65
push 0x1013ea20
mov eax, dword [ebp - 0x20]
add eax, 1
push eax
call fcn.1011def0
add esp, 8
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0
jne 0x100e2a80
mov eax, 0xfffffffe
jmp 0x100e2b65
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x20]
mov byte [eax], 0
mov esi, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fseek]
add esp, 0xc
cmp esi, esp
call fcn.1011c3e0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push 1
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ucrtbased.dll_fread]
add esp, 0x10
cmp esi, esp
call fcn.1011c3e0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x20]
je 0x100e2b12
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.1011bf40
add esp, 4
cmp dword [ebp - 0x11c], 0
jne 0x100e2afb
mov dword [ebp - 0x130], 0
jmp 0x100e2b0b
mov dword [ebp - 0x2c], 0x8123
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x130], edx
mov eax, 0xfffffffd
jmp 0x100e2b65
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 8]
call fcn.100e2640
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x128], eax
mov ecx, dword [ebp - 0x128]
push ecx
call fcn.1011bf40
add esp, 4
cmp dword [ebp - 0x128], 0
jne 0x100e2b52
mov dword [ebp - 0x130], 0
jmp 0x100e2b62
mov dword [ebp - 0x2c], 0x8123
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x44]
pop edi
pop esi
pop ebx
add esp, 0x130
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x100e5800
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101254ed
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x88]
mov ecx, 0x1f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, 0x101c37de
call fcn.1011c410
mov dword [0x10172238], 1
mov eax, dword [ebp + 8]
push eax
push 0x1015185c
lea ecx, [ebp - 0x3c]
push ecx
call fcn.10029d20
add esp, 0xc
mov dword [ebp - 4], 0
mov esi, esp
push 0
lea ecx, [ebp - 0x3c]
call fcn.10014900
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, esp
call fcn.1011c3e0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x108], esp
lea eax, [ebp - 0x3c]
push eax
call fcn.100bf6c0
call fcn.100e3930
add esp, 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x114], esp
lea eax, [ebp - 0x3c]
push eax
call fcn.100bf6c0
call fcn.100e1160
add esp, 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x120], esp
lea eax, [ebp - 0x3c]
push eax
call fcn.100bf6c0
call fcn.100e6270
add esp, 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x12c], esp
lea eax, [ebp - 0x3c]
push eax
call fcn.100bf6c0
call fcn.100e07c0
add esp, 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x138], esp
lea eax, [ebp - 0x3c]
push eax
call fcn.100bf6c0
call fcn.100e2f60
add esp, 0x1c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x144], esp
lea eax, [ebp - 0x3c]
push eax
call fcn.100bf6c0
call fcn.100de430
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.100083c0
push edx
mov ecx, ebp
push eax
lea edx, [0x100e5984]
call fcn.1011c380
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011c450
add esp, 0x148
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x100f0e10
Capabilities:
Hash data using jshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov ecx, 9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101c3b70
call fcn.1011c410
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x4e67c6a7
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movsx ecx, byte [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 0x20], 0
je 0x100f0e8c
mov eax, dword [ebp - 0x14]
shr eax, 2
mov ecx, dword [ebp - 0x14]
shl ecx, 5
add eax, dword [ebp - 0x20]
add ecx, eax
xor ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movsx ecx, byte [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x100f0e58
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret
Function at 0x100f5bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x10]
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c3f00
call fcn.1011c410
mov eax, dword [ebp - 8]
mov esi, esp
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1011c3e0
test eax, eax
je 0x100f5c27
mov dword [ebp - 0xd0], 1
jmp 0x100f5c31
mov dword [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
pop edi
pop esi
pop ebx
add esp, 0xd0
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 8