joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006004a
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x1016a067
call fcn.101673d5
mov esi, ecx
lea eax, [ebp - 0x30]
xor edi, edi
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], edi
call fcn.1003e2ec
mov dword [ebp - 4], edi
mov ecx, dword [esi]
mov ecx, dword [ecx]
call fcn.1005ff41
mov edx, dword [esi]
lea ecx, [ebp - 0x2c]
push dword [esi + 4]
mov edx, dword [edx]
call fcn.1005fb06
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x10060090
lea eax, [ebp - 0x2c]
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x10060116
cmp eax, 0xffffffff
je 0x10060116
push edi
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [esi + 0xc]
push dword [ecx]
mov ecx, dword [esi + 8]
push dword [ecx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100600f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x100600e1
movzx esi, si
or esi, 0x80070000
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x10060161
test byte [eax + 0x44], 1
jne 0x1006014d
jmp 0x10060161
lea ecx, [ebp - 0x30]
call fcn.1003f382
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.10045637
lea ecx, [ebp - 0x44]
call fcn.1003e392
call fcn.10167384
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1006012b
movzx esi, si
or esi, 0x80070000
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x10060161
test byte [eax + 0x44], 1
je 0x10060161
push esi
push dword [eax + 0x3c]
mov edx, 0x1001b208
push dword [eax + 0x38]
push 0x10
jmp 0x1006015b
push esi
push dword [eax + 0x3c]
mov edx, 0x1001b208
push dword [eax + 0x38]
push 0x11
pop ecx
call fcn.1003f754
push esi
lea ecx, [ebp - 0x34]
call fcn.1003ecfb
push 0x10196090
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x100800e2
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x101a4c2c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
cmp dword [ebx + 0xa4], 0
je 0x10080229
cmp byte [ebx + 0xa8], 0
je 0x10080229
lea edi, [ebx + 0x94]
push esi
mov ecx, edi
call fcn.1004575b
mov esi, eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
cmp dword [edi], 0
je 0x100801dd
cmp dword [edi], 0xffffffff
je 0x100801dd
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101a77c4]
call esi
lea edi, [ebx + 0x90]
mov ecx, edi
call fcn.1004575b
mov esi, eax
xor eax, eax
push eax
push eax
push ebx
push 0x1007fdb0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
cmp dword [edi], 0
je 0x10080182
cmp dword [edi], 0xffffffff
jne 0x10080228
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x101a77c4]
call esi
mov eax, dword [0x101973c0]
mov esi, 0x80070000
cmp eax, 0x101973c0
je 0x100801d1
test byte [eax + 0x44], 1
je 0x100801d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100801b8
movzx eax, ax
or eax, esi
push eax
mov eax, dword [0x101973c0]
mov edx, 0x1001c4c8
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x54
pop ecx
call fcn.1003f754
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x10080239
jmp 0x1008023e
mov eax, dword [0x101973c0]
mov esi, 0x80070000
cmp eax, 0x101973c0
je 0x1008021c
test byte [eax + 0x44], 1
je 0x1008021c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10080203
movzx eax, ax
or eax, esi
push eax
mov eax, dword [0x101973c0]
mov edx, 0x1001c4c8
push dword [eax + 0x3c]
push dword [eax + 0x38]
push 0x53
pop ecx
call fcn.1003f754
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1008023e
jmp 0x10080239
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10166ce0
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, esi
push eax
lea ecx, [ebp - 8]
call fcn.1003ecfb
push 0x10196090
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x1008ef64
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24
mov eax, 0x1016e99c
call fcn.101673d5
mov ebx, ecx
lea edi, [ebx + 0x30]
cmp dword [edi + 0x14], 8
jb 0x1008ef7f
mov ecx, dword [edi]
jmp 0x1008ef81
mov ecx, edi
mov eax, dword [ebx + 0x28]
lea edx, [ebp - 0x1c]
push edx
push 0
lea edx, [ebp - 0x2c]
push edx
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
je 0x1008f0fd
test esi, esi
je 0x1008efd6
jle 0x1008efb5
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x1008efd6
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x1008f117
test byte [eax + 0x44], 1
jne 0x1008f103
jmp 0x1008f117
mov eax, dword [ebx + 0x24]
push 0
push dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x101a77c4]
call esi
mov esi, eax
test esi, esi
jns 0x1008f023
mov ecx, dword [0x101973c0]
cmp ecx, 0x101973c0
je 0x1008f117
test byte [ecx + 0x44], 1
je 0x1008f117
push esi
push dword [ecx + 0x3c]
mov edx, 0x1001caf8
push dword [ecx + 0x38]
push 0x12
jmp 0x1008f111
lea eax, [ebp - 0x28]
push eax
push dword [ebx + 0x24]
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
mov esi, eax
test esi, esi
jns 0x1008f065
mov ecx, dword [0x101973c0]
cmp ecx, 0x101973c0
je 0x1008f117
test byte [ecx + 0x44], 1
je 0x1008f117
push esi
push dword [ecx + 0x3c]
mov edx, 0x1001caf8
push dword [ecx + 0x38]
push 0x13
jmp 0x1008f111
mov eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
jne 0x1008f086
lea ecx, [ebp - 0x24]
call fcn.1003f32e
mov ecx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
jb 0x1008f092
mov edi, dword [edi]
mov eax, dword [ebx + 0x28]
lea edx, [ebp - 0x1c]
push edx
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push 0
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x1008f0ba
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0x1008f0f4
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x1008f0e2
test byte [eax + 0x44], 1
je 0x1008f0e2
push esi
push dword [eax + 0x3c]
mov edx, 0x1001caf8
push dword [eax + 0x38]
push 0x14
pop ecx
call fcn.1003f754
push esi
lea ecx, [ebp - 0x30]
call fcn.1003ecfb
push 0x10196090
mov eax, ecx
jmp 0x1008f127
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call fcn.10167384
ret
push esi
push dword [eax + 0x3c]
mov edx, 0x1001caf8
push dword [eax + 0x38]
push 0x11
pop ecx
call fcn.1003f754
push esi
lea ecx, [ebp - 0x18]
call fcn.1003ecfb
push 0x10196090
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x10094aa0
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x1016f172
call fcn.101673d5
mov esi, ecx
mov dword [ebp - 0x34], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x10094ac5
xor eax, eax
jmp 0x10094c37
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x10094af1
mov edx, dword [esi + 0x34]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x10094af1
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x24]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x10094c37
cmp dword [esi + 0x54], 0
je 0x10094c34
mov ecx, esi
call fcn.10094d39
cmp dword [esi + 0x44], 0
jne 0x10094b25
push dword [esi + 0x54]
push edi
call dword [sym.imp.msvcrt.dll_fputwc]
pop ecx
pop ecx
cmp ax, bx
je 0x10094c34
movzx ebx, di
jmp 0x10094c34
push 0
push 8
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x30], di
call fcn.1007239a
and dword [ebp - 4], 0
lea eax, [esi + 0x4c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov edx, ecx
cmp eax, 0x10
jae 0x10094b51
lea edx, [ebp - 0x2c]
mov ecx, edx
mov edi, dword [esi + 0x44]
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x1c]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x40]
mov ecx, dword [esi + 0x14]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x38]
call dword [0x101a77c4]
mov ecx, edi
call dword [esi + 0x14]
test eax, eax
js 0x10094c28
cmp eax, 1
jg 0x10094c04
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov edx, ecx
cmp eax, 0x10
jae 0x10094b9b
lea edx, [ebp - 0x2c]
mov edi, dword [ebp - 0x3c]
sub edi, edx
je 0x10094bc9
cmp eax, 0x10
jae 0x10094baa
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
push dword [esi + 0x54]
push edi
push 1
push ecx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10094bfc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
jmp 0x10094bcc
mov esi, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
mov byte [esi + 0x4a], 1
cmp dword [ebp - 0x40], edx
jne 0x10094bf6
test edi, edi
jne 0x10094b45
cmp dword [ebp - 0x1c], 0x20
jae 0x10094bff
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10055938
jmp 0x10094b3f
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
movzx ebx, bx
jmp 0x10094c25
cmp eax, 3
jne 0x10094c28
mov eax, dword [ebp - 0x34]
push dword [eax + 0x54]
push dword [ebp - 0x30]
call dword [sym.imp.msvcrt.dll_fputwc]
pop ecx
pop ecx
cmp ax, bx
je 0x10094c25
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100572cc
mov ax, bx
call fcn.10167384
ret 4
Function at 0x10094de5
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x1016f19f
call fcn.101673d5
mov ebx, ecx
cmp dword [ebx + 0x44], 0
je 0x10094ee6
cmp byte [ebx + 0x4a], 0
je 0x10094ee6
mov esi, 0xffff
push esi
call fcn.10094aa0
movzx eax, ax
cmp si, ax
jne 0x10094e21
xor al, al
jmp 0x10094ee8
push 0
push 8
lea ecx, [ebp - 0x2c]
call fcn.1007239a
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov edx, ecx
cmp eax, 0x10
jae 0x10094e43
lea edx, [ebp - 0x2c]
mov ecx, edx
mov edi, dword [ebx + 0x44]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x4c]
mov ecx, dword [esi + 0x18]
push eax
call dword [0x101a77c4]
mov ecx, edi
call dword [esi + 0x18]
sub eax, 0
je 0x10094e79
sub eax, 1
je 0x10094e7d
dec eax
sub eax, 1
je 0x10094ed4
xor bl, bl
jmp 0x10094ed6
mov byte [ebx + 0x4a], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov edx, ecx
cmp eax, 0x10
jae 0x10094e8d
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x10094eb6
cmp eax, 0x10
jae 0x10094e9c
lea ecx, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push ecx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10094e75
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
cmp byte [ebx + 0x4a], 0
je 0x10094ed4
test esi, esi
jne 0x10094e37
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10055938
jmp 0x10094e31
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100572cc
mov al, bl
jmp 0x10094ee8
mov al, 1
call fcn.10167384
ret
Function at 0x10098419
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ecx
push ebx
push esi
mov esi, ecx
xor dl, dl
mov ecx, dword [esi + 0x40]
cmp ecx, 0xffff
je 0x100985b9
mov eax, ecx
mov ebx, sym.PrintConfig.dll_Ordinal_276
cmp eax, 0x7c
je 0x100985b9
cmp eax, 0x29
jne 0x1009846a
cmp dword [esi + 0x10], 0
jne 0x100985b9
cmp eax, eax
jne 0x1009846a
test dword [esi + 0x44], ebx
jne 0x10098558
push 5
call fcn.10166381
pop ecx
jmp 0x1009859a
cmp eax, 0x2e
jne 0x10098485
push 5
lea ecx, [esi + 0x18]
call fcn.100986bd
mov ecx, esi
call fcn.100983ec
jmp 0x1009859a
cmp eax, 0x5c
jne 0x100984da
mov ecx, esi
call fcn.100983ec
test byte [esi + 0x44], 0x80
je 0x100984ce
movzx eax, word [esi + 0x3e]
cmp eax, 0x62
jne 0x100984b6
push 4
lea ecx, [esi + 0x18]
call fcn.100986bd
mov ecx, esi
call fcn.100983ec
jmp 0x100985a1
cmp eax, 0x42
jne 0x100984ce
push 4
lea ecx, [esi + 0x18]
call fcn.100986bd
mov eax, dword [esi + 0x1c]
xor dword [eax + 8], 1
jmp 0x100984aa
mov ecx, esi
call fcn.10098985
jmp 0x1009859a
cmp eax, 0x5b
jne 0x10098500
mov ecx, esi
call fcn.100983ec
mov ecx, esi
call fcn.10098937
cmp dword [esi + 0x40], 0x5d
je 0x10098479
push 4
call fcn.10166381
pop ecx
jmp 0x10098479
cmp eax, 0x28
jne 0x1009852c
mov ecx, esi
call fcn.100983ec
mov ecx, esi
call fcn.10098a66
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x10098523
push 5
call fcn.10166381
pop ecx
mov ecx, esi
call fcn.100983ec
jmp 0x10098596
cmp eax, 0x5e
jne 0x10098538
push 2
jmp 0x100984a2
cmp eax, 0x24
jne 0x10098544
push 3
jmp 0x100984a2
cmp eax, 0x2a
je 0x1009858c
cmp eax, 0x2b
je 0x1009858c
cmp eax, 0x3f
je 0x1009858c
cmp eax, 0x7b
je 0x1009858c
cmp ecx, 0x7d
jne 0x10098569
test dword [esi + 0x44], ebx
jne 0x1009857a
push 6
jmp 0x1009845f
cmp ecx, 0x5d
jne 0x1009857a
test dword [esi + 0x44], ebx
jne 0x1009857a
push 4
jmp 0x1009845f
movzx eax, word [esi + 0x3e]
lea ecx, [esi + 0x18]
push eax
call fcn.10098c18
jmp 0x10098479
push 0xa
call fcn.10166381
pop ecx
mov bl, 1
test bl, bl
je 0x100985a1
mov ecx, esi
call fcn.10098b35
mov ecx, dword [esi + 0x40]
mov dl, 1
mov eax, ecx
mov ebx, sym.PrintConfig.dll_Ordinal_276
cmp ecx, 0xffff
jne 0x10098438
pop esi
mov al, dl
pop ebx
pop ecx
ret
Function at 0x100a3682
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x1017079c
call fcn.101673d5
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 2
mov ecx, dword [edi]
test ecx, ecx
je 0x100a36c3
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101a77c4]
call esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.100a37bf
test eax, eax
js 0x100a36fe
push dword [ebp - 0x14]
mov ecx, edi
call fcn.100a38e9
test eax, eax
js 0x100a36fe
push ebx
push ebx
push edi
push 0x100a3980
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xc], eax
test eax, eax
jne 0x100a36fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.10167384
ret 8

Function at 0x100bcc14
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10020414]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 1
push 4
mov esi, 0x10020410
mov dword [edi], eax
mov eax, dword [0x10020418]
mov dword [edi + 4], eax
lea eax, [ebp - 4]
push eax
push 0x2000100a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100bcc72
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi], ecx
je 0x100bcc67
inc eax
add esi, 0xc
cmp eax, 0x74
jb 0x100bcc58
jmp 0x100bcc72
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, dword [esi + 8]
mov dword [edi + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100bec60
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x1016f172
call fcn.101673d5
mov esi, ecx
mov dword [ebp - 0x34], esi
or ebx, 0xffffffff
cmp dword [ebp + 8], ebx
jne 0x100bec80
xor eax, eax
jmp 0x100bede2
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x100becae
mov edx, dword [esi + 0x34]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100becae
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x24]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x100bede2
xor edi, edi
cmp dword [esi + 0x54], edi
je 0x100bede0
mov ecx, esi
call fcn.10094d39
mov eax, dword [ebp + 8]
cmp dword [esi + 0x44], edi
jne 0x100bece7
push dword [esi + 0x54]
movsx eax, al
push eax
call dword [sym.imp.msvcrt.dll_fputc]
pop ecx
cmp eax, ebx
mov eax, dword [ebp + 8]
pop ecx
jne 0x100bede2
jmp 0x100bede0
push edi
push 8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2d], al
call fcn.1007239a
lea eax, [esi + 0x4c]
mov dword [ebp - 4], edi
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov edx, ecx
cmp eax, 0x10
jae 0x100bed10
lea edx, [ebp - 0x2c]
mov ecx, edx
mov edi, dword [esi + 0x44]
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x1c]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x40]
mov ecx, dword [esi + 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2d]
push eax
push dword [ebp - 0x38]
call dword [0x101a77c4]
mov ecx, edi
call dword [esi + 0x14]
test eax, eax
js 0x100bedd4
cmp eax, 1
jg 0x100bedb5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov edx, ecx
cmp eax, 0x10
jae 0x100bed5a
lea edx, [ebp - 0x2c]
mov edi, dword [ebp - 0x3c]
sub edi, edx
je 0x100bed88
cmp eax, 0x10
jae 0x100bed69
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
push dword [esi + 0x54]
push edi
push 1
push ecx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100bedd4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
jmp 0x100bed8b
mov esi, dword [ebp - 0x34]
lea edx, [ebp - 0x2d]
mov byte [esi + 0x49], 1
cmp dword [ebp - 0x40], edx
jne 0x100bedd1
test edi, edi
jne 0x100bed04
cmp dword [ebp - 0x1c], 0x20
jae 0x100bedd4
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10055938
jmp 0x100becfe
cmp eax, 3
jne 0x100bedd4
mov eax, dword [ebp - 0x34]
push dword [eax + 0x54]
movsx eax, byte [ebp - 0x2d]
push eax
call dword [sym.imp.msvcrt.dll_fputc]
pop ecx
pop ecx
cmp eax, ebx
je 0x100bedd4
mov ebx, dword [ebp + 8]
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100572cc
mov eax, ebx
call fcn.10167384
ret 4
Function at 0x100bf054
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x1016f19f
call fcn.101673d5
mov ebx, ecx
cmp dword [ebx + 0x44], 0
je 0x100bf14e
cmp byte [ebx + 0x49], 0
je 0x100bf14e
push 0xffffffffffffffff
call fcn.100bec60
cmp eax, 0xffffffff
jne 0x100bf089
xor al, al
jmp 0x100bf150
push 0
push 8
lea ecx, [ebp - 0x2c]
call fcn.1007239a
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov edx, ecx
cmp eax, 0x10
jae 0x100bf0ab
lea edx, [ebp - 0x2c]
mov ecx, edx
mov edi, dword [ebx + 0x44]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x1c]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x4c]
mov ecx, dword [esi + 0x18]
push eax
call dword [0x101a77c4]
mov ecx, edi
call dword [esi + 0x18]
sub eax, 0
je 0x100bf0e1
sub eax, 1
je 0x100bf0e5
dec eax
sub eax, 1
je 0x100bf13c
xor bl, bl
jmp 0x100bf13e
mov byte [ebx + 0x49], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov edx, ecx
cmp eax, 0x10
jae 0x100bf0f5
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x100bf11e
cmp eax, 0x10
jae 0x100bf104
lea ecx, [ebp - 0x2c]
push dword [ebx + 0x54]
push esi
push 1
push ecx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x100bf0dd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x100bf13c
test esi, esi
jne 0x100bf09f
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10055938
jmp 0x100bf099
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100572cc
mov al, bl
jmp 0x100bf150
mov al, 1
call fcn.10167384
ret
Function at 0x100da3bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101a4c2c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x100da4e9
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x100da4e9
xor edi, edi
cmp dword [esi + 8], edi
jne 0x100da3f7
xor eax, eax
inc eax
jmp 0x100da4f3
push edi
xor edx, edx
call fcn.100e26f0
mov ebx, eax
test ebx, ebx
jne 0x100da40c
push 0x66
jmp 0x100da4eb
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x128], edi
jne 0x100da4dc
mov edx, ebx
mov ecx, esi
call fcn.100da5f1
test eax, eax
je 0x100da4d7
mov edx, ebx
mov ecx, esi
call fcn.100da752
test eax, eax
je 0x100da4d7
mov eax, dword [ebx + 0x28]
mov dword [ebp - 8], 1
mov ecx, dword [eax + 4]
lea edi, [eax + 0x14]
test ecx, ecx
je 0x100da4dc
dec ecx
cmp dword [edi + 0x10], 0
mov dword [ebp - 0xc], ecx
je 0x100da4c5
cmp dword [edi + 0x24], 0
je 0x100da48c
push dword [edi + 0x1c]
mov edx, ebx
mov ecx, edi
push dword [ebx + 0x2c]
push esi
call fcn.100d88ad
cmp eax, 0x80004001
je 0x100da4c2
xor ecx, ecx
test eax, eax
setns cl
mov dword [ebp - 8], ecx
test eax, eax
js 0x100da4d2
jmp 0x100da4c2
test byte [edi + 0x3c], 0x20
je 0x100da497
mov eax, dword [edi + 0x54]
jmp 0x100da4a4
push 5
pop edx
mov ecx, edi
call fcn.10110711
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100da4c5
push dword [edi + 0x1c]
mov ecx, eax
push dword [ebx + 0x2c]
push esi
push ebx
call dword [0x101a77c4]
call dword [ebp - 0x10]
test eax, eax
je 0x100da4ce
mov ecx, dword [ebp - 0xc]
add edi, 0x78
test ecx, ecx
jne 0x100da455
jmp 0x100da4d2
and dword [ebp - 8], 0
mov esi, dword [ebp - 8]
jmp 0x100da4df
mov dword [ebp - 8], edi
jmp 0x100da4d2
xor esi, esi
inc esi
push ebx
call fcn.100e2690
mov eax, esi
jmp 0x100da4f3
push 0x65
push esi
call fcn.100da506
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10166ce0
mov esp, ebp
pop ebp
ret 4
Function at 0x100dddb1
Capabilities:
Create directory
Delete file
Get common file path
Move file
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
push ebx
push esi
mov dword [ebp - 8], eax
xor esi, esi
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
call fcn.100ddc5c
mov ebx, eax
test ebx, ebx
je 0x100ddec5
push edi
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x100ddeb2
mov eax, dword [ebp - 8]
push esi
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], esi
push esi
push 0x8100000
push 2
push esi
push esi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x100dde7f
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100dde59
mov eax, dword [ebp - 8]
push edi
push esi
push 0x10024f58
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x100ddeb2
push 1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x100ddeb2
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x100ddeb2
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 2
jb 0x100dddfe
jmp 0x100ddeb2
cmp dword [ebp - 4], esi
je 0x100dde9b
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100dde9e
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x1000
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100dde64
jmp 0x100dde9e
xor esi, esi
inc esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x100ddeb2
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x100ddec4
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret