joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ff0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
call fcn.10001f50
test al, al
jne 0x10001ffe
pop esi
ret
push edi
mov edi, dword [esi + 8]
cmp edi, 8
jae 0x1000200c
pop edi
xor al, al
pop esi
ret
mov edx, dword [esi + 4]
mov eax, 0x1001d868
mov ecx, 8
sub edx, eax
push ebx
lea esp, [esp]
mov ebx, dword [edx + eax]
cmp ebx, dword [eax]
jne 0x1000208e
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x10002020
add edi, 0xfffffff8
xor eax, eax
test edi, edi
jle 0x10002083
jmp 0x10002040
mov ecx, dword [esi + 4]
mov edx, eax
and edx, 0x1f
movsx edx, byte [edx + 0x1012758c]
and edx, 0xf
movzx edx, byte [edx + 0x1001d870]
sub byte [ecx + eax + 8], dl
lea ecx, [ecx + eax + 8]
mov ecx, dword [esi + 4]
mov edx, eax
and edx, 0xf
movzx edx, byte [edx + 0x1001d870]
xor byte [ecx + eax + 8], dl
lea ecx, [ecx + eax + 8]
mov ecx, dword [esi + 8]
inc eax
sub ecx, 8
cmp eax, ecx
jl 0x10002040
mov edi, esi
call fcn.100020a0
pop ebx
pop edi
pop esi
ret
pop ebx
pop edi
xor al, al
pop esi
ret

Function at 0x100020a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [edi + 0xc]
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push 0x1001d880
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x102
push 2
push 0
push 7
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002113
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
lea edx, [ebp - 4]
push edx
sub eax, 8
push eax
add ecx, 8
push ecx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x1000211a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002130
Capabilities:
Delete file

Disassembly:
push edi
lea edi, [esi + 0xc]
mov ecx, 0x1001d898
mov eax, edi
jmp 0x10002140
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002160
test dl, dl
je 0x1000215c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002160
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002140
xor eax, eax
jmp 0x10002165
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000219c
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1000219c
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
push 0x100
push 0
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.MSVCR100.dll_memset
add esp, 0x10
pop edi
ret
Function at 0x100026d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x1127fdd0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_jc]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x1127fdd0], cl
inc eax
cmp eax, 0x100
jb 0x100026f0
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x1127fdd0
push 0
mov ecx, 0x10122560
call fcn.1000ab70
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x1127f764], ecx
mov dword [ebp - 4], 0
jbe 0x100027e8
mov edi, dword [0x10122518]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x1000279b
mov eax, dword [0x10122514]
cmp eax, ebx
ja 0x1000279b
mov ecx, ebx
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1012251c]
jne 0x1000278a
mov ecx, 0x10122514
call fcn.100031b0
mov edi, dword [0x10122518]
mov eax, dword [0x10122514]
lea edx, [esi + esi*8]
lea esi, [eax + edx*8]
test edi, edi
je 0x100027c6
jmp 0x100027b9
cmp edi, dword [0x1012251c]
jne 0x100027b3
mov ecx, 0x10122514
call fcn.100031b0
mov edi, dword [0x10122518]
test edi, edi
je 0x100027c9
mov esi, ebx
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x10122518]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x48
mov dword [0x10122518], edi
movzx ecx, byte [esi + 8]
inc eax
add ebx, 0x48
mov dword [ebp - 4], eax
cmp eax, ecx
jl 0x10002750
pop edi
pop esi
mov dword [0x1127f754], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002800
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x1127fdd0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x1001c268]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x1127fdd0], cl
inc eax
cmp eax, 0x100
jb 0x10002820
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x1127fdd0
push 0
mov ecx, 0x10122560
call fcn.1000ab70
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x1127f768], ecx
mov dword [ebp - 4], 0
jbe 0x1000291f
mov edi, dword [0x10122528]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x100028cc
mov eax, dword [0x10122524]
cmp eax, ebx
ja 0x100028cc
mov ecx, ebx
sub ecx, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1012252c]
jne 0x100028ba
mov ecx, 0x10122524
call fcn.10003220
mov edi, dword [0x10122528]
imul esi, esi, 0x108
add esi, dword [0x10122524]
test edi, edi
je 0x100028f7
jmp 0x100028ea
cmp edi, dword [0x1012252c]
jne 0x100028e4
mov ecx, 0x10122524
call fcn.10003220
mov edi, dword [0x10122528]
test edi, edi
je 0x100028fa
mov esi, ebx
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x10122528]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x108
mov dword [0x10122528], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x108
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10002880
pop edi
pop esi
mov dword [0x1127f758], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002930
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x1127fdd0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_j_]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x1127fdd0], cl
inc eax
cmp eax, 0x100
jb 0x10002950
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x1127fdd0
push 0
mov ecx, 0x10122560
call fcn.1000ab70
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x1127f76c], ecx
mov dword [ebp - 4], 0
jbe 0x10002a50
mov edi, dword [0x10122538]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x100029fc
mov eax, dword [0x10122534]
cmp eax, ebx
ja 0x100029fc
mov ecx, ebx
sub ecx, eax
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1012253c]
jne 0x100029ea
mov ecx, 0x10122534
call fcn.10003290
mov edi, dword [0x10122538]
imul esi, esi, 0x105
add esi, dword [0x10122534]
test edi, edi
je 0x10002a28
jmp 0x10002a1a
cmp edi, dword [0x1012253c]
jne 0x10002a14
mov ecx, 0x10122534
call fcn.10003290
mov edi, dword [0x10122538]
test edi, edi
je 0x10002a2b
mov esi, ebx
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x10122538]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x105
mov dword [0x10122538], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x105
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x100029b0
pop edi
pop esi
mov dword [0x1127f75c], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002a70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x1127fdd0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_jv]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x1127fdd0], cl
inc eax
cmp eax, 0x100
jb 0x10002a90
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x1127fdd0
push 0
mov ecx, 0x10122560
call fcn.1000ab70
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x1127f770], ecx
mov dword [ebp - 4], 0
jbe 0x10002b8d
mov edi, dword [0x10122548]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x10002b3f
mov eax, dword [0x10122544]
cmp eax, ebx
ja 0x10002b3f
mov ecx, ebx
sub ecx, eax
mov eax, 0x7e07e07f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1012254c]
jne 0x10002b2a
mov ecx, 0x10122544
call fcn.10003300
mov edi, dword [0x10122548]
mov eax, esi
shl eax, 6
add eax, dword [0x10122544]
add eax, esi
test edi, edi
je 0x10002b6b
mov esi, eax
jmp 0x10002b5d
cmp edi, dword [0x1012254c]
jne 0x10002b57
mov ecx, 0x10122544
call fcn.10003300
mov edi, dword [0x10122548]
test edi, edi
je 0x10002b6e
mov esi, ebx
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x10122548]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x41
mov dword [0x10122548], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x41
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10002af0
pop edi
pop esi
mov dword [0x1127f760], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002ba0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
cmp byte [esi + 4], 0xb
jne 0x10002bf7
cmp byte [0x1127f6d4], 0x11
jne 0x10002bc1
push 0
push 0
mov ecx, 0x1127f6d0
call dword [0x1127f714]
cmp byte [0x1127f6d4], 0x19
jne 0x10002bd9
push 0
push 1
mov ecx, 0x1127f6d0
call dword [0x1127f714]
cmp byte [0x1127f6d4], 0x1e
jne case.0x10002c4c.0
push 0
push 1
mov ecx, 0x1127f6d0
call dword [0x1127f714]
pop esi
ret
push 0x100
push 0
push 0x1127fdd0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + str.r_jj]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x1127fdd0], cl
inc eax
cmp eax, 0x100
jb 0x10002c10
movzx edx, byte [esi + 4]
push edx
push 0x1127fdd0
push 0
mov ecx, 0x10122560
call fcn.1000ab70
movzx eax, byte [esi + 4]
add esp, 0xc
cmp eax, 0xa
ja case.default.0x10002c4c
jmp dword [eax*4 + 0x10002c84]
add esi, 5
push esi
push 2
mov eax, 0x1012c660
call fcn.100134b0
add esp, 8
pop esi
ret
mov ecx, 0x15
call fcn.1000b120
push eax
push 2
mov eax, 0x1012c660
call fcn.100134b0
add esp, 8
pop esi
ret
Function at 0x10002cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10022018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
cmp dword [0x1127f788], 1
push edi
je 0x10002d58
mov ecx, dword [0x10122514]
mov dword [0x1127f750], ebx
mov dword [0x1127f754], ebx
mov dword [0x1127f758], ebx
mov dword [0x1127f75c], ebx
mov dword [0x1127f760], ebx
mov dword [0x1127f764], ebx
mov dword [0x1127f768], ebx
mov dword [0x1127f76c], ebx
mov dword [0x1127f770], ebx
cmp ecx, dword [0x10122518]
je 0x10002d1c
mov dword [0x10122518], ecx
mov ecx, dword [0x10122524]
cmp ecx, dword [0x10122528]
je 0x10002d30
mov dword [0x10122528], ecx
mov ecx, dword [0x10122534]
cmp ecx, dword [0x10122538]
je 0x10002d44
mov dword [0x10122538], ecx
mov ecx, dword [0x10122544]
cmp ecx, dword [0x10122548]
je 0x10002d58
mov dword [0x10122548], ecx
mov dword [0x1012c3c4], ebx
mov dword [0x1012c3cc], ebx
mov word [ebp - 0x3c], 0x38c1
call dword [sym.imp.MSVCR100.dll_rand]
and eax, 0x800000ff
jns 0x10002d7e
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x1012c3b4]
mov edx, dword [str.1.7.0]
mov byte [ebp - 0x3a], al
mov eax, dword [0x1127f788]
mov dword [ebp - 0x38], eax
mov eax, dword [0x1001d8bc]
mov byte [ebp - 0x39], bl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
call fcn.10013680
push 0x100
mov esi, eax
push ebx
mov ecx, 9
lea edi, [ebp - 0x28]
push 0x1127fdd0
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x1001c568]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x1127fdd0], cl
inc eax
cmp eax, 0x100
jb 0x10002dd0
mov ecx, dword [ebp - 0x34]
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x30]
push eax
push ecx
push edx
push 0x1127fdd0
push ebx
mov ecx, 0x10122560
call fcn.1000ab70
movzx ecx, byte [ebp - 0x3b]
add esp, 0x18
lea edx, [ebp - 0x3c]
call fcn.10001900
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10016888
mov esp, ebp
pop ebp
ret
Function at 0x10003bb0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ecx
mov eax, dword [0x1012ce44]
test eax, eax
je 0x10003c54
mov ecx, dword [eax]
cmp ecx, dword [0x1012ce58]
jne 0x10003bd7
mov dl, byte [0x1012ce5c]
cmp dl, byte [eax + 4]
je 0x10003c54
push 0x100
push 0
push 0x1127fdd0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0x1001b568]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x1127fdd0], cl
inc eax
cmp eax, 0x100
jb 0x10003bf0
push 0x1127fdd0
push 0
mov ecx, 0x10122560
call fcn.1000ab70
xor eax, eax
add esp, 8
push eax
mov dword [0x1127fa80], eax
mov dword [0x1127fa84], eax
mov dword [0x1127fa88], eax
mov dword [0x1127fa8c], eax
mov dword [0x1127fa90], eax
mov dword [0x1127fa94], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov eax, dword [0x1012ce40]
test eax, eax
je 0x10003cc2
mov edx, dword [eax]
cmp edx, dword [0x1012ce50]
jne 0x10003c72
mov cl, byte [0x1012ce54]
cmp cl, byte [eax + 4]
je 0x10003cc2
mov eax, 0x10
call fcn.10013740
push eax
push 0
mov ecx, 0x10122560
call fcn.1000ab70
xor eax, eax
add esp, 8
push eax
mov dword [0x1127fa80], eax
mov dword [0x1127fa84], eax
mov dword [0x1127fa88], eax
mov dword [0x1127fa8c], eax
mov dword [0x1127fa90], eax
mov dword [0x1127fa94], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov eax, dword [0x1012ce3c]
test eax, eax
je 0x10003cff
mov edx, dword [eax]
cmp edx, dword [0x1012ce48]
jne 0x10003ce0
mov cl, byte [0x1012ce4c]
cmp cl, byte [eax + 4]
je 0x10003cff
mov eax, 0x11
call fcn.10013740
push eax
push 0
mov ecx, 0x10122560
call fcn.1000ab70
add esp, 8
call fcn.100130a0
pop ecx
ret
Function at 0x100095c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x57
xor ecx, ecx
jmp 0x100095d0
mov al, byte [edi + ecx - 0x3661ab76]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x2d
jb 0x100095d0
mov byte [esi + 0x2d], 0
mov eax, esi
ret

Function at 0x100095f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xf0
xor ecx, ecx
jmp 0x10009600
mov al, byte [edi + ecx + 0x79ddc0fb]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1e
jb 0x10009600
mov byte [esi + 0x1e], 0
mov eax, esi
ret

Function at 0x10009620
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7f
xor ecx, ecx
jmp 0x10009630
mov al, byte [edi + ecx + 0x7b9bf7eb]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xb
jb 0x10009630
mov byte [esi + 0xb], 0
mov eax, esi
ret

Function at 0x100096e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xf3
xor ecx, ecx
jmp 0x100096f0
mov al, byte [edi + ecx - 0x2b8b1aec]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xc
jb 0x100096f0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x10009710
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xae
xor ecx, ecx
jmp 0x10009720
mov al, byte [edi + ecx - 0x37b821da]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xe
jb 0x10009720
mov byte [esi + 0xe], 0
mov eax, esi
ret
Function at 0x1000a7c0
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10022018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push 3
push 0
push 1
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp + 0xc]
push connect
push eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000a813
lea edx, [ebp - 0x38]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1000a826
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016888
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push edi
push 0
push eax
push ecx
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
jne 0x1000a85d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016888
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x1000a89b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000a894
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000a894
mov edx, 0x14c
cmp word [ecx + 4], dx
je 0x1000a8bb
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016888
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x44]
mov dword [ebx], esi
mov dword [edx], edi
mov edx, dword [ebp - 0x3c]
mov dword [edx], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10016888
mov esp, ebp
pop ebp
ret 8
Function at 0x1000aa50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10022018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10122778]
push ebx
push esi
push edi
test eax, eax
js 0x1000ab59
cmp eax, 1
jge 0x1000ab59
mov esi, eax
imul esi, esi, 0x214
push ecx
add esi, 0x10122564
inc eax
lea edi, [esi + 4]
push 0x100
mov dword [0x10122778], eax
push edi
mov dword [esi], 1
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
cmp dword [esi], 0
je 0x1000ab59
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
push eax
push ecx
push edx
push edi
lea ebx, [esi + 0x110]
push str.._s_04d__02d__02d.log
push ebx
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x1000ab34
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016888
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000ab59
mov ecx, dword [esi + 0x210]
push ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10016888
mov esp, ebp
pop ebp
ret
Function at 0x1000ab70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x10022018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
js 0x1000ad67
cmp eax, dword [ecx + 0x218]
jge 0x1000ad67
imul eax, eax, 0x214
cmp dword [eax + ecx + 4], 0
lea esi, [eax + ecx + 4]
je 0x1000ad67
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x812]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, dword [esi + 0x104]
jne 0x1000abf6
movzx edx, word [ebp - 0x816]
cmp edx, dword [esi + 0x108]
jne 0x1000abf6
movzx eax, word [ebp - 0x818]
cmp eax, dword [esi + 0x10c]
je 0x1000acb3
mov ecx, dword [esi + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebp - 0x812]
movzx ecx, word [ebp - 0x816]
movzx edx, word [ebp - 0x818]
push eax
push ecx
push edx
mov dword [esi + 0x10c], edx
lea edx, [esi + 4]
push edx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.log
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
call ebx
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x1000ac7d
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016888
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000acb3
mov eax, dword [esi + 0x210]
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016888
mov esp, ebp
pop ebp
ret
push 0x3ff
lea ecx, [ebp - 0x807]
push 0
push ecx
mov byte [ebp - 0x808], 0
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
lea ecx, [ebp - 0x808]
push 0x400
push ecx
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
push 0x3ff
lea edx, [ebp - 0x407]
push 0
push edx
mov byte [ebp - 0x408], 0
call sub.MSVCR100.dll_memset
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
lea eax, [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x810]
push ecx
push edx
push eax
lea ecx, [ebp - 0x408]
push str._02d:_02d:_02d__s_r_n
push ecx
call ebx
lea eax, [ebp - 0x408]
add esp, 0x40
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ad40
mov ecx, dword [esi + 0x210]
sub eax, edx
push 0
lea edx, [ebp - 0x81c]
push edx
push eax
lea eax, [ebp - 0x408]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10016888
mov esp, ebp
pop ebp
ret

Function at 0x1000adb0
Capabilities:
Create thread

Disassembly:
cmp dword [0x1127f77c], 0
je 0x1000adf6
mov eax, dword [0x1127f690]
push 0x1127fa90
mov dword [0x10122780], eax
xor eax, eax
push eax
push 0x1012277c
push 0x1000aee0
push eax
push eax
mov dword [0x10122788], eax
mov dword [0x1012278c], eax
mov dword [0x10122790], eax
mov dword [0x10122794], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10122784], eax
ret