joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.004066d0
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.004066d0
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4066d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4066df
pop dword [ebp - 0x50]
mov eax, 0x6a2630b6
sub eax, 0x69e5c9d7
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3c2d6
push 0
mov eax, 0x8a577948
add eax, 0x75ec06e8
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x4e14
xor esi, esi
add esi, eax
mov edi, 0x2c4126ee
add edi, 0xd4039f12
add edi, dword [ebp - 0x50]
mov ebx, 0xe6025338
xor dword [ebp - 0xc], ecx
mov edx, dword [edi]
sub edx, ebx
add dword [ebp - 0x14], 0xd4433f18
mov dword [esi], edx
add esi, 0x7dcfca25
sub esi, 0x7dcfca21
add edi, 0x7e988aee
sub edi, 0x7e988aea
loop 0x406734
add eax, 0x12b23
xor ebx, ebx
add ebx, eax
add eax, 0x31c640e3
sub eax, 0x31c640de
mov ecx, 0x274d2c70
add ecx, 0xd8f2d390
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10002b80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1005ccde
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10071430]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov eax, dword [ebp]
cmp eax, 5
ja case.default.0x10002bbf
jmp dword [eax*4 + 0x10002d38]
push 0xc
call fcn.1004846c
add esp, 4
cmp eax, ebx
je 0x10002cc7
mov dword [eax + 4], ebx
mov dword [eax], vtable.NKZ::CCopyCoder.0
mov dword [eax + 8], ebx
jmp 0x10002cc9
push 0x10
call fcn.1004846c
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x20], 1
cmp eax, ebx
je 0x10002c20
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 4]
push ecx
push edx
mov esi, eax
call fcn.10021630
mov byte [esp + 0x20], bl
jmp 0x10002cc9
xor eax, eax
mov byte [esp + 0x20], bl
jmp 0x10002cc9
push 0x4b30
call fcn.1004846c
add esp, 4
cmp eax, ebx
je 0x10002cc7
mov ecx, dword [ebp + 4]
push ecx
mov esi, eax
call fcn.10023bf0
jmp 0x10002cc9
push 0x44
call fcn.1004846c
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x20], 2
cmp eax, ebx
je 0x10002c20
mov edx, dword [ebp + 4]
mov esi, eax
call fcn.10002350
mov byte [esp + 0x20], bl
jmp 0x10002cc9
push 0x18
call fcn.1004846c
add esp, 4
cmp eax, ebx
je 0x10002cc7
mov ecx, dword [ebp + 4]
mov dword [eax + 4], ebx
mov dword [eax], vtable.NKZ::CWvEncoder.0
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
call fcn.1003f990
jmp 0x10002cc9
push 0x47b0
call fcn.1004846c
add esp, 4
cmp eax, ebx
je 0x10002cc7
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 4]
push ecx
push edx
mov edi, eax
call fcn.10043f50
jmp 0x10002cc9
xor eax, eax
mov esi, eax
lea edi, [esp + 0x28]
call fcn.1000ae20
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0x30]
push ebx
add ebp, 0x10
push ebp
push edx
mov edx, dword [eax + 0xc]
push ecx
push esi
call edx
mov dword [esp + 0x20], 0xffffffff
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, 0x80004005
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10007230
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1000723f
mov dword [esi], 0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [eax + 8]
push edx
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10007273
call fcn.10006a70
pop esi
ret 0x10
test esi, esi
je 0x1000727d
mov edx, dword [esp + 0x14]
mov dword [esi], edx
xor eax, eax
pop esi
ret 0x10

Function at 0x100072f0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x10007308
mov eax, 0x80070057
pop esi
add esp, 8
ret 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 8]
lea eax, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1000732b
call fcn.10006a70
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esi], eax
mov dword [esi + 4], ecx
xor eax, eax
pop esi
add esp, 8
ret 8
Function at 0x1000ab10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x16c
mov eax, dword [0x10071430]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push ebp
mov ebp, dword [esp + 0x178]
push edi
cmp esi, 0xffffffff
je 0x1000acde
test ebp, ebp
je 0x1000acde
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call edi
test eax, eax
jne 0x1000ab71
call fcn.10006a70
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.10047eba
add esp, 0x16c
ret
push 0x40
lea eax, [esp + 0x134]
push 0
push eax
call fcn.1004c5f0
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x40
lea edx, [esp + 0x13c]
push edx
push esi
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x1000ab54
cmp dword [esp + 0xc], 0x40
je 0x1000abcf
mov eax, 0x80004005
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.10047eba
add esp, 0x16c
ret
mov eax, dword [esp + 0x16c]
push 0
cdq
push 0
push edx
push eax
push esi
call edi
test eax, eax
je 0x1000ab54
push 0xf8
lea eax, [esp + 0x14]
push 0
push eax
call fcn.1004c5f0
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xf8
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
test eax, eax
je 0x1000ab54
cmp dword [esp + 0xc], 0xf8
jne 0x1000abb2
movzx eax, word [esp + 0x16]
dec eax
lea eax, [eax + eax*4]
push 1
add eax, eax
xor ecx, ecx
push ecx
add eax, eax
push ecx
add eax, eax
push eax
push esi
call edi
test eax, eax
je 0x1000ab54
xor eax, eax
push eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
lea eax, [esp + 0x10]
push eax
push 0x28
lea ecx, [esp + 0x114]
push ecx
push esi
call ebx
test eax, eax
je 0x1000ab54
cmp dword [esp + 0xc], 0x28
jne 0x1000abb2
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
add eax, edx
mov dword [ebp], eax
xor eax, eax
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.10047eba
add esp, 0x16c
ret
mov ecx, dword [esp + 0x174]
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x80070057
call fcn.10047eba
add esp, 0x16c
ret
Function at 0x1000ad00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
je 0x1000ae08
cmp eax, ebx
je 0x1000ae08
cmp word [eax], bx
je 0x1000ae08
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x1000ad32
mov dword [ecx], ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000ad58
call fcn.10006a70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [esp + 0x18]
push eax
push 4
push edi
push esi
mov dword [edi], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000ad89
call fcn.10006a70
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi], 0x4d
jne 0x1000adf8
cmp byte [edi + 1], 0x5a
jne 0x1000adf8
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], ebx
call fcn.1000ab10
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000adbb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x10]
xor eax, eax
push eax
push eax
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1000ad72
mov eax, dword [ebp + 8]
mov dword [edi], 0
test eax, eax
je 0x1000addf
mov dword [eax], ebx
push 0
lea edx, [esp + 0x18]
push edx
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000ad72
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b5a0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1000b5b9
mov dword [esi + 0x40], 0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esi + 0x7c], 8
jb 0x1000b5cb
mov esi, dword [esi + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
add esi, 0x68
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
Function at 0x1000bab0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1005dd93
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x10071430]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi], vtable.NKZ::CKZArchive.0
mov dword [esi + 4], vtable.NKZ::CKZArchive.1.0
mov dword [esi + 8], vtable.NKZ::CKZArchive.2.0
mov dword [esi + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x70], 7
mov dword [esi + 0x6c], ebx
xor eax, eax
mov word [esi + 0x5c], ax
xor ecx, ecx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov word [esi + 0x52], cx
mov byte [esi + 0x41], bl
mov byte [esi + 0x42], bl
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x49], eax
mov dword [esi + 0x4d], eax
xor edx, edx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov word [esi + 0x80], dx
mov word [esi + 0x54], ax
mov byte [esi + 0x40], bl
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
lea ecx, [esi + 0x94]
push ecx
mov byte [esp + 0x18], 6
call fcn.10001300
mov dword [esi + 0xac], vtable.NKZ::CBuffer_unsigned_char_.0
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0x90], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x100115d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
lea edx, [esp + 0xc]
mov esi, eax
or ebx, 0xffffffff
call fcn.10011540
mov edx, dword [esp + 0x410]
test esi, esi
jbe 0x1001160c
test dl, 7
je 0x1001160c
movzx eax, byte [edx]
movzx ecx, bl
xor eax, ecx
shr ebx, 8
xor ebx, dword [esp + eax*4 + 0xc]
dec esi
inc edx
test esi, esi
ja 0x100115f2
cmp esi, 8
jb 0x1001167e
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
add edx, 8
movzx ecx, bl
mov eax, ebx
shr eax, 8
xor eax, dword [esp + ecx*4 + 0xc]
sub esi, 8
movzx ecx, al
shr eax, 8
xor eax, dword [esp + ecx*4 + 0xc]
movzx ecx, al
shr eax, 8
xor eax, dword [esp + ecx*4 + 0xc]
mov ecx, eax
movzx eax, cl
mov eax, dword [esp + eax*4 + 0xc]
xor eax, dword [edx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [esp + ecx*4 + 0xc]
movzx ecx, al
shr eax, 8
xor eax, dword [esp + ecx*4 + 0xc]
movzx ecx, al
shr eax, 8
xor eax, dword [esp + ecx*4 + 0xc]
movzx ecx, al
shr eax, 8
xor eax, dword [esp + ecx*4 + 0xc]
sub edi, 1
mov ebx, eax
jne 0x10011616
xor eax, eax
test esi, esi
jbe 0x10011699
movzx ecx, byte [eax + edx]
movzx edi, bl
xor ecx, edi
shr ebx, 8
xor ebx, dword [esp + ecx*4 + 0xc]
inc eax
cmp eax, esi
jb 0x10011684
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x400
ret

Function at 0x100116b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x400
xor edx, edx
mov eax, edx
shr eax, 1
test dl, 1
je 0x100116c6
xor eax, 0xedb88320
test al, 1
je 0x100116d3
shr eax, 1
xor eax, 0xedb88320
jmp 0x100116d5
shr eax, 1
test al, 1
je 0x100116e2
shr eax, 1
xor eax, 0xedb88320
jmp 0x100116e4
shr eax, 1
test al, 1
je 0x100116f1
shr eax, 1
xor eax, 0xedb88320
jmp 0x100116f3
shr eax, 1
test al, 1
je 0x10011700
shr eax, 1
xor eax, 0xedb88320
jmp 0x10011702
shr eax, 1
test al, 1
je 0x1001170f
shr eax, 1
xor eax, 0xedb88320
jmp 0x10011711
shr eax, 1
test al, 1
je 0x1001171e
shr eax, 1
xor eax, 0xedb88320
jmp 0x10011720
shr eax, 1
test al, 1
je 0x1001172d
shr eax, 1
xor eax, 0xedb88320
jmp 0x1001172f
shr eax, 1
mov dword [esp + edx*4], eax
inc edx
cmp edx, 0x100
jl 0x100116b8
mov edx, dword [esp + 0x404]
or eax, 0xffffffff
test ecx, ecx
je 0x1001176c
push esi
push edi
nop
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esp + esi*4 + 8]
dec ecx
inc edx
test ecx, ecx
jne 0x10011750
pop edi
pop esi
not eax
add esp, 0x400
ret
Function at 0x10012f60
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1005c8e0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10071430]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [esp + 0x44], ebx
jne 0x10012fa8
mov eax, 0x80070057
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 0x40]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], ebx
cmp edi, 0xffffffff
jne 0x10012fe7
call fcn.10006a70
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea ecx, [esp + 0x24]
push ecx
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10013023
call fcn.10006a70
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push 0x100732c0
push 0x100000
call fcn.10048539
mov esi, eax
add esp, 8
mov dword [esp + 0x20], esi
mov byte [esp + 0x38], 1
cmp esi, ebx
jne 0x10013064
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor ebp, ebp
cmp dword [esp + 0x28], ebp
jb 0x10013074
ja 0x100130a4
cmp dword [esp + 0x24], ebp
ja 0x100130a4
lea esi, [esp + 0x20]
call fcn.10005cc0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov edi, dword [esp + 0x1c]
push 0x100000
push 0
push esi
call fcn.1004c5f0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
add esp, 0xc
sub ecx, ebx
sbb eax, ebp
test eax, eax
jb 0x100130d3
ja 0x100130ce
cmp ecx, 0x100000
jbe 0x100130d3
mov ecx, 0x100000
push 0
lea edx, [esp + 0x1c]
push edx
push ecx
push esi
push edi
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10013126
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
push 0
push edx
push esi
push eax
mov eax, dword [ecx + 0xc]
call eax
mov edi, eax
test edi, edi
jne 0x10013153
add ebx, dword [esp + 0x18]
adc ebp, eax
cmp ebp, dword [esp + 0x28]
jb 0x100130a0
ja 0x1001311d
cmp ebx, dword [esp + 0x24]
jb 0x100130a0
mov edi, dword [esp + 0x1c]
jmp 0x10013074
call fcn.10006a70
lea esi, [esp + 0x20]
mov ebx, eax
call fcn.10005cc0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea esi, [esp + 0x20]
call fcn.10005cc0
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10013420
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001342f
mov dword [esi], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10013471
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
push edx
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10013467
call fcn.10006a70
pop esi
ret 0x10
test esi, esi
je 0x10013471
mov edx, dword [esp + 0x14]
mov dword [esi], edx
xor eax, eax
pop esi
ret 0x10

Function at 0x10013480
Capabilities:
Clear file content

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push 0
push 0
push ecx
push edx
push esi
call eax
test eax, eax
jne 0x100134b8
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100134b6
call fcn.10006a70
pop esi
ret 0xc
xor eax, eax
pop esi
ret 0xc
Function at 0x10013680
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1005d09b
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x10071430]
xor eax, esp
mov dword [esp + 0x430], eax
push esi
push edi
mov eax, dword [0x10071430]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
mov edi, ecx
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100136c0
sub eax, edx
sar eax, 1
push eax
lea esi, [ebx + 0x10]
mov eax, edi
call fcn.10005ec0
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10013720
mov eax, dword [ebx + 8]
cmp eax, 0xffffffff
je 0x100136fb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 8], 0xffffffff
push 0
push 0
push 1
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
je 0x1001376e
xor eax, eax
jmp 0x100138a9
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10013735
and eax, 0x10
jne 0x1001387e
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.1004c5f0
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x1001379a
lea edx, [esp + 0x2c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x10013778
call fcn.10006a70
jmp 0x100138a9
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
lea ecx, [esp + 0x30]
push 0x104
push ecx
call fcn.10048a05
add esp, 0xc
lea edi, [esp + 0x2c]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
sub eax, edi
sar eax, 1
xor edx, edx
push eax
mov eax, edi
lea esi, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], dx
call fcn.10005ec0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x23e]
mov dword [esp + 0x450], 0
push ecx
mov word [esp + 0x240], ax
call fcn.1004c5f0
mov eax, dword [esp + 0x20]
mov edi, 8
add esp, 0xc
cmp dword [esp + 0x28], edi
jae 0x10013806
lea eax, [esp + 0x14]
lea edx, [esp + 0x234]
push edx
push 0
push 0x1006b7c0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1001383e
call fcn.10006a70
mov esi, eax
cmp dword [esp + 0x28], edi
jb 0x1001383a
mov eax, dword [esp + 0x14]
push eax
call fcn.10047eaf
add esp, 4
mov eax, esi
jmp 0x100138a9
lea eax, [esp + 0x234]
lea edx, [eax + 2]
jmp 0x10013850
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10013850
sub eax, edx
sar eax, 1
push eax
lea esi, [ebx + 0x2c]
lea eax, [esp + 0x238]
call fcn.10005ec0
cmp dword [ebx + 0x40], 0
jne 0x10013885
lea esi, [esp + 0x10]
call fcn.10006a90
mov eax, 0x80004005
jmp 0x100138a9
cmp dword [esi + 0x18], edi
jb 0x1001388f
mov esi, dword [esi + 4]
jmp 0x10013892
add esi, 4
push 1
push esi
mov esi, ebx
call fcn.100134c0
lea esi, [esp + 0x10]
mov edi, eax
call fcn.10006a90
mov eax, edi
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.10047eba
add esp, 0x440
ret