joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b380
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100804b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x1002b4ed
test ebx, ebx
je 0x1002b4ed
cmp word [ebx], 0
je 0x1002b4ed
push esi
push 0xfffffffffffffff0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x1002b472
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
jne 0x1002b472
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.1004bdc0
mov eax, dword [edi + 0x18]
add esp, 0xc
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], 0xa1
mov dword [ebp - 0x2c], eax
push 0
mov dword [ebp - 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x432
push dword [edi]
mov dword [ebp - 0x10], ebx
call esi
lea ecx, [ebp - 0x3c]
call fcn.1003b0b0
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x38]
add eax, 0xf
movzx ecx, ax
mov eax, dword [ebp - 0x3c]
add eax, 0xf
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push 0
push 0x412
push dword [edi]
call esi
lea eax, [ebp - 0x34]
push eax
push 1
push 0x411
jmp 0x1002b4e8
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.1004bdc0
mov eax, dword [edi + 0x18]
add esp, 0xc
mov dword [ebp - 0x34], 0x2c
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], eax
push 0
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push dword [edi + 0x18]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x34]
push eax
push 0
push 0x432
push dword [edi]
call esi
lea ecx, [ebp - 0x3c]
call fcn.1003b0b0
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0
push 0
push 0x41c
push dword [edi]
call esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 4

Function at 0x10030060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100804b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100300df
cmp eax, 0x104
ja 0x100300df
push esi
push 0
push 0x1006cd5c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x100300df
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
pop esi
cmove eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 4
Function at 0x10030210
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100804b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test ebx, ebx
je 0x10030301
cmp dword [ebp + 0x10], 0
jle 0x10030301
mov eax, dword [esi + 0x210]
test eax, eax
je 0x10030258
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [esi + 0x210], 0
push edi
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.10030060
mov edi, eax
test edi, edi
je 0x100302ec
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
je 0x100302d9
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x50
push 0
push 0
push 2
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [esi + 0x210], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 0x210]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10031f50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10032085
cmp word [esi], 0
je 0x10032085
mov ecx, dword [ebp + 8]
call fcn.10031a50
push 0
push 0
push 3
push 0
push 7
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10032085
test esi, esi
je 0x10032085
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test ebx, ebx
je 0x10032074
push edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp dword [ebp + 0xc], 0
jne 0x10031fee
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003204b
mov ecx, dword [ebp + 8]
push dword [ebp + 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x40]
test eax, eax
je 0x1003204b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100329a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov dword [0x100831cc], esi
test esi, esi
jne 0x100329bc
push str.Load_UI_Library._Current_Version:_1_1_14_8260
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10
call fcn.1004aa3a
add esp, 4
test eax, eax
je 0x100329d3
mov ecx, eax
call fcn.1003a650
jmp 0x100329d5
xor eax, eax
push esi
mov ecx, eax
mov dword [0x100831d0], eax
call fcn.1003ad50
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 8
call fcn.1004aa3a
mov esi, eax
add esp, 4
test esi, esi
je 0x10032a10
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1002f520
mov dword [esi], eax
jmp 0x10032a12
xor esi, esi
mov ecx, esi
mov dword [0x100831c8], esi
call fcn.1003aff0
push 0
push 0x1007d060
push 0x100831c4
call sub.gdiplus.dll_GdiplusStartup
pop esi
pop ebp
ret 4
Function at 0x10037c00
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064ca3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100804b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10032e50
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duImageStyle.0
lea ecx, [esi + 0x4c]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x10066e48
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.100054d0
xor eax, eax
mov dword [esi + 0x78], 7
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 1
mov dword [ecx + 0x10], 0
push eax
push 0x10066e48
mov word [ecx], ax
call fcn.100054d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10037d10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064cc8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100804b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10032e50
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duLineStyle.0
lea ecx, [esi + 0x34]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x10066e48
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.100054d0
push 0
push 0
lea ecx, [esi + 0x4c]
call fcn.1003b0c0
push 0
push 0
lea ecx, [esi + 0x54]
call fcn.1003b0c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10037de0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064cc8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100804b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10032e50
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duRectStyle.0
lea ecx, [esi + 0x40]
mov dword [esi + 0x2c], 0xffffff
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 1
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x10066e48
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.100054d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10037eb0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064d0e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100804b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10032e50
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], vtable.duTextStyle.0
lea ecx, [esi + 0x34]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x10066e48
mov dword [ebp - 4], 0
mov word [ecx], ax
call fcn.100054d0
xor eax, eax
mov dword [esi + 0x60], 7
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [ecx + 0x10], 0
push eax
push 0x10066e48
mov word [ecx], ax
call fcn.100054d0
xor eax, eax
mov dword [esi + 0x78], 7
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 2
mov dword [ecx + 0x10], 0
push eax
push 0x10066e48
mov word [ecx], ax
call fcn.100054d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003c4f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc04
mov eax, dword [0x100804b8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1003c510
lea ecx, [ebp + 0xc]
sub eax, edx
push ecx
push dword [ebp + 8]
sar eax, 1
push eax
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.1004c234
mov eax, dword [0x10083408]
mov ecx, eax
inc eax
mov dword [0x10083408], eax
lea eax, [ebp - 0x404]
push eax
push ecx
lea eax, [ebp - 0xc04]
push str.__d__s
push eax
call fcn.100099c0
add esp, 0x24
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004aab5
mov esp, ebp
pop ebp
ret
Function at 0x1003d090
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100804b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1003d1f5
cmp dword [eax + 0x21c], 0
je 0x1003d0df
push ebx
push esi
push edi
push eax
call fcn.1003d3f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 0x10
push 0x104
add eax, 0xc
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1004bec7
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1004cd73
add esp, 0x1c
lea eax, [ebp - 0x20c]
push 0
push 0
push 3
push 0
push 7
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003d1f5
test edi, edi
je 0x1003d1f5
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x1003d1c6
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
push 0
push eax
mov dword [esi], eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp dword [ebx], 0
jne 0x1003d173
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003d1e7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x214], eax
push ecx
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1003d1c6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003d1df
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebx], 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi], 0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004aab5
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1003da60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003dab2
cmp word [esi], 0
je 0x1003dab2
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1003dab2
push edi
mov edi, dword [ebp + 8]
push 0
push esi
mov dword [edi + 0x21c], 1
call fcn.100469d0
add esp, 8
mov dword [edi + 0x220], eax
test eax, eax
jne 0x1003daa5
pop edi
pop esi
pop ebp
ret 8
push esi
push edi
call fcn.1003d5f0
pop edi
pop esi
pop ebp
ret 8
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x10040ad0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065333
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100804b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], 0
mov word [esi + 0x1c], ax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
lea ecx, [esi + 0x48]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], eax
mov word [ecx], ax
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
push eax
push 0x10066e48
mov byte [ebp - 4], 1
mov dword [esi + 0x60], 4
mov byte [esi + 0x40], al
mov dword [esi + 0x44], eax
call fcn.100054d0
mov dword [esi + 0x68], 0
mov eax, esi
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10040ba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065363
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100804b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], 0
mov word [esi + 0x1c], ax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.TiXmlElement.0
xor ecx, ecx
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0xffffffff
mov dword [esi + 0x40], vtable.TiXmlAttribute.0
mov dword [esi + 0x64], 7
mov dword [esi + 0x60], 0
mov dword [ebp - 4], eax
lea eax, [esi + 0x40]
mov word [eax + 0x10], cx
mov dword [eax + 0x3c], 7
mov dword [eax + 0x38], ecx
mov word [eax + 0x28], cx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x44], eax
mov dword [eax + 0x40], eax
mov edx, dword [ebp + 8]
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], ecx
mov byte [ebp - 4], 1
cmp word [edx], cx
jne 0x10040c62
xor eax, eax
jmp 0x10040c76
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10040c67
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.100054d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10040d00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065388
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100804b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], 0
mov word [esi + 0x1c], ax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov edi, dword [ebp + 8]
mov dword [esi], vtable.TiXmlText.0
mov dword [ebp - 4], eax
cmp word [edi], ax
jne 0x10040d7b
xor ecx, ecx
jmp 0x10040d8f
mov ecx, edi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040d80
sub ecx, ebx
sar ecx, 1
push ecx
push edi
lea ecx, [esi + 0x1c]
call fcn.100054d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10045fd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100804b8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10046004
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10046004
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x100460c8
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x10046021
cmp ax, 0x5c
jne 0x10046023
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x10046015
cmp esi, ebx
je 0x1004606f
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.1004b770
add esp, 0xc
cmp esi, 0x208
jae 0x100460d8
xor eax, eax
mov word [ebp + esi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.10045fd0
add esp, 8
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x10046092
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1004b2c4
add esp, 0xc
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.1004cd73
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100460c8
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1004aab5
mov esp, ebp
pop ebp
ret
call fcn.1004caa7
int3
Function at 0x100468d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x1004699a
cmp dword [esi + 4], 0xffffffff
jne 0x1004699a
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10046901
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x10046935
cmp eax, 0x2f
je 0x10046935
push 0x1006ffb0
push 0x104
push edi
call fcn.1004cd73
add esp, 0xc
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x1004695b
push edi
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1004695b
pop edi
mov eax, 0x2000000
pop esi
pop ebp
ret 0xc
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10049510
add esp, 0x10
test eax, eax
jne 0x1004697b
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret 0xc
push eax
call fcn.10049c40
add esp, 4
mov dword [esi], eax
xor ecx, ecx
mov edx, 0x200
test eax, eax
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x10047040
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movsx eax, al
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
mov eax, dword [eax*4 + 0x1006f910]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edx + 8]
inc ecx
mov dword [edx + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x1006f910]
mov dword [edx + 8], eax
pop ebp
ret