joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100065d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10058c84], eax
je 0x100065ed
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x10058c88]
test eax, eax
jne 0x100066e6
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1000660c
lea eax, [esi + 6]
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [esi], 0
jne 0x10006628
mov eax, 6
mov dword [0x10058c8c], esi
mov dword [0x10058c88], eax
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
push edi
push 0x18
call fcn.1001f870
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10006642
lea esi, [eax + 8]
jmp 0x100066c5
mov edi, dword [esi]
mov esi, dword [ebp + 0xc]
call fcn.10005e10
movzx ecx, byte [edi + 0x17]
mov esi, dword [edi + 0x18]
sub esi, ecx
test ecx, ecx
je 0x100066b7
cmp ecx, 0x17
ja 0x100066b7
cmp dword [edi + 0x1c], eax
jne 0x100066b7
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10006686
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x100066c5
mov ecx, dword [ebp + 8]
mov eax, dword [0x10058c94]
mov dword [ebx + 0x10], edi
mov dword [ebx + 0xc], esi
mov dword [ebx + 4], 1
mov dword [ebx + 8], ecx
mov edx, dword [ebp - 4]
pop edi
mov dword [ebx], eax
mov dword [ebx + 0x14], edx
mov dword [0x10058c94], ebx
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [0x10058c80], 0
mov esi, 9
jne 0x100066cb
mov dword [0x10058c88], esi
test ebx, ebx
je 0x100066d8
push ebx
call fcn.1001f865
add esp, 4
mov ecx, dword [ebp + 8]
pop edi
pop ebx
mov eax, esi
mov dword [0x10058c8c], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10006b90
Capabilities:
Hash data using jshash

Disassembly:
push esi
mov esi, dword [edi + 0x10]
xor ecx, ecx
mov eax, 0x4e67c6a7
test esi, esi
je 0x10006bc6
push ebx
cmp dword [edi + 0x14], 0x10
jb 0x10006baa
mov edx, dword [edi]
jmp 0x10006bac
mov edx, edi
movsx edx, byte [edx + ecx]
mov ebx, eax
shl ebx, 5
add edx, ebx
mov ebx, eax
shr ebx, 2
add edx, ebx
inc ecx
xor eax, edx
cmp ecx, esi
jb 0x10006ba0
pop ebx
pop esi
ret
Function at 0x10006be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x9e3779b9
xor esi, esi
mov dword [ebp - 4], edx
mov ebx, edi
cmp edx, 0xc
jb 0x10006ce8
mov eax, 0xaaaaaaab
mul edx
shr edx, 3
mov dword [ebp - 8], edx
mov edi, edi
movzx eax, byte [ecx + 7]
movzx edx, byte [ecx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 5]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 4]
add edi, edx
movzx edx, byte [ecx + 0xa]
shl eax, 8
add edi, eax
movzx eax, byte [ecx + 0xb]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 9]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 8]
add esi, edx
movzx edx, byte [ecx + 2]
shl eax, 8
add esi, eax
movzx eax, byte [ecx + 3]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 1]
shl eax, 8
add eax, edx
movzx edx, byte [ecx]
shl eax, 8
add eax, edx
sub eax, esi
sub eax, edi
sub edi, esi
add eax, ebx
mov edx, esi
shr edx, 0xd
xor eax, edx
sub edi, eax
mov edx, eax
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 0xd
xor esi, edx
sub eax, esi
sub eax, edi
mov edx, esi
shr edx, 0xc
xor eax, edx
sub edi, esi
sub edi, eax
mov edx, eax
sub dword [ebp - 4], 0xc
shl edx, 0x10
xor edi, edx
sub esi, edi
sub esi, eax
mov edx, edi
shr edx, 5
xor esi, edx
sub eax, esi
sub eax, edi
mov ebx, esi
shr ebx, 3
xor ebx, eax
sub edi, esi
mov eax, ebx
sub edi, ebx
shl eax, 0xa
xor edi, eax
sub esi, edi
mov edx, edi
sub esi, ebx
shr edx, 0xf
xor esi, edx
add ecx, 0xc
dec dword [ebp - 8]
jne 0x10006c10
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
dec eax
add esi, edx
cmp eax, 0xa
ja case.default.0x10006cf3
jmp dword [eax*4 + 0x10006dc0]
movzx eax, byte [ecx + 0xa]
shl eax, 0x18
add esi, eax
movzx edx, byte [ecx + 9]
shl edx, 0x10
add esi, edx
movzx eax, byte [ecx + 8]
shl eax, 8
add esi, eax
movzx edx, byte [ecx + 7]
shl edx, 0x18
add edi, edx
movzx eax, byte [ecx + 6]
shl eax, 0x10
add edi, eax
movzx edx, byte [ecx + 5]
shl edx, 8
add edi, edx
movzx eax, byte [ecx + 4]
add edi, eax
movzx edx, byte [ecx + 3]
shl edx, 0x18
add ebx, edx
movzx eax, byte [ecx + 2]
shl eax, 0x10
add ebx, eax
movzx edx, byte [ecx + 1]
shl edx, 8
add ebx, edx
movzx eax, byte [ecx]
add ebx, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xd
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 8
xor edi, edx
sub esi, edi
sub esi, ebx
mov eax, edi
shr eax, 0xd
xor esi, eax
sub ebx, esi
sub ebx, edi
sub edi, esi
mov ecx, esi
shr ecx, 0xc
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0x10
xor edi, edx
sub esi, edi
mov eax, edi
sub esi, ebx
shr eax, 5
xor eax, esi
sub ebx, eax
sub ebx, edi
mov ecx, eax
sub edi, eax
shr ecx, 3
xor ebx, ecx
sub edi, ebx
mov edx, ebx
shl edx, 0xa
xor edi, edx
sub eax, edi
sub eax, ebx
shr edi, 0xf
xor eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006f10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10042eb0
push 0x10024b00
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10047410]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
test eax, eax
mov esi, 0x10000
je 0x10006f55
lea esi, [eax + 0x10000]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea ebx, [eax - 2]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [ebp - 0x34]
push eax
push esi
call edi
test eax, eax
je 0x10006fda
cmp dword [ebp - 0x24], 0x1000
jne 0x10006ff3
test dword [ebp - 0x20], 0x100
jne 0x10006ff3
mov dword [ebp - 4], 0
mov ecx, 0x5a4d
cmp word [esi], cx
jne 0x10006ff0
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x10006ff0
mov dword [ebp - 4], ebx
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
jmp 0x10006f75
Function at 0x10007000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10042e90
push 0x10024b00
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10047410]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], ecx
xor esi, esi
cmp eax, esi
jne 0x1000704d
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x10007064
push 0xc1
jmp 0x10007141
mov edx, dword [ecx + 0x3c]
add edx, ecx
mov dword [ebp - 0x20], edx
cmp dword [edx], 0x4550
je 0x1000707e
push 0xbf
jmp 0x10007141
movzx ecx, word [edx + 0x14]
cmp cx, si
je 0x1000713c
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x1c], esi
movzx edx, word [edx + 6]
cmp esi, edx
jae 0x1000713c
lea ecx, [esi + esi*4]
lea edi, [eax + ecx*8]
mov edx, str..detour
mov ecx, edi
jmp 0x100070b0
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x100070d0
test bl, bl
je 0x100070cc
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x100070d0
add ecx, 2
add edx, 2
test bl, bl
jne 0x100070b0
xor ecx, ecx
jmp 0x100070d5
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x1000712a
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x1000713c
cmp dword [edi + 0x10], 0
je 0x1000713c
mov edx, dword [ebp + 8]
lea esi, [ecx + edx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x1000713c
cmp dword [esi + 4], 0x727444
jne 0x1000713c
cmp dword [esi + 8], 0
jne 0x10007105
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc esi
mov edx, dword [ebp - 0x20]
jmp 0x1000708f
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100072d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebx], 0x150
jne 0x100073b3
cmp dword [ebp + 8], 0x150
jb 0x100073b3
mov ecx, dword [ebx + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x40
push ecx
xor edi, edi
call esi
test eax, eax
je 0x100073a9
mov eax, dword [ebx + 8]
lea edx, [ebp - 8]
push edx
push 0x40
push pe_nt_image_headers32
push eax
call esi
test eax, eax
je 0x10007399
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x1000733a
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push 4
push eax
call esi
test eax, eax
je 0x10007386
mov edi, dword [ebx + 4]
lea esi, [ebx + 0x14]
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebx + 8]
lea esi, [ebx + 0x54]
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x10007363
mov edx, dword [ebx + 0x14c]
mov dword [eax], edx
mov eax, dword [ebx + 0xc]
mov edi, 1
test eax, eax
je 0x10007380
mov edx, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push edx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 8]
lea eax, [ebp + 8]
push eax
push ecx
push pe_nt_image_headers32
push edx
call esi
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + 4]
lea eax, [ebp + 8]
push eax
push ecx
push 0x40
push edx
call esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10007420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [0x10058d38]
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000746c
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 1
push 0
push 0
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push edi
lea ecx, [ebp - 8]
push ecx
push 0
push str.Language
push edx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x100074a3
cmp dword [ebp - 8], 1
je 0x100074a3
lea esi, [eax + 1]
push edi
call fcn.10020167
mov eax, dword [ebp - 4]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100074c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000750a
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareValveSteamActiveProcess
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, dword [ebp - 4]
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x10040bf4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x10007540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10007582
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10007587
mov ecx, dword [ebp - 4]
sub eax, edx
inc eax
push eax
mov eax, dword [ebp + 8]
push edi
push 1
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10009270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x20
call fcn.1001f870
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x20
push eax
mov dword [esi + 4], eax
call fcn.1001f848
mov edx, dword [esi + 4]
mov eax, dword [edx]
xor ecx, ecx
mov edx, 0x1c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10020ea1
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
xor edi, edi
add esp, 0x18
cmp dword [eax], edi
jbe 0x100092e2
push ebx
xor ebx, ebx
lea esp, [esp]
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 8]
push ecx
push 1
add edx, ebx
push 0x1c
push edx
call fcn.1001f848
mov eax, dword [esi + 4]
inc edi
add esp, 0x10
add ebx, 0x1c
cmp edi, dword [eax]
jb 0x100092c0
pop ebx
mov al, 1
pop edi
pop ebp
ret 4

Function at 0x100092f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0x10
call fcn.1001f870
push ebx
push 1
push 0x10
push eax
mov dword [esi + 4], eax
call fcn.1001f848
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x24]
mov ecx, dword [ebp - 4]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10020ea1
mov edx, dword [esi]
mov dword [esi + 8], eax
mov eax, dword [edx + 4]
xor edi, edi
add esp, 0x18
cmp dword [eax + 0x24], edi
jbe 0x1000935f
mov ecx, dword [esi + 8]
push ebx
push 1
lea edx, [ecx + edi*4]
push 4
push edx
call fcn.1001f848
mov eax, dword [esi]
mov ecx, dword [eax + 4]
inc edi
add esp, 0x10
cmp edi, dword [ecx + 0x24]
jb 0x10009340
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10009650
Capabilities:
Read file on windows

Disassembly:
push edi
push 8
call fcn.1001f870
push ebx
push 1
push 8
push eax
mov dword [esi + 4], eax
call fcn.1001f848
push 0x10
call fcn.1001f870
push ebx
push 1
push 0x10
push eax
mov dword [esi + 8], eax
call fcn.1001f848
mov eax, dword [esi + 8]
mov eax, dword [eax + 8]
xor ecx, ecx
mov edx, 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10020ea1
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
xor edi, edi
add esp, 0x2c
cmp dword [eax + 8], edi
jbe 0x100096c4
mov ecx, dword [esi + 0xc]
push ebx
push 1
lea edx, [ecx + edi*8]
push 8
push edx
call fcn.1001f848
mov eax, dword [esi + 8]
inc edi
add esp, 0x10
cmp edi, dword [eax + 8]
jb 0x100096a7
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0xc]
xor ecx, ecx
add eax, 0x20
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10020ea1
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xc]
add esp, 4
xor edi, edi
add ecx, 0x20
je 0x10009718
mov edx, dword [esi + 0x10]
push ebx
push 1
lea eax, [edx + edi*4]
push 4
push eax
call fcn.1001f848
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0xc]
inc edi
add edx, 0x20
add esp, 0x10
cmp edi, edx
jb 0x100096f6
mov al, 1
pop edi
ret
Function at 0x1000aa30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
imul eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
mov esi, eax
mov eax, dword [ecx + 0x18]
mov ebx, dword [eax + 4]
mov eax, dword [edi + 8]
mov dword [esp + 0x1c], edx
xor edx, edx
div dword [ebx + 8]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], esi
test esi, esi
je 0x1000abbe
lea edx, [eax*4]
mov dword [esp + 0x20], edx
jmp 0x1000aa88
mov edi, dword [ebp + 0xc]
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 0x18]
mov ecx, dword [eax + 4]
mov esi, dword [edi + 8]
mov ecx, dword [ecx + 8]
xor edx, edx
mov eax, esi
div ecx
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x10]
sub ecx, edx
mov ebx, ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x18], ebx
cmp ebx, eax
jbe 0x1000aab8
mov ebx, eax
mov dword [esp + 0x18], eax
mov ecx, dword [edi + 4]
mov edx, dword [ecx]
mov eax, dword [edx]
mov edi, dword [ecx + 0xc]
mov dword [esp + 0x30], eax
lea eax, [esi + ebx]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x34], 0
cmp eax, edi
jbe 0x1000aadf
sub edi, esi
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], 0
jbe 0x1000ab93
mov edx, dword [edx + 0x18]
mov ecx, dword [ecx + 0x18]
mov eax, dword [esp + 0x20]
mov edi, dword [edx + 4]
mov eax, dword [ecx + eax]
mov edx, dword [edi + 8]
xor ecx, ecx
xor esi, esi
cmp edx, 0x100
jne 0x1000ab0d
test esi, esi
je 0x1000ab44
cmp edx, 0x200
jne 0x1000ab19
test esi, esi
je 0x1000ab3b
cmp edx, 0x400
jne 0x1000ab25
test esi, esi
je 0x1000ab32
push ecx
push eax
push esi
push edx
call fcn.1002d650
mov ecx, edx
jmp 0x1000ab4b
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x1000ab4b
shld ecx, eax, 9
shl eax, 9
jmp 0x1000ab4b
shld ecx, eax, 8
shl eax, 8
mov edx, dword [edi + 0xc]
xor esi, esi
xor edi, edi
add edx, dword [esp + 0x2c]
push edi
adc esi, edi
add eax, edx
adc ecx, esi
mov esi, dword [esp + 0x34]
push ecx
push eax
push esi
call fcn.100212ba
add esp, 0x10
test eax, eax
je 0x1000ab78
mov ebx, dword [esp + 0x18]
xor eax, eax
jmp 0x1000ab97
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push esi
push eax
push 1
push ecx
call fcn.1001f848
mov ebx, dword [esp + 0x28]
add esp, 0x10
jmp 0x1000ab97
mov eax, dword [esp + 0x34]
mov ecx, dword [ebp + 0xc]
add dword [ecx + 8], eax
mov ecx, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0x10], ecx
cmp ebx, eax
jne 0x1000abcb
add dword [esp + 0x1c], eax
add dword [esp + 0x20], 4
cmp ecx, dword [esp + 0x24]
jb 0x1000aa81
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000ad80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [eax + 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov eax, dword [eax + edx*4]
mov dword [ebp + 8], ecx
mov ecx, dword [ecx + 8]
push esi
xor edx, edx
xor esi, esi
cmp ecx, 0x100
jne 0x1000adb4
test esi, esi
je 0x1000ade9
cmp ecx, 0x200
jne 0x1000adc0
test esi, esi
je 0x1000ade0
cmp ecx, 0x400
jne 0x1000adcc
test esi, esi
je 0x1000add7
push edx
push eax
push esi
push ecx
call fcn.1002d650
jmp 0x1000adf0
shld edx, eax, 0xa
shl eax, 0xa
jmp 0x1000adf0
shld edx, eax, 9
shl eax, 9
jmp 0x1000adf0
shld edx, eax, 8
shl eax, 8
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
add eax, ecx
adc edx, esi
mov esi, dword [ebp - 4]
push 0
push edx
push eax
push esi
call fcn.100212ba
add esp, 0x10
test eax, eax
je 0x1000ae17
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push esi
push edx
push 1
push eax
call fcn.1001f848
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000ae40
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x10047410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x1000ae9b
push edi
lea edi, [ebp - 0x104]
sub edi, esi
jmp 0x1000ae70
mov al, byte [esi]
cmp al, 0x5c
je 0x1000ae7a
cmp al, 0x2f
jne 0x1000ae8b
cmp byte [esi - 1], 0x3a
je 0x1000ae8b
push 0
lea eax, [ebp - 0x104]
push eax
call ebx
mov cl, byte [esi]
mov byte [edi + esi], cl
inc esi
cmp byte [esi], 0
mov byte [edi + esi], 0
jne 0x1000ae70
pop edi
push 0
lea edx, [ebp - 0x104]
push edx
call ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f521
mov esp, ebp
pop ebp
ret
Function at 0x1000cfe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030608
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10047410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10058838
mov dword [ebp - 0x10], 0x10058838
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x18]
cmp eax, ecx
je 0x1000d02f
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov byte [eax + 0xc], cl
mov esi, dword [ebp + 0x14]
cmp byte [esi], cl
je 0x1000d050
mov eax, dword [esi + 4]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ebx
push esi
push ecx
call fcn.1001f848
add esp, 0x10
jmp 0x1000d081
lea edx, [esi + 0xc]
push 0x62
push edx
call fcn.10021160
mov ebx, dword [ebp + 0x10]
add esp, 8
push esi
mov esi, dword [ebp + 0xc]
push ebx
test eax, eax
je 0x1000d076
mov edx, dword [ebp + 8]
mov eax, esi
call fcn.1000aa30
jmp 0x1000d081
mov eax, dword [ebp + 8]
push eax
mov eax, esi
call fcn.1000abe0
imul esi, ebx
mov edi, eax
cmp edi, esi
je 0x1000d093
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0xb
mov dword [ebp - 4], 0xffffffff
push 0x10058838
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000de80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10030608
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10047410]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10058838
mov dword [ebp - 0x10], 0x10058838
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x10058ca0], eax
je 0x1000def2
cmp dword [0x10058cac], eax
je 0x1000def2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [0x1005895c]
push eax
push edi
push ecx
push edx
push str.SteamWriteFile_0x_08X___u___u__0x_08X__n
call fcn.10006df0
add esp, 0x14
xor eax, eax
mov ebx, dword [ebp + 0x18]
cmp ebx, eax
je 0x1000df05
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
push edi
push edx
push eax
call fcn.10021ca7
mov esi, eax
add esp, 0x10
cmp esi, edi
jae 0x1000df78
cmp dword [0x10058ca0], 0
je 0x1000df4c
cmp dword [0x10058cac], 0
je 0x1000df4c
mov ecx, dword [ebp + 0x14]
mov esi, dword [0x1005895c]
push ecx
push str._tWrite_failed__0x_08X__n
call fcn.10006df0
add esp, 8
mov dword [ebx], 1
mov dword [ebp - 4], 0xffffffff
push 0x10058838
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
push 0x10058838
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret