joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018f90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x30c
push ebp
push esi
mov esi, dword [esp + 0x318]
push edi
test esi, esi
mov ebp, ecx
je 0x10019190
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10019190
mov ecx, 0x40
lea edi, [esp + 0xd]
mov byte [esp + 0xc], al
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push esi
push eax
call fcn.10054640
mov al, byte [esp + 0x18]
add esp, 0xc
cmp al, 0x5c
jne 0x10019100
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xc
lea ecx, [esp + 0x10]
push 0x101b1990
push ecx
stosb byte es:[edi], al
call fcn.10061650
add esp, 0xc
test eax, eax
jne 0x100190ae
mov edi, 0x101b1980
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x11d]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x104
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x120], 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x114]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10019190
cmp eax, 0x104
jb 0x100190f9
pop edi
pop esi
pop ebp
add esp, 0x30c
ret 8
push 4
lea eax, [esp + 0x10]
push 0x101b1324
push eax
call fcn.10061650
add esp, 0xc
test eax, eax
jne 0x10019100
lea ecx, [esp + 0x10]
push 0x103
lea edx, [esp + 0x114]
push ecx
push edx
call fcn.10054640
lea eax, [esp + 0x11c]
push 0x103
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.10054640
add esp, 0x18
jmp 0x10019100
mov esi, dword [esp + 0x31c]
lea edx, [esp + 0xc]
push 0x104
push edx
mov ecx, ebp
call fcn.100197e0
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x215]
mov byte [esp + 0x214], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 4]
test eax, eax
je 0x10019179
lea eax, [esp + 0xc]
push 0x7e
push eax
call fcn.10056460
add esp, 8
test eax, eax
je 0x10019179
lea ecx, [esp + 0x214]
push 0x104
lea edx, [esp + 0x10]
push ecx
push edx
call dword [ebp + 4]
test eax, eax
jbe 0x10019179
cmp eax, 0x104
jae 0x10019179
mov eax, dword [esp + 0x320]
lea ecx, [esp + 0x214]
dec eax
push eax
push ecx
jmp 0x10019187
mov edx, dword [esp + 0x320]
lea eax, [esp + 0xc]
dec edx
push edx
push eax
push esi
call fcn.10054640
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x30c
ret 8
Function at 0x100191a0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101871c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
mov esi, ecx
push 0xffffffffffffffff
push 0
mov ecx, ebx
call fcn.10039150
mov ebp, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.10039150
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, dword [esi + 0x6c]
mov dword [esp + 0x3c], eax
test ecx, ecx
je 0x10019216
cmp eax, ecx
jne 0x10019216
mov edx, dword [esi + 0x70]
test edx, edx
je 0x10019216
cmp edi, edx
jb 0x10019216
add edx, 0x493e0
cmp edx, edi
jae 0x1001921e
mov dword [esp + 0x38], 1
mov edx, dword [0x101f1d98]
test edx, edx
je 0x10019251
mov edx, dword [esi + 0x74]
push edx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esi + 0x70]
push edi
push edx
push eax
push ecx
push str.CProcMgr::EnumVolumesW___08x______08x____d______d____enum_:__d___loop_:__d_
push str.EnumVolumes
push 0xffffffffffffffff
push 0x101f1d2c
call fcn.100066b0
add esp, 0x28
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x100192a1
mov ecx, dword [esi + 0x74]
lea eax, [esi + 0x98]
inc ecx
push 1
mov dword [esi + 0x74], ecx
push eax
lea ecx, [esp + 0x18]
call fcn.100405b0
lea ecx, [esi + 0x78]
mov dword [esp + 0x30], 0
push ecx
mov ecx, ebx
call fcn.10039330
add esi, 0x88
mov ecx, ebp
push esi
call fcn.10039330
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x10019310
push ebp
push ebx
mov ecx, esi
mov dword [esi + 0x74], 0
call fcn.10019330
lea edx, [esi + 0x98]
push 1
push edx
lea ecx, [esp + 0x24]
call fcn.100405b0
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x70], edi
lea edi, [esi + 0x78]
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x38], 1
mov dword [esi + 0x6c], eax
call fcn.10039150
push ebx
mov ecx, edi
call fcn.10039330
add esi, 0x88
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.10039150
push ebp
mov ecx, esi
call fcn.10039330
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.10040610
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x10019330
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101871e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.10039150
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.10039150
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x10019469
mov edx, dword [0x101b1a50]
mov cx, word [0x101b1a54]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.10032fc0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.100396f0
mov edx, dword [0x1019175c]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.100339e0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.100396f0
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.10033760
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.10033760
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x1001938b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret 8
Function at 0x10019900
Capabilities:
Get disk information

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push edi
mov edi, ecx
xor eax, eax
push 2
lea ecx, [esp + 0x10]
xor ebx, ebx
mov word [esp + 0x11], ax
push ebp
push ecx
mov byte [esp + 0x18], bl
mov byte [esp + 0x1b], al
call fcn.10054abe
mov al, byte [esp + 0x18]
add esp, 0xc
cmp al, 0x43
jl 0x1001993f
cmp al, 0x5a
jle 0x10019947
cmp al, 0x63
jl 0x10019971
cmp al, 0x7a
jg 0x10019971
cmp byte [esp + 0xd], 0x3a
jne 0x10019971
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, ebx
je 0x10019971
cmp eax, 2
je 0x10019971
cmp eax, 3
je 0x10019971
cmp eax, 5
je 0x10019971
cmp eax, 6
jne 0x1001997f
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 8
mov eax, dword [edi + 0x58]
push esi
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x1001999a
push eax
call fcn.1006a1b0
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x24], 0x104
call sub.MPR.dll_WNetGetConnectionA
test eax, eax
jne 0x10019a38
lea edx, [ebp + 2]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x1c]
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebx, ecx
cmp ebx, 0x104
jae 0x10019a38
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x1c]
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x128]
mov ecx, edx
and ecx, 3
dec eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebp
call fcn.10054abe
add esp, 0xc
mov esi, 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10019a45
call fcn.1006a520
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x110
ret 8

Function at 0x1001b290
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x2001f
push esi
push ecx
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001b308
mov eax, dword [esp + 4]
cmp eax, esi
je 0x1001b308
cmp dword [esp + 0x20], esi
je 0x1001b2e1
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
inc ecx
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 1
push esi
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1001b2ed
mov edx, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, esi
jne 0x1001b2f6
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret 0x18
xor eax, eax
pop esi
pop ecx
ret 0x18
Function at 0x1001b460
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
push ebx
xor ebx, ebx
cmp eax, ebx
push ebp
je 0x1001b549
mov ebp, dword [esp + 0x24]
cmp ebp, ebx
je 0x1001b549
xor ecx, ecx
push edi
mov dword [esp + 0x11], ecx
push eax
mov dword [esp + 0x19], ecx
lea edx, [esp + 0x14]
mov dword [esp + 0x1d], ecx
push 0x101aef10
mov word [esp + 0x25], cx
push edx
xor edi, edi
mov byte [esp + 0x1c], bl
mov byte [esp + 0x2b], cl
call fcn.10054150
add esp, 0xc
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebx
push eax
push 0x2001f
push ebx
push str.SOFTWARETECOcular.3ShareDataPID
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001b53e
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x1001b53e
lea ecx, [esp + 0x28]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x14]
push ebx
push edx
lea ecx, [esp + 0x20]
push ebx
push ecx
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x44], ebx
call esi
test eax, eax
jne 0x1001b532
cmp dword [esp + 0x10], 1
jne 0x1001b532
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp edx, eax
ja 0x1001b532
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
push ebp
push ebx
lea ecx, [esp + 0x20]
push ebx
push ecx
push edx
call esi
test eax, eax
jne 0x1001b532
mov edi, 1
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0xc

Function at 0x1001c9a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10187498
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1001caa6
mov eax, dword [0x1019175c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], 0
test eax, eax
je 0x1001ca48
lea ecx, [esp + 8]
push 0x101aed40
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.10043a30
mov ecx, eax
call fcn.10044630
mov eax, dword [eax]
lea ecx, [esp + 0x30]
push eax
mov byte [esp + 0x28], 1
call fcn.10032e60
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0xc]
push str._s___s_r_n
push eax
mov byte [esp + 0x34], 2
call fcn.100366e0
add esp, 0x10
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 1
call fcn.10033760
lea ecx, [esp + 8]
mov byte [esp + 0x24], 0
call fcn.1002e3e0
jmp 0x1001ca56
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esp + 8]
call fcn.100339e0
mov edx, dword [esp + 4]
mov eax, dword [edx - 8]
test eax, eax
je 0x1001ca95
mov eax, dword [esi + 8]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
mov dword [esp + 0x2c], 0
lea edx, [esp + 0x2c]
push 0
mov ecx, dword [eax - 8]
push edx
mov edx, dword [esi + 8]
add ecx, ecx
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.10033760
mov ecx, dword [esp + 0x1c]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x1001cbd0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x10187538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x14]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x28], ebp
jne 0x1001cc1f
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.10033760
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
push esi
lea eax, [esp + 0x34]
push edi
push eax
lea ecx, [esp + 0x14]
call fcn.10032d60
push 0x101f1d00
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 1
call fcn.10032fc0
lea edi, [ebx + 4]
push 0x101ae4fc
mov ecx, edi
mov byte [esp + 0x34], 2
call fcn.10036fd0
push 0x101f1d00
lea ecx, [esp + 0x1c]
call fcn.10032fc0
push 0x2e
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 3
call fcn.10034910
mov esi, eax
cmp esi, ebp
jle 0x1001ccd6
lea ecx, [esp + 0x20]
push esi
push ecx
lea ecx, [esp + 0x18]
call fcn.10035a50
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 4
call fcn.100338f0
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], 3
call fcn.10033760
lea edx, [esp + 0x1c]
push esi
push edx
lea ecx, [esp + 0x18]
call fcn.10035ea0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x34], 5
call fcn.100338f0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.10033760
test ebp, ebp
jne 0x1001cd18
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, ebx
call fcn.1001cac0
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
mov eax, dword [edi]
push ecx
push edx
push eax
lea ecx, [esp + 0x20]
push str._s_s_s
push ecx
mov byte [esp + 0x44], 6
call fcn.100366e0
add esp, 0x14
mov byte [esp + 0x30], 3
lea ecx, [esp + 0x20]
jmp 0x1001cd55
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, ebx
call fcn.1001cac0
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
mov eax, dword [edi]
push ecx
push ebp
push edx
push eax
lea ecx, [esp + 0x24]
push str._s_s__d__s
push ecx
mov byte [esp + 0x48], 7
call fcn.100366e0
add esp, 0x18
mov byte [esp + 0x30], 3
lea ecx, [esp + 0x1c]
call fcn.10033760
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push edx
inc ebp
call fcn.1002dc80
mov eax, dword [eax]
mov byte [esp + 0x30], 8
push eax
call fcn.100112a0
add esp, 4
lea ecx, [esp + 0x24]
mov esi, eax
mov byte [esp + 0x30], 3
call fcn.1002e3e0
test esi, esi
jne 0x1001ccd6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x30], 2
call fcn.10033760
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 1
call fcn.10033760
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.10033760
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.10033760
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x1001dba0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x101f1d98]
sub esp, 0xc
push edi
xor edi, edi
cmp eax, edi
je 0x1001dbc8
push str.other__GetFileType________
push str.GetTxt
push 0xffffffffffffffff
push 0x101f1d2c
call fcn.100066b0
add esp, 0x10
push esi
mov esi, dword [esp + 0x18]
cmp esi, 0xffffffff
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
je 0x1001dd6c
cmp esi, edi
je 0x1001dd6c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x18]
push 1
push eax
push edi
push esi
mov dword [esp + 0x28], edi
call ebx
push 0
push 0
push 0
push esi
mov ebp, eax
call ebx
push 7
call fcn.1005473e
mov edi, eax
add esp, 4
test edi, edi
je 0x1001dd13
mov edx, edi
xor ecx, ecx
lea eax, [esp + 0x20]
mov dword [edx], ecx
push ecx
push eax
push 6
push edi
mov word [edx + 4], cx
push esi
mov dword [esp + 0x34], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001dd1d
lea ecx, [esp + 0x18]
push 0
push ecx
push ebp
push esi
call ebx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], 1
push edx
push edi
call fcn.1001da00
add esp, 8
test eax, eax
jne 0x1001dd27
mov eax, dword [esp + 0x20]
push eax
push edi
call fcn.1001da40
add esp, 8
test eax, eax
jne 0x1001dd33
mov ecx, dword [esp + 0x20]
push ecx
push edi
call fcn.1001db40
add esp, 8
test eax, eax
jne 0x1001dd3f
mov edx, dword [esp + 0x20]
push edx
push edi
call fcn.1001db70
add esp, 8
test eax, eax
jne 0x1001dd4e
mov eax, dword [esp + 0x20]
push eax
push edi
call fcn.1001db10
add esp, 8
test eax, eax
jne 0x1001dd5d
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
pop ebp
pop ebx
test edi, edi
je 0x1001dcd8
push edi
call fcn.10054626
add esp, 4
mov edi, dword [esp + 0xc]
mov eax, dword [0x101f1d98]
pop esi
test eax, eax
je 0x1001dd0c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 4]
mov edx, dword [ecx]
push edx
push eax
push edi
push str.other__GetFileType______d_____d____d_
push str.GetTxt
push 0xffffffffffffffff
push 0x101f1d2c
call fcn.100066b0
add esp, 0x1c
mov eax, edi
pop edi
add esp, 0xc
ret
mov dword [esp + 0x10], 2
jmp 0x1001dcc9
mov dword [esp + 0x10], 3
jmp 0x1001dcc9
mov edx, dword [esp + 0x24]
mov dword [edx], 1
jmp 0x1001dcc9
mov eax, dword [esp + 0x24]
mov dword [eax], 2
jmp 0x1001dcc9
mov ecx, dword [esp + 0x24]
mov dword [ecx], 3
jmp 0x1001dcc9
mov edx, dword [esp + 0x24]
mov dword [edx], 4
jmp 0x1001dcc9
mov eax, dword [esp + 0x24]
mov dword [eax], 5
jmp 0x1001dcc9
mov dword [esp + 8], 1
jmp 0x1001dcdc
Function at 0x10021080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10187b00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x1019175c]
push ebp
push esi
push edi
mov esi, ecx
mov ebp, 0xf002
mov dword [esp + 0xc], eax
xor edi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], edi
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x30]
push ecx
push edi
push edi
push edi
lea edx, [esp + 0x20]
push edi
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
mov dword [esp + 0x34], edi
call fcn.10020720
test eax, eax
je 0x100211e0
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], edi
jle 0x100210f1
push eax
jmp 0x100210f6
push 0x101f1d00
mov ecx, esi
call fcn.10020540
mov ecx, dword [esp + 0x14]
lea edx, [esi + 0x1538]
mov dword [esi + 0x16d4], ecx
push edx
lea ecx, [esp + 0x30]
call fcn.10032d60
push 0x101b3544
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 2
call fcn.100343b0
push str.MEMSS
lea ecx, [esp + 0x30]
call fcn.100343b0
push 0x101b3544
push 0x101ae4fc
lea ecx, [esp + 0x34]
call fcn.100356a0
lea ecx, [esp + 0x2c]
call fcn.10034a90
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push eax
call fcn.1002dc80
mov ecx, dword [esp + 0x2c]
mov edi, dword [eax]
push ecx
mov byte [esp + 0x28], 3
call fcn.100132b0
neg eax
sbb eax, eax
inc eax
push eax
push edi
call fcn.1004bf50
add esp, 0xc
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 2
call fcn.1002e3e0
push 4
mov ecx, esi
call fcn.100271d0
push 4
mov ecx, esi
call fcn.10027a10
test eax, eax
je 0x100211b5
push 8
mov ecx, esi
call fcn.10027a10
test eax, eax
je 0x100211b5
xor ebp, ebp
call fcn.1006cf80
test eax, eax
je 0x100211d2
push 0x10
mov ecx, esi
mov ebp, 0xf002
call fcn.10027a10
test eax, eax
je 0x100211d2
xor ebp, ebp
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 1
call fcn.10033760
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.10033760
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.10033760
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x10022e00
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x10187df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
lea eax, [esp]
push eax
call fcn.10022d80
push 0x101b3544
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call fcn.100343b0
push str.TKS_RUN
lea ecx, [esp + 4]
call fcn.100343b0
lea ecx, [esp]
call fcn.10034a90
mov ecx, dword [esp]
push ecx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x10022e90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov dword [esp + 0xc], 0xffffffff
lea ecx, [esp]
je 0x10022ea3
call fcn.10033760
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], 0xffffffff
lea ecx, [esp]
call fcn.10033760
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10022ec0
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x10187e18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
add ecx, 0x1538
push ecx
lea ecx, [esp + 4]
call fcn.10032d60
push 0x101b3544
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0
call fcn.100343b0
push str.TKS_START
lea ecx, [esp + 4]
call fcn.100343b0
lea ecx, [esp]
call fcn.10034a90
mov eax, dword [esp]
push eax
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x10022f56
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov dword [esp + 0xc], 0xffffffff
lea ecx, [esp]
je 0x10022f69
call fcn.10033760
xor eax, eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], 0xffffffff
lea ecx, [esp]
call fcn.10033760
mov ecx, dword [esp + 4]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x10
ret