joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push ecx
push edx
call esi
test eax, eax
jne 0x1000545a
xor al, al
pop esi
add esp, 0x10
ret 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
call fcn.10012270
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
add esp, 0xc
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
push 0x1003c570
lea eax, [esp + 0x24]
call fcn.100062d0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
lea esi, [esp + 0x14]
mov eax, 0x1003c570
call fcn.10005e80
lea ecx, [esp + 0x24]
push ecx
mov esi, 0x1003c560
call fcn.10006d90
push eax
lea esi, [esp + 0x10]
mov eax, 0x1003c560
call fcn.100066f0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
pop esi
add esp, 0x10
ret 0x10

Function at 0x100054f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, 0x10
mov esi, ecx
cmp dword [eax + 0x14], edi
jb 0x10005504
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp dword [esi + 0x14], edi
jb 0x10005516
mov eax, dword [esi]
jmp 0x10005518
mov eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10005570
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 0xf
push esi
mov dword [esp + 0x1c], 0
call edi
test eax, eax
jne 0x1000554b
pop edi
pop esi
pop ebx
add esp, 8
ret
mov edx, dword [0x1003c58c]
mov eax, dword [edx + 8]
push 0x10004c80
push esi
mov ecx, 0x1003c58c
call eax
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
push 0xf
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x10005580
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1064
call fcn.10019da0
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x1060], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, 0x10
push edi
mov esi, ecx
cmp dword [eax + 0x14], ebx
jb 0x100055b2
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [esp + 0x18], edi
cmp dword [esi + 0x14], ebx
jb 0x100055c6
mov esi, dword [esi]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor esi, esi
mov dword [esp + 0x20], ebx
cmp ebx, esi
je 0x10005695
mov edx, dword [0x1003c554]
mov ecx, dword [edx]
cmp ecx, edx
je 0x1000563d
lea ebx, [ebx]
cmp dword [ecx + 0x10], ebx
je 0x1000575d
cmp byte [ecx + 0x21], 0
jne 0x10005639
mov eax, dword [ecx + 8]
cmp byte [eax + 0x21], 0
jne 0x1000561e
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x21], 0
jne 0x10005639
mov ecx, eax
mov eax, dword [ecx]
cmp byte [eax + 0x21], 0
je 0x10005612
jmp 0x10005639
mov eax, dword [ecx + 4]
cmp byte [eax + 0x21], 0
jne 0x10005637
cmp ecx, dword [eax + 8]
jne 0x10005637
mov ecx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x21], 0
je 0x10005627
mov ecx, eax
cmp ecx, edx
jne 0x100055f0
lea eax, [esp + 0x10]
push eax
push 0x14
lea ecx, [esp + 0x30]
push ecx
push 1
push 0x14
push ebx
push esi
push esi
mov dword [esp + 0x30], esi
call fcn.1001ed80
add esp, 0x20
cmp eax, 1
jne 0x1000569c
cmp dword [esp + 0x10], esi
jbe 0x10005695
lea edi, [esp + 0x2c]
jmp 0x10005670
push 3
push 0x100288c8
push edi
call fcn.10011976
add esp, 0xc
test eax, eax
je 0x100056b5
inc esi
add edi, 0xd0
cmp esi, dword [esp + 0x10]
jb 0x10005670
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1060]
xor ecx, esp
call fcn.10010f62
mov esp, ebp
pop ebp
ret 4
lea edx, [esp + 0x14]
push edx
push 0x40
push 0xf
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000569c
mov edx, dword [0x1003c58c]
imul esi, esi, 0xd0
mov eax, dword [esp + esi + 0xf0]
lea edi, [esp + esi + 0xf0]
add eax, ebx
push 0x10004ce0
push eax
mov eax, dword [edx + 8]
mov ecx, 0x1003c58c
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push edx
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + esi + 0x70]
push 0x100288cc
push ecx
call fcn.10011aa4
mov edx, dword [edi]
add edx, dword [esp + 0x28]
add esp, 0xc
add edx, ebx
lea eax, [esp + 0x20]
mov dword [0x1003b7fc], edx
xor esi, esi
xor edi, edi
call fcn.10005b70
mov dword [eax], ebx
mov ecx, 0x10004ce0
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x106c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10010f62
mov esp, ebp
pop ebp
ret 4
Function at 0x10007390
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 4]
cmp eax, dword [0x1003953c]
jne 0x100073cc
mov ecx, dword [esp + 8]
cmp ecx, dword [0x10039540]
jne 0x100073cc
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push 0x1003bb00
push 4
push edx
push eax
push str.Stats
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
test eax, eax
setne al
ret 0x10
xor al, al
ret 0x10

Function at 0x1000ae30
Capabilities:
Delete file

Disassembly:
sub esp, 0x108
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
test eax, eax
jne 0x1000ae68
xor al, al
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret 4
mov cl, byte [eax]
cmp cl, 0x2f
je 0x1000ae74
cmp cl, 0x5c
jne 0x1000ae75
inc eax
push eax
push 0x1003c440
push 0x1002bd00
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.1001153f
add esp, 0x14
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x104]
test eax, eax
setne al
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret 4

Function at 0x1000b310
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x104], eax
cmp dword [esp + 0x110], 1
mov eax, dword [esp + 0x10c]
je 0x1000b351
mov eax, 1
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret 0xc
cmp byte [0x1003b801], 0
jne 0x1000b335
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp]
push 0x5c
push edx
call fcn.10011560
add esp, 8
test eax, eax
je 0x1000b380
mov byte [eax], 0
call fcn.10004d20
push str.3DMGAME.ini
lea eax, [esp + 4]
push eax
push 0x1002bd00
push 0x104
push 0x1003c230
call fcn.1001153f
add esp, 0x14
push 0x1003c230
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000b3e0
push 0
push 0
push 0x1002bd08
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret 0xc
call fcn.1000b430
test al, al
je 0x1000b3c7
push str.SteamLog.txt
lea ecx, [esp + 4]
push ecx
push 0x1002bd00
push 0x104
push 0x1003c230
call fcn.1001153f
add esp, 0x14
call sym.steam_api.dll_SteamAPI_Init
mov ecx, dword [esp + 0x104]
xor edx, edx
test al, al
setne dl
xor ecx, esp
mov eax, edx
call fcn.10010f62
add esp, 0x108
ret 0xc
Function at 0x1000f050
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000f07f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000f07f
push eax
mov eax, dword [esp + 8]
push 0x1002887c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
ret
mov al, 1
ret
Function at 0x1000f090
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
sub esp, 0x108
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, 1
push ebx
push 0x23
push 0x1003c440
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x1000f0cd
cmp byte [0x1003b802], bl
je 0x1000f0cd
push str.Steam
jmp 0x1000f14a
push 0x1003c440
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x1000f10b
push eax
push 0x1002887c
push 0x1002c1d8
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret
cmp byte [0x1003bc08], 0
mov byte [0x1003b802], bl
je 0x1000f145
push 0x1002c1ec
push 0x104
push 0x1003c440
call fcn.10011ea7
push 0x1003bc08
push 0x104
push 0x1003c440
call fcn.10011ea7
add esp, 0x18
push str.3DMGAME
push 0x104
push 0x1003c440
call fcn.10011ea7
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x1003c440
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 0xffffffff
jne 0x1000f182
push 0
push 0x1003c440
call ebx
test eax, eax
je 0x1000f1c6
push 0x1002c1ec
push 0x104
push 0x1003c440
call fcn.10011ea7
push 0x1003bd10
push 0x104
push 0x1003c440
call fcn.10011ea7
add esp, 0x18
push 0x1003c440
call edi
cmp eax, 0xffffffff
jne 0x1000f1f3
push 0
push 0x1003c440
call ebx
test eax, eax
jne 0x1000f1f3
push 0
push 0x1002887c
push 0x1002c204
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret
cmp byte [0x1003b802], 0
push esi
jne 0x1000f241
mov eax, dword [0x1003b9f0]
push eax
push 0x1002c218
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.1001153f
lea edx, [esp + 0x1c]
push edx
push 0x104
push 0x1003c440
call fcn.10011ea7
push 0x1002c204
mov esi, 0x1003c440
call fcn.1000f050
add esp, 0x20
test al, al
je 0x1000f28d
push 0x1002c21c
push 0x1003c440
push 0x1002bd00
push 0x104
push 0x1003bd90
call fcn.1001153f
add esp, 0x14
push 0x1003bd90
call edi
cmp eax, 0xffffffff
jne 0x1000f2a7
push 0
push 0x1003bd90
call ebx
test eax, eax
jne 0x1000f2a7
push eax
push 0x1002887c
push 0x1002c224
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret
push 0x1002c238
push 0x1003c440
push 0x1002bd00
push 0x104
push 0x1003c128
call fcn.1001153f
push 0x1002c240
mov esi, 0x1003c128
call fcn.1000f050
add esp, 0x18
test al, al
je 0x1000f28d
push str.stats.ini
push esi
push 0x1002bd00
push 0x104
push 0x1003bb00
call fcn.1001153f
push str.achievements.ini
push esi
push 0x1002bd00
push 0x104
push 0x1003be98
call fcn.1001153f
push str._storage
push 0x104
push 0x1003c440
call fcn.10011ea7
push 0x1002c280
mov esi, 0x1003c440
call fcn.1000f050
mov ecx, dword [esp + 0x148]
add esp, 0x38
pop esi
test al, al
pop edi
setne al
pop ebx
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret
Function at 0x1000f360
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x250
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x264]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000f399
xor eax, eax
jmp 0x1000f466
push 0x5c
push edi
call fcn.10011560
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
add esp, 8
mov byte [eax], 0
xor esi, esi
nop
test byte [esp + 0x10], 0x10
je 0x1000f453
mov ecx, 0x1002c294
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000f3e4
test dl, dl
je 0x1000f3e0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000f3e4
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000f3c4
xor eax, eax
jmp 0x1000f3e9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000f454
mov ecx, 0x1002c298
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000f416
test dl, dl
je 0x1000f412
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000f416
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000f3f6
xor eax, eax
jmp 0x1000f41b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000f454
lea ecx, [esp + 0x3c]
push ecx
push edi
push str._s_s
lea edx, [esp + 0x15c]
push 0x104
push edx
call fcn.1001153f
lea eax, [esp + 0x164]
add esp, 0x14
push eax
call fcn.1000f360
add esp, 4
add esi, eax
jmp 0x1000f454
inc esi
lea ecx, [esp + 0x10]
push ecx
push ebx
call ebp
test eax, eax
jne 0x1000f3b0
mov eax, esi
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10010f62
add esp, 0x250
ret
Function at 0x1000f480
Capabilities:
Create directory
Write file on windows

Disassembly:
sub esp, 0x314
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x310], eax
mov eax, dword [esp + 0x318]
push ebp
mov ebp, dword [esp + 0x320]
test eax, eax
jne 0x1000f4bf
xor al, al
pop ebp
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.10010f62
add esp, 0x314
ret
test ebp, ebp
je 0x1000f4a7
mov cl, byte [eax]
cmp cl, 0x2f
je 0x1000f4cf
cmp cl, 0x5c
jne 0x1000f4d0
inc eax
push ebx
push esi
push edi
push eax
lea eax, [esp + 0x18]
push 0x104
push eax
call fcn.1001158d
lea ecx, [esp + 0x20]
push 0x5c
push ecx
call fcn.10011f30
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1000f50d
lea edx, [esp + 0x14]
push 0x2f
push edx
call fcn.10011f30
mov esi, eax
add esp, 8
test esi, esi
je 0x1000f56e
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [esp + 0x14]
push eax
push 0x1003c440
push 0x1002bd00
lea ecx, [esp + 0x124]
push 0x104
push ecx
mov byte [esi], 0
call fcn.1001153f
add esp, 0x14
push 0
lea edx, [esp + 0x11c]
push edx
call ebx
lea edi, [esi + 1]
push 0x5c
push edi
mov byte [esi], 0x5c
call fcn.10011f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000f513
push 0x2f
push edi
call fcn.10011f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000f513
lea eax, [esp + 0x14]
push eax
push 0x1003c440
push 0x1002bd00
lea ecx, [esp + 0x228]
push 0x104
push ecx
call fcn.1001153f
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea edx, [esp + 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000f5bd
xor al, al
jmp 0x1000f5ea
mov ebx, dword [esp + 0x330]
push 0
lea eax, [esp + 0x14]
push eax
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp dword [esp + 0x10], ebx
je 0x1000f5de
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
setne al
mov ecx, dword [esp + 0x320]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.10010f62
add esp, 0x314
ret
Function at 0x1000f610
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x110]
test eax, eax
jne 0x1000f644
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10010f62
add esp, 0x10c
ret
test edi, edi
jne 0x1000f65f
mov eax, ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10010f62
add esp, 0x10c
ret
mov cl, byte [eax]
cmp cl, 0x2f
je 0x1000f66b
cmp cl, 0x5c
jne 0x1000f66c
inc eax
push esi
push eax
push 0x1003c440
push 0x1002bd00
lea eax, [esp + 0x14]
push 0x104
push eax
call fcn.1001153f
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f6c9
push 0
lea edx, [esp + 8]
push edx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
jne 0x1000f6e1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10010f62
add esp, 0x10c
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10c]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.10010f62
add esp, 0x10c
ret

Function at 0x1000f710
Capabilities:
Create directory

Disassembly:
sub esp, 0x314
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x310], eax
mov eax, dword [esp + 0x318]
test eax, eax
jne 0x1000f746
xor edx, edx
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.10010f62
add esp, 0x314
ret
mov cl, byte [eax]
cmp cl, 0x2f
je 0x1000f752
cmp cl, 0x5c
jne 0x1000f753
inc eax
push esi
push eax
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.1001158d
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call fcn.10011f30
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1000f78e
lea edx, [esp + 8]
push 0x2f
push edx
call fcn.10011f30
mov esi, eax
add esp, 8
test esi, esi
je 0x1000f7f3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
lea eax, [esp + 0x10]
push eax
push 0x1003c440
push 0x1002bd00
lea ecx, [esp + 0x224]
push 0x104
push ecx
mov byte [esi], 0
call fcn.1001153f
add esp, 0x14
push 0
lea edx, [esp + 0x21c]
push edx
call ebx
lea edi, [esi + 1]
push 0x5c
push edi
mov byte [esi], 0x5c
call fcn.10011f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000f796
push 0x2f
push edi
call fcn.10011f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000f796
pop edi
pop ebx
lea eax, [esp + 8]
push eax
push 0x1003c440
push 0x1002bd00
lea ecx, [esp + 0x118]
push 0x104
push ecx
call fcn.1001153f
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
lea edx, [esp + 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 4]
mov dword [esp + 4], eax
call fcn.100101b0
mov ecx, eax
lea eax, [esp + 0x10c]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000f850
sub eax, esi
mov esi, eax
lea eax, [esp + 0x10c]
call fcn.10003e90
mov ecx, dword [esp + 0x314]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
cdq
call fcn.10010f62
add esp, 0x314
ret
Function at 0x1000f890
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
push edi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], esi
call fcn.10010680
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x18]
push ecx
push edx
push eax
lea edi, [esp + 0x24]
call fcn.10007320
add esp, 0xc
cmp dword [esp + 0x18], 0
jne 0x1000f8e0
pop edi
mov eax, 8
pop esi
add esp, 0xc
ret
test ebx, ebx
je 0x1000f8d5
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
pop edi
add eax, 2
pop esi
add esp, 0xc
ret

Function at 0x1000f9a0
Capabilities:
Delete file

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x1c]
push edi
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], esi
call fcn.10010680
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
lea edi, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.10007320
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x1000f9f0
mov eax, 8
pop edi
pop esi
add esp, 0x14
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x20]
call fcn.100101b0
cmp dword [eax + 0x14], 0x10
jb 0x1000fa08
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x24]
call fcn.10010680
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
lea esi, [esp + 0x28]
call fcn.10010310
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret

Function at 0x1000fa40
Capabilities:
Get file size

Disassembly:
sub esp, 0x108
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
test eax, eax
jne 0x1000fa74
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret
mov cl, byte [eax]
cmp cl, 0x2f
je 0x1000fa80
cmp cl, 0x5c
jne 0x1000fa81
inc eax
push esi
push eax
push 0x1003c440
push 0x1002bd00
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.1001153f
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000fadb
xor eax, eax
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10010f62
add esp, 0x108
ret
Function at 0x1000fc00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x100385e0]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
push 0x1003c440
push str._s
lea eax, [esp + 0x158]
push 0x104
push eax
call fcn.1001153f
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000fc6d
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.10010f62
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor esi, esi
test byte [esp + 0x10], 0x10
je 0x1000fd23
mov ecx, 0x1002c294
lea eax, [esp + 0x3c]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000fcb0
test dl, dl
je 0x1000fcac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000fcb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000fc90
xor eax, eax
jmp 0x1000fcb5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000fd24
mov ecx, 0x1002c298
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000fce2
test dl, dl
je 0x1000fcde
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000fce2
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000fcc2
xor eax, eax
jmp 0x1000fce7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000fd24
lea eax, [esp + 0x3c]
push eax
push 0x1003c440
push str._s_s
lea ecx, [esp + 0x15c]
push 0x104
push ecx
call fcn.1001153f
lea edx, [esp + 0x164]
add esp, 0x14
push edx
call fcn.1000f360
add esp, 4
add esi, eax
jmp 0x1000fd24
inc esi
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
jne 0x1000fc75
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.10010f62
mov esp, ebp
pop ebp
ret

Function at 0x1000fd50
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
push 0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1003c440
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x1000fd74
xor al, al
add esp, 0x10
ret
cmp dword [esp + 4], 0
ja 0x1000fd85
mov eax, dword [esp]
cmp eax, 0x7fffffff
jbe 0x1000fd8d
mov dword [esi], 0x7fffffff
jmp 0x1000fd8f
mov dword [esi], eax
cmp dword [esp + 0xc], 0
ja 0x1000fda1
mov eax, dword [esp + 8]
cmp eax, 0x7fffffff
jbe 0x1000fdad
mov dword [edi], 0x7fffffff
mov al, 1
add esp, 0x10
ret
mov dword [edi], eax
mov al, 1
add esp, 0x10
ret