joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10050280
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10134530
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10186bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x100502c7
mov esi, dword [edi]
jmp 0x100502c9
mov esi, edi
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x100502ea
mov edi, eax
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100502d6
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x18]
and ecx, edx
mov edx, dword [ebx + 0xc]
lea esi, [ecx*8]
mov dword [ebp - 0x14], esi
mov eax, dword [edx + esi]
cmp eax, dword [ebx + 4]
jne 0x10050309
mov esi, dword [ebx + 4]
jmp 0x1005030f
mov esi, dword [edx + esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1005035a
lea eax, [ecx*8]
mov dword [ebp + 0xc], eax
nop dword [eax]
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
lea edx, [eax + 0x10]
jb 0x10050331
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
jb 0x1005033b
mov ecx, dword [edi]
jmp 0x1005033d
mov ecx, edi
push dword [edx]
mov edx, dword [edi + 0x10]
push eax
call fcn.10028b80
add esp, 8
test eax, eax
je 0x100503a1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
cmp esi, dword [ecx + eax]
jne 0x10050320
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10050387
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x100503e4
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x10050406
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.100501d0
push edi
call fcn.10074570
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x100503ec
mov dword [ecx], edi
jmp 0x10050406
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10050406
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10050490
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10053440
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x804]
mov edi, ecx
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100534dd
push esi
lea ecx, [ebp - 0x804]
call fcn.10053060
mov esi, eax
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10053480
sub ecx, edx
je 0x10053496
cmp byte [ecx + esi - 1], 0x5c
jne 0x10053496
mov byte [ecx + esi - 1], al
mov edx, esi
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x100534a0
sub edx, ecx
or ecx, 0xffffffff
cmp edx, 0x104
cmovb ecx, edx
push ecx
push esi
push 0x104
push edi
call fcn.101157e5
push esi
call fcn.1010458a
add esp, 0x14
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.100eb369
mov esp, ebp
pop ebp
ret

Function at 0x10053570
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
push 0
push 0
push 0xffffffffffffffff
mov ebx, ecx
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jle 0x100535d0
push 2
push esi
call fcn.101152f7
mov edi, eax
add esp, 8
test edi, edi
je 0x100535d0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x100535b9
mov word [edi], ax
push edi
call fcn.10117bdc
push edi
mov esi, eax
call fcn.1010458a
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
ret
push 0x16
call fcn.10116b53
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x100536e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
dec edx
push edi
mov edi, ecx
cmp edx, 0xfe
ja case.0x10053707.2
movzx eax, byte [edx + 0x100537e4]
jmp dword [eax*4 + 0x100537c8]
mov esi, 0x2b
jmp 0x10053736
mov esi, 0x23
jmp 0x10053736
mov esi, 0x1c
jmp 0x10053736
mov esi, 0x2a
jmp 0x10053736
mov esi, 0x26
jmp 0x10053736
mov esi, 0x2c
lea eax, [ebp - 0x804]
push eax
push 0
push 0
mov eax, esi
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x10053774
cmp esi, 0x2c
jne 0x100537b5
lea edx, [esi - 0x2b]
mov ecx, edi
call fcn.100536e0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x804]
call fcn.10053060
mov esi, eax
test esi, esi
je 0x100537b5
push 0xffffffffffffffff
push esi
push 0x400
push edi
call fcn.101157e5
xor ecx, ecx
test eax, eax
push esi
cmovne edi, ecx
call fcn.1010458a
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100eb369
mov esp, ebp
pop ebp
ret
Function at 0x10053980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x100539ef
test edi, edi
je 0x100539ef
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100539a3
sub ecx, edx
je 0x100539ef
lea edx, [ebp - 0x38]
mov ecx, edi
call fcn.10053350
test eax, eax
jne 0x100539ef
mov eax, dword [ebp - 0x24]
inc eax
push 1
push eax
call fcn.101152f7
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x100539ef
mov edx, 0x10163c40
mov ecx, edi
call fcn.10053280
mov edi, eax
test edi, edi
jne 0x10053a02
push dword [esi]
call fcn.1010458a
add esp, 4
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x24]
push 1
push dword [esi]
call fcn.10118b44
push edi
mov esi, eax
call fcn.101156b4
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.100eb369
mov esp, ebp
pop ebp
ret

Function at 0x10054da0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10134943
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10186bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x1018d088
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x1018d088
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x10146070
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10056290
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100586e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
sub esp, 0xc
test edx, edx
je 0x10058768
push ebx
push esi
mov ecx, 0x10146db3
mov byte [edx], 0xda
sub ecx, edx
mov dword [ebp - 4], 0x33
push edi
mov dword [ebp - 8], ecx
lea eax, [edx + 1]
mov esi, 0x10146db0
mov edi, 0x10146db1
mov ebx, 0x10146db2
mov ecx, 0x10146db4
sub esi, edx
sub edi, edx
sub ebx, edx
sub ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, byte [esi + eax]
lea eax, [eax + 5]
xor cl, byte [edx]
mov byte [eax - 5], cl
movzx ecx, byte [edi + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 3], cl
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
sub dword [ebp - 4], 1
mov byte [eax - 1], cl
jne 0x10058725
pop edi
pop esi
pop ebx
mov eax, 0x100
mov esp, ebp
pop ebp
ret

Function at 0x1005a540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
add ecx, 0x4c
mov word [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ecx + 0x14], 8
jb 0x1005a55e
mov ecx, dword [ecx]
push str.rb__ccsUTF_8
push ecx
lea eax, [ebp - 8]
push eax
call fcn.101155ec
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x1005a5b7
push eax
push 2
lea eax, [ebp - 4]
push 1
push eax
call fcn.10118b44
push dword [ebp - 8]
call fcn.101156b4
mov cl, byte [ebp - 4]
add esp, 0x14
mov al, byte [ebp - 3]
cmp cl, 0xff
jne 0x1005a59f
cmp al, 0xfe
je 0x1005a5a8
cmp al, 0xff
jne 0x1005a5b1
cmp cl, 0xfe
jne 0x1005a5b1
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x1005a5c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x1005a5f8
call fcn.1005a540
test al, al
jne 0x1005a5f8
mov eax, dword [ebx]
test eax, eax
je 0x1005a5f1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.1005b560
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
jb 0x1005a605
mov eax, dword [esi]
jmp 0x1005a607
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x1005a69f
cmp dword [esi + 0x14], 8
jb 0x1005a62f
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x1005a65a
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x8c], 1
lea ecx, [ebp - 4]
push 0
push ecx
jne 0x1005a688
push 2
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0xfeff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 3
lea ecx, [ebp + 8]
mov word [ebp + 8], 0xbbef
push ecx
push eax
mov byte [ebp + 0xa], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005a6b0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10134cf6
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1005a774
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.10027270
xor bl, bl
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 8
push 0
cmovae eax, dword [ebp - 0x260]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x1005a749
cmp eax, 0xb7
je 0x1005a749
cmp eax, 0x50
jne 0x1005a74b
mov bl, 1
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x1005a769
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.10028060
test bl, bl
jne 0x1005a774
xor al, al
jmp 0x1005a892
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x1005a79e
xor ecx, ecx
jmp 0x1005a7b6
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005a7a7
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10027660
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
cmp word [esi], ax
jne 0x1005a7f6
xor ecx, ecx
jmp 0x1005a80f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005a800
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x248]
call fcn.10027660
lea edx, [ebp - 0x248]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.1005fdc0
mov byte [ebp - 4], 0
mov bl, al
mov ecx, dword [ebp - 0x234]
cmp ecx, 8
jb 0x1005a855
inc ecx
push ecx
push dword [ebp - 0x248]
lea ecx, [ebp - 0x248]
call fcn.10028060
test bl, bl
je 0x1005a872
lea ecx, [edi + 0x4c]
lea eax, [ebp - 0x230]
cmp ecx, eax
je 0x1005a870
push 0xffffffffffffffff
push 0
push eax
call fcn.10027760
mov bl, 1
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x1005a890
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.10028060
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret 4
Function at 0x1005aab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005aac0
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
add esi, esi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
push 0x1014ca6c
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005ab20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x1005ab30
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
call esi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 2
push 0x10164408
push dword [ebx + 0x68]
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005b560
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10134eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
lea esi, [edi + 0x4c]
mov dword [ebp - 0x18], 0
push esi
lea ecx, [ebp - 0x28]
mov word [ebp - 0x28], ax
call fcn.10027760
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.1005fe70
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.1005fca0
lea eax, [ebp - 0x58]
mov edx, 0x1014d5f4
push eax
lea ecx, [ebp - 0x70]
call fcn.1003dbf0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.100283c0
mov eax, dword [ebp - 0x5c]
cmp eax, 8
jb 0x1005b619
inc eax
lea ecx, [ebp - 0x70]
push eax
push dword [ebp - 0x70]
call fcn.10028060
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.10060100
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1005ff00
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x1005b6a5
cmp dword [esi + 0x10], 0
je 0x1005b6a5
cmp dword [ebp - 0x18], 0
je 0x1005b6a5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x1005b67c
mov esi, dword [esi]
push eax
push esi
call fcn.10116b74
add esp, 8
test eax, eax
jne 0x1005b6a5
lea ecx, [edi + 0x98]
lea eax, [ebp - 0x28]
cmp ecx, eax
je 0x1005b6a1
push 0xffffffffffffffff
push 0
push eax
call fcn.10027760
mov bl, 1
jmp 0x1005b6a7
xor bl, bl
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x1005b6bc
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10028060
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
cmp eax, 8
jb 0x1005b6e5
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10028060
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
cmp ecx, 8
jb 0x1005b70e
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10028060
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret
Function at 0x1005e0f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012fc16
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10186bd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.100eb7d3
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100e8780
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005ef90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10135210
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x64], edi
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], eax
call fcn.100296b0
test al, al
je 0x1005f18e
xor ecx, ecx
mov dword [ebp - 0x48], 7
push 0xffffffffffffffff
push ecx
lea eax, [esi + 0x34]
mov word [ebp - 0x5c], cx
push eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x4c], 0
call fcn.10027760
push str..trace
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.10027270
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.1005ffb0
mov byte [ebp - 4], 1
mov bl, al
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x1005f048
inc ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x44]
call fcn.10028060
test bl, bl
je 0x1005f165
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x2c]
call fcn.1005fdc0
test al, al
je 0x1005f165
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1005f086
mov dword [esi + 0x64], 0xa
jmp 0x1005f165
push str..debug
lea ecx, [ebp - 0x44]
call fcn.10027270
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.1005ffb0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov bl, al
call fcn.100271b0
test bl, bl
je 0x1005f0c4
lea ecx, [ebp - 0x2c]
call fcn.1005fda0
test al, al
jne 0x1005f159
lea ecx, [ebp - 0x2c]
call fcn.10060060
test al, al
je 0x1005f165
push str.asu.trace
lea ecx, [ebp - 0x44]
call fcn.10027270
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.1005fdc0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
mov bl, al
call fcn.100271b0
test bl, bl
je 0x1005f165
lea ecx, [ebp - 0x2c]
call fcn.1005fda0
test al, al
je 0x1005f117
mov dword [esi + 0x64], 0xa
jmp 0x1005f165
lea ecx, [ebp - 0x2c]
call fcn.10060060
test al, al
je 0x1005f165
push str.asu.debug
lea ecx, [ebp - 0x44]
call fcn.10027270
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2c]
call fcn.1005fdc0
lea ecx, [ebp - 0x44]
mov bl, al
call fcn.100271b0
test bl, bl
je 0x1005f165
lea ecx, [ebp - 0x2c]
call fcn.1005fda0
test al, al
je 0x1005f165
cmp edi, 0x14
jle 0x1005f165
mov dword [esi + 0x64], 0x14
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x1005f17a
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.10028060
xor eax, eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x1005f1a3
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.10028060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret 4
Function at 0x100602a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.100ec720
mov eax, dword [0x10186bd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
xor edx, edx
cmp dword [ecx + 0x14], 8
push edi
mov dword [ebp - 0x200c], edx
jb 0x100602cc
mov ecx, dword [ecx]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebx
cmp dword [esi + 0x14], 8
mov edi, eax
jb 0x100602f1
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push esi
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10060327
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100eb369
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [eax]
push 0
lea eax, [ebp - 0x2008]
push eax
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006036f
push 0
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10060377
call esi
mov dword [ebp - 0x200c], eax
cmp dword [ebp - 0x2008], 0x1000
je 0x10060330
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
mov edx, dword [ebp - 0x200c]
xor eax, eax
mov ecx, dword [ebp - 4]
test edx, edx
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.100eb369
mov esp, ebp
pop ebp
ret