joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100146fd
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eaf9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014757
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000ec37
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014774
call fcn.100060e0
jmp 0x10014776
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100147c2
call fcn.10007f79
jmp 0x100147c2
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret

Function at 0x10014eb7
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001eb59
call fcn.1001bb3b
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.1000ec37
test eax, eax
je 0x10014ee2
call fcn.10014ea8
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1002051c
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10014f3d
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.100178de
pop ecx
pop ecx
push edi
push esi
call fcn.1000ec37
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10006f58
push eax
push esi
push 0x10023e3c
call fcn.100178de
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10014f36
ret
cmp ebx, edi
je 0x10014f48
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014fa5
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10014f01
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014ff9
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10014f01
mov eax, esi
call fcn.1001bbe0
ret
Function at 0x100ba690
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
push ebx
movzx ebx, word [eax + 2]
push ebp
push esi
movzx esi, word [eax]
shl ebx, 0x10
mov dword [esp + 0xc], esi
or ebx, esi
push edi
mov ecx, 0x1b434c83
mov edx, 0x3281ab71
mov dword [esp + 0x14], 0x21e1cde3
mov dword [esp + 0x18], 0xf4d50d87
mov dword [esp + 0x1c], 0x9cefa3f8
mov dword [esp + 0x20], 0xa4beea47
mov dword [esp + 0x24], 0xb5bfbc70
mov dword [esp + 0x28], 0x6aa127fa
mov dword [esp + 0x2c], 0x8a845dd1
mov dword [esp + 0x30], 0x1d3af235
mov eax, 1
mov esi, 0x4f111
nop
and ecx, 7
mov ecx, dword [esp + ecx*4 + 0x14]
xor ecx, edx
lea edi, [eax + 0x82a3]
lea edx, [edi - 1]
imul edi, eax
lea ebp, [eax - 1]
imul edx, ebp
add ecx, edx
lea edx, [esi - 0x980]
imul edx, ebp
mov ebp, ecx
shr ebx, 1
add edx, ebx
lea edx, [edx + ecx + 0xc9de]
and ebp, 7
mov ebp, dword [esp + ebp*4 + 0x14]
add ebp, ecx
xor edx, ebp
and edx, 7
mov edx, dword [esp + edx*4 + 0x14]
xor edx, ecx
add edx, edi
mov ecx, edx
and ecx, 7
mov ecx, dword [esp + ecx*4 + 0x14]
add ecx, edx
mov edi, esi
imul edi, eax
shr ebx, 1
add edi, ebx
lea edi, [edi + edx + 0xc9de]
xor ecx, edi
and ecx, 7
mov ecx, dword [esp + ecx*4 + 0x14]
xor ecx, edx
lea edi, [eax + 1]
lea edx, [eax + 0x82a4]
imul edx, edi
add ecx, edx
lea edx, [esi + 0x980]
imul edx, edi
mov edi, ecx
and edi, 7
mov edi, dword [esp + edi*4 + 0x14]
add edi, ecx
shr ebx, 1
add edx, ebx
lea edx, [edx + ecx + 0xc9de]
xor edx, edi
and edx, 7
mov edx, dword [esp + edx*4 + 0x14]
xor edx, ecx
lea edi, [eax + 2]
lea ecx, [eax + 0x82a5]
imul ecx, edi
add edx, ecx
lea ecx, [esi + 0x1300]
imul ecx, edi
mov edi, edx
and edi, 7
mov edi, dword [esp + edi*4 + 0x14]
shr ebx, 1
add ecx, ebx
add edi, edx
lea ecx, [ecx + edx + 0xc9de]
add eax, 4
xor ecx, edi
lea edi, [eax - 1]
add esi, 0x2600
cmp edi, 0x20
jb 0x100ba700
mov eax, dword [esp + 0x38]
movzx eax, word [eax + 2]
mov esi, eax
imul esi, eax
mov eax, dword [esp + 0x10]
add esi, ecx
mov dword [esp + 0x14], esi
mov esi, eax
imul esi, eax
add edx, ecx
add esi, ecx
and edx, 0xffff41d3
lea ecx, [esp + 0x10]
or edx, 0x41d3
push ecx
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x3c], edx
call fcn.100ba540
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x100c86b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x10], eax
xor eax, eax
push eax
mov byte [esp + 4], al
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov word [esp + 0x11], ax
mov byte [esp + 0x13], al
push 2
lea eax, [esp + 8]
push eax
push ecx
call sub.WS2_32.dll_recv
cmp eax, 2
jne 0x100c870a
cmp byte [esp], 0xd
jne 0x100c870a
cmp byte [esp + 1], 0xa
jne 0x100c870a
mov al, 1
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10103a83
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor ecx, esp
xor al, al
call fcn.10103a83
add esp, 0x14
ret
Function at 0x100c9710
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x68
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, ecx
push edi

Function at 0x100cbc30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push 0x101636c4
lea eax, [esp + 4]
push esi
push eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.101016b9
mov eax, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x100cbc82
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.101019ac
mov edx, dword [esp + 0x10]
push edx
call fcn.10101a40
mov eax, dword [esp + 0x18]
add esp, 0x14
add esp, 8
ret
push 0
call fcn.10103f43
push eax
call fcn.1010011e
call fcn.10100130
push 0x10165abc
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push esi
push eax
call fcn.101016b9
mov eax, dword [esp + 0x14]
add esp, 0x14
test eax, eax
je 0x100cbccf
push eax
push 1
lea ecx, [esp + 0xc]
push 4
push ecx
call fcn.10103ec1
mov edx, dword [esp + 0x10]
push edx
call fcn.10101a40
add esp, 0x14
mov eax, dword [esp + 4]
add esp, 8
ret

Function at 0x100cbe90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
test edx, edx
jbe 0x100cbec1
mov eax, dword [edi]
push ebx
push ebp
lea ebx, [ebx]
movzx ebx, byte [ecx + esi]
mov ebp, eax
and ebp, 0xff
xor ebx, ebp
shr eax, 8
xor eax, dword [ebx*4 + 0x10192100]
inc ecx
cmp ecx, edx
jb 0x100cbea0
pop ebp
mov dword [edi], eax
pop ebx
ret

Function at 0x100ccc70
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x88
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x94]
push esi
push edi
xor ebx, ebx
push 0x1000000
mov byte [esp + 0x1b], bl
call fcn.100fe24c
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x100ccd31
push 0x1000000
push esi
mov ecx, str.mhelp.dat
call 0x10b8cee2
mov edi, eax
cmp edi, ebx
je 0x100ccd22
push 0x27
lea eax, [esp + 0x71]
push ebx
push eax
mov byte [esp + 0x78], bl
call fcn.10109950
add esp, 0xc
push edi
push esi
lea ebx, [esp + 0x20]
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.100cdba0
mov ecx, ebx
push ecx
lea edi, [esp + 0x70]
call fcn.100af8f0
mov edx, edi
push edx
push ebp
call fcn.100ccb70
add esp, 8
test al, al
je 0x100ccd22
mov byte [esp + 0x17], 1
push esi
call fcn.100ffe83
mov al, byte [esp + 0x1b]
add esp, 4
jmp 0x100ccd33
mov al, bl
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10103a83
add esp, 0x88
ret
Function at 0x100d6a20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x14], eax
push 0
call fcn.10103f43
mov ecx, dword [esp + 0x20]
add esp, 4
lea edx, [esp]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov ecx, 0x10
lea edx, [esp + 0x13]
push esi
xor eax, 0x10
mov dword [esp + 0x10], 0x10161508
mov dword [esp + 0x14], fcn.100d6ef0
sub edx, ecx
push edi
movzx esi, byte [edx + ecx]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
dec ecx
xor eax, esi
cmp ecx, 1
jae 0x100d6a67
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.10103a83
add esp, 0x18
ret

Function at 0x100db1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push esi
push edi
mov edi, eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
lea eax, [esp + 0x18]
push eax
mov eax, edi
call fcn.100dadd0
add esp, 4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x10], eax
mov esi, eax
call fcn.100dae40
add esi, eax
mov eax, dword [ebx + 4]
and eax, 0x7fffff00
add esp, 8
cmp eax, 0x7ff7a500
je 0x100db31a
fld qword [ebx]
fstp qword [esp + 0x10]
fld qword [esp + 0x10]
fistp dword [esp + 0xc]
fild dword [esp + 0xc]
fcomp qword [esp + 0x10]
fnstsw ax
test ah, 0x44
jp 0x100db31a
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x100db31a
cmp eax, 0x40000000
jg 0x100db31a
dec eax
xor ecx, ecx
cmp eax, 0x100
jb 0x100db302
shr eax, 8
add ecx, 8
cmp eax, 0x100
jae 0x100db2f5
movzx eax, byte [eax + 0x10161510]
add eax, ecx
inc dword [esp + eax*4 + 0x18]
lea eax, [esp + eax*4 + 0x18]
mov eax, 1
jmp 0x100db31c
xor eax, eax
add dword [esp + 8], eax
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x1c]
call fcn.100dad70
mov edx, dword [esp + 0xa0]
sub esi, eax
mov eax, dword [esp + 0xc]
add esp, 4
inc esi
push esi
push edx
mov ecx, edi
call fcn.100db040
add esp, 8
pop edi
pop esi
add esp, 0x90
ret

Function at 0x100db8d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
shr ecx, 5
mov eax, edx
xor eax, dword [esp + 4]
inc ecx
cmp edx, ecx
jb 0x100db8ff
push ebx
push edi
movzx edi, byte [esi + edx - 1]
mov ebx, eax
shl ebx, 5
add edi, ebx
mov ebx, eax
shr ebx, 2
add edi, ebx
sub edx, ecx
xor eax, edi
cmp edx, ecx
jae 0x100db8e2
pop edi
pop ebx
ret
Function at 0x100dbaa0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [eax + 0xc]
mov ebx, dword [esi + 0x30]
mov eax, edi
shr eax, 5
inc eax
xor ebx, edi
mov dword [esp + 0xc], esi
mov ecx, edi
cmp edi, eax
jb 0x100dbadf
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + ecx - 1]
mov ebp, ebx
shl ebp, 5
add edx, ebp
mov ebp, ebx
shr ebp, 2
add edx, ebp
sub ecx, eax
xor ebx, edx
cmp ecx, eax
jae 0x100dbac0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x18]
dec eax
and eax, ebx
mov ebp, dword [ecx + eax*4]
test ebp, ebp
je 0x100dbb5b
nop
cmp ebx, dword [ebp + 8]
jne 0x100dbb54
cmp edi, dword [ebp + 0xc]
jne 0x100dbb54
mov esi, dword [esp + 0x18]
mov ecx, edi
lea edx, [ebp + 0x10]
cmp edi, 4
jb 0x100dbb1c
mov eax, dword [esi]
cmp eax, dword [edx]
jne 0x100dbb50
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x100dbb08
test ecx, ecx
je 0x100dbbf8
mov al, byte [edx]
cmp al, byte [esi]
jne 0x100dbb50
cmp ecx, 1
jbe 0x100dbbf8
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x100dbb50
cmp ecx, 2
jbe 0x100dbbf8
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x100dbbf8
mov esi, dword [esp + 0xc]
mov ebp, dword [ebp]
test ebp, ebp
jne 0x100dbaf0
mov eax, dword [esi + 0x20]
cmp dword [esi + 0x1c], eax
jb 0x100dbb7b
cmp eax, 0x3ffffffe
jg 0x100dbb7b
lea edx, [eax + eax]
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.100db900
add esp, 8
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov eax, dword [esp + 0x14]
dec ecx
and ecx, ebx
lea ebp, [edx + ecx*4]
mov ecx, dword [eax + 0xc]
lea edx, [edi + 0x11]
push edx
push 4
push 0
push eax
mov dword [esp + 0x24], ecx
call fcn.100ee490
add esp, 0x10
mov esi, eax
test ebp, ebp
jne 0x100dbbb0
mov ebp, dword [esp + 0x14]
add ebp, 0x3c
mov eax, dword [esp + 0x14]
mov cl, byte [eax + 0x34]
mov eax, dword [esp + 0x18]
and cl, 3
mov byte [esi + 5], cl
mov byte [esi + 4], 4
mov edx, dword [ebp]
push edi
push eax
lea ecx, [esi + 0x10]
mov dword [esi], edx
mov dword [ebp], esi
push ecx
mov dword [esi + 0xc], edi
mov dword [esi + 8], ebx
mov byte [esi + 6], 0
call fcn.101099d0
mov eax, dword [esp + 0x18]
add esp, 0xc
mov byte [esi + edi + 0x10], 0
inc dword [eax + 0x1c]
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [esp + 0xc]
mov al, byte [ebp + 5]
mov cl, byte [edx + 0x34]
xor al, 3
xor cl, 3
test al, cl
jne 0x100dbc0e
mov byte [ebp + 5], al
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x100e8270
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x20]
mov esi, 0x200
mov dword [esp + 0x10], ecx
mov ecx, esi
lea ebx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], esi
call fcn.100d5b70
push edi
push esi
push 1
push eax
call fcn.101019ac
add dword [esp + 0x28], eax
add esp, 0x10
cmp eax, esi
jb 0x100e82fa
lea ecx, [ecx]
cmp esi, 0x3fffffff
ja 0x100e82da
add esi, esi
mov ecx, esi
lea ebx, [esp + 0x10]
call fcn.100d5b70
push edi
push esi
push 1
push eax
call fcn.101019ac
add dword [esp + 0x28], eax
add esp, 0x10
cmp eax, esi
jae 0x100e82d0
lea edi, [esp + 0x10]
call fcn.100d5bf0
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10103a83
add esp, 0x21c
ret

Function at 0x100e8320
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], ecx
push edi
mov ecx, esi
lea ebx, [esp + 0x10]
mov edi, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x200
call fcn.100d5b70
push edi
push esi
push 1
push eax
call fcn.101019ac
mov esi, eax
add dword [esp + 0x28], esi
add esp, 0x10
mov edi, ebx
call fcn.100d5bf0
mov ecx, dword [esp + 0x224]
xor edx, edx
cmp edx, esi
pop edi
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
neg eax
call fcn.10103a83
add esp, 0x21c
ret

Function at 0x100e833c
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x10181630]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0xc], ecx
push edi
mov ecx, esi
lea ebx, [esp + 0x10]
mov edi, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x200
call fcn.100d5b70
push edi
push esi
push 1
push eax
call fcn.101019ac
mov esi, eax
add dword [esp + 0x28], esi
add esp, 0x10
mov edi, ebx
call fcn.100d5bf0
mov ecx, dword [esp + 0x224]
xor edx, edx
cmp edx, esi
pop edi
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
neg eax
call fcn.10103a83
add esp, 0x21c
ret
Function at 0x100e8a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
mov ecx, dword [ebx + 0x10]
push esi
push edi
mov edi, eax
mov eax, dword [ebx + 8]
sub eax, dword [ecx]
mov esi, 1
sub eax, 8
sar eax, 3
sub eax, edi
mov dword [esp + 0x2c], esi
je 0x100e8c4a
jmp 0x100e8ac4
mov eax, dword [esp + 0x30]
mov edx, dword [ebx + 0x10]
dec eax
mov dword [esp + 0x30], eax
test edi, edi
jle 0x100e8b23
mov eax, dword [edx]
lea eax, [eax + edi*8]
cmp eax, dword [ebx + 8]
jb 0x100e8b61
lea eax, [esp + 0x34]
push eax
mov eax, ebx
call fcn.100d39d0
add esp, 4
test eax, eax
je 0x100e8c55
test esi, esi
je 0x100e8c34
mov ecx, dword [ebp + 8]
mov esi, dword [esp + 0x34]
push ecx
push esi
push 1
push eax
call fcn.10103ec1
add esp, 0x10
cmp eax, esi
jne 0x100e8c34
mov esi, 1
jmp 0x100e8c36
cmp edi, 0xfff0b9d8
jle 0x100e8b33
mov ecx, dword [ebx + 8]
lea eax, [ecx + edi*8]
jmp 0x100e8b61
jne 0x100e8b3d
mov eax, dword [ebx + 0xc]
add eax, 0x28
jmp 0x100e8b61
mov ecx, dword [edx]
mov eax, 0xfff0b9d8
sub eax, edi
cmp dword [ecx + 4], 0x7ff7a516
je 0x100e8ade
mov ecx, dword [ecx]
movzx esi, byte [ecx + 6]
cmp eax, esi
mov esi, dword [esp + 0x2c]
jg 0x100e8ade
lea eax, [ecx + eax*8 + 8]
cmp eax, 0x10161508
je 0x100e8ade
mov eax, dword [eax + 4]
mov ecx, eax
and ecx, 0x7fffff00
cmp ecx, 0x7ff7a500
je 0x100e8b86
mov eax, 3
jmp 0x100e8b8b
and eax, 0xff
and eax, 0xf
cmp eax, 3
jne 0x100e8ade
test esi, esi
je 0x100e8c34
test edi, edi
jle 0x100e8baf
mov edx, dword [edx]
lea eax, [edx + edi*8]
cmp eax, dword [ebx + 8]
jae 0x100e8be9
jmp 0x100e8bee
cmp edi, 0xfff0b9d8
jle 0x100e8bbf
mov eax, dword [ebx + 8]
lea eax, [eax + edi*8]
jmp 0x100e8bee
jne 0x100e8bc9
mov eax, dword [ebx + 0xc]
add eax, 0x28
jmp 0x100e8bee
mov ecx, dword [edx]
mov eax, 0xfff0b9d8
sub eax, edi
cmp dword [ecx + 4], 0x7ff7a516
je 0x100e8be9
mov ecx, dword [ecx]
movzx edx, byte [ecx + 6]
cmp eax, edx
lea eax, [ecx + eax*8 + 8]
jle 0x100e8bee
mov eax, 0x10161508
mov ecx, dword [eax + 4]
and ecx, 0x7fffff00
cmp ecx, 0x7ff7a500
jne 0x100e8c10
lea esi, [esp + 0x38]
call fcn.100d8270
test eax, eax
jne 0x100e8c10
fldz
jmp 0x100e8c12
fld qword [eax]
mov edx, dword [ebp + 8]
sub esp, 8
fstp qword [esp]
push str._.14g
push edx
call fcn.10105d6f
add esp, 0x10
test eax, eax
jle 0x100e8c34
mov esi, 1
jmp 0x100e8c36
xor esi, esi
inc edi
cmp dword [esp + 0x30], 0
mov dword [esp + 0x2c], esi
jne 0x100e8ac0
test esi, esi
je 0x100e8c63
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [str.string]
push edx
mov eax, ebx
call fcn.100d5360
call fcn.10105d26
mov eax, dword [eax]
mov ecx, dword [ebx + 8]
mov dword [ecx + 4], 0x7ff7a500
mov esi, 8
add dword [ebx + 8], esi
push eax
mov dword [esp + 0x38], eax
call fcn.10105c78
add esp, 4
mov edi, ebx
call fcn.100d3c80
fild dword [esp + 0x34]
mov edx, dword [ebx + 8]
pop edi
fstp qword [edx]
add dword [ebx + 8], esi
lea eax, [esi - 5]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1010153d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1010156e
call fcn.10105d39
mov dword [eax], esi
call fcn.10105d26
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.100ff7a5
add esp, 0x14
push 0x16
pop eax
jmp 0x101015c3
test dword [ebp + 0xc], 0xfffffff9
jne 0x1010154a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1010159b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10105d4c
pop ecx
call fcn.10105d26
mov eax, dword [eax]
jmp 0x101015c3
test al, 0x10
jne 0x101015c1
test al, 1
je 0x101015c1
test byte [ebp + 0xc], 2
je 0x101015c1
call fcn.10105d39
mov dword [eax], 5
call fcn.10105d26
mov dword [eax], 0xd
jmp 0x10101592
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10103a83
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10181630]
jne 0x10103a8d
repz ret
jmp fcn.1011390e

Function at 0x1011f6fa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1010d65a
and dword [ebp - 4], 0
cmp dword [0x101b20e0], 0
mov ebx, eax
jne 0x1011f7ab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1011f85c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1015d9a8
push edi
call esi
test eax, eax
je 0x1011f85c
push eax
call fcn.1010d5e8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101b20e0], eax
call esi
push eax
call fcn.1010d5e8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101b20e4], eax
call esi
push eax
call fcn.1010d5e8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101b20e8], eax
call esi
push eax
call fcn.1010d5e8
pop ecx
mov dword [0x101b20f0], eax
test eax, eax
je 0x1011f7ab
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1010d5e8
pop ecx
mov dword [0x101b20ec], eax
mov eax, dword [0x101b20ec]
cmp eax, ebx
je 0x1011f803
cmp dword [0x101b20f0], ebx
je 0x1011f803
push eax
call fcn.1010d663
push dword [0x101b20f0]
mov esi, eax
call fcn.1010d663
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1011f803
test edi, edi
je 0x1011f803
call esi
test eax, eax
je 0x1011f7fa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1011f7fa
test byte [ebp - 0xc], 1
jne 0x1011f803
or dword [ebp + 0x10], 0x200000
jmp 0x1011f83c
mov eax, dword [0x101b20e4]
cmp eax, ebx
je 0x1011f83c
push eax
call fcn.1010d663
pop ecx
test eax, eax
je 0x1011f83c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1011f83c
mov eax, dword [0x101b20e8]
cmp eax, ebx
je 0x1011f83c
push eax
call fcn.1010d663
pop ecx
test eax, eax
je 0x1011f83c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101b20e0]
call fcn.1010d663
pop ecx
test eax, eax
je 0x1011f85c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1011f85e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret