joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405997
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x4059b8
mov ecx, dword [0x423afc]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x424358]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x4232c0
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405b7e
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405b7e
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405b8b
inc ebx
cmp cl, 0xfc
jbe 0x405b71
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0xc], eax
or eax, edx
push 2
mov dword [ebp - 8], eax
pop eax
mov dword [ebp - 0x14], ecx
or ecx, edx
add ebx, eax
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0x10], ecx
jne 0x405b1c
cmp dword [0x4243a4], 0
mov dword [ebp + 0xc], eax
je 0x405a4a
mov dword [ebp + 0xc], 4
dec dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push dword [ebp + eax*4 - 0x14]
push dword [0x424324]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405a81
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x405a8a
and byte [edi], 0
cmp dword [ebp + 0xc], 0
jne 0x405a4a
cmp byte [edi], 0
jne 0x405b03
mov eax, dword [ebp - 0x14]
cmp eax, 0x2b
jne 0x405aae
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405869
jmp 0x405afe
cmp eax, 0x26
jne 0x405ada
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405869
cmp byte [edi], 0
jne 0x405b03
push str.C:Program_Files
push edi
call fcn.00405975
jmp 0x405afe
cmp eax, 0x25
jne 0x405aed
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405afe
cmp eax, 0x24
jne 0x405afe
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
je 0x405b14
cmp dword [ebp - 0xc], 0x1a
jne 0x405b14
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405ba4
jmp 0x405b62
cmp byte [ebp + 0xf], 0xfd
jne 0x405b50
cmp esi, 0x1b
jne 0x405b35
push dword [0x424324]
push edi
call fcn.004058d3
jmp 0x405b46
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.00405975
add esi, 0xffffffeb
cmp esi, 6
jae 0x405b62
jmp 0x405b14
cmp byte [ebp + 0xf], 0xff
jne 0x405b62
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00405997
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x4232c0
jmp 0x405b7e
jne 0x405b7b
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405b7e
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x4059e3
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405ba0
push eax
push dword [ebp + 8]
call fcn.00405975
leave
ret 8
Function at 0x405cd8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422eb4], 0
push esi
jne 0x405d0f
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405ce9
mov dword [ecx*4 + 0x422eb0], eax
inc ecx
cmp ecx, 0x100
jl 0x405ce4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d40
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422eb0]
xor eax, esi
inc ecx
dec edx
jne 0x405d22
pop edi
not eax
pop esi
ret 0xc
Function at 0x10002890
Capabilities:
Delete service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020d58
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
jne 0x100028c9
lea eax, [ecx + 0x57]
jmp 0x10002a1d
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x100028e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10002a1d
push 0xf01ff
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x10002903
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x22
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push str.SYSTEMCurrentControlSetServices_
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10006290
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.100063e0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x34]
push ecx
push 0xf003f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100029b6
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x2c]
push 4
push eax
push 4
push 0
push 0x100256f0
push dword [ebp - 0x34]
mov dword [ebp - 0x2c], 1
call esi
push 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 4
push eax
push 4
push 0
push 0x100256d8
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x100029c3
push edi
call esi
push ebx
call esi
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10002a09
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100029ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100029ff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1001f38a
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f349
mov esp, ebp
pop ebp
ret
Function at 0x1000df60
Capabilities:
Extract resource via kernel32 functions
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1002e008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 8
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x14], eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 1
jb 0x1000df90
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x1000e06a
cmp dword [edi + 0x14], 8
jb 0x1000dfa9
mov edi, dword [edi]
mov eax, dword [ebp - 0x14]
push edi
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1000e06a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000e06a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x1000e06a
cmp dword [ebx + 0x14], 8
jb 0x1000dfef
mov ebx, dword [ebx]
push 0
push 0x80000080
push 2
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e06a
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push edi
push dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1000e031
cmp edi, dword [ebp - 8]
je 0x1000e035
mov byte [ebp - 0xd], 0
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
movzx ebx, byte [ebp - 0xd]
xor ecx, ecx
cmp eax, edi
push esi
cmovne ebx, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f349
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f349
mov esp, ebp
pop ebp
ret
Function at 0x1000e410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022018
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x1002e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x220], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
push 0x20c
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x220], 1
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x1000e4de
xor eax, eax
lea ecx, [ebp - 0x21c]
mov word [ebp - 0x12], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e4c0
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10006290
cmp dword [esi + 0x10], 0
je 0x1000e66e
push 4
xor eax, eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x238]
push str.Temp
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
call fcn.10006290
mov dword [ebp - 4], 1
lea eax, [ebp - 0x238]
push eax
mov edx, esi
lea ecx, [ebp - 0x258]
call fcn.100173d0
add esp, 4
mov edi, eax
mov byte [ebp - 4], 2
cmp esi, edi
je 0x1000e57d
mov ecx, esi
call fcn.10006230
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x244]
cmp edx, 8
jb 0x1000e5c3
mov ecx, dword [ebp - 0x258]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000e5b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000e5b9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1001f38a
add esp, 8
xor eax, eax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 7
mov word [ebp - 0x258], ax
mov byte [ebp - 4], al
mov edx, dword [ebp - 0x224]
cmp edx, 8
jb 0x1000e625
mov ecx, dword [ebp - 0x238]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000e61b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000e61b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1001f38a
add esp, 8
xor eax, eax
mov dword [ebp - 0x228], 0
mov ecx, esi
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
call fcn.10016380
test al, al
jne 0x1000e66e
mov ecx, esi
call fcn.100168c0
test al, al
jne 0x1000e66e
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [esi + 0x10], 0
jb 0x1000e669
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f349
mov esp, ebp
pop ebp
ret
Function at 0x10010280
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [esi + 4]
test eax, eax
jne 0x100102a3
push str.Ktmw32.dll
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x100103b3
cmp dword [esi + 8], 0
jne 0x100102b3
push str.Advapi32.dll
call edi
mov dword [esi + 8], eax
cmp dword [esi + 0xc], 0
jne 0x100102c3
push 0x10026c20
call edi
mov dword [esi + 0xc], eax
cmp dword [esi + 8], 0
je 0x100103b3
cmp dword [esi + 0xc], 0
je 0x100103b3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateTransaction
push dword [esi + 4]
call edi
mov dword [esi + 0x10], eax
test eax, eax
je 0x100103b3
push str.RollbackTransaction
push dword [esi + 4]
call edi
mov dword [esi + 0x14], eax
test eax, eax
je 0x100103b3
push str.CommitTransaction
push dword [esi + 4]
call edi
mov dword [esi + 0x18], eax
test eax, eax
je 0x100103b3
push str.RegCreateKeyTransactedW
push dword [esi + 8]
call edi
push str.RegDeleteKeyTransactedW
mov dword [esi + 0x1c], eax
push dword [esi + 8]
call edi
push str.RegOpenKeyTransactedW
mov dword [esi + 0x20], eax
push dword [esi + 8]
call edi
push str.DeleteFileTransactedW
mov dword [esi + 0x24], eax
push dword [esi + 0xc]
call edi
push str.CopyFileTransactedW
mov dword [esi + 0x28], eax
push dword [esi + 0xc]
call edi
push str.CreateDirectoryTransactedW
mov dword [esi + 0x2c], eax
push dword [esi + 0xc]
call edi
push str.MoveFileTransactedW
mov dword [esi + 0x30], eax
push dword [esi + 0xc]
call edi
push str.CreateFileTransactedW
mov dword [esi + 0x34], eax
push dword [esi + 0xc]
call edi
push str.RemoveDirectoryTransactedW
mov dword [esi + 0x38], eax
push dword [esi + 0xc]
call edi
push str.SetFileAttributesTransactedW
mov dword [esi + 0x3c], eax
push dword [esi + 0xc]
call edi
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x10]
push 0
call eax
mov dword [esi], eax
pop edi
pop esi
ret 0x10
Function at 0x100108c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022358
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1002e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x100109f8
push 0xc
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
push str.wintrust.dll
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
call fcn.10006290
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
call fcn.100183d0
mov ecx, eax
call fcn.10018490
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x10010980
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10010976
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10010976
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1001f38a
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
test ebx, ebx
jne 0x100109b1
mov dword [edi + 0x18], 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x14], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017780
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x1002e008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100178c2
cmp dword [esi + 4], 6
push edi
ja 0x100177d6
jne 0x1001785e
cmp dword [esi + 8], 2
jb 0x1001785e
push 0x100279dc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x1001785e
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1001785e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001785e
movups xmm0, xmmword [0x10027a24]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x10027a34]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1001785e
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001785e
cmp word [edi + 2], ax
jbe 0x1001785e
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push 0x100279a4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x100279b8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x100178a9
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x100178a9
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.1001f349
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.1001f349
add esp, 0x140
ret

Function at 0x1001a2b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x1002e008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x1001a332
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x1001a332
test ecx, ecx
je 0x1001a32e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x1001a2f0
xor eax, eax
jmp 0x1001a337
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1001a341
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001f349
add esp, 0xc
ret 0xc
Function at 0x1001a700
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023438
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1002e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and edi, 0xffffb1af
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1001a73f
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push eax
call ebx
test eax, eax
je 0x1001a754
mov al, 1
jmp 0x1001a7f9
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1001b510
test al, al
je 0x1001a79e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x1001a79e
mov bl, 1
jmp 0x1001a7a0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1001a7e3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001a7d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001a7d9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1001f38a
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f349
mov esp, ebp
pop ebp
ret
Function at 0x1001a820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10023438
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1002e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1001a856
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1001a906
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1001b510
test al, al
je 0x1001a8af
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1001a8f2
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001a8e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001a8e8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1001f38a
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f349
mov esp, ebp
pop ebp
ret