joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ad60
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100db63e
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x10118974]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
mov dword [ebp - 0x48], ebx
call fcn.10064ac0
push 1
mov ecx, eax
mov edx, dword [eax]
mov edx, dword [edx + 8]
call edx
movzx ecx, al
sub ecx, 1
jne 0x1004aec7
push 0x51
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x40], cl
lea ecx, [ebp - 0x40]
push str.d:jenkins.jenkinsworkspacemgamecef_basicjs_basicjs_basicwebwndweb_wnd.cc
mov dword [ebp - 0x2c], 0xf
call fcn.1000b3d0
push 3
push 0x100e4e3c
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000b3d0
mov byte [ebp - 4], 1
call fcn.10064ac0
mov edi, eax
lea ecx, [ebp - 0xe0]
push 0x30e
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10007d20
mov esi, eax
push str.GetForegroundWindow_:
push esi
mov byte [ebp - 4], 2
call fcn.100053e0
add esp, 8
mov ecx, esi
push ebx
call fcn.100132f0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xe0]
call fcn.10009120
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1004ae85
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1004ae7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004af2f
push edx
push ecx
call fcn.100915df
add esp, 8
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp edx, 0x10
jb 0x1004aec7
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1004aebd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004af34
push edx
push ecx
call fcn.100915df
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push dword [ebp - 0x48]
mov ebx, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
push 1
push edi
push ebx
call esi
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push ebx
call esi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009195e
mov esp, ebp
pop ebp
ret 4
call fcn.100af803
call fcn.100af803
int3
Function at 0x1004c9a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d3c6a
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x10118974]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x54]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0
cmp dword [esi + 0x200b4], 0
mov dword [ebp - 4], 2
jne 0x1004ca0c
push 0
push 0
push esi
push 0x10009880
push 0
push 0
call fcn.100b25b6
add esp, 0x18
mov dword [esi + 0x200b4], eax
push 0x14
call fcn.10088930
mov edi, eax
add esp, 4
mov dword [ebp - 0x3c], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x1004ca41
push dword [ebp - 0x40]
lea eax, [ebp + 0x3c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10007940
push edi
mov ecx, esi
call fcn.10006a90
mov dword [ebp - 0x40], eax
jmp 0x1004ca48
mov dword [ebp - 0x40], 0
push 0xc
mov byte [ebp - 4], 2
call fcn.10088930
add esp, 4
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1004ca6c
mov ecx, eax
call fcn.1004ced0
mov edi, eax
jmp 0x1004ca6e
xor edi, edi
push ebx
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.1000bcd0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x88], 0x10005690
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp + 0x38]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x1004cab7
mov eax, dword [ecx]
lea edx, [ebp - 0x78]
push edx
call dword [eax]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 7
push eax
call fcn.1004ce10
mov ecx, dword [ebp - 0x54]
add esp, 4
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x1004cafd
mov edx, dword [ecx]
lea eax, [ebp - 0x78]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x54], 0
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 8
push eax
lea ecx, [esi + 0x2008c]
call fcn.1000c420
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1004cb28
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp + 0x38]
test ecx, ecx
je 0x1004cb47
mov edx, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp + 0x38], 0
mov edx, dword [ebp + 0x50]
cmp edx, 0x10
jb 0x1004cb77
mov ecx, dword [ebp + 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1004cb6d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004cb97
push edx
push ecx
call fcn.100915df
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009195e
mov esp, ebp
pop ebp
ret 0x50
call fcn.100af803
int3
Function at 0x1004e5f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dbb0b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10118974]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], vtable.LdsWebView::IWebViewAdvanceListener.0
xor eax, eax
mov dword [esi], vtable.WndBase.1.0
mov dword [esi + 4], vtable.WndBase.0
mov dword [esi + 8], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 7
mov dword [ebp - 4], 0
mov word [esi + 0x1c], ax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
call fcn.1004e170
mov dword [esi + 0x154], 0
mov eax, esi
mov dword [esi + 0x158], 0
mov dword [esi + 0x15c], 1
mov dword [esi + 0x160], 0
mov dword [esi + 0x164], 0
mov dword [esi + 0x168], 0
mov dword [esi + 0x16c], 0x320
mov dword [esi + 0x170], 0x258
mov dword [esi + 0x17c], 0
mov dword [esi + 0x180], 0
mov dword [esi + 0x184], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10063e50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dda5a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10118974]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.10009a50
mov ecx, eax
test ecx, ecx
je 0x10064014
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.10009a50
mov ecx, eax
test ecx, ecx
je 0x1006401e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.10009a50
mov ecx, eax
test ecx, ecx
je 0x10064028
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10063f32
xor ecx, ecx
jmp 0x10063f50
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10063f40
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.1000a550
push edi
mov ecx, ebx
call fcn.10012f20
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10063f6c
xor ecx, ecx
jmp 0x10063f84
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10063f74
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.1000a550
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10064840
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10012f20
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10063fc5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x10063ffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10063ffe
cmp dword [esi + 0x10], 0
je 0x10063ff5
push dword [edi]
call fcn.100b8ad3
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10009840
push 0x80004005
call fcn.10009840
push 0x80004005
call fcn.10009840
int3
Function at 0x10064640
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ddb48
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10118974]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x10064814
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10064695
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x10064814
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100646b3
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x10064814
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100646d1
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x10064814
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100646ef
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x10064814
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10064814
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10064714
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x10064747
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1006475f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1006479d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.1000b050
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.100ab800
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x100ee554
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10065020
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100647cb
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x10064804
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x10064804
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10007a60
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10008910
lea ecx, [ebp - 0x28]
call fcn.10008910
lea ecx, [ebp - 0x34]
call fcn.100640e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009195e
mov esp, ebp
pop ebp
ret 4
Function at 0x10064bf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ddc07
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10118974]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x10064c3a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10064c46
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.1000b4c0
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x10064cb3
push 0x48
call fcn.10088930
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x10064ca7
push 0x48
push 0
push ebx
call fcn.100ac300
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.10063e50
jmp 0x10064ca9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10064ce0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.1000b4c0
push 3
push 0x100ee554
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10046b40
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10064d2f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x10064d7e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x10064d7e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.1000b4c0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10008910
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10064db4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10064daa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10064df1
push edx
push ecx
call fcn.100915df
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x10064dd3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009195e
mov esp, ebp
pop ebp
ret 0x14
call fcn.100af803
int3
Function at 0x1006bc40
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10118974]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x1006be08
test eax, eax
je 0x1006be08
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x1006be08
push ecx
push ebx
push eax
call fcn.100ac300
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x1006be08
cmp edi, 0xffffffff
je 0x1006be01
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1007a620
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1006be01
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x1006bd97
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x1006be01
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x1006bd97
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x1006bd30
cmp edi, esi
jae 0x1006bd97
nop
sub esi, edi
sbb ecx, eax
js 0x1006bd45
jg 0x1006bd40
cmp esi, 0x400000
jb 0x1006bd45
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x1006bd97
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1007a670
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x1006bd8b
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x1006bd30
jg 0x1006bd97
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x1006bd30
lea eax, [ebp - 0x6c]
push eax
call fcn.1007a510
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x100eec68
push 3
push edi
call fcn.100176e0
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x1006bdb0
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.100beea4
add esp, 8
mov esi, 1
test ebx, ebx
je 0x1006bded
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x1006bdfb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009195e
mov esp, ebp
pop ebp
ret
Function at 0x1006c1f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100deb20
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10118974]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1006c309
cmp dword [ebp + 0x10], 0
je 0x1006c309
call fcn.10009a50
mov ecx, eax
test ecx, ecx
je 0x1006c359
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp + 0xc], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x105
or eax, ecx
mov dword [ebp - 4], 1
jge 0x1006c26e
push 0x105
lea ecx, [ebp + 0xc]
call fcn.10009fa0
mov esi, dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [esi - 8]
push esi
call fcn.100b3c53
add esp, 8
test eax, eax
js 0x1006c363
cmp eax, dword [esi - 8]
jg 0x1006c363
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [ebp + 0x14], ecx
je 0x1006c2f9
push ecx
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1006c2f9
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x100e4a18
call fcn.10007890
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1006c2e6
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov ecx, edi
call fcn.1006a040
jmp 0x1006c2c7
call fcn.10009a50
mov ecx, eax
test ecx, ecx
je 0x1006c36d
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x100e4a18
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1002a390
test al, al
jne 0x1006c346
push 0
push 0x100e4a18
mov ecx, esi
call fcn.1000a550
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10009840
push 0x80070057
call fcn.10009840
push 0x80004005
call fcn.10009840
int3
Function at 0x100716e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100df258
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10118974]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10088930
mov edi, eax
add esp, 4
test edi, edi
je 0x1007177d
push 1
mov dword [ebp - 4], 0
call fcn.1005eed0
add esp, 4
mov dword [edi + 4], eax
jmp 0x1007177f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.1006029f
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov dword [ebp - 4], 3
test edi, edi
je 0x100717e1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x100717e1
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x10071804
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10071827
cmp byte [ebp + 0xc], 0
je 0x10071813
push esi
call fcn.1005f3f7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10071833
mov esi, str.ios_base::badbit_set
jmp 0x10071843
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.1000c020
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.100082c0
push 0x1010541c
lea eax, [ebp - 0x30]
push eax
call fcn.100ab3e7
int3