joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e6a0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x208
mov ecx, 0x41
push ebx
push ebp
push esi
push edi
mov dword [eax], 0
xor eax, eax
lea edi, [esp + 0x114]
push 0x100
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, dword [esp + 0x220]
lea ecx, [esp + 0x14]
push ecx
mov dword [esi], eax
call fcn.10002010
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov ebx, dword [sym.imp.MSVCRT.dll__strlwr]
mov ebp, dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
je 0x1000e73f
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push str._sWindnsapi.dat
push eax
call edi
mov ecx, dword [esi]
push ecx
call ebx
mov edx, dword [esi]
push 0
push edx
call ebp
add esp, 0x18
test eax, eax
jne 0x1000e73f
mov eax, dword [esp + 0x220]
pop edi
pop esi
pop ebp
mov dword [eax], 1
pop ebx
add esp, 0x208
ret
lea ecx, [esp + 0x114]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000e7a0
push 0x100
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea edx, [esp + 0x114]
mov dword [esi], eax
push edx
push str._s_systemWindnsapi.dat
push eax
call edi
mov eax, dword [esi]
push eax
call ebx
mov ecx, dword [esi]
push 0
push ecx
call ebp
add esp, 0x18
test eax, eax
jne 0x1000e7a0
mov edx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
mov dword [edx], 1
pop ebx
add esp, 0x208
ret
mov eax, dword [esi]
push eax
call fcn.10010220
mov ecx, dword [esp + 0x224]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [ecx], 0
pop ebx
add esp, 0x208
ret
Function at 0x1000e7d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002af90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x42c]
xor esi, esi
push eax
push ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
call fcn.1000e6a0
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
cmp esi, eax
jge 0x1000e9af
mov edx, dword [ebp + esi*4 - 0x42c]
mov ecx, 0x1003c458
push edx
call fcn.1000e560
test eax, eax
jne 0x1000e9a6
mov eax, dword [ebp + esi*4 - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x1000e9a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.partInit
push ebx
call edi
push str.GetDLLVer
push ebx
mov esi, eax
call edi
test esi, esi
je 0x1000e99f
test eax, eax
je 0x1000e99f
xor ecx, ecx
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
call eax
add esp, 4
mov eax, fcn.10002e30
push 0x10030060
push eax
push 0x100
push 0x1003c468
call esi
mov esi, eax
and eax, 0xff00
add esp, 0x10
and esi, 0xff
cmp eax, 0xff00
jne 0x1000e8e0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [ebp - 0x14]
inc esi
jmp 0x1000e80f
cmp eax, 0x5500
jne 0x1000e916
push 1
push esi
mov ecx, 0x1003c458
call fcn.1000e5f0
mov edi, eax
test edi, edi
je 0x1000e916
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call fcn.10010220
add esp, 4
push 0x88
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor edx, edx
add esp, 4
cmp eax, edx
je 0x1000e939
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax], edx
mov edx, eax
mov ecx, dword [ebp - 0x14]
mov dword [edx], ebx
mov dword [edx + 0x7c], esi
xor eax, eax
mov edi, dword [ebp + ecx*4 - 0x42c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [edx + 4]
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [edx + 0x68]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x1003c458
call fcn.1000e520
mov esi, dword [ebp - 0x14]
inc esi
jmp 0x1000e80f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x14]
inc esi
jmp 0x1000e80f
xor esi, esi
cmp esi, dword [ebp - 0x18]
jge 0x1000e9cf
mov ecx, dword [ebp + esi*4 - 0x42c]
push ecx
call fcn.10010220
add esp, 4
inc esi
jmp 0x1000e9b1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ed60
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1000ecc0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
add esp, 8
lea ecx, [esp + 0xc]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
xor eax, eax
cmp ecx, edx
sete al
pop esi
ret

Function at 0x1000eda0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000edc9
xor eax, eax
pop esi
ret
push edi
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.1000ecc0
mov eax, dword [esp + 0x1c]
add esp, 8
lea edx, [esp + 0xc]
push 0
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
xor eax, eax
cmp ecx, edx
pop edi
pop esi
sete al
ret
Function at 0x1000f560
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push 0x1000f410
push 0
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000f58f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret

Function at 0x1000f5a0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push 0
push 0x1000f5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000f5c4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
Function at 0x10010bf0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x160
mov ecx, dword [esp + 0x168]
lea eax, [esp + 0x20]
push esi
mov esi, 1
push eax
push ecx
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x10010db7
mov esi, dword [esp + 0x170]
push ebx
mov ebx, dword [esp + 0x16c]
push ebp
push edi
test byte [esp + 0x30], 0x10
je 0x10010cc0
mov edi, 0x10031888
lea eax, [esp + 0x5c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x10010c69
test cl, cl
je 0x10010c65
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x10010c69
add eax, 2
add edi, 2
test cl, cl
jne 0x10010c45
xor eax, eax
jmp 0x10010c6e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10010d7e
mov edi, 0x10031884
lea eax, [esp + 0x5c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x10010ca3
test cl, cl
je 0x10010c9f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x10010ca3
add eax, 2
add edi, 2
test cl, cl
jne 0x10010c7f
xor eax, eax
jmp 0x10010ca8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10010d7e
mov eax, dword [esi + 4]
xor edi, edi
inc eax
mov ebp, 1
mov dword [esi + 4], eax
jmp 0x10010cd7
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
xor ebp, ebp
test eax, eax
jbe 0x10010cd4
or edi, 0x80000000
inc dword [esi + 8]
lea eax, [esp + 0x28]
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [esp + 0x18]
lea eax, [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x22]
mov eax, dword [esp + 0x20]
push ebp
and ecx, 0xffff
push edi
and edx, 0xffff
mov ebp, dword [esi]
push ecx
mov ecx, dword [esp + 0x2a]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x2a]
push eax
mov eax, dword [esp + 0x2c]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
mov edx, dword [esi + 0xc]
push eax
lea ecx, [esp + 0x7c]
push ebx
push ecx
add edx, ebp
push str._s_t_s_t_04d_02d_02d_02d_02d_02d_t_u_t_d_r_n
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esi + 0xc]
add esp, 0x30
add ecx, eax
mov dword [esi + 0xc], ecx
mov eax, ecx
mov ecx, dword [0x1003d088]
lea edx, [ecx + 0x3fffff]
shl edx, 0xa
cmp eax, edx
ja 0x10010d97
mov eax, dword [esi + 8]
mov edi, dword [esi + 4]
add eax, edi
cmp eax, ecx
jae 0x10010d97
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x10010d9b
jmp 0x10010c31
xor esi, esi
jmp 0x10010d9f
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebp
mov eax, esi
pop ebx
pop esi
add esp, 0x160
ret
mov eax, esi
pop esi
add esp, 0x160
ret
Function at 0x10010dd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002afc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x10], esp
repne scasb al, byte es:[edi]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
add edx, 0x12c
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 4
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
push 0x10030690
push esi
mov dword [ebp + 8], esi
call edi
mov ecx, dword [ebp + 0x10]
push ecx
push esi
push ebx
call fcn.10010bf0
add esp, 0x1c
test eax, eax
je 0x10010f9d
push ebx
push str._s.
push esi
mov dword [ebp - 0x14], 1
call edi
add esp, 0xc
mov edi, eax
lea edx, [ebp - 0x15c]
sub edi, 3
push edx
push esi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x10010f9d
mov dword [ebp - 4], 0
test byte [ebp - 0x15c], 0x10
je 0x10010f73
mov esi, 0x10031888
lea eax, [ebp - 0x130]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x10010ed2
test cl, cl
je 0x10010ece
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x10010ed2
add eax, 2
add esi, 2
test cl, cl
jne 0x10010eaa
xor eax, eax
jmp 0x10010ed7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10010f73
mov esi, 0x10031884
lea eax, [ebp - 0x130]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x10010f12
test cl, cl
je 0x10010f0e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x10010f12
add eax, 2
add esi, 2
test cl, cl
jne 0x10010eea
xor eax, eax
jmp 0x10010f17
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10010f73
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
mov edx, dword [ebp + 8]
mov byte [eax + edi], 0
lea edi, [ebp - 0x130]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x10]
push ecx
push eax
push edx
call fcn.10010dd0
add esp, 0xc
test eax, eax
jne 0x10010f70
mov dword [ebp - 0x14], eax
jmp 0x10010f8c
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x15c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10010e92
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
push ecx
call fcn.10010220
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011d80
Capabilities:
Get disk size

Disassembly:
sub esp, 0x18
lea eax, [esp]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x10011dda
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov ecx, 0x14
call fcn.10023050
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, dword [esp + 8]
mov ecx, 0x14
call fcn.10023050
mov edx, dword [esp + 0x20]
mov dword [edx], eax
mov eax, 1
add esp, 0x18
ret
xor eax, eax
add esp, 0x18
ret
Function at 0x10013cb0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10013d2a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jle 0x10013d23
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jge 0x10013d23
push edi
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 0
mov edx, dword [edi]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0xc]
push esi
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
Function at 0x100142f0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
push edi
or ebp, 0xffffffff
push 0
push ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], ebp
call dword [sym.imp.MSVCRT.dll__access]
mov esi, dword [esp + 0x3c]
add esp, 8
test eax, eax
jne 0x100143ce
push 0
push 0
push 3
push 0
push 1
push bind
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x100143ce
cmp edi, ebp
je 0x100143ce
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
test ecx, ecx
jbe 0x10014373
or eax, 0x80000000
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1001437b
xor ebp, ebp
jmp 0x100143be
cmp eax, 0x3c00000
jbe 0x10014389
mov ebp, 1
jmp 0x100143be
add eax, 0x400
mov ebp, 2
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
push 0
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi]
add ecx, eax
mov dword [esi], ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 2
je 0x100144d6
push ebp
push ebx
push str._s_
call fcn.10022cd0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov dword [esi], 0
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push str.filename:__s_r_n
push edi
call ebx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x2e]
add esp, 0xc
and edx, 0xffff
and ecx, 0xffff
mov dword [esi], eax
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x26]
and edx, 0xffff
and ecx, 0xffff
push edx
mov edx, dword [esp + 0x26]
push ecx
mov ecx, dword [esp + 0x28]
and edx, 0xffff
and ecx, 0xffff
push edx
push ecx
add eax, edi
push str.time:__04d_02d_02d_02d_02d_02d_r_n
push eax
call ebx
mov edx, dword [esi]
add esp, 0x20
add edx, eax
mov dword [esi], edx
mov eax, edx
mov edx, dword [esp + 0x38]
add eax, edi
push edx
push str.monitortype:__s_r_n
push eax
call ebx
mov ecx, dword [esi]
add esp, 0xc
add ecx, eax
mov dword [esi], ecx
mov eax, ecx
mov ecx, dword [esp + 0x3c]
add eax, edi
push ecx
push str.monitorvalue:__s_r_n
push eax
call ebx
mov edx, dword [esi]
add esp, 0xc
add edx, eax
mov eax, edx
push 0
add eax, edi
push str.content_length:__d_r_n
push eax
mov dword [esi], edx
call ebx
mov ecx, dword [esi]
add esp, 0xc
add ecx, eax
mov eax, ecx
mov dword [esi], ecx
push str.content_type:_file_r_n_r_n
add eax, edi
push eax
call ebx
mov ecx, dword [esi]
mov edx, dword [esp + 0x38]
add esp, 8
add ecx, eax
mov dword [esi], ecx
mov dword [edx], edi
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x10014d00
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0
push ecx
push 0x10014820
push 0
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10014d2f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
Function at 0x10015050
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, dword [0x1003d0a0]
sub esp, 0x208
test eax, eax
jne 0x10015068
xor eax, eax
add esp, 0x208
ret
push ebx
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xc]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
rep stosd dword es:[edi], eax
mov ecx, dword [0x1003d0a0]
lea edx, [esp + 0x110]
push ecx
push edx
lea eax, [esp + 0x14]
push 0x100303fc
push eax
call ebx
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x18
test eax, eax
je 0x100150de
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
mov esi, dword [esp + 0x218]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.10015130
mov ecx, dword [esp + 0x224]
add esp, 8
lea eax, [esp + 0xc]
push esi
push eax
push 0x10030690
push ecx
call ebx
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x10015160
Capabilities:
Get disk information

Disassembly:
sub esp, 0x308
lea eax, [esp + 0x204]
push ebx
push edi
push eax
call fcn.10015260
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xc]
add esp, 4
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 8]
lea ebx, [esp + 8]
test al, al
je 0x1001524c
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
mov al, byte [ebx]
cmp al, 0x41
je 0x1001522e
cmp al, 0x61
je 0x1001522e
cmp al, 0x42
je 0x1001522e
cmp al, 0x62
je 0x1001522e
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x1001522e
movsx edx, byte [ebx]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x110]
push edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x218]
lea ecx, [esp + 0x114]
push eax
push str._s_c
push ecx
call ebp
lea edx, [esp + 0x120]
push 0x10030a68
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x18
test esi, esi
je 0x1001522e
push ebx
push esi
call fcn.10012670
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [ebx + 4]
add ebx, 4
test al, al
jne 0x100151ad
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
add esp, 0x308
ret
pop edi
mov eax, 1
pop ebx
add esp, 0x308
ret
Function at 0x10015260
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, dword [0x1003d094]
sub esp, 0x104
test eax, eax
jne 0x10015278
xor eax, eax
add esp, 0x104
ret
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [esp + 0x110]
mov ecx, 0x41
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [0x1003d094]
lea edx, [esp + 8]
push ecx
push edx
push 0x100303fc
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x18
test eax, eax
je 0x100152db
push esi
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret

Function at 0x10015320
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, dword [0x1003d098]
sub esp, 0x104
test eax, eax
jne 0x10015338
xor eax, eax
add esp, 0x104
ret
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [esp + 0x110]
mov ecx, 0x41
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [0x1003d098]
lea edx, [esp + 8]
push ecx
push edx
push 0x100303fc
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x18
test eax, eax
je 0x1001539b
push esi
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret

Function at 0x100153b0
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, dword [0x1003d09c]
sub esp, 0x104
test eax, eax
jne 0x100153c8
xor eax, eax
add esp, 0x104
ret
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [esp + 0x110]
mov ecx, 0x41
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [0x1003d09c]
lea edx, [esp + 8]
push ecx
push edx
push 0x100303fc
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0
push esi
call dword [sym.imp.MSVCRT.dll__access]
add esp, 0x18
test eax, eax
je 0x1001542b
push esi
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret