joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f1bc566
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6fc55018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6fc55018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6f1bc5fa
jmp 0x6f1bc66e
jmp 0x6f1bc6e2
jmp 0x6f1bc756
jmp 0x6f1bc7ca
jmp 0x6f1bc83e
jmp 0x6f1bc8b2
jmp 0x6f1bc926
jmp 0x6f1bc99a
jmp 0x6f1bca0e
jmp 0x6f1bca82
jmp 0x6f1bcaf6
jmp 0x6f1bcb6a
jmp 0x6f1bcbde
jmp 0x6f1bcc52
jmp 0x6f1bccc6
jmp 0x6f1bcd3a
jmp 0x6f1bcdae
jmp 0x6f1bce22
jmp 0x6f1bce96
jmp 0x6f1bcf0a
jmp 0x6f1bcf7e
jmp 0x6f1bcff2
jmp 0x6f1bd066
jmp 0x6f1bd0da
jmp 0x6f1bd14e
jmp 0x6f1bd1c2
jmp 0x6f1bd236
jmp 0x6f1bd2aa
jmp 0x6f1bd31e
jmp 0x6f1bd392
mov dword [ebp - 0x14], 0
jmp 0x6f1bd40d
jmp 0x6f1bd481
jmp 0x6f1bd4f5
jmp 0x6f1bd569
jmp 0x6f1bd5dd
jmp 0x6f1bd651
jmp 0x6f1bd6c5
jmp 0x6f1bd739
jmp 0x6f1bd7ad
jmp 0x6f1bd821
jmp 0x6f1bd895
jmp 0x6f1bd909
jmp 0x6f1bd97d
jmp 0x6f1bd9f1
jmp 0x6f1bda65
jmp 0x6f1bdad9
jmp 0x6f1bdb4d
jmp 0x6f1bdbc1
jmp 0x6f1bdc35
jmp 0x6f1bdca9
jmp 0x6f1bdd1d
jmp 0x6f1bdd91
jmp 0x6f1bde05
jmp 0x6f1bde79
jmp 0x6f1bdeed
jmp 0x6f1bdf61
jmp 0x6f1bdfd5
jmp 0x6f1be049
jmp 0x6f1be0bd
jmp 0x6f1be131
jmp 0x6f1be1a5
mov dword [ebp - 0x18], 0
jmp 0x6f1be220
jmp 0x6f1be294
jmp 0x6f1be308
jmp 0x6f1be37c
jmp 0x6f1be3f0
jmp 0x6f1be464
jmp 0x6f1be4d8
jmp 0x6f1be54c
jmp 0x6f1be5c0
jmp 0x6f1be634
jmp 0x6f1be6a8
jmp 0x6f1be71c
jmp 0x6f1be790
jmp 0x6f1be804
jmp 0x6f1be878
jmp 0x6f1be8ec
jmp 0x6f1be960
jmp 0x6f1be9d4
jmp 0x6f1bea48
jmp 0x6f1beabc
jmp 0x6f1beb30
jmp 0x6f1beba4
jmp 0x6f1bec18
jmp 0x6f1bec8c
jmp 0x6f1bed00
jmp 0x6f1bed74
jmp 0x6f1bede8
jmp 0x6f1bee5c
jmp 0x6f1beed0
jmp 0x6f1bef44
jmp 0x6f1befb8
mov dword [ebp - 0x10], 0
jmp 0x6f1bf033
jmp 0x6f1bf0a7
jmp 0x6f1bf11b
jmp 0x6f1bf18f
jmp 0x6f1bf203
jmp 0x6f1bf277
jmp 0x6f1bf2eb
jmp 0x6f1bf35f
jmp 0x6f1bf3d3
jmp 0x6f1bf447
jmp 0x6f1bf4bb
jmp 0x6f1bf52f
jmp 0x6f1bf5a3
jmp 0x6f1bf617
jmp 0x6f1bf68b
jmp 0x6f1bf6ff
jmp 0x6f1bf773
jmp 0x6f1bf7e7
jmp 0x6f1bf85b
jmp 0x6f1bf8cf
jmp 0x6f1bf943
jmp 0x6f1bf9b7
jmp 0x6f1bfa2b
jmp 0x6f1bfa9f
jmp 0x6f1bfb13
jmp 0x6f1bfb87
jmp 0x6f1bfbfb
jmp 0x6f1bfc6f
jmp 0x6f1bfce3
jmp 0x6f1bfd57
jmp 0x6f1bfdcb
mov dword [ebp - 0x10], 0
jmp 0x6f1c445b
jmp 0x6f1bfe4b
jmp 0x6f1bfebf
jmp fcn.6f1bff33
mov eax, dword [0x6fc55018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6f1bfdd7
nop
leave
ret
Function at 0x10001100
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
mov esi, eax
lea edi, [esi + 0x10]
lea eax, [edi + 0xdc]
push eax
push 0
push edi
push 0x100095b0
push 0
push 0
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xd8], eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi], 0
jne 0x1000113d
call fcn.10001080
mov ecx, esi
call fcn.10001160
cmp dword [esi], 0
jne 0x10001152
push 0x2710
call edi
jmp 0x10001133
push 0x1388
call edi
jmp 0x10001133
Function at 0x10001b40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x100fc57b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x224], eax
push ebp
push esi
push edi
mov eax, dword [0x10143328]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [esp + 0x248]
mov ecx, 0xe
mov esi, str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x104
lea ecx, [esp + 0x30]
push ecx
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x2c]
push 0x5c
push edx
call fcn.1000f3aa
add esp, 8
xor ebp, ebp
mov word [eax + 2], bp
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x10001bc0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x30]
lea edi, [ebx + 0x104]
push eax
mov esi, edi
call fcn.100019d0
push edi
lea esi, [esp + 0x14]
call fcn.10002110
add esp, 4
push 0xffffffffffffffff
push ebp
lea ecx, [ebx + 0x120]
mov dword [esp + 0x248], ebp
call fcn.100015f0
mov esi, 8
mov dword [esp + 0x240], 0xffffffff
cmp dword [esp + 0x28], esi
jb 0x10001c27
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1000f3a5
add esp, 4
mov ecx, ebx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebp
mov word [esp + 0x14], bp
call fcn.10001c90
cmp dword [edi + 0x18], esi
jb 0x10001c49
mov edi, dword [edi + 4]
jmp 0x10001c4c
add edi, 4
push edi
push str.m_strConfigPath_path___s
call fcn.10006930
add esp, 8
mov eax, 1
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.1000efa1
add esp, 0x234
ret 4

Function at 0x10001c90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, ecx
cmp dword [esi + 0x138], 8
jb 0x10001cb8
mov eax, dword [esi + 0x124]
jmp 0x10001cbe
lea eax, [esi + 0x124]
push eax
push 0x104
lea eax, [esp + 0xc]
push eax
push str.SCWordSvcHost.exe
push str.SvcHost
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001ce5
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 8]
push ecx
add esi, 0x13c
call fcn.100019d0
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.1000efa1
add esp, 0x20c
ret
Function at 0x10001d20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x414
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
cmp dword [eax + 0x11c], 8
push esi
mov esi, ecx
jb 0x10001d4f
mov eax, dword [eax + 0x108]
jmp 0x10001d54
add eax, 0x108
push str.SCSvcInfo.ini
push eax
lea eax, [esp + 0x214]
push str._s_s
push eax
call fcn.1000f0cb
push 0x206
lea ecx, [esp + 0x1a]
push 0
push ecx
mov word [esp + 0x20], 0
call fcn.10015360
add esp, 0x1c
lea edx, [esp + 0x20c]
push edx
push 0x104
lea eax, [esp + 0xc]
push eax
push str.null
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, str.null
lea eax, [esp + 4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001ddd
test dx, dx
je 0x10001dd9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001ddd
add eax, 4
add ecx, 4
test dx, dx
jne 0x10001db7
xor eax, eax
jmp 0x10001de2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001e00
xor al, al
pop esi
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.1000efa1
add esp, 0x414
ret 4
lea eax, [esp + 4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001e07
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 8]
push ecx
call fcn.100019d0
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
mov al, 1
call fcn.1000efa1
add esp, 0x414
ret 4

Function at 0x10001f90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x16]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x18], ebx
mov word [esp + 0x1c], bx
call fcn.10015360
add esp, 0xc
cmp dword [edi + 0x138], 8
jb 0x10001fda
mov edi, dword [edi + 0x124]
jmp 0x10001fe0
add edi, 0x124
push edi
push 0x104
lea ecx, [esp + 0x18]
push ecx
push 0x1013cc94
push str.InstallDay
push str.main
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x10]
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], bx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10002015
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x14]
push edx
call fcn.100019d0
mov ecx, dword [esp + 0x218]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1000efa1
add esp, 0x210
ret
Function at 0x10002110
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x100fc1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x10143328]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.100015f0
mov eax, str.SCSvcInfo.ini
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10002167
sub eax, edx
sar eax, 1
push eax
push str.SCSvcInfo.ini
lea ecx, [esp + 0x14]
call fcn.100021d0
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.100015f0
cmp dword [esp + 0x24], 8
jb 0x100021b1
mov eax, dword [esp + 0x10]
push eax
call fcn.1000f3a5
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x10002ea0
Capabilities:
Create thread

Disassembly:
sub esp, 0x23c
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x238], eax
push esi
mov esi, dword [esp + 0x248]
push str.ServersDll_ServiceMain
call fcn.10006b90
mov eax, dword [esi]
push 0x100
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.1000f431
add esp, 0x10
push 0x100034a0
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
xor esi, esi
cmp eax, esi
mov dword [0x10150138], eax
jne 0x10002f1b
push str.SvcHostDLL_RegisterServiceCtrlHandler_failed
call fcn.10006930
add esp, 4
pop esi
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.1000efa1
add esp, 0x23c
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, dword [0x10150138]
mov edi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, 2
mov dword [0x1015013c], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x2c], 0x10
mov dword [esp + 0x34], 7
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 1
mov dword [esp + 0x44], 0xbb8
call edi
mov eax, 4
lea edx, [esp + 8]
mov dword [0x1015013c], eax
mov dword [esp + 0xc], eax
mov eax, dword [0x10150138]
push edx
push eax
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x18], 7
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0xbb8
call edi
push esi
push esi
push esi
push 0x10003580
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x240]
pop edi
pop esi
xor ecx, esp
call fcn.1000efa1
add esp, 0x23c
ret 8

Function at 0x10003030
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp]
cmp ax, 9
je 0x10003053
cmp ax, 6
je 0x10003053
xor eax, eax
add esp, 0x24
ret
mov eax, 1
add esp, 0x24
ret
Function at 0x100033a0
Capabilities:
Delete service
Query service status

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x100033c4
pop edi
xor al, al
pop esi
add esp, 0x1c
ret
cmp dword [esi + 0x18], 8
jb 0x100033cf
mov eax, dword [esi + 4]
jmp 0x100033d2
lea eax, [esi + 4]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x100033bc
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x100033bc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test eax, eax
je 0x100033bc
push edi
call esi
pop edi
mov al, 1
pop esi
add esp, 0x1c
ret

Function at 0x10003420
Capabilities:
Query service status
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x10003444
pop edi
xor al, al
pop esi
add esp, 0x1c
ret
cmp dword [esi + 0x18], 8
jb 0x1000344f
mov eax, dword [esi + 4]
jmp 0x10003452
lea eax, [esi + 4]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1000343c
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0xc], 1
je 0x10003486
lea ecx, [esp + 8]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov al, 1
pop esi
add esp, 0x1c
ret
Function at 0x100035f0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x38]
xor ebp, ebp
mov eax, edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x10003620
sub eax, edx
sar eax, 1
push eax
push edi
lea esi, [esp + 0x1c]
call fcn.100019d0
mov eax, esi
call fcn.10003420
test al, al
sete bl
cmp dword [esp + 0x2c], 8
jb 0x1000365a
mov eax, dword [esp + 0x18]
push eax
call fcn.1000f3a5
add esp, 4
test bl, bl
je 0x10003675
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1000efa1
add esp, 0x24
ret 4
mov eax, edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
lea edx, [eax + 2]
jmp 0x10003690
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x10003690
sub eax, edx
sar eax, 1
push eax
push edi
lea esi, [esp + 0x1c]
call fcn.100019d0
mov eax, esi
call fcn.100033a0
test al, al
mov esi, 8
sete bl
cmp dword [esp + 0x2c], esi
jb 0x100036ce
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1000f3a5
add esp, 4
test bl, bl
jne 0x1000365e
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebp
push str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionSvchost
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10003737
mov edx, str.LocalWorkSvc
lea eax, [esp + 0x14]
call fcn.100013d0
cmp dword [esp + 0x2c], esi
mov eax, dword [esp + 0x18]
jae 0x1000370d
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x2c], esi
jb 0x10003737
mov edx, dword [esp + 0x18]
push edx
call fcn.1000f3a5
add esp, 4
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1000efa1
add esp, 0x24
ret 4

Function at 0x100039e0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10003580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret
Function at 0x10004030
Capabilities:
Check if file exists
Create directory

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004040
sub eax, edx
sar eax, 1
mov ebp, eax
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000e2be
mov esi, eax
mov edx, esi
add esp, 4
mov eax, edi
sub edx, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10004075
xor edi, edi
test ebp, ebp
mov byte [esp + 0xf], 1
jl 0x100040dd
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp word [esi + edi*2], 0x5c
jne 0x100040bc
push esi
mov word [esi + edi*2], 0
call ebx
test eax, eax
jne 0x100040b6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100040d7
mov word [esi + edi*2], 0x5c
add edi, 1
cmp edi, ebp
jle 0x10004096
pop ebx
push esi
call fcn.1000f416
movzx eax, byte [esp + 0x13]
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
ret
mov byte [esp + 0x13], 0
pop ebx
push esi
call fcn.1000f416
movzx eax, byte [esp + 0x13]
add esp, 4
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x10004550
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x100fc086
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10143328]
xor eax, esp
push eax
lea eax, [esp + 0x280]
mov dword fs:[0], eax
xor edi, edi
cmp edx, edi
je 0x10004717
mov eax, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
lea esi, [eax + 2]
jmp 0x100045b0
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100045b0
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x1c]
call fcn.100019d0
mov ebx, esi
mov dword [esp + 0x288], edi
call fcn.10004a40
xor esi, esi
push 0x228
lea eax, [esp + 0x54]
push esi
push eax
mov dword [esp + 0x58], esi
call fcn.10015360
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10004615
cmp dword [esp + 0x2c], 8
jb 0x10004717
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x1000470f
lea edx, [esp + 0x4c]
push edx
push ebp
mov dword [esp + 0x54], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x100046f8
lea eax, [esp + 0x70]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], esi
mov word [esp + 0x34], si
lea edx, [eax + 2]
jmp 0x10004650
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x10004650
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x74]
push eax
lea esi, [esp + 0x38]
call fcn.100019d0
mov ebx, esi
mov byte [esp + 0x288], 1
call fcn.10004a40
mov eax, dword [esp + 0x18]
mov esi, 8
cmp dword [esp + 0x2c], esi
jae 0x10004690
lea eax, [esp + 0x18]
mov edi, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x34]
call fcn.100014c0
test eax, eax
je 0x100046d7
mov byte [esp + 0x288], 0
cmp dword [esp + 0x48], esi
jb 0x100046c1
mov ecx, dword [esp + 0x34]
push ecx
call fcn.1000f3a5
add esp, 4
lea edx, [esp + 0x4c]
push edx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x100046fd
xor esi, esi
jmp 0x10004630
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x54]
lea ecx, [esp + 0x30]
call fcn.10001a70
lea ecx, [esp + 0x14]
call fcn.10001a70
mov eax, esi
jmp 0x10004719
mov esi, 8
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x2c], esi
jb 0x10004717
mov eax, dword [esp + 0x18]
push eax
call fcn.1000f3a5
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x280]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.1000efa1
add esp, 0x278
ret
Function at 0x10004c40
Capabilities:
Check if file exists
Write file on windows

Disassembly:
sub esp, 0x82c
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x426]
push ebx
push eax
mov word [esp + 0x42c], bx
call fcn.10015360
add esp, 0xc
xor eax, eax
jmp 0x10004c80
movzx ecx, word [eax + 0x1013ddb0]
mov word [esp + eax + 0x420], cx
add eax, 2
cmp cx, bx
jne 0x10004c80
lea ecx, [esp + 0x420]
push ecx
push str._sgswb.log
lea edx, [esp + 0x220]
call fcn.10005e70
push 0x206
lea edx, [esp + 0x636]
push ebx
push edx
mov word [esp + 0x63c], bx
call fcn.10015360
push 0x206
lea eax, [esp + 0x2a]
push ebx
push eax
mov word [esp + 0x30], bx
call fcn.10015360
add esp, 0x20
push 0x104
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.1000f3aa
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov word [eax], bx
add esp, 8
lea eax, [esp + 0x218]
push eax
call esi
test eax, eax
je 0x10004e4d
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10004d25
sub eax, edx
sar eax, 1
lea eax, [esp + eax*2 + 0x12]
lea edx, [esp + 0x628]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x10004d41
push edi
lea ecx, [esp + 0x62c]
push ecx
lea edx, [esp + 0x428]
push edx
push str._s_s.txt
lea edx, [esp + 0x228]
call fcn.10005e70
mov ecx, dword [esp + 0x848]
lea eax, [esp + 0x84c]
push eax
push ecx
push 0xfff
push 0x10150390
call fcn.100119ef
add esp, 0x1c
lea edx, [esp + 0x21c]
push edx
mov word [0x1015238e], bx
xor edi, edi
call esi
test eax, eax
je 0x10004db0
mov edi, 1
lea eax, [esp + 0x21c]
push 0x1013ddec
push eax
call fcn.10011b7e
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x10004e4c
cmp edi, ebx
jne 0x10004ded
push esi
push 2
lea ecx, [esp + 0x18]
push 1
push ecx
mov dword [esp + 0x20], 0xfeff
call fcn.1000f7fa
add esp, 0x10
mov eax, 0x10150390
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10004df5
sub eax, edx
sar eax, 1
push esi
lea edx, [eax + eax]
push edx
push 1
push 0x10150390
call fcn.1000f7fa
push esi
push 2
lea eax, [esp + 0x24]
push 1
push eax
mov dword [esp + 0x2c], 0xd
call fcn.1000f7fa
push esi
push 2
lea ecx, [esp + 0x34]
push 1
push ecx
mov dword [esp + 0x3c], 0xa
call fcn.1000f7fa
push esi
call fcn.1000f8ee
add esp, 0x34
pop edi
mov ecx, dword [esp + 0x830]
pop esi
pop ebx
xor ecx, esp
call fcn.1000efa1
add esp, 0x82c
ret
Function at 0x10006930
Capabilities:
Check if file exists
Write file on windows

Disassembly:
sub esp, 0xc14
mov eax, dword [0x10143328]
xor eax, esp
mov dword [esp + 0xc10], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x21e]
push ebx
push eax
mov word [esp + 0x224], bx
call fcn.10015360
add esp, 0xc
xor eax, eax
jmp 0x10006970
movzx ecx, word [eax + 0x1013ddb0]
mov word [esp + eax + 0x218], cx
add eax, 2
cmp cx, bx
jne 0x10006970
push 0x206
lea ecx, [esp + 0x62e]
push ebx
push ecx
mov word [esp + 0x634], bx
call fcn.10015360
push 0x206
lea edx, [esp + 0x22]
push ebx
push edx
mov word [esp + 0x28], bx
call fcn.10015360
add esp, 0x18
push 0x104
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call fcn.1000f3aa
push 0x3e6
lea edx, [esp + 0x83e]
push ebx
mov word [eax], bx
push edx
mov word [esp + 0x844], bx
call fcn.10015360
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x438]
push str._sgswb.log
push ecx
call fcn.1000f0cb
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
lea edx, [esp + 0x420]
push edx
call esi
test eax, eax
je 0x10006b6a
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10006a31
sub eax, edx
sar eax, 1
lea eax, [esp + eax*2 + 0x12]
lea edx, [esp + 0x628]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x10006a50
push edi
lea eax, [esp + 0x62c]
push eax
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x42c]
push str._s_s.txt
push edx
call fcn.1000f0cb
mov ecx, dword [esp + 0xc34]
lea eax, [esp + 0xc38]
push eax
push ecx
lea edx, [esp + 0x84c]
push 0x1f3
push edx
call fcn.100119ef
add esp, 0x20
lea eax, [esp + 0x424]
push eax
mov word [esp + 0xc1e], bx
xor edi, edi
call esi
test eax, eax
je 0x10006ac4
mov edi, 1
lea ecx, [esp + 0x424]
push 0x1013ddec
push ecx
call fcn.10011b7e
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x10006b69
cmp edi, ebx
jne 0x10006b01
push esi
push 2
lea edx, [esp + 0x18]
push 1
push edx
mov dword [esp + 0x20], 0xfeff
call fcn.1000f7fa
add esp, 0x10
lea eax, [esp + 0x834]
lea edx, [eax + 2]
jmp 0x10006b10
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10006b10
sub eax, edx
sar eax, 1
push esi
add eax, eax
push eax
lea ecx, [esp + 0x83c]
push 1
push ecx
call fcn.1000f7fa
push esi
push 2
lea edx, [esp + 0x24]
push 1
push edx
mov dword [esp + 0x2c], 0xd
call fcn.1000f7fa
push esi
push 2
lea eax, [esp + 0x34]
push 1
push eax
mov dword [esp + 0x3c], 0xa
call fcn.1000f7fa
push esi
call fcn.1000f8ee
add esp, 0x34
pop edi
mov ecx, dword [esp + 0xc18]
pop esi
pop ebx
xor ecx, esp
call fcn.1000efa1
add esp, 0xc14
ret