joyce8/EMBER2024-capa huggingface dataset:
Function at 0x703caba8
Capabilities:
Hash data using djb2

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x703cabf4
mov ecx, ebx
mov eax, 0x1505
mov dl, byte [ecx]
test esi, esi
jne 0x703cabcd
test dl, dl
jne 0x703cabdb
jmp 0x703cabf4
mov edi, ecx
sub edi, ebx
cmp esi, edi
jbe 0x703cabf4
cmp dl, 1
adc ecx, 0
cmp dl, 0x60
jbe 0x703cabe9
cmp dword [ebp + 0x10], 0
je 0x703cabe9
sub edx, 0x20
imul eax, eax, 0x21
movzx edx, dl
inc ecx
add eax, edx
jmp 0x703cabc1
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x703cabfc
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov eax, 0x1505
mov ebp, esp
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x703cac16
imul eax, eax, 0x21
add eax, edx
jmp 0x703cac07
pop ebp
ret

Function at 0x703cc43c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
push edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cl, byte [edx + esi*4]
mov byte [eax + esi*4], cl
mov cl, byte [edx + esi*4 + 1]
mov byte [eax + esi*4 + 1], cl
mov cl, byte [edx + esi*4 + 2]
mov byte [eax + esi*4 + 2], cl
mov cl, byte [edx + esi*4 + 3]
mov byte [eax + esi*4 + 3], cl
inc esi
cmp esi, 8
jne 0x703cc44b
mov dl, byte [eax + 0x1e]
mov edi, esi
movzx ebx, byte [eax + 0x1c]
movzx ecx, byte [eax + 0x1d]
mov byte [ebp - 0xd], dl
mov dl, byte [eax + 0x1f]
mov byte [ebp - 0xe], dl
and edi, 7
jne 0x703cc4c2
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ecx + str.cw]
mov bl, byte [ebx + str.cw]
mov cl, byte [edx + str.cw]
movzx edx, byte [ebp - 0xe]
mov byte [ebp - 0xe], bl
mov ebx, esi
mov dl, byte [edx + str.cw]
shr ebx, 3
mov byte [ebp - 0xd], dl
mov edx, edi
xor dl, byte [ebx + 0x703d6298]
mov ebx, edx
jmp 0x703cc4ed
cmp edi, 4
jne 0x703cc4ed
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ebp - 0xe]
mov bl, byte [ebx + str.cw]
mov cl, byte [ecx + str.cw]
mov dl, byte [edx + str.cw]
mov byte [ebp - 0xd], dl
mov dl, byte [edi + str.cw]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
xor dl, byte [eax + 2]
inc esi
add eax, 4
xor bl, byte [eax - 4]
xor cl, byte [eax - 3]
mov byte [eax + 0x1e], dl
mov dl, byte [ebp - 0xe]
xor dl, byte [eax - 1]
mov byte [eax + 0x1c], bl
mov byte [eax + 0x1d], cl
mov byte [eax + 0x1f], dl
cmp esi, 0x3c
jne 0x703cc46f
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x703cc934
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ebx, ebx
je 0x703cc95f
cmp dword [ebp + 0xc], 0
jne 0x703cc966
xor eax, eax
jmp 0x703cca3e
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add edx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
je 0x703cc95f
lea eax, [ebx + ecx]
mov dword [ebp - 0x40], edx
mov edi, dword [eax + esi*4]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
add edi, ebx
mov dword [ebp - 0x3c], ecx
mov dword [esp], edi
call fcn.703caba8
cmp eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
jne 0x703cca38
mov eax, dword [ebp - 0x34]
add esi, esi
add esi, ebx
movzx eax, word [esi + eax]
mov esi, dword [ebp - 0x30]
lea eax, [ebx + eax*4]
mov ecx, dword [eax + esi]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp ecx, edx
jae 0x703cc9e5
mov eax, dword [ebp - 0x24]
jmp 0x703cca3e
mov eax, dword [ebp - 0x2c]
add eax, ebx
add eax, edx
cmp ecx, eax
jae 0x703cc9e0
mov dword [esp], edi
call fcn.703d1820
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x20], ax
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x703d5418]
test eax, eax
je 0x703cc95f
lea edx, [ebp - 0x24]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], ebx
call eax
sub esp, 0x10
test eax, eax
jns 0x703cc9e0
jmp 0x703cc95f
inc esi
jmp 0x703cc98d
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x703d0cf8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
add ecx, dword [ecx + 0x3c]
movzx eax, word [ecx + 0x14]
lea eax, [ecx + eax + 0x18]
cmp dword [eax + 0x14], edx
ja 0x703d0d3e
movzx ecx, word [ecx + 6]
imul ecx, ecx, 0x28
add ecx, eax
cmp eax, ecx
je 0x703d0d3c
mov ebx, dword [eax + 0xc]
cmp edx, ebx
jb 0x703d0d37
mov esi, dword [eax + 0x10]
add esi, ebx
cmp esi, edx
jbe 0x703d0d37
add edx, dword [eax + 0x14]
sub edx, ebx
jmp 0x703d0d3e
add eax, 0x28
jmp 0x703d0d1c
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop ebp
ret
Function at 0x10001230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100258f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.sdcore.dat
lea eax, [ebp - 0x2c]
push 0x1002f5c0
xor ebx, ebx
push eax
mov dword [ebp - 0x30], ebx
call fcn.10001900
add esp, 0xc
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x10001289
lea eax, [ebp - 0x2c]
push 0x1002a468
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.10013c67
add esp, 0xc
test eax, eax
je 0x100012c2
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], edi
jb 0x100012b7
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10013b8f
add esp, 4
xor eax, eax
mov word [ebp - 0x2c], ax
jmp 0x10001346
mov edx, dword [0x10030634]
mov ecx, dword [0x10030630]
sub edx, ecx
sar edx, 4
xor esi, esi
test edx, edx
je 0x1000131c
xor edi, edi
jmp 0x100012e0
mov edx, dword [edi + ecx + 8]
or edx, dword [edi + ecx + 0xc]
lea eax, [edi + ecx]
je 0x10001304
mov ecx, dword [ebp - 0x30]
push ecx
push 1
push 0x10
push eax
call fcn.10014130
mov ecx, dword [0x10030630]
add esp, 0x10
mov edx, dword [0x10030634]
sub edx, ecx
inc esi
sar edx, 4
add edi, 0x10
cmp esi, edx
jb 0x100012e0
mov edi, 8
mov eax, dword [ebp - 0x30]
push eax
call fcn.10013f65
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], edi
jb 0x10001340
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10013b8f
add esp, 4
xor edx, edx
mov word [ebp - 0x2c], dx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10013b9a
mov esp, ebp
pop ebp
ret
Function at 0x100027d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100261cb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x1002e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.10017090
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.10014721
add esp, 8
test eax, eax
je 0x1000284a
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002853
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
mov esi, 0x1002f588
call fcn.10002660
push str.sdcore.log
lea edx, [ebp - 0x234]
push esi
push edx
call fcn.10001900
add esp, 0xc
mov dword [ebp - 4], 0
mov edi, eax
call fcn.100019e0
mov dword [ebp - 4], 0xffffffff
mov esi, 8
cmp dword [ebp - 0x220], esi
jb 0x100028b9
mov eax, dword [ebp - 0x234]
push eax
call fcn.10013b8f
add esp, 4
mov eax, dword [0x1002f588]
xor ecx, ecx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], cx
cmp dword [0x1002f59c], esi
jae 0x100028e8
mov eax, 0x1002f588
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10013b9a
mov esp, ebp
pop ebp
ret
Function at 0x10003000
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100254b4
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1002e080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
lea ebx, [esi + 0x94]
lea ecx, [ebx + 4]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x8c], edi
push ecx
mov dword [ebp + 0xc], ebx
mov dword [ebx], vtable.CCriticalBase.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], edi
mov dword [ebx], vtable.CCritical.0
mov dword [ebp - 4], 1
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov byte [ebp - 4], 2
mov eax, dword [0x10032010]
mov dword [esi + 0x18], edi
cmp eax, 0x64
ja 0x10003095
mov eax, 0x64
xor ecx, ecx
mov dword [esi + 0xc], eax
mov edx, 0xc
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10013b84
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 4
push edi
push edi
push edi
push edi
mov dword [esi + 8], eax
call ebx
push edi
push edi
push 1
push edi
mov dword [esi + 0x8c], eax
call ebx
mov ecx, dword [esi + 8]
mov dword [esi + 0x90], eax
mov eax, dword [esi + 0xc]
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
push eax
push edi
push ecx
call fcn.10017090
add esp, 0xc
cmp dword [ebp + 0x10], 1
jne 0x10003111
push edi
push 4
push esi
push 0x10003c20
push edi
push edi
call fcn.10014b8d
add esp, 0x18
push eax
mov dword [esi + 0x80], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003130
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025234
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1002e080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x80]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
cmp eax, 0x102
jne 0x10003195
mov edx, dword [esi + 0x80]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x100031a8
push eax
call fcn.10013b8f
add esp, 4
mov dword [esi + 8], ebx
mov eax, dword [esi + 0x8c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x90]
push ecx
call edi
mov byte [ebp - 4], bl
mov eax, dword [esi + 0xb0]
cmp eax, ebx
je 0x100031d6
push eax
call fcn.10013b8f
add esp, 4
or ecx, 0xffffffff
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [ebp - 4], ecx
lea eax, [esi + 0x94]
mov dword [ebp + 8], eax
mov dword [eax], vtable.CCritical.0
mov dword [ebp - 4], ecx
mov dword [eax], vtable.CCriticalBase.0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10003c40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x8c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
push eax
call edi
cmp eax, 0x102
jne 0x10003e02
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov ecx, ebx
sub ecx, dword [esi + 0x88]
mov dword [ebp - 4], ebx
cmp ecx, 0xbb8
jb 0x10003d0b
lea eax, [esi + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, esi
call fcn.100037d0
mov ecx, dword [esi + 0xb4]
mov edi, dword [esi + 0xb0]
cmp edi, ecx
je 0x10003ccc
mov eax, ecx
sub eax, ecx
sar eax, 2
lea ebx, [eax*4]
push ebx
push ecx
push edi
call fcn.100143c0
add esp, 0xc
add ebx, edi
mov dword [esi + 0xb4], ebx
mov ebx, dword [ebp - 4]
push 1
mov ecx, esi
call fcn.10003490
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x88], eax
lea eax, [esi + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esi + 0x90]
push edx
mov dword [esi + 0x84], 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x90]
push 0
push eax
call edi
test eax, eax
jne 0x10003de8
mov ecx, ebx
sub ecx, dword [esi + 0x88]
cmp ecx, 0xc8
jb 0x10003de8
mov dword [esi + 0x88], ebx
lea ebx, [esi + 0x98]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esi + 0xb4]
sub edx, dword [esi + 0xb0]
xor eax, eax
sar edx, 2
test edx, edx
je 0x10003dab
lea ebx, [ebx]
cmp dword [esi + 0x84], 0
je 0x10003d81
mov ecx, dword [esi + 0xb0]
mov ecx, dword [ecx + eax*4]
lea edx, [ecx + ecx*2]
mov ecx, dword [esi + 8]
or byte [ecx + edx*4], 0x80
lea ecx, [ecx + edx*4]
jmp 0x10003d97
mov edx, dword [esi + 0xb0]
mov ecx, dword [edx + eax*4]
mov edx, dword [esi + 8]
lea ecx, [ecx + ecx*2]
and byte [edx + ecx*4], 0x7f
lea ecx, [edx + ecx*4]
mov ecx, dword [esi + 0xb4]
sub ecx, dword [esi + 0xb0]
inc eax
sar ecx, 2
cmp eax, ecx
jb 0x10003d60
xor edx, edx
cmp dword [esi + 0x84], edx
sete dl
mov dword [esi + 0x84], edx
mov eax, dword [esi + 0xb4]
sub eax, dword [esi + 0xb0]
sar eax, 2
test eax, eax
je 0x10003de1
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
push ecx
mov ecx, dword [esi + 0xc]
call fcn.10012b30
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esi + 0x8c]
push 0x12c
push edx
call edi
cmp eax, 0x102
je 0x10003c65
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10005260
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1002e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [esi + 0x1c]
push ebx
push edi
mov edi, dword [esi + 0x18]
mov word [ebp - 0xc], ax
xor eax, eax
lea ecx, [ebp - 0x20]
push ecx
xor ebx, ebx
lea edx, [ebp - 0x18]
mov word [ebp - 6], ax
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov dword [esi + 0x248], ebx
mov dword [ebp - 0xa], 0x5c003a
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp edi, ebx
je 0x10005397
mov ecx, dword [esi + 0x228]
cmp ecx, ebx
je 0x10005397
call fcn.10003e10
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x228]
call fcn.10003e50
fld qword [edi + 0x60]
fld qword [0x1002a7b8]
mov dword [edi + 0x84], eax
fcomp st(1)
mov dword [esi + 0x248], 2
fnstsw ax
test ah, 0x41
jne 0x10005322
fstp st(0)
mov dword [esi + 0x248], ebx
mov eax, ebx
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013b9a
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x84]
cmp ecx, 0x19
jl 0x10005340
cmp ecx, 0x28
jl 0x10005340
fstp st(0)
mov dword [esi + 0x248], 5
jmp 0x10005397
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
shrd edx, eax, 1
shr eax, 1
cmp eax, dword [ebp - 0x1c]
ja 0x10005371
jb 0x10005358
cmp edx, dword [ebp - 0x20]
ja 0x10005371
fcomp qword [0x1002a7d0]
fnstsw ax
test ah, 5
jp 0x10005373
mov dword [esi + 0x248], 3
jmp 0x10005397
fstp st(0)
cmp dword [edi + 0x80], 0x19
jl 0x10005388
mov dword [esi + 0x248], 4
jmp 0x10005397
cmp ecx, 0x28
jl 0x10005397
mov dword [esi + 0x248], 6
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x248]
pop edi
xor ecx, ebp
pop ebx
call fcn.10013b9a
mov esp, ebp
pop ebp
ret
Function at 0x10006120
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
xor eax, eax
push ebx
push esi
mov ecx, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.10005de0
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea esi, [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
je 0x10006157
mov edx, dword [edi + 0x14]
mov ecx, esi
call fcn.10012c10
mov ecx, dword [ebp - 0xc]
test ecx, ecx
js 0x10006166
mov edx, dword [edi + 0x14]
call fcn.10012ba0
mov esi, dword [edi + 0x228]
lea eax, [ebx + 0x28]
push 1
push eax
call fcn.10003340
mov ecx, dword [ebx + 0x2c]
sub ecx, dword [ebx + 0x28]
xor eax, eax
sar ecx, 4
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x100062a1
mov dword [ebp - 4], eax
jmp 0x10006194
mov ebx, eax
mov eax, dword [ebp - 4]
add eax, dword [ebx + 0x28]
cmp dword [0x10032004], 0
mov esi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
jne 0x1000629e
cmp dword [section.sdcoredl], 0
je 0x100061d5
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [section.sdcoredl], 0
jne 0x100061c4
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x14]
push esi
push ebx
push eax
mov eax, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
push edi
call fcn.100062e0
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000629e
cmp dword [ebp + 0x18], eax
push esi
setne al
push ebx
inc eax
cdq
push edx
push eax
call fcn.1001ef00
add dword [edi + 0x530], eax
mov ecx, edi
adc dword [edi + 0x534], edx
call fcn.10005de0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [edi + 0xc]
cmp edx, 0x1f4
jb 0x10006246
mov dword [edi + 0xc], eax
test esi, esi
js 0x10006246
mov edx, dword [edi + 0x14]
mov ecx, esi
call fcn.10012ba0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov esi, dword [edi + 0x228]
push eax
push ecx
mov edx, ebx
call fcn.10003880
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [edi + 0x228]
push edx
push eax
mov edx, ebx
call fcn.10003820
add dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
adc dword [ebp - 0x14], eax
add dword [ebp + 0x10], ebx
adc dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x2c]
sub edx, dword [eax + 0x28]
add dword [ebp - 4], 0x10
inc ecx
sar edx, 4
mov dword [ebp - 0xc], ecx
cmp ecx, edx
jb 0x10006192
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [ebx + 4], eax
mov esi, dword [edi + 0x228]
push 0
lea eax, [ebx + 0x28]
push eax
call fcn.10003340
mov eax, dword [ebp - 8]
xor ecx, ecx
test eax, eax
setne cl
xor edx, edx
test eax, eax
sete dl
pop esi
lea ecx, [ecx + ecx + 2]
mov dword [ebx], ecx
pop ebx
mov eax, edx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100078e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025e68
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x1002e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push 0x24c
lea eax, [ebp - 0x2b4]
push esi
push eax
mov dword [ebp - 0x2b8], esi
call fcn.10017090
push 0x1002a544
lea ecx, [ebp - 0x48]
push edi
push ecx
call fcn.10001900
add esp, 0x18
mov dword [ebp - 4], esi
cmp dword [eax + 0x14], 8
jb 0x10007943
mov eax, dword [eax]
lea edx, [ebp - 0x2b8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x34], 8
jb 0x10007970
mov eax, dword [ebp - 0x48]
push eax
call fcn.10013b8f
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], cx
je 0x10007b04
cmp dword [0x10032004], esi
jne 0x10007af7
cmp dword [section.sdcoredl], esi
je 0x100079b1
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [section.sdcoredl], esi
jne 0x100079a1
test byte [ebp - 0x2b8], 0x10
je 0x10007aca
mov ecx, 0x1002a54c
lea eax, [ebp - 0x28c]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100079f6
cmp dx, si
je 0x100079f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100079f6
add eax, 4
add ecx, 4
cmp dx, si
jne 0x100079d0
xor eax, eax
jmp 0x100079fb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x10007adb
mov ecx, 0x1002a550
lea eax, [ebp - 0x28c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10007a36
cmp dx, si
je 0x10007a32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10007a36
add eax, 4
add ecx, 4
cmp dx, si
jne 0x10007a10
xor eax, eax
jmp 0x10007a3b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x10007adb
lea edx, [ebp - 0x28c]
push edx
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.10001900
mov dword [ebp - 4], 1
push 0x1002a558
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.100080e0
add esp, 0x18
mov byte [ebp - 4], 2
push eax
mov ecx, ebx
call fcn.10007bc0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
jb 0x10007a8f
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10013b8f
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x50], 8
jb 0x10007ab8
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.10013b8f
add esp, 4
xor edx, edx
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], esi
mov word [ebp - 0x64], dx
jmp 0x10007adb
mov eax, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
push edi
call edx
mov ecx, dword [ebp - 0x2bc]
lea eax, [ebp - 0x2b8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000798d
mov edx, dword [ebp - 0x2bc]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10013b9a
mov esp, ebp
pop ebp
ret