joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10054c88
Capabilities:
Print debug messages

Disassembly:
push 0x58
mov eax, 0x100c1376
call fcn.10078edd
xor esi, esi
cmp dword [ebx + 0x70], esi
je 0x10054ca2
xor eax, eax
jmp 0x10054dee
mov eax, ebx
call fcn.10053a20
cmp byte [ebp + 8], 0
jne 0x10054cc8
lea eax, [ebx + 0x84]
mov ecx, dword [eax]
cmp ecx, 1
ja 0x10054cc8
inc ecx
mov dword [eax], ecx
mov ecx, ebx
call fcn.10053826
jmp 0x10054cd5
mov edi, ebx
call fcn.100553b6
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x18], eax
push dword [ebx + 0x88]
mov eax, ebx
call fcn.1005494f
push dword [ebx + 0x8c]
mov eax, ebx
call fcn.10054a0c
cmp dword [ebx + 0x98], esi
je 0x10054d05
lea eax, [ebx + 0x9c]
push eax
mov eax, ebx
call fcn.10054b96
cmp dword [ebx + 0x90], esi
je 0x10054d1a
push dword [ebx + 0x94]
mov eax, ebx
call fcn.10054aca
push 0x100d73b4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x2c]
lea ecx, [ebx + 0x11e8]
push eax
call fcn.10055a46
lea edi, [ebx + 0x11f4]
mov dword [ebp - 4], esi
call fcn.10052d02
mov eax, dword [ebp - 0x28]
mov esi, dword [eax]
lea ecx, [ebp - 0x18]
call fcn.10021fb0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.10021fb0
cmp dword [ebp - 0x18], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
je 0x10054d77
cmp dword [ebp - 0x18], eax
je 0x10054d7c
call fcn.10070ccd
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
je 0x10054dd4
lea esi, [ebp - 0x18]
call fcn.100524b6
push dword [eax]
push 0
call fcn.100524b6
add eax, 4
push eax
push ebx
call fcn.10053ae2
test eax, eax
jne 0x10054dca
push 0x38
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.10073a50
or dword [ebp - 0x64], 0xffffffff
add esp, 0xc
call fcn.100524b6
push dword [eax]
mov ecx, dword [ebx + 0x7c]
push 0x59
lea edx, [ebp - 0x64]
call fcn.10051234
lea esi, [ebp - 0x18]
call fcn.100569f9
jmp 0x10054d58
push str.ReloadDownloadtask_end
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
call fcn.10056724
xor eax, eax
inc eax
call fcn.10078f7c
ret 4
Function at 0x1005767e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x2f0
mov eax, dword [0x100ea3e0]
xor eax, ebp
mov dword [ebp + 0x64], eax
push esi
push edi
lea esi, [ebp + 0x70]
lea edi, [ebp - 0x27c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x64
xor edi, edi
lea eax, [ebp - 0x64]
push edi
push eax
call fcn.10073a50
movzx eax, byte [ebp - 0x270]
movzx ecx, byte [ebp - 0x26f]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x26e]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x26d]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x271]
push eax
movzx eax, byte [ebp - 0x272]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 0x273]
push eax
movzx eax, byte [ebp - 0x274]
shl eax, 8
or eax, ecx
push eax
movzx eax, word [ebp - 0x276]
push eax
movzx eax, word [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
lea eax, [ebp - 0x64]
push str._X__X__X__X__X_X
push eax
call fcn.1007537b
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x26c]
push str.CLSID_sLocalServer32
push eax
call fcn.1007537b
add esp, 0x38
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x26c]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x10057761
xor eax, eax
jmp 0x100577a5
lea eax, [ebp - 0x288]
push eax
push ebx
lea eax, [ebp - 0x284]
push eax
push edi
push edi
push dword [ebp - 0x280]
xor esi, esi
inc esi
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x288], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10057797
xor esi, esi
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp + 0x64]
pop edi
xor ecx, ebp
pop esi
call fcn.10070dd1
add ebp, 0x68
leave
ret
Function at 0x10057b40
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x100bfe83
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100ea3e0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, 0x10106444
mov ebx, 0x10101e64
mov dword [esp + 0x14], 3
xor ebp, ebp
jmp 0x10057b80
push 0x44
call fcn.10070b17
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebp
mov dword [esp + 0x3c], ebp
je 0x10057bab
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx - 4]
push edx
push ecx
push eax
call fcn.10058580
mov edi, eax
jmp 0x10057bad
xor edi, edi
mov dword [esp + 0x3c], 0xffffffff
mov ecx, dword [esi]
cmp edi, ecx
je 0x10057bc9
cmp ecx, ebp
je 0x10057bc7
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi], edi
mov ecx, dword [esi]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], ebp
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea eax, [esp + 0x20]
push eax
call edx
test al, al
je 0x10057c39
mov eax, dword [esi]
lea ecx, [esp + 0x18]
call fcn.100578e0
mov dword [esp + 0x3c], 1
mov edi, dword [eax]
cmp edi, ebp
je 0x10057c14
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x10057c23
lea ecx, [eax + 4]
call fcn.100353e9
lea ecx, [esp + 0x18]
mov dword [esi + 0x10], edi
mov dword [esp + 0x3c], 0xffffffff
call fcn.10035338
jmp 0x10057c48
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
add ebx, 0xc
add esi, 4
sub dword [esp + 0x14], 1
jne 0x10057b80
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x10058b30
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
push edi
mov edi, 0x10106138
push 0x10106460
call ebx
mov esi, dword [edi]
test esi, esi
je 0x10058b68
cmp dword [esi + 0x14], 0
je 0x10058b68
push 0x10106460
call ebp
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
sub edi, 4
cmp edi, 0x1010612c
jne 0x10058b45
mov eax, dword [0x10106254]
test eax, eax
jne 0x10058bad
push 8
call fcn.10070b17
mov esi, eax
add esp, 4
test esi, esi
je 0x10058ba6
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
mov eax, esi
jmp 0x10058ba8
xor eax, eax
mov dword [0x10106254], eax
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
je 0x10058bc6
mov dword [eax + 0x68], 1
mov al, 1
ret
Function at 0x10058cc0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100bf21d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100ea3e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor edi, edi
mov dword [esi], vtable.qmbase::MessageLoop.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esp + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea eax, [esi + 0x2c]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov byte [esp + 0x20], 5
mov eax, dword [0x10106254]
cmp eax, edi
mov ebx, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 0x88], edi
jne 0x10058d8d
push 8
call fcn.10070b17
mov ebp, eax
add esp, 4
cmp ebp, edi
je 0x10058d86
mov dword [ebp], edi
mov dword [ebp + 4], 0xffffffff
call ebx
mov dword [ebp + 4], eax
mov eax, ebp
jmp 0x10058d88
xor eax, eax
mov dword [0x10106254], eax
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [0x10106254]
cmp eax, edi
jne 0x10058dc7
push 8
call fcn.10070b17
mov ebp, eax
add esp, 4
cmp ebp, edi
je 0x10058dc0
mov dword [ebp], edi
mov dword [ebp + 4], 0xffffffff
call ebx
mov dword [ebp + 4], eax
mov eax, ebp
jmp 0x10058dc2
xor eax, eax
mov dword [0x10106254], eax
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x10058dd7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0x24
call fcn.10070b17
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, edi
mov byte [esp + 0x20], 6
je 0x10058df8
push eax
call fcn.1005b830
mov ebp, eax
jmp 0x10058dfa
xor ebp, ebp
cmp ebp, edi
mov byte [esp + 0x20], 5
je 0x10058e0d
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esi + 0x70]
cmp eax, edi
je 0x10058e1c
lea ecx, [eax + 4]
call fcn.100353e9
mov eax, esi
mov dword [esi + 0x70], ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x10058ea0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x100c0ae2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100ea3e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
mov dword [edi], vtable.qmbase::MessageLoop.0
mov dword [esp + 0x20], 5
xor ebp, ebp
jmp 0x10058ee0
push edi
call fcn.100590b0
mov esi, edi
call fcn.10059720
push edi
call fcn.100590b0
test al, al
je 0x10058eff
add ebp, 1
cmp ebp, 0x64
jl 0x10058ee0
cmp dword [edi + 0x70], 0
lea ebx, [edi + 0x70]
je 0x10058f2c
mov ecx, ebx
call fcn.100212fb
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
mov eax, dword [ebx]
test eax, eax
je 0x10058f26
lea ecx, [eax + 4]
call fcn.100353e9
mov dword [ebx], 0
mov eax, dword [0x10106254]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_TlsAlloc]
jne 0x10058f68
push 8
call fcn.10070b17
mov esi, eax
add esp, 4
test esi, esi
je 0x10058f61
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call ebp
mov dword [esi + 4], eax
mov eax, esi
jmp 0x10058f63
xor eax, eax
mov dword [0x10106254], eax
mov ecx, dword [eax + 4]
cmp ecx, 0xffffffff
je 0x10058f7e
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x10106254]
test eax, eax
jne 0x10058faf
push 8
call fcn.10070b17
mov esi, eax
add esp, 4
test esi, esi
je 0x10058fa8
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call ebp
mov dword [esi + 4], eax
mov eax, esi
jmp 0x10058faa
xor eax, eax
mov dword [0x10106254], eax
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
xor ebp, ebp
test eax, eax
jne 0x10058fe7
cmp esi, ebp
je 0x10058fe1
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10058fd8
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [esi + 4], 0xffffffff
push esi
call fcn.10070de0
add esp, 4
mov dword [0x10106254], ebp
lea esi, [edi + 0x74]
call fcn.1005a910
mov ecx, ebx
mov byte [esp + 0x20], 3
call fcn.10035338
mov eax, dword [edi + 0x48]
cmp eax, ebp
je 0x1005900b
push eax
call fcn.10070de0
add esp, 4
lea ecx, [edi + 0x2c]
push ecx
mov dword [edi + 0x48], ebp
mov dword [edi + 0x4c], ebp
mov dword [edi + 0x50], ebp
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea esi, [edi + 0x18]
call fcn.1005a910
lea esi, [edi + 4]
call fcn.1005a910
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10059050
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push esi
mov esi, dword [0x10106254]
test esi, esi
jne 0x1005909b
push 8
call fcn.10070b17
mov esi, eax
add esp, 4
test esi, esi
je 0x10059093
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
push eax
mov dword [0x10106254], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
ret
xor esi, esi
mov dword [0x10106254], esi
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
ret
Function at 0x1005ba6e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x100d7958
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1005ba97
xor eax, eax
leave
ret
push esi
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret
Function at 0x1005bd4e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100ea3e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
test byte [0x10106880], 1
push esi
mov esi, 0x1010687c
jne 0x1005bd90
or dword [0x10106880], 1
mov ecx, esi
call fcn.10003dd8
push 0x100c2a8c
call fcn.1007133b
pop ecx
mov ecx, esi
call fcn.100308ac
test al, al
je 0x1005bdda
and word [ebp - 0x210], 0
push 0x20a
lea eax, [ebp - 0x20e]
push 0
push eax
call fcn.10073a50
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.10003ea0
push esi
mov ecx, ebx
call fcn.10003df2
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.10070dd1
leave
ret
Function at 0x1005f858
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, edx
jne 0x1005f863
xor eax, eax
pop esi
ret
cmp eax, 8
push ebx
not esi
mov edx, 0xff
jb 0x1005f915
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
sub eax, 8
dec edi
jne 0x1005f87a
pop edi
test eax, eax
je 0x1005f92e
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x100cb340]
inc ecx
dec eax
jne 0x1005f919
mov eax, esi
pop ebx
not eax
pop esi
ret

Function at 0x1005f935
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x100cb340]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x100cb340]
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x10060069
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x10060099
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10060094
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x100600d1
xor eax, eax
mov ecx, edi
add ecx, dword [esi + 0x28]
adc eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x24]
jl 0x100600b5
jg 0x100600af
cmp ecx, dword [esi + 0x20]
jbe 0x100600b5
mov edi, dword [esi + 0x20]
sub edi, dword [esi + 0x28]
mov eax, dword [esi + 0x1c]
add eax, dword [esi + 0x28]
push edi
push eax
push dword [ebp + 8]
call fcn.10073ad0
add esp, 0xc
add dword [esi + 0x28], edi
mov eax, edi
adc dword [esi + 0x2c], 0
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x100601b9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push edi
mov edi, eax
xor eax, eax
cmp edi, eax
mov esi, ecx
je 0x10060247
push 2
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
neg eax
push eax
push dword [esi + 4]
call ebx
and dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10060213
or eax, 0xffffffff
jmp 0x10060330
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
push edx
push eax
xor ecx, ecx
mov eax, esi
call fcn.1005ffcd
test eax, eax
pop ecx
pop ecx
jne 0x1006020b
cmp byte [esi], al
je 0x10060257
cmp byte [esi + 1], al
je 0x1006024e
push 1
push eax
push eax
push dword [esi + 4]
call ebx
mov ebx, eax
sub ebx, dword [esi + 0x10]
mov dword [ebp - 4], ebx
jmp 0x1006025f
push eax
push eax
push 2
pop ecx
jmp 0x1006021e
and dword [ebp - 4], 0
mov ebx, dword [ebp - 4]
jmp 0x1006025f
mov eax, dword [esi + 0x28]
mov dword [ebp - 4], eax
mov ebx, eax
mov eax, 0xffff
cmp ebx, eax
mov dword [ebp - 8], eax
jae 0x1006026e
mov dword [ebp - 8], ebx
push 0x404
call fcn.10073163
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
je 0x1006020b
or dword [ebp - 0x14], 0xffffffff
push 4
pop eax
cmp dword [ebp - 8], eax
jbe 0x10060324
jmp 0x10060298
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add eax, 0x400
cmp eax, ecx
mov dword [ebp - 0xc], ecx
ja 0x100602aa
mov dword [ebp - 0xc], eax
mov edi, ebx
sub edi, dword [ebp - 0xc]
mov eax, ebx
sub eax, edi
mov ebx, 0x404
cmp eax, ebx
ja 0x100602be
mov ebx, eax
push 0
push edi
xor ecx, ecx
mov eax, esi
call fcn.1005ffcd
test eax, eax
pop ecx
pop ecx
jne 0x10060324
push 1
push ebx
push dword [ebp - 0x10]
call fcn.10060069
add esp, 0xc
cmp eax, 1
jne 0x10060324
lea eax, [ebx - 3]
jmp 0x10060307
mov ecx, dword [ebp - 0x10]
dec eax
cmp byte [eax + ecx], 0x50
jne 0x10060307
cmp byte [eax + ecx + 1], 0x4b
jne 0x10060307
cmp byte [eax + ecx + 2], 5
jne 0x10060307
cmp byte [eax + ecx + 3], 6
je 0x1006030d
test eax, eax
jg 0x100602e8
jmp 0x10060312
add eax, edi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10060324
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
jb 0x10060292
push dword [ebp - 0x10]
call fcn.100732dd
mov eax, dword [ebp - 0x14]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10060d80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
jne 0x10060e0f
cmp dword [esi + 4], 0xffffffff
jne 0x10060e0f
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.10070dbb
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
pop ecx
je 0x10060ddc
cmp ax, 0x2f
je 0x10060ddc
push edi
call fcn.10070dbb
mov ecx, 0x103
sub ecx, eax
push ecx
push 0x100d5b34
push edi
call fcn.10077f21
add esp, 0x10
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.1005ff1c
test eax, eax
pop ecx
pop ecx
pop edi
jne 0x10060df4
mov eax, dword [ebp + 8]
jmp 0x10060e14
push dword [ebp + 0xc]
call fcn.10060335
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x10060e14
mov eax, 0x1000000
pop ebp
ret 8

Function at 0x10061371
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100ea3e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
je 0x100613a5
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100613a5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx ecx, word [esi]
test cx, cx
je 0x10061467
mov eax, esi
mov edx, esi
movzx ecx, cx
cmp cx, 0x2f
je 0x100613c4
cmp cx, 0x5c
jne 0x100613c6
mov eax, edx
inc edx
inc edx
movzx ecx, word [edx]
test cx, cx
jne 0x100613b8
cmp eax, esi
push edi
je 0x10061404
sub eax, esi
sar eax, 1
add eax, eax
mov edi, eax
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.10073ad0
and word [ebp + edi - 0x414], 0
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.10061371
add esp, 0x14
and word [ebp - 0x20c], 0
test ebx, ebx
mov edi, 0x103
je 0x10061426
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.100740c3
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.10070dbb
sub edi, eax
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.10077f21
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
pop edi
jne 0x10061467
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10070dd1
leave
ret
Function at 0x10061f13
Capabilities:
Create directory
Get file attributes

Disassembly:
push 0x14
mov eax, 0x100bfd98
call fcn.10078edd
mov edi, ecx
and dword [ebp - 0x18], 0
lea esi, [ebp - 0x10]
call fcn.10061a16
and dword [ebp - 4], 0
mov eax, dword [0x101051ec]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x10062055
mov edi, dword [ebp - 0x10]
mov eax, dword [edi - 8]
movzx eax, word [edi + eax*2 - 2]
cmp ax, 0x5c
mov esi, 0x100d5b34
je 0x10061f77
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x10]
call fcn.10061d67
mov edi, dword [ebp - 0x10]
mov eax, dword [edi - 8]
test eax, eax
jl 0x10061f8b
push esi
push edi
call fcn.10071571
test eax, eax
pop ecx
pop ecx
jne 0x10061f90
or eax, 0xffffffff
jmp 0x10061f94
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
je 0x10062055
lea ecx, [eax + 1]
lea eax, [ebp - 0x1c]
push eax
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x20], ecx
call fcn.10061aa2
mov byte [ebp - 4], 2
mov eax, dword [eax]
push eax
mov eax, dword [eax - 8]
lea ecx, [ebp - 0x14]
call fcn.10061d67
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10061c6c
mov ebx, dword [ebp - 0x20]
test ebx, ebx
mov esi, dword [edi - 8]
jle 0x1006200f
test esi, esi
jle 0x1006200f
cmp ebx, esi
jle 0x10061fe1
mov ebx, esi
lea eax, [ebp - 0x10]
call fcn.10061dee
mov edi, dword [ebp - 0x10]
mov eax, esi
sub eax, ebx
lea eax, [eax + eax + 2]
push eax
lea eax, [edi + ebx*2]
push eax
mov eax, dword [edi - 4]
lea eax, [eax + eax + 2]
push eax
push edi
call fcn.10025149
add esp, 0x10
sub esi, ebx
mov dword [edi - 8], esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
cmp eax, esi
jne 0x1006202e
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1006205c
cmp dword [edi - 8], 0
jl 0x10062045
push 0x100d5b34
push edi
call fcn.10071571
test eax, eax
pop ecx
pop ecx
jne 0x10062049
mov eax, esi
jmp 0x1006204d
sub eax, edi
sar eax, 1
cmp eax, esi
jne 0x10061f9d
mov dword [ebp - 0x18], 1
lea esi, [ebp - 0x14]
call fcn.10061c6c
lea esi, [ebp - 0x10]
call fcn.10061c6c
mov eax, dword [ebp - 0x18]
call fcn.10078f7c
ret