joyce8/EMBER2024-capa huggingface dataset:
Function at 0x228afe0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x146b000]
push edi
or ebp, 0xffffffff
jmp 0x228b002
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x228b009
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x228aff8
mov eax, 1
add ebx, ebx
jne 0x228b01b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x228b02c
jne 0x228b04b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x228b04b
dec eax
add ebx, ebx
jne 0x228b038
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x228b010
add ebx, ebx
jne 0x228b047
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x228b09d
xor ecx, ecx
sub eax, 3
jb 0x228b063
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x228b0d2
sar eax, 1
mov ebp, eax
jmp 0x228b06e
add ebx, ebx
jne 0x228b06e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x228b03c
inc ecx
add ebx, ebx
jne 0x228b07c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x228b03c
add ebx, ebx
jne 0x228b089
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x228b07e
jne 0x228b09a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x228b07e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x228b0bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x228b0ae
jmp 0x228affe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x228b0bc
add edi, ecx
jmp 0x228affe
pop esi
mov edi, esi
mov ecx, 0xa248
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x228b0da
cmp byte [edi], 0x36
jne 0x228b0da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x228b0df
lea edi, [esi + 0x1e87000]
mov eax, dword [edi]
or eax, eax
je 0x228b157
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ee6970]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1ee6b00]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x228b10c
mov ecx, edi
jns 0x228b13b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1ee6b04]
or eax, eax
je 0x228b151
mov dword [ebx], eax
add ebx, 4
jmp 0x228b129
call dword [esi + 0x1ee6b14]
mov ebp, dword [esi + 0x1ee6b08]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x228b18b
sub esp, 0xffffff80
jmp 0x512bb0
Function at 0x414188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x414197
pop dword [ebp - 0x3c]
mov eax, 0xb20ae0fa
sub eax, 0xb1c99f63
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push SetTokenInformation
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x315b2f72
add ecx, 0xcea513e2
xor esi, esi
add esi, eax
mov edx, 0x43f000
add edx, dword [ebp - 0x3c]
mov ebx, 0xde5fcf62
sub ebx, 0x5c125929
xor dword [ebp - 0x10], esi
mov edi, dword [edx]
mov dword [ebp - 4], 0xac6ac97
sub edi, ebx
xor dword [ebp - 0x20], 0x16a7c526
mov dword [esi], edi
mov dword [ebp - 0x38], 0x41151a11
add esi, 0xcdb64a54
sub esi, 0xcdb64a50
add edx, 0xac21367a
add edx, 0x53dec98a
loop 0x4141ed
add eax, 0xd32bafb6
sub eax, 0xd32aaf93
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10008af0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x10193864]
mov dword [esp], 0
push esi
test eax, 0xfffffffe
jne 0x10008b6c
mov ecx, 1
mov edx, 0x10193864
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10008b48
mov eax, dword [0x10193864]
cmp eax, 1
jne 0x10008b6c
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
mov eax, dword [0x10193864]
cmp eax, 1
je 0x10008b30
mov eax, dword [0x10193864]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x10193868], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10193868], eax
cmp eax, 0xffffffff
je 0x10008b76
mov dword [0x10193864], 0x10193868
mov eax, dword [0x10193864]
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10023650
int3

Function at 0x1000a610
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x1019386c]
mov dword [esp], 0
push esi
test eax, 0xfffffffe
jne 0x1000a6a7
mov ecx, 1
mov edx, 0x1019386c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x1000a668
mov eax, dword [0x1019386c]
cmp eax, 1
jne 0x1000a6a7
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 0
call esi
mov eax, dword [0x1019386c]
cmp eax, 1
je 0x1000a650
mov eax, dword [0x1019386c]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x10193870], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10193870], eax
cmp eax, 0xffffffff
je 0x1000a6b1
mov eax, 0x1000a6c0
mov dword [0x1019386c], 0x10193870
test eax, eax
je 0x1000a6a7
push 0x1019386c
push 0x1000a6c0
call fcn.1001a690
add esp, 8
mov eax, dword [0x1019386c]
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10023650
int3
Function at 0x1000fb30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 8], 4
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 4
push eax
push 0
push dword [ebp + 8]
mov dword [esp + 0x20], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x1000fba6
mov ecx, dword [esp + 4]
cmp ecx, 4
je 0x1000fb89
cmp ecx, 3
jne 0x1000fba1
cmp dword [esp + 8], 4
jne 0x1000fba1
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, edx
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov esp, ebp
pop ebp
ret 8

Function at 0x1000fbb0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.1011bf70
mov eax, dword [0x1018d0d0]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x1000fcf7
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x1000fc84
cmp word [esp + 0x10], ax
jne 0x1000fc48
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.1000c2b0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000fc50
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.1000c2b0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x1000fcf2
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x1000fcd7
cmp eax, 0x400
ja 0x1000fcd7
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.1000bb20
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 8

Function at 0x1000fd40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov edx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
lea edi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000fd60
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10010de0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x1018d0d0]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [0x10193904], 0
push esi
je 0x10010e10
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.1011a4b2
add esp, 4
test eax, eax
je 0x10010e2d
push ecx
mov ecx, eax
call fcn.10010c40
mov dword [0x10193904], eax
jmp 0x10010e37
mov dword [0x10193904], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [esp + 0x18], 7
xor eax, eax
mov dword [esp + 0x14], 0
mov word [esp + 4], ax
cmp word [edx], ax
jne 0x10010e5f
xor ecx, ecx
jmp 0x10010e73
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010e64
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc]
call fcn.1000c2b0
lea eax, [esp + 4]
push eax
call fcn.10011bf0
cmp dword [esp + 0x18], 8
jb 0x10010e9b
push dword [esp + 4]
call fcn.1011a1ea
add esp, 4
mov ecx, dword [esp + 0x1c]
mov al, 1
pop esi
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret

Function at 0x10011bf0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x1018d0d0]
xor eax, esp
mov dword [esp + 0x34], eax
mov dword [esp], 0
mov edx, str._t_n_v_f_r
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [0x10193904]
lea ecx, [edx + 2]
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], eax
mov word [esp + 0x24], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10011c46
sub edx, ecx
lea ecx, [esp + 0x24]
sar edx, 1
push edx
push str._t_n_v_f_r
call fcn.1000c2b0
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x2c]
mov ecx, esi
call fcn.10029960
add esp, 8
cmp dword [esp + 0x38], 8
jb 0x10011c8b
push dword [esp + 0x24]
call fcn.1011a1ea
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x10011cc9
cmp dword [esp + 0x20], 8
lea ecx, [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 8], 0
cmovae eax, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [esp + 0xc]
call fcn.10010eb0
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x20], 8
jb 0x10011cdc
push dword [esp + 0xc]
call fcn.1011a1ea
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret 4
Function at 0x10017130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1001713e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x10017150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1001715e
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10017172
shr eax, 4
and eax, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x10017180
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x100172dd
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x260]
call fcn.1000b9e0
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x230], ax
lea ecx, [ebp - 0x230]
lea eax, [ebp - 0x260]
mov dword [ebp - 0x220], 0
push eax
call fcn.1000bf70
push 1
push 0
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0
push eax
lea ecx, [ebp - 0x230]
call fcn.1000e720
cmp eax, 0xffffffff
je 0x1001722b
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x230]
call fcn.1000c3b0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x230]
call fcn.1000dcd0
cmp esi, eax
je 0x1001724d
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.1000bf70
cmp dword [ebp - 0x234], 8
jb 0x10017264
push dword [ebp - 0x248]
call fcn.1011a1ea
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x10017298
push dword [ebp - 0x230]
call fcn.1011a1ea
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
cmp dword [ebp - 0x24c], 8
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
jb 0x100172cc
push dword [ebp - 0x260]
call fcn.1011a1ea
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
Function at 0x100172f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov esi, ecx
push eax
push 0
push 0
push 0x28
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10017361
cmp word [ebp - 0x210], 0
je 0x10017361
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.1000b9e0
lea eax, [ebp - 0x228]
mov ecx, esi
push eax
call fcn.1000d260
cmp dword [ebp - 0x214], 8
jb 0x1001747f
push dword [ebp - 0x228]
jmp 0x10017477
xor eax, eax
mov dword [ebp - 0x22c], 7
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x230], 0
mov word [ebp - 0x240], ax
call fcn.10017180
test al, al
je 0x100173b6
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x240]
push eax
call fcn.1000bf70
jmp 0x10017468
push 3
xor eax, eax
mov dword [ebp - 0x214], 7
push 0x101790fc
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
call fcn.1000c2b0
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
call fcn.1000bf70
push 1
push 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
mov ecx, esi
call fcn.1000e720
cmp eax, 0xffffffff
je 0x10017434
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.1000c3b0
cmp dword [ebp - 0x214], 8
jb 0x1001744b
push dword [ebp - 0x228]
call fcn.1011a1ea
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
cmp dword [ebp - 0x22c], 8
jb 0x1001747f
push dword [ebp - 0x240]
call fcn.1011a1ea
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
Function at 0x10017490
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x1018d0d0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov esi, edx
cmp dword [edi + 0x14], 8
jb 0x100174bd
mov ebx, dword [edi]
jmp 0x100174bf
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10017501
test al, 0x10
je 0x100174e3
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100174ed
mov dword [esi], 0xfffffff7
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.1000d7b0
cmp dword [edi + 0x14], 8
jb 0x10017517
mov eax, dword [edi]
jmp 0x10017519
mov eax, edi
push dword [edi + 0x10]
lea ecx, [esp + 0x18]
push eax
push dword [esp + 0x2c]
push 0
call fcn.1000e880
test eax, eax
jne 0x1001753e
test esi, esi
je 0x10017588
mov dword [esi], 0xfffffffc
xor bl, bl
jmp 0x1001758e
mov edx, esi
lea ecx, [esp + 0x14]
call fcn.10017490
test al, al
jne 0x10017551
xor bl, bl
jmp 0x1001758e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1001758c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xb7
jne 0x1001757b
push edi
call fcn.10017150
add esp, 4
test al, al
jne 0x1001758c
test esi, esi
je 0x10017588
mov ecx, ebx
call fcn.1002ea80
mov dword [esi], eax
xor bl, bl
jmp 0x1001758e
mov bl, 1
cmp dword [esp + 0x28], 8
jb 0x100175a1
push dword [esp + 0x14]
call fcn.1011a1ea
add esp, 4
mov ecx, dword [esp + 0x2c]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
Function at 0x100179a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 8
push ebx
push esi
push edi
mov edi, edx
jb 0x100179c0
mov ecx, dword [ecx]
push 0
push 0x80
push 3
push 0
push 7
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor ecx, ecx
mov dword [ebp - 0x25c], ecx
test esi, esi
je 0x10017b52
lea ecx, [ebp - 0x25c]
call fcn.10013be0
cmp esi, 0xffffffff
je 0x10017a1b
mov dword [ebp - 0x25c], esi
call fcn.10006540
push eax
mov eax, dword [ebp + 4]
push eax
lea eax, [ebp - 0x25c]
push eax
push esi
call fcn.100134c0
add esp, 0x10
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
je 0x10017b52
cmp ecx, 0xffffffff
je 0x10017b52
push 0
push 1
push 0
push 2
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
mov dword [ebp - 0x260], 0
test esi, esi
je 0x10017b3d
lea ecx, [ebp - 0x260]
call fcn.10013be0
cmp esi, 0xffffffff
je 0x10017a87
mov dword [ebp - 0x260], esi
call fcn.10006540
push eax
mov eax, dword [ebp + 4]
push eax
lea eax, [ebp - 0x260]
push eax
push esi
call fcn.100134c0
add esp, 0x10
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x10017b3d
cmp eax, 0xffffffff
je 0x10017b3d
push 1
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x10017b3d
xor bl, bl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x10e
lea ecx, [ebp - 0x228]
push ecx
push esi
push eax
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
test eax, eax
je 0x10017b23
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x240]
call fcn.1000b9e0
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x258]
call fcn.1000d260
cmp edi, eax
je 0x10017b0b
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.1000bf70
lea ecx, [ebp - 0x258]
call fcn.1000baf0
lea ecx, [ebp - 0x240]
call fcn.1000baf0
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea ecx, [ebp - 0x260]
call fcn.10013be0
mov ecx, dword [ebp - 0x25c]
jmp 0x10017b54
lea ecx, [ebp - 0x260]
xor bl, bl
call fcn.10013be0
mov ecx, dword [ebp - 0x25c]
jmp 0x10017b54
xor bl, bl
test ecx, ecx
je 0x10017bac
cmp ecx, 0xffffffff
je 0x10017bac
call fcn.10006540
push eax
mov eax, dword [ebp + 4]
push eax
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x25c]
call fcn.10013580
mov edi, dword [ebp - 0x25c]
add esp, 0x10
call fcn.100136e0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov byte [0x1019389e], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov byte [0x1019389e], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
Function at 0x10017ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 8], 0
mov ebx, edx
cmp dword [ecx + 0x14], 8
push edi
mov edi, dword [ebp + 8]
jb 0x10017cbd
mov ecx, dword [ecx]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor ecx, ecx
mov dword [ebp - 4], ecx
test esi, esi
je 0x10017d33
lea ecx, [ebp - 4]
call fcn.10013be0
cmp esi, 0xffffffff
je 0x10017d05
mov dword [ebp - 4], esi
call fcn.10006540
push eax
mov eax, dword [ebp + 4]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.100134c0
add esp, 0x10
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10017d33
cmp ecx, 0xffffffff
je 0x10017d33
push 0
lea eax, [ebp - 8]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10017d30
mov ebx, dword [ebp - 8]
cmp ebx, edi
jne 0x10017d30
mov ecx, dword [ebp - 4]
jmp 0x10017d36
mov ecx, dword [ebp - 4]
or ebx, 0xffffffff
test ecx, ecx
je 0x10017d85
cmp ecx, 0xffffffff
je 0x10017d85
call fcn.10006540
push eax
mov eax, dword [ebp + 4]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
call fcn.10013580
mov edi, dword [ebp - 4]
add esp, 0x10
call fcn.100136e0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov byte [0x1019389e], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov byte [0x1019389e], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017d90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x1018d0d0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x10017e89
cmp eax, 0x104
ja 0x10017e89
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x240]
call fcn.1000b9e0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x258]
call fcn.1000d260
mov ecx, eax
call fcn.1000dcd0
cmp esi, eax
je 0x10017e16
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.1000bf70
cmp dword [ebp - 0x214], 8
jb 0x10017e2d
push dword [ebp - 0x228]
call fcn.1011a1ea
add esp, 4
xor eax, eax
mov dword [ebp - 0x214], 7
cmp dword [ebp - 0x244], 8
mov dword [ebp - 0x218], 0
mov word [ebp - 0x228], ax
jb 0x10017e61
push dword [ebp - 0x258]
call fcn.1011a1ea
add esp, 4
cmp dword [ebp - 0x22c], 8
jb 0x10017e78
push dword [ebp - 0x240]
call fcn.1011a1ea
add esp, 4
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.1011a3e5
mov esp, ebp
pop ebp
ret