joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10054f30
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10054f40
mov esi, dword [ebp + 0xc]
sub eax, edx
sar eax, 1
mov ecx, 0x1f3
push esi
sub ecx, eax
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x10054f7a
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, 1
test byte [esi], 0x10
je 0x100550c1
cmp word [esi + 0x2c], 0x2e
lea eax, [esi + 0x2c]
jne 0x10054fb1
movzx ecx, word [esi + 0x2e]
cmp cx, 0x2e
jne 0x10054fa8
cmp word [esi + 0x30], 0
je 0x100550e8
test cx, cx
je 0x100550e8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10054fb4
sub eax, edx
sar eax, 1
mov dword [ebp - 0x10], eax
inc eax
cmp dword [ebp - 0xc], eax
jb 0x100550e8
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push edx
push 0x10002
add esi, 0x2c
push esi
lea eax, [ebx + eax*2 - 2]
xor ecx, ecx
push ebx
mov word [eax], cx
call dword [ebp + 0x10]
mov edi, eax
test edi, edi
je 0x100550ff
mov eax, esi
mov edx, esi
jmp 0x10055000
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10055000
mov edi, ebx
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10055012
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10055033
mov ecx, dword [0x101225c0]
mov esi, dword [ebp + 0xc]
mov dword [eax], ecx
mov dx, word [0x101225c4]
mov ecx, dword [ebp + 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp + 0x14]
push eax
push ecx
push esi
push ebx
call fcn.10054f30
mov edi, eax
add esp, 0x10
test edi, edi
je 0x100550ff
push 0x208
push 0
lea edi, [esi + 0x2c]
push edi
call fcn.1007d080
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push edx
lea esi, [ebx + eax*2 - 2]
push esi
push edi
call fcn.1007ce61
mov edx, dword [ebp + 0x14]
add esp, 0x18
push edx
push 0x20002
push edi
xor ecx, ecx
push ebx
mov word [esi], cx
call dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov edi, eax
mov eax, 0x2a
xor ecx, ecx
mov word [esi], ax
mov esi, dword [ebp + 0xc]
mov word [ebx + edx*2], cx
jmp 0x100550e8
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
xor eax, eax
push edx
mov word [ebx + ecx*2 - 2], ax
push 1
lea eax, [esi + 0x2c]
push eax
push ebx
call dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0x2a
mov edi, eax
mov word [ebx + edx*2 - 2], cx
test edi, edi
je 0x100550ff
mov eax, dword [ebp - 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10054f80
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10056b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 0x10175880
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10056b70
sub eax, edx
sar eax, 1
jne 0x10056b91
push 0x10175880
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, 0x10175880
mov esp, ebp
pop ebp
ret

Function at 0x10056ba0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1015bdd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edi
xor edi, edi
test edx, edx
je 0x10056c24
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10056bc0
sub eax, esi
sar eax, 1
pop esi
cmp eax, 2
jb 0x10056c24
movzx eax, word [edx]
cmp ax, 0x5c
jne 0x10056bf8
cmp word [edx + 2], ax
jne 0x10056bf8
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ceab
mov esp, ebp
pop ebp
ret
mov word [ebp - 0xc], ax
mov ax, word [edx + 2]
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
xor ecx, ecx
xor edx, edx
push eax
mov word [ebp - 8], cx
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x10056be4
cmp eax, 1
je 0x10056be4
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.1007ceab
mov esp, ebp
pop ebp
ret

Function at 0x10059140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1005914c
pop ebp
ret
mov ecx, dword [ebp + 0xc]
push esi
lea esi, [eax + ecx*4]
test esi, esi
jne 0x1005915c
xor eax, eax
pop esi
pop ebp
ret
push ebx
mov ebx, dword [esi]
push ebx
push esi
push ecx
push eax
push str.vtable_:__c__n_:__d__funcaddr_:__c__func_:__c
push 2
push str.HookVTable
push 0x10180918
call fcn.100644a0
add esp, 0x20
test ebx, ebx
je 0x10059213
cmp ebx, dword [ebp + 0x10]
je 0x10059213
push edi
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push ecx
push edi
push str.VirtualProtect______ret_:__d__old_:__d__err_:__08x
push 2
push str.HookVTable
push 0x10180918
call fcn.100644a0
add esp, 0x1c
test edi, edi
pop edi
je 0x10059211
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push 0
push eax
push 4
push esi
mov dword [esi], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push eax
push ecx
push esi
push str.VirtualProtect__ret_:__d__old_:__d__err_:__08x
push 2
push str.HookVTable
push 0x10180918
call fcn.100644a0
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
Function at 0x100598e0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x100
ja 0x10059974
je 0x1005996d
dec eax
cmp eax, 0x7f
ja case.0x10059904.3
movzx eax, byte [eax + 0x10059af8]
jmp dword [eax*4 + 0x10059aac]
mov eax, 3
pop ebp
ret
mov eax, 4
pop ebp
ret
mov eax, 8
pop ebp
ret
mov eax, 9
pop ebp
ret
mov eax, 0xb
pop ebp
ret
mov eax, 0xc
pop ebp
ret
mov eax, 0xe
pop ebp
ret
mov eax, 0x1c
pop ebp
ret
mov eax, 0x20
pop ebp
ret
mov eax, 0x1d
pop ebp
ret
mov eax, 0x1e
pop ebp
ret
mov eax, 0x1f
pop ebp
ret
mov eax, 7
pop ebp
ret
mov eax, 6
pop ebp
ret
mov eax, 2
pop ebp
ret
cmp eax, 0x400000
ja 0x10059a25
je 0x10059a1e
cmp eax, 0x10000
ja 0x100599df
je 0x100599d8
cmp eax, 0x2000
ja 0x100599b8
je 0x100599b1
cmp eax, 0x800
je case.0x10059904.2
cmp eax, 0x1000
je case.0x10059904.1
xor eax, eax
pop ebp
ret
mov eax, 0xd
pop ebp
ret
cmp eax, 0x4000
je 0x100599d1
cmp eax, 0x8000
jne case.0x10059904.3
mov eax, 0xa
pop ebp
ret
mov eax, 0x10
pop ebp
ret
mov eax, 0x11
pop ebp
ret
cmp eax, 0x80000
ja 0x10059a0c
je case.0x10059904.2
cmp eax, 0x20000
je case.0x10059904.50
cmp eax, 0x40000
jne case.0x10059904.3
mov eax, 0x13
pop ebp
ret
mov eax, 0x12
pop ebp
ret
cmp eax, 0x100000
jne case.0x10059904.3
mov eax, 0x15
pop ebp
ret
mov eax, 0x17
pop ebp
ret
cmp eax, 0x8000000
ja 0x10059a6c
je 0x10059a65
cmp eax, 0x2000000
ja 0x10059a57
je 0x10059a50
cmp eax, 0x800000
je case.0x10059904.48
cmp eax, 0x1000000
je case.0x10059904.1
xor eax, eax
pop ebp
ret
mov eax, 0x18
pop ebp
ret
mov eax, 0xf
pop ebp
ret
cmp eax, 0x4000000
jne case.0x10059904.3
mov eax, 0x16
pop ebp
ret
mov eax, 0x19
pop ebp
ret
cmp eax, 0x40000000
ja 0x10059a98
je 0x10059a91
cmp eax, 0x10000000
je case.0x10059904.2
cmp eax, 0x20000000
jne case.0x10059904.3
mov eax, 5
pop ebp
ret
mov eax, 1
pop ebp
ret
mov eax, 0x1a
pop ebp
ret
cmp eax, 0x80000000
je 0x10059aa3
xor eax, eax
pop ebp
ret
mov eax, 0x1b
pop ebp
ret
Function at 0x1005ec50
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1005ec61
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
call fcn.1005e9d0
add esp, 4
test eax, eax
jne 0x1005ec5b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
pop ebp
ret

Function at 0x1005f100
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1015bdd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 4
push 0x10136cd0
push esi
call fcn.1007f260
add esp, 0xc
test eax, eax
je 0x1005f158
push 4
push 0x10136cc4
push esi
call fcn.1007f260
add esp, 0xc
test eax, eax
je 0x1005f158
push 4
push 0x10136cb8
push esi
call fcn.1007f260
add esp, 0xc
test eax, eax
jne 0x1005f15b
add esi, 8
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1005f160
sub eax, edx
sar eax, 1
cmp eax, 4
jb 0x1005f22c
cmp word [esi + 2], 0x3a
jne 0x1005f22c
cmp word [esi + 4], 0x5c
lea edi, [esi + 4]
jne 0x1005f22c
mov eax, dword [0x10126a00]
movzx edx, word [esi]
mov cx, word [0x10126a04]
mov dword [ebp - 0x10], eax
xor eax, eax
push edx
mov word [ebp - 0xc], cx
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
call fcn.1007ff08
mov word [ebp - 0x10], ax
add esp, 4
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x1005f22c
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.1007d080
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x21c], 0x104
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x1005f22c
mov ecx, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x218]
push eax
push 0x10127dc8
dec ecx
push ecx
push ebx
call fcn.1007e032
add esp, 0x14
jmp 0x1005f23b
mov edx, dword [ebp + 0x10]
dec edx
push edx
push esi
push ebx
call fcn.1007ce61
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1007ceab
mov esp, ebp
pop ebp
ret
Function at 0x1005f260
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1015bdd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 4
push 0x10136dd0
push esi
call fcn.10080002
add esp, 0xc
test eax, eax
je 0x1005f2b8
push 4
push 0x10136dc8
push esi
call fcn.10080002
add esp, 0xc
test eax, eax
je 0x1005f2b8
push 4
push 0x10136dc0
push esi
call fcn.10080002
add esp, 0xc
test eax, eax
jne 0x1005f2bb
add esi, 4
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005f2c0
sub eax, edx
cmp eax, 4
jb 0x1005f382
cmp byte [esi + 1], 0x3a
jne 0x1005f382
cmp byte [esi + 2], 0x5c
lea edi, [esi + 2]
jne 0x1005f382
mov ax, word [0x101393a4]
movsx edx, byte [esi]
mov cl, byte [0x101393a6]
mov word [ebp - 0xc], ax
xor eax, eax
push edx
mov byte [ebp - 0xa], cl
mov word [ebp - 9], ax
mov byte [ebp - 7], al
call fcn.1007ff08
mov byte [ebp - 0xc], al
add esp, 4
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x1005f382
push 0x103
lea ecx, [ebp - 0x10f]
push 0
push ecx
mov byte [ebp - 0x110], 0
call fcn.1007d080
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x114], 0x104
call sub.MPR.dll_WNetGetConnectionA
test eax, eax
jne 0x1005f382
mov eax, dword [ebp + 0x10]
push edi
lea edx, [ebp - 0x110]
push edx
push 0x1013939c
dec eax
push eax
push ebx
call fcn.1007ff34
add esp, 0x14
jmp 0x1005f391
mov ecx, dword [ebp + 0x10]
dec ecx
push ecx
push esi
push ebx
call fcn.1007ed10
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1007ceab
mov esp, ebp
pop ebp
ret
Function at 0x1005ffc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x1015bdd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x256
push eax
lea ecx, [ebp - 0x266]
push ecx
mov word [ebp - 0x268], ax
call fcn.1007d080
push 0x12c
lea edx, [ebp - 0x268]
push edx
push esi
call fcn.1005db80
add esp, 0x18
test eax, eax
jne 0x1006001f
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ceab
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10126a00]
mov cx, word [0x10126a04]
mov dword [ebp - 0x10], eax
xor eax, eax
cmp word [ebp - 0x10], 0x5a
push edi
mov word [ebp - 0xc], cx
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
ja 0x100600ce
mov edi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea ecx, [ecx]
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x46e]
push eax
mov word [ebp - 0x470], dx
call fcn.1007d080
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x470]
push ecx
lea edx, [ebp - 0x10]
push edx
call edi
lea eax, [ebp - 0x470]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10060090
sub eax, edx
sar eax, 1
mov esi, eax
je 0x100600be
push esi
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x268]
push ecx
call fcn.1007fbc9
add esp, 0xc
test eax, eax
je 0x100600f0
mov ax, word [ebp - 0x10]
inc ax
mov word [ebp - 0x10], ax
cmp ax, 0x5a
jbe 0x10060050
push 8
lea ecx, [ebp - 0x268]
push 0x101394c4
push ecx
call fcn.1007fbc9
add esp, 0xc
test eax, eax
jne 0x10060114
lea edx, [ebp - 0x258]
jmp 0x10060156
lea eax, [ebp + esi*2 - 0x268]
test eax, eax
je 0x100600ce
push eax
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x10]
push edx
push 0x10127dc8
push eax
push ebx
call fcn.1007e032
add esp, 0x14
jmp 0x1006017f
push 0x19
lea ecx, [ebp - 0x268]
push 0x10139490
push ecx
call fcn.1007fbc9
add esp, 0xc
test eax, eax
jne 0x10060136
lea edx, [ebp - 0x236]
jmp 0x10060156
push 0xc
lea ecx, [ebp - 0x268]
push str.DeviceMup_
push ecx
call fcn.1007fbc9
add esp, 0xc
test eax, eax
jne 0x1006016b
lea edx, [ebp - 0x250]
mov eax, dword [ebp + 0x10]
push edx
push 0x101393a8
push eax
push ebx
call fcn.1007e032
add esp, 0x10
jmp 0x1006017f
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x268]
push ebx
push edx
call fcn.1005f100
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1007ceab
mov esp, ebp
pop ebp
ret
Function at 0x10060e40
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x10060ebc
push edi
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10060eb8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHGetFolderPathA
push edi
call ebx
push str.SHCreateShellItemArrayFromDataObject
push edi
mov dword [esi + 0x1c], eax
call ebx
push str.SHCreateShellItemArrayFromShellItem
push edi
mov dword [esi + 4], eax
call ebx
push str.SHCreateItemFromIDList
push edi
mov dword [esi + 8], eax
call ebx
push str.SHGetKnownFolderPath
push edi
mov dword [esi + 0xc], eax
call ebx
push str.SHCreateItemFromParsingName
push edi
mov dword [esi + 0x10], eax
call ebx
push str.SHCreateShellItemArrayFromIDLists
push edi
mov dword [esi + 0x14], eax
call ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], 1
pop ebx
mov eax, dword [esi + 0x20]
pop edi
pop esi
ret

Function at 0x10063440
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1015bdd0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
push 0x10180498
call fcn.1007d080
push 0x208
push 0
push 0x101806a0
call fcn.1007d080
add esp, 0x18
cmp dword [0x1015ba48], 0
je 0x100634a6
push 0x104
push 0x10180498
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x104
push 0x101806a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x10063563
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.1007d080
push 0x103
lea ecx, [ebp - 0x20b]
push 0
push ecx
mov byte [ebp - 0x20c], 0
call fcn.1007d080
add esp, 0x18
push 0x104
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10063510
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x103
push 0x10180498
sub eax, edx
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
call esi
lea eax, [ebp - 0x20c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10063541
push 0x103
push 0x101806a0
sub eax, ecx
push eax
lea edx, [ebp - 0x20c]
push edx
push 0
push 0
call esi
pop esi
push 0x10180498
call fcn.10082ce1
push 0x101806a0
call fcn.10082ce1
mov eax, 0x10180498
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10063582
sub eax, edx
sar eax, 1
mov dword [0x10180490], eax
mov eax, 0x101806a0
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100635a0
mov ecx, dword [ebp - 4]
sub eax, edx
sar eax, 1
xor ecx, ebp
mov dword [0x10180494], eax
call fcn.1007ceab
mov esp, ebp
pop ebp
ret

Function at 0x10063600
Capabilities:
Get common file path

Disassembly:
cmp dword [0x1018048c], 0
jne 0x1006361d
mov dword [0x1018048c], 1
call fcn.10063400
jmp fcn.10063440
ret
Function at 0x100640a0
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
push edi
mov edi, dword [ebp + 8]
je 0x100640b7
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esi + 0xc], 0
je 0x1006410b
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x1006410b
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 0x20]
jae 0x1006410b
mov eax, dword [esi + 0x18]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, edi
mov dword [ebp + 8], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100640f0
push 0
lea ecx, [ebp + 8]
push ecx
sub eax, edx
mov edx, dword [esi + 0x18]
push eax
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi + 0x10], 0
je 0x10064140
mov eax, edi
mov dword [ebp + 8], 0
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10064120
push 0
lea ecx, [ebp + 8]
push ecx
sub eax, edx
push eax
push edi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10064150
Capabilities:
Get file size
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 8], 0
push edi
mov edi, dword [ebp + 8]
je 0x10064167
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi + 0xc], 0
je 0x100641c4
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x100641c4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esi + 0x20]
jae 0x100641c4
mov eax, dword [esi + 0x18]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, edi
mov dword [ebp + 8], 0
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100641a0
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp + 8]
push ecx
lea edx, [eax + eax]
mov eax, dword [esi + 0x18]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi + 0x10], 0
je 0x100641ff
mov eax, edi
mov dword [ebp + 8], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100641d6
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp + 8]
push ecx
lea edx, [eax + eax]
push edx
push edi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
pop edi
pop esi
pop ebp
ret 4
Function at 0x10069050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1006909e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1006909e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x100690a3
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x10069089
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x100690b3
test esi, esi
jne 0x100690d1
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x100690cf
mov byte [eax + esi - 1], 0
jne 0x100690d8
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x1006e7c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1006e810
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1006e810
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x1006e815
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1006e7fb
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x1006e822
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret