joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a270
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 9
mov ebx, ecx
mov dword [ebp - 4], edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
and dword [edx], eax
rep stosd dword es:[edi], eax
push 0x10
pop edi
mov ecx, ebx
call fcn.10030d9c
test eax, eax
jne 0x1001a2a2
xor eax, eax
inc eax
jmp 0x1001a3b6
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x14], 1
jbe 0x1001a29a
mov ecx, ebx
call fcn.10030c3b
test eax, eax
je 0x1001a2c0
push 2
pop edi
push 0x30
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x1001a311
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80070000
test eax, eax
jle 0x1001a2ed
movzx eax, ax
or eax, esi
test eax, eax
jns 0x1001a307
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1001a3b6
movzx eax, ax
or eax, esi
jmp 0x1001a3b6
mov eax, 0x80004005
jmp 0x1001a3b6
lea eax, [esi + 0x18]
mov dword [esi], ebx
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esi]
lea eax, [esi + 0x10]
push eax
lea edx, [esi + 0xc]
call fcn.10030a2b
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
jb 0x1001a334
mov ecx, edi
lea eax, [esi + 4]
mov dword [esi + 0x14], ecx
push eax
push ecx
push ecx
mov ecx, ebx
call fcn.100427bb
mov edi, eax
test edi, edi
jns 0x1001a352
push edi
push 0xd2d
jmp 0x1001a370
lea eax, [esi + 8]
mov ecx, ebx
push eax
push 0x100
push 1
call fcn.100427bb
mov edi, eax
test edi, edi
jns 0x1001a385
push edi
push 0xd34
mov ecx, 0x100044a8
call fcn.1003a254
mov edx, esi
mov ecx, ebx
call fcn.1001a22e
jmp 0x1001a3b4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov eax, dword [ebp - 0x14]
dec eax
push eax
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov eax, dword [ebp - 4]
mov dword [eax], esi
test ebx, ebx
je 0x1001a3b4
mov dword [ebx + 0xac], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d11f
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
or dword [ebp - 8], 0xffffffff
xor eax, eax
or dword [ebp - 0xc], 0xffffffff
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 1], 1
push edi
mov edi, ecx
test ebx, ebx
jne 0x1001d16c
call fcn.1001ced9
mov esi, eax
test esi, esi
jns 0x1001d26b
push esi
push 0x192
jmp 0x1001d261
mov ecx, dword [edi + 0x24]
call fcn.10030aab
lea edx, [ebp - 0x18]
mov ecx, eax
call fcn.10047628
mov esi, eax
test esi, esi
jns 0x1001d18f
push esi
push 0x19d
jmp 0x1001d261
mov ecx, dword [edi + 8]
lea edx, [ebp - 0x20]
call fcn.10048630
mov esi, eax
test esi, esi
js 0x1001d1ce
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x18]
jne 0x1001d1e1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jne 0x1001d1e1
mov edx, ebx
mov ecx, edi
call fcn.1001ced9
mov esi, eax
test esi, esi
jns 0x1001d26b
push esi
push 0x1a4
jmp 0x1001d261
cmp esi, 0x80070002
je 0x1001d1e1
push esi
push 0x1a9
jmp 0x1001d261
mov edx, dword [edi + 0x34]
lea eax, [ebp - 8]
push eax
push 0
push 0x80000000
lea ecx, [ebp - 0x18]
call fcn.100483a6
test eax, eax
jns 0x1001d1ff
xor esi, esi
jmp 0x1001d26b
mov edx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 3
push 0
push ecx
mov ecx, 0x1000478c
call fcn.10048a21
mov esi, eax
test esi, esi
jns 0x1001d223
push esi
push 0x1ca
jmp 0x1001d261
push 0xd
push 1
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x1001d24c
mov esi, eax
or esi, 0x10000000
push esi
push 0x1d1
jmp 0x1001d261
cmp dword [ebp - 0x28], 0
jge 0x1001d26b
mov esi, dword [ebp - 0x28]
or esi, 0x10000000
push esi
push 0x1d2
mov ecx, 0x10004760
call fcn.1003a254
cmp dword [ebp - 8], 0xffffffff
je 0x1001d27a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0xffffffff
je 0x1001d289
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001daa9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x80
xor edi, edi
lea eax, [ebp - 0x84]
push edi
push eax
mov esi, edx
mov ebx, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x84]
push 0x40
push eax
push 0x10004918
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 0x40
jae 0x1001db0e
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
test eax, eax
je 0x1001db0e
push 0x10004938
jmp 0x1001db1b
test esi, 0x400
je 0x1001db54
push 0x1000497c
mov esi, 0x20000
push esi
call fcn.10039c80
movzx eax, word [ebx]
pop ecx
pop ecx
xor ecx, ecx
push 3
pop edx
inc ecx
cmp ax, dx
ja 0x1001db4a
jne 0x1001db3e
cmp word [ebx + 2], cx
jae 0x1001db4a
push 0x10004a30
push 0x40000
jmp 0x1001db5e
push 0x10004a00
mov edi, ecx
push esi
jmp 0x1001db5e
push 0x100049b8
push 0x20000
call fcn.10039c80
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret
Function at 0x100217d2
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10021890
test al, 0x10
jne 0x1002188b
push 0xd0
lea eax, [ebp - 0xe0]
push esi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [0x10004518]
add esp, 8
mov dword [ebp - 0xc], eax
mov edx, 0x80000000
mov eax, dword [0x1000451c]
mov dword [ebp - 8], eax
push esi
push 3
push ecx
push 3
mov ecx, edi
call fcn.10029103
mov edi, eax
cmp edi, 0xffffffff
je 0x10021890
push esi
lea eax, [ebp - 0xe4]
push eax
push 0xd0
lea eax, [ebp - 0xe0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10021882
lea ecx, [ebp - 0xe0]
mov eax, dword [ecx]
lea edx, [ebp - 0xc]
cmp eax, dword [edx]
jne 0x1002187d
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x1002187d
inc esi
mov dword [ebx], esi
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10021890
mov dword [ebx], esi
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret

Function at 0x10022271
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x1002226d
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x1002225e
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10022019
xor dh, byte [ebx]
sbb dword [eax], ebp
lea eax, [ebp - 0x58]
push eax
call fcn.10022029
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10021fde
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10022307
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10022019
add eax, 0x8dc0d639
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x10022397
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in eax, dx
salc
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10022029
push eax
push esi
push dword [ebp + 8]
call fcn.10021fde
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10022029
push eax
push esi
push dword [ebp + 8]
call fcn.10021fde
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10022029
push eax
push esi
push dword [ebp + 8]
call fcn.10021fde
add esp, 0x30
mov dword [ebp - 0xb8], eax
invalid
cmp bl, 0xff

Function at 0x10023a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.10022029
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.10022029
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.10021f8a
add esp, 0xc
lea eax, [ebp - 0x504]
mov dword [ebp - 0x3a0], eax
jmp 0x10023f91
Function at 0x10028e5a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov eax, edx
and dword [ebp - 8], edi
mov esi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp + 0x10], edi
je 0x10028e98
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ebx
push ecx
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10028ee3
cmp dword [0x10086660], edi
je 0x10028ed0
call fcn.10014063
test eax, eax
jne 0x10028ecd
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
push esi
mov esi, dword [0x10086654]
mov ecx, esi
call dword [0x10087410]
call esi
mov esi, dword [ebp - 0x10]
jmp 0x10028ee3
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ebx
push ecx
push dword [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10028f41
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10028efb
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10028f14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x10028f19
movzx edi, di
or edi, 0x80070000
jmp 0x10028f19
mov edi, 0x80004005
test ebx, ebx
je 0x10028fb1
cmp edi, 0x800703e5
jne 0x10028fb1
push 1
lea eax, [ebp - 8]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x10028f73
xor edi, edi
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 8]
je 0x10028f5e
mov edi, 0x8007000d
push edi
push 0x97
mov ecx, 0x10005a00
call fcn.1003a254
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10028f87
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10028fa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x10028fa7
movzx edi, di
or edi, 0x80070000
jmp 0x10028fa5
mov edi, 0x80004005
test edi, edi
jns 0x10028f41
push edi
push 0x87
jmp 0x10028f54
test edi, edi
jns 0x10028f41
push edi
push 0x8e
jmp 0x10028f54
Function at 0x1002a3da
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov ax, word [0x100860d0]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov ecx, 0xffff
mov dword [ebp - 4], edx
push 9
pop esi
and dword [edi], 0
cmp ax, cx
jne 0x1002a426
xor eax, eax
lea edi, [ebp - 0x28]
mov ecx, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x28]
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov word [0x100860d0], ax
cmp ax, si
je 0x1002a430
test ax, ax
jne 0x1002a485
mov edx, dword [edx]
mov ecx, dword [ebx + 0x14]
call fcn.1002a2d3
test eax, eax
jne 0x1002a485
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x1002a48b
mov esi, dword [esi + 0xc]
test esi, esi
je 0x1002a48b
cmp dword [ebx + 0x38], eax
jne 0x1002a455
cmp ebx, esi
je 0x1002a48b
test esi, esi
je 0x1002a48b
mov ecx, dword [esi + 0xc]
mov edx, dword [ebx + 0xc]
mov eax, dword [ecx + 0x58]
cmp eax, dword [edx + 0x58]
jne 0x1002a480
mov eax, dword [ecx + 0x5c]
cmp eax, dword [edx + 0x5c]
jne 0x1002a480
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 0x14]
mov edx, dword [eax]
call fcn.1002a2d3
test eax, eax
jne 0x1002a485
mov esi, dword [esi + 0x38]
jmp 0x1002a455
mov dword [edi], 1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e7b5
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 4], 0
mov edx, ecx
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], edx
and dword [ebp - 8], ebx
lea edi, [ebp - 0x30]
push 9
xor eax, eax
test dword [edx + 0x24], 0x80000
pop ecx
rep stosd dword es:[edi], eax
je 0x1002e825
lea ecx, [ebp - 0x30]
call fcn.1002f7a2
mov esi, eax
test esi, esi
js 0x1002e8ad
push 0x10006614
lea eax, [ebp - 0x30]
push ebx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
test ebx, ebx
jne 0x1002e8ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 4]
cmp eax, 5
jne 0x1002e850
mov eax, 0x10006634
jmp 0x1002e855
push dword [edx + 0x1c]
mov eax, dword [edx + 0xc]
push dword [edx + 0x18]
movzx eax, word [eax]
push eax
lea eax, [ebp - 4]
push 0x10006648
push eax
call fcn.1007ff3f
mov edi, dword [ebp - 4]
mov esi, eax
add esp, 0x14
test esi, esi
js 0x1002e899
mov eax, edi
jmp 0x1002e855
mov eax, 0x10006614
push eax
push 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
test ebx, ebx
jne 0x1002e899
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1002e87b
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1002e894
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002e899
movzx esi, si
or esi, 0x80070000
jmp 0x1002e899
mov esi, 0x80004005
test edi, edi
je 0x1002e8ad
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x10], 0
je 0x1002e8ce
push dword [ebp - 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and dword [ebp - 0x10], eax
test esi, esi
jns 0x1002e8df
test ebx, ebx
je 0x1002e8df
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov eax, dword [ebp - 0xc]
pop edi
mov dword [eax + 0x10], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f1b8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10086084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x34
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
lea eax, [ebp - 0x38]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x3c]
test edi, edi
jne 0x1002f1fb
mov ebx, 0x80004005
jmp 0x1002f34d
push esi
push 0xffffffffffffffff
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1002f264
cmp eax, 0x80
je 0x1002f264
cmp eax, 0x102
je 0x1002f25a
cmp eax, 0xffffffff
jne 0x1002f250
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80070000
test eax, eax
jle 0x1002f234
movzx eax, ax
or eax, esi
test eax, eax
jns 0x1002f250
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1002f34c
movzx ebx, bx
or ebx, esi
jmp 0x1002f34c
mov ebx, 0x80004005
jmp 0x1002f34c
mov ebx, 0x800705b4
jmp 0x1002f34c
lea eax, [ebp - 0x38]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1002f313
cmp dword [ebp - 0x14], ebx
je 0x1002f2e4
cmp dword [ebp - 0xc], ebx
je 0x1002f2e4
lea eax, [ebp - 0x54]
mov word [ebp - 0x3c], bx
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 0x3a], bl
push eax
push 3
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002f313
mov ecx, 0x10006804
lea edx, [ebp - 0x3c]
movzx eax, word [ecx]
cmp ax, word [edx]
jne 0x1002f2c7
movzx eax, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1002f2c7
or dword [edi + 0x24], 1
jmp 0x1002f343
mov eax, 0x10006800
lea ecx, [ebp - 0x3c]
mov ax, word [eax]
cmp ax, word [ecx]
jne 0x1002f2dd
and dword [edi + 0x24], 0xfffffffe
jmp 0x1002f343
mov ebx, 0xc1440129
jmp 0x1002f343
mov eax, dword [edi + 0x24]
mov ecx, 0x10006804
mov dword [ebp - 0x40], ebx
and eax, 1
jne 0x1002f2f9
mov ecx, 0x10006800
lea edx, [ebp - 0x54]
add eax, 2
push edx
lea edx, [ebp - 0x40]
push edx
push eax
push ecx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002f343
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80070000
test eax, eax
jle 0x1002f329
movzx eax, ax
or eax, esi
test eax, eax
jns 0x1002f33e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1002f343
movzx ebx, bx
or ebx, esi
jmp 0x1002f343
mov ebx, 0x80004005
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.10083b20
mov esp, ebp
pop ebp
ret
Function at 0x1002f35f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push esi
mov esi, ecx
push edi
test eax, eax
je 0x1002f540
test ebx, ebx
je 0x1002f540
test byte [eax + 0x24], 1
push 2
je 0x1002f442
mov edi, ebx
pop ecx
lea edx, [edi + 2]
mov ax, word [edi]
add edi, ecx
cmp ax, word [ebp - 0x10]
jne 0x1002f3a0
sub edi, edx
sar edi, 1
mov eax, edi
shl eax, 2
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
test eax, eax
jne 0x1002f3d6
mov esi, 0x8007000e
jmp 0x1002f545
xor edx, edx
mov ecx, edi
push edx
push edx
shl ecx, 2
push ecx
push eax
push edi
push ebx
push edx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1002f42f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1002f409
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1002f425
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002f51f
movzx esi, si
or esi, edi
jmp 0x1002f51f
mov esi, 0x80004005
jmp 0x1002f51f
mov edi, dword [ebp - 8]
mov ebx, edi
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1002f437
sub edi, ecx
jmp 0x1002f475
mov ecx, ebx
xor edi, edi
pop edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, edx
cmp ax, di
jne 0x1002f44a
sub ecx, esi
sar ecx, 1
mov eax, ecx
mul edx
mov edi, eax
xor eax, eax
cmp edx, eax
ja 0x1002f539
jb 0x1002f473
cmp edi, 0xffffffff
ja 0x1002f539
mov esi, eax
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1002f4a6
cmp eax, 0x80
je 0x1002f4a6
cmp eax, 0x102
je 0x1002f49f
cmp eax, 0xffffffff
jne 0x1002f425
jmp 0x1002f3f3
mov esi, 0x800705b4
jmp 0x1002f51f
push 2
xor eax, eax
push eax
push eax
mov eax, dword [ebp - 4]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x1002f4ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1002f4e3
xor eax, eax
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push edi
push ebx
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002f513
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
test eax, eax
jle 0x1002f4f9
movzx eax, ax
or eax, edi
test eax, eax
jns 0x1002f50e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002f513
movzx esi, si
or esi, edi
jmp 0x1002f513
mov esi, 0x80004005
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 8]
test eax, eax
je 0x1002f545
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1002f545
mov esi, 0x80070216
jmp 0x1002f545
mov esi, 0x80070057
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret