joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009560
Capabilities:
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x10009722
cmp word [edi], 0
je 0x10009722
test ebx, ebx
je 0x10009722
cmp word [ebx], 0
je 0x10009722
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0x10000000
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x1000970c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push 8
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x1000962e
test esi, esi
je 0x1000962e
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push ecx
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000961e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jne 0x1000961e
mov dword [ebp - 8], 1
jmp 0x1000962e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x1000970c
mov ecx, esi
call fcn.1000efa0
test eax, eax
jne 0x10009662
pop esi
pop edi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0x10000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100096f6
push 2
push edi
push edi
push ebx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100096c4
mov eax, dword [ebp - 0x10]
mov ecx, 1
cmp eax, dword [ebp - 8]
cmove edi, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x100096f6
test esi, esi
je 0x100096e3
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x63
pop edi
xor ecx, ebp
pop ebx
call fcn.100212e2
mov esp, ebp
pop ebp
ret
Function at 0x1000b960
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041c94
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x38
push str.hewxnspxlnwecntcbjstpjolikpfutiovobcrupysfiyfidvjjddtlbu
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], 0
call fcn.1000d700
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa0]
push 0x5a
push str.mvufqtrtlvornszixyesobyowcupqlbuyvuhcpeccunxejywhzghbkisdfxamgdejsmrmmpleeualfvptgguytmrjk
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.1000d700
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x40]
push 0x52
push 0x10056898
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
push 0x26
push str.pnlcibsnpjjmveuhlhrdelihzgieriilmmwhyv
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x88]
push 0x52
push 0x10056950
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000d700
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
push 0x52
push 0x100569c0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
lea ecx, [ebp - 0x70]
call fcn.1000d670
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 4
call fcn.1000d670
push 0x52
push 0x10056a40
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x88]
push 0x52
push str.wuzeeggfhtlycjkvgmlvhlmnbhaewfbhmduyhuzdqsxlfxyakgstwaxubylggspksxrqqrrrifauoishwk
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000d700
lea ecx, [ebp - 0x88]
call fcn.1000d670
lea ecx, [ebp - 0x70]
call fcn.1000d670
lea ecx, [ebp - 0x28]
call fcn.1000d670
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.1000d670
push 0x36
push str.gptcmllwiyyomqppmazoldravemlviozqkfgjfseljiprfxbteysrq
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.1000d700
lea ecx, [ebp - 0x58]
call fcn.1000d670
lea ecx, [ebp - 0xa0]
call fcn.1000d670
lea ecx, [ebp - 0xb8]
call fcn.1000d670
push 0
push str.taskkill__F__IM_chrome.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call esi
mov ecx, str.chrome.exe
call fcn.100200e0
test al, al
jne 0x1000bb66
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
Function at 0x1000bba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041cfe
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x3d
push str.oqhxszuknlrsrnfoisahderuepkcyrbbzzmsslyjabjajemlmiwghbgtwlnuc
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0xf
mov byte [ebp - 0xb8], 0
call fcn.1000d700
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x70]
push 0x15
push str.vxhsyybqwzaopkxqzbidw
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
call fcn.1000d700
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x1d
push 0x10056838
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa0]
push 0x1d
push 0x10056858
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf
mov byte [ebp - 0xa0], 0
call fcn.1000d700
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88]
push 0x1d
push str.qiuzlvdghfgsqumxqpiffbiqawpaw
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.1000d700
lea ecx, [ebp - 0x88]
call fcn.1000d670
lea ecx, [ebp - 0xa0]
call fcn.1000d670
lea ecx, [ebp - 0x28]
call fcn.1000d670
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0
call fcn.1000d670
push 0x54
push 0x10051eb0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
call fcn.1000d700
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
push 0x27
push str.ubgdqhtzyefjwbfotznnjhdeexkjybyxtqkartg
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000d700
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
push 0x54
push 0x10051f30
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1000d700
mov byte [ebp - 4], 6
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
push 0x54
push str.cjuijbuvzzediwddxomtnjqhzidormjxeolrjnaivuomcoasvrgyvezfyjqyadxeigqepvlxtviodflvitga
lea ecx, [ebp - 0x70]
mov byte [ebp - 0x70], 0
call fcn.1000d700
lea ecx, [ebp - 0x70]
call fcn.1000d670
lea ecx, [ebp - 0x28]
call fcn.1000d670
lea ecx, [ebp - 0x40]
call fcn.1000d670
lea ecx, [ebp - 0x58]
call fcn.1000d670
lea ecx, [ebp - 0xb8]
call fcn.1000d670
push 5
push 0
push str.__no_startup_window
push 0x1005de90
push 0x1005de98
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push 0
push str.__restore_last_session
push str.chrome
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
Function at 0x10016010
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042960
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1006f068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100212f3
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1002051f
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001d310
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1001d31b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1001d3d7
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
sub edi, 1
jne 0x1001d330
pop edi
test esi, esi
je 0x1001d3fa
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
sub esi, 1
jne 0x1001d3e0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1001db70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov ebx, esi
mov dword [ebp - 0xc], esi
imul ebx, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x1001dbcc
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001dbb4
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp - 8]
call fcn.10023640
add dword [edi + 0x1c], esi
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
xor edx, edx
xor ecx, ebp
div dword [ebp - 0xc]
pop edi
pop esi
pop ebx
call fcn.100212e2
mov esp, ebp
pop ebp
ret
Function at 0x1001dc10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x1001dc55
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001dc50
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x1001dc82
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1001dc66
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.10023640
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x1001dca0
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x1001dc8d
cmp byte [esi + 8], 0
je 0x1001dc8d
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100212e2
mov esp, ebp
pop ebp
ret
Function at 0x1001e840
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
jne 0x1001e85b
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x18], 0
je 0x1001e850
cmp dword [edi + 0x7c], 0
je 0x1001e86c
call fcn.1001ecd0
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.1001e5d0
add esp, 8
test eax, eax
je 0x1001e890
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.100272ed
mov esi, eax
add esp, 4
test esi, esi
je 0x1001e8d3
push 0x4000
call fcn.100272ed
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x1001e8df
push esi
call fcn.100270aa
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x1001e93a
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.1001d650
test eax, eax
jne 0x1001e93a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x1001e95d
mov al, byte [edi + 0x39]
jmp 0x1001e960
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x1001e9dd
nop
mov al, byte [ebx]
test al, al
je 0x1001e9dd
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, ecx
shr ecx, 8
movzx eax, al
mov eax, dword [eax*4 + 0x10068088]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10068088]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x1001e990
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f460
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x1001f492
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001f492
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x1001f57c
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x1001f4b1
cmp dx, 0x5c
jne 0x1001f4b3
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x1001f4a5
cmp edi, ebx
je 0x1001f4fe
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.10023640
add esp, 0xc
cmp edi, 0x208
jae 0x1001f58c
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.1001f460
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x1001f523
lea ecx, [ebp - 0x20c]
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x1001f513
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1001f525
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1001f540
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x1001f57c
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100212e2
mov esp, ebp
pop ebp
ret
call fcn.100217e5
int3
Function at 0x1001f8e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043142
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1006f068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x44c
call fcn.100212f3
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
push 0x44c
push 0
push ebx
call fcn.10023bc0
add esp, 0xc
mov dword [ebx], 0
lea edi, [ebx + 0x244]
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x238], 0xffffffff
mov dword [ebx + 0x23c], 0
push edi
push 0x104
mov dword [ebx + 0x240], 0
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f975
sub ecx, edx
sar ecx, 1
movzx eax, word [ebx + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x1001f9b3
cmp eax, 0x2f
je 0x1001f9b3
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x1001f9a0
mov eax, dword [0x100679c8]
mov dword [edi], eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x1001fa68
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
cmp esi, 0xffffffff
push 0x20
setne bl
call fcn.100212f3
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x10]
mov byte [edi], 1
mov byte [edi + 0x10], 1
mov byte [edi + 1], bl
mov dword [edi + 4], eax
mov byte [edi + 8], 0
mov dword [edi + 0xc], 0
cmp esi, 0xffffffff
je 0x1001fa29
push 1
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [edi + 0xc], eax
mov ecx, edi
call fcn.1001ded0
mov ebx, dword [ebp - 0x14]
mov dword [ebx], eax
test eax, eax
je 0x1001fa68
push 8
mov dword [0x10070d2c], 0
call fcn.100212f3
add esp, 4
mov dword [eax], 1
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, ebx
mov dword [0x10070d2c], 0x200
call fcn.1001fa90
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001fb50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x10], ebx
test ecx, ecx
je 0x1001fc1a
cmp word [ecx], 0
je 0x1001fc1a
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x1001fbb5
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
xor esi, esi
test ebx, ebx
je 0x1001fc00
xor edx, edx
mov ecx, ebx
add ecx, 1
setb dl
neg edx
or edx, ecx
push edx
call fcn.100272ed
mov esi, eax
add esp, 4
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x1001fbfb
push eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.100212e2
mov esp, ebp
pop ebp
ret

Function at 0x1001fc30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006f068]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, edx
test ecx, ecx
je 0x1001fcb4
cmp word [ecx], 0
je 0x1001fcb4
push esi
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001fc83
pop esi
mov eax, 0xa
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100212e2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.100212e2
mov esp, ebp
pop ebp
ret