joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100074d3
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [ebp - 4]
push edi
xor edi, edi
push edi
push 1
push edi
push edi
push eax
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x10007514
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x10007510
push 8
push 1
push edi
push edi
lea eax, [ebp - 4]
push eax
call esi
test eax, eax
jne 0x10007514
xor eax, eax
jmp 0x10007531
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push edi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x1000ab4f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1008b548]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x30]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x38], ecx
push edi
push eax
push 0x18
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], edi
push eax
push esi
call ebx
test eax, eax
je 0x1000ac64
cmp dword [ebp - 0x30], 0x18
jne 0x1000ac64
cmp dword [ebp - 0x2c], 3
jne 0x1000ac64
mov eax, dword [ebp - 0x28]
mov ecx, 0x23c
cmp eax, ecx
jb 0x1000ac64
xor edx, edx
div ecx
test edx, edx
jne 0x1000ac64
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xa00000
jg 0x1000ac64
cmp dword [ebp - 0x34], edi
jne 0x1000ac64
mov edx, dword [ebp - 0x28]
lea ecx, [edx + 0x18]
cmp eax, ecx
jne 0x1000ac64
push edx
call fcn.1002f940
mov edi, eax
pop ecx
test edi, edi
je 0x1000ac64
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x28]
push edi
push esi
call ebx
test eax, eax
je 0x1000ac55
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x30], eax
jne 0x1000ac55
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
call fcn.1000ce35
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10037c04
add esp, 0x18
test eax, eax
jne 0x1000ac55
mov ebx, dword [ebp - 0x38]
lea esi, [ebx + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, 0x23c
div ecx
mov ecx, ebx
push eax
push edi
call fcn.1000b826
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 1
push edi
call fcn.1002f21b
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x1000ac66
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f237
leave
ret 4
Function at 0x1000aecc
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x10067337
call fcn.1002f2b3
mov edi, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000b035
xor esi, esi
cmp dword [edi + 0x28], esi
jne 0x1000aef4
xor eax, eax
inc eax
jmp 0x1000b035
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
push esi
push esi
push 0x80
push 2
push 7
push 0x40000000
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.1000a89f
mov ebx, dword [ebp - 0x3c]
test eax, eax
jne 0x1000b028
lea eax, [edi + 0xc]
push eax
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
imul eax, dword [edi + 8], 0x23c
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x1000af55
lea eax, [edi + 0xc]
mov dword [edi + 0x28], esi
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1000b025
push eax
call fcn.1002f940
mov dword [ebp - 0x30], eax
pop ecx
test eax, eax
jne 0x1000af72
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1000b028
mov ecx, dword [edi + 4]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
mov dword [ebp - 0x2c], eax
cmp eax, ecx
je 0x1000afaf
mov ebx, dword [ebp - 0x34]
push 0x23c
add eax, 0x14
push eax
push ebx
call fcn.10037690
add esp, 0xc
lea ecx, [ebp - 0x2c]
add ebx, 0x23c
call fcn.100063ac
mov eax, dword [ebp - 0x2c]
cmp eax, dword [edi + 4]
jne 0x1000af84
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x30]
call fcn.1000ce35
add esp, 0xc
mov dword [edi + 0x28], esi
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x7d0
push 1
push ebx
call fcn.1000db36
add esp, 0xc
test eax, eax
je 0x1000b019
push esi
lea eax, [ebp - 0x34]
push eax
push 0x18
lea eax, [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000affd
call fcn.1000a888
push esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x3c]
push dword [ebp - 0x30]
call fcn.1000b0f8
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
push 1
push dword [ebp - 0x30]
call fcn.1002f21b
pop ecx
pop ecx
xor esi, esi
inc esi
test ebx, ebx
je 0x1000b033
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.1002f25d
ret 4
Function at 0x1000d261
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push 0x234
mov eax, 0x1006751d
call fcn.1002f2b3
mov eax, dword [0x1008e47c]
xor ebx, ebx
mov esi, dword [ebp + 8]
inc ebx
mov edi, 0x1008e464
test bl, al
jne 0x1000d31f
or eax, ebx
mov dword [0x1008e47c], eax
push dword [0x1008b0fc]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
call fcn.100062d5
push dword [0x1008b100]
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], bl
call fcn.100062d5
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.10033b90
add esp, 0xc
push dword [eax]
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.1000cb01
mov ecx, dword [ebp - 0x23c]
lea ecx, [ecx - 0x10]
call fcn.100057c1
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.100057c1
mov ecx, dword [ebp - 0x238]
lea ecx, [ecx - 0x10]
call fcn.100057c1
push 0x1006b2f5
call fcn.1002f8fb
or dword [ebp - 4], 0xffffffff
pop ecx
push dword [0x1008b0fc]
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x240], ebx
call fcn.100062d5
push dword [0x1008b0f8]
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 4
call fcn.100062d5
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.10033b90
add esp, 0xc
push dword [eax]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 6
call fcn.1000cb01
mov ecx, dword [ebp - 0x23c]
lea ecx, [ecx - 0x10]
call fcn.100057c1
mov ecx, dword [ebp - 0x238]
lea ecx, [ecx - 0x10]
call fcn.100057c1
mov ecx, dword [ebp - 0x234]
lea ecx, [ecx - 0x10]
call fcn.100057c1
cmp dword [0x1008e478], 8
lea eax, [ebp + 0xc]
push eax
cmovae edi, dword [0x1008e464]
lea eax, [ebp - 0x240]
push esi
push eax
push str.Path
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000d3fe
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push esi
call fcn.1000ce4d
pop ecx
pop ecx
test eax, eax
jne 0x1000d488
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
mov edi, 0x1008e688
cmovae eax, dword [ebp - 0x230]
push eax
push edi
call fcn.1000ce4d
pop ecx
pop ecx
test eax, eax
jne 0x1000d473
push eax
push 0x26
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000d486
push str.360360Safe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.1000ce4d
pop ecx
pop ecx
test eax, eax
je 0x1000d486
push edi
push dword [ebp + 0xc]
push esi
call fcn.1000538d
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
jmp 0x1000d488
xor ebx, ebx
lea ecx, [ebp - 0x230]
call fcn.10005c70
mov eax, ebx
call fcn.1002f25d
ret
Function at 0x1000d599
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x1008b548]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, 0x1008f7f0
push esi
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.1001e1de
test eax, eax
jne 0x1000d64f
push 0x11c
xor esi, esi
push esi
push edi
call fcn.10038c20
add esp, 0xc
mov dword [edi], 0x11c
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
imul eax, dword [edi + 4], 0xa
push str.RtlGetVersion
push str.ntdll
add eax, dword [edi + 8]
or dword [ebx], 0xffffffff
mov dword [ebp - 0x654], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d665
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x530], 0x11c
push ecx
call eax
test eax, eax
js 0x1000d665
imul eax, dword [ebp - 0x52c], 0xa
add eax, dword [ebp - 0x528]
cmp eax, dword [ebp - 0x654]
jle 0x1000d661
push 0x47
pop ecx
lea esi, [ebp - 0x530]
mov dword [ebx], 1
rep movsd dword es:[edi], dword [esi]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f237
leave
ret
mov dword [ebx], esi
jmp 0x1000d64f
push 0x410
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.10038c20
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push 0x25
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1000d71d
push str._ntoskrnl.exe
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1000d71d
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000d71d
push 8
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.1000a982
mov ecx, eax
call fcn.1000acc8
test eax, eax
je 0x1000d71d
test byte [ebp - 0x650], 8
je 0x1000d71d
mov eax, dword [ebp - 0x420]
mov ecx, eax
shr ecx, 0x10
movzx edx, ax
imul eax, ecx, 0xa
add eax, edx
cmp dword [ebp - 0x654], eax
jge 0x1000d661
mov eax, dword [ebp - 0x41c]
xor esi, esi
shr eax, 0x10
inc esi
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jmp 0x1000d661
xor eax, eax
jmp 0x1000d652
Function at 0x1000d786
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x234
mov eax, 0x10067577
call fcn.1002f321
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x240], eax
mov ebx, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x238]
push eax
push 1
push esi
push dword [0x1008b104]
mov dword [ebp - 4], esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000d9cb
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x224]
push eax
push esi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 7
push eax
push esi
push dword [0x1008b108]
mov dword [ebp - 0x224], esi
push dword [ebp - 0x238]
call edi
test eax, eax
je 0x1000d814
cmp eax, 0xea
jne 0x1000d9bf
cmp dword [ebp - 0x228], 7
jne 0x1000d9bf
mov eax, dword [ebp - 0x224]
add eax, 0x64
push eax
call fcn.1002f940
mov esi, eax
pop ecx
test esi, esi
je 0x1000d9bf
push 4
push 0
push esi
call fcn.10038c20
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
lea eax, [ebp - 0x228]
push eax
push 0
push dword [0x1008b108]
push dword [ebp - 0x238]
call edi
test eax, eax
jne 0x1000d9b8
mov eax, dword [ebp - 0x224]
xor edx, edx
mov ecx, edx
mov dword [ebp - 0x22c], edx
add eax, esi
mov dword [ebp - 0x234], ecx
mov edi, esi
cmp esi, eax
jmp 0x1000d9ac
test byte [ebp - 0x22c], 1
jne 0x1000d8fb
push 4
push 0x1006cf50
push edi
mov dword [ebp - 0x234], edx
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x1000d986
push eax
lea eax, [ebp - 0x220]
push eax
push 0x106
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x1000d986
push dword [ebp - 0x240]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1000d986
inc eax
mov dword [ebp - 0x234], eax
jmp 0x1000d986
test ecx, ecx
je 0x1000d986
push 0x1006cf50
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov edi, eax
test edi, edi
jne 0x1000d91d
mov edi, dword [ebp - 0x230]
jmp 0x1000d920
add edi, 8
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10038c20
xor ecx, ecx
add esp, 0xc
cmp word [edi], cx
je 0x1000d953
push ecx
lea eax, [ebp - 0x220]
push eax
push 0x106
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor ecx, ecx
mov eax, dword [ebp - 0x23c]
test eax, eax
jne 0x1000d967
xor ebx, ebx
cmp word [edi], cx
sete bl
jmp 0x1000d97c
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
test ebx, ebx
jne 0x1000d9b8
mov edi, dword [ebp - 0x230]
inc dword [ebp - 0x22c]
push edi
call fcn.1003d0a0
pop ecx
mov ecx, dword [ebp - 0x234]
push 0
lea edi, [edi + eax*2]
mov eax, dword [ebp - 0x224]
add edi, 2
add eax, esi
cmp edi, eax
pop edx
mov dword [ebp - 0x230], edi
jb 0x1000d890
push esi
call fcn.1002f949
pop ecx
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
call fcn.1002f26e
ret
Function at 0x1000dc3f
Capabilities:
Check if file exists
Create directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000dc87
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000dc73
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1000dc82
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x1000dc87
xor eax, eax
inc eax
jmp 0x1000dc89
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000dc8c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
push eax
push ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ecx
push eax
push 0x1000d075
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1000dcd0
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x1000dec3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x10]
call fcn.10005e74
pop ecx
test eax, eax
je 0x1000dede
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
pop ebp
ret

Function at 0x1000dee1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x1008b548]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push esi
call fcn.10005e74
pop ecx
test eax, eax
je 0x1000dfb3
push ebx
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x468]
push 0
push eax
call fcn.10038c20
mov ax, word [ebp + 0x10]
mov dword [ebp - 0x468], ebx
xor ebx, ebx
push 0x10
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x424]
push ebx
push eax
call fcn.10038c20
add esp, 0x18
lea eax, [ebp - 0x414]
test edi, edi
je 0x1000df64
push edi
push esi
push str.__s___s
push 0x208
push eax
call fcn.1000e274
add esp, 0x14
jmp 0x1000df78
push esi
push str.__s_
push 0x208
push eax
call fcn.1000e274
add esp, 0x10
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebx
test eax, eax
je 0x1000dfb3
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x424]
jmp 0x1000dfb5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002f237
leave
ret
Function at 0x1000e392
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, 0x80
test eax, eax
je 0x1000e3b2
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push esi
push 4
push 0
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop esi
cmp eax, 0xffffffff
jne 0x1000e3d3
xor eax, eax
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop ebp
ret

Function at 0x1000f046
Capabilities:
Write file on windows

Disassembly:
push 0xc
mov eax, 0x10067738
call fcn.1002f2b3
call fcn.1000678d
push eax
lea ecx, [ebp - 0x14]
call fcn.100062ac
lea eax, [ebp + 0x18]
xor ebx, ebx
push eax
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.1000d0df
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
cmp dword [ebp + 0x10], ebx
je 0x1000f08d
mov eax, dword [esi - 0xc]
lea ecx, [ebp - 0x18]
push ebx
push ecx
add eax, eax
push eax
push esi
jmp 0x1000f0c9
test esi, esi
je 0x1000f0d4
push esi
call fcn.1003d0a0
inc eax
pop ecx
cmp eax, 0x3fffffff
jg 0x1000f0d4
lea edi, [eax + eax]
mov eax, edi
call fcn.1002f950
mov eax, esp
push ebx
push edi
push esi
push eax
call fcn.1000efae
mov edi, eax
test edi, edi
je 0x1000f0d4
push edi
call fcn.1003e420
pop ecx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.100057c1
mov eax, ebx
lea esp, [ebp - 0x28]
call fcn.1002f25d
ret
Function at 0x1000f48f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
call fcn.1000f00d
push dword [ebp + 8]
lea ecx, [ebx + 0x1c]
call fcn.100058f7
mov eax, dword [ebp + 0xc]
xor esi, esi
push 0x7d0
push esi
push dword [ebp + 8]
mov ecx, ebx
mov dword [ebx + 4], eax
call fcn.1000fe99
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x1000f4d0
xor eax, eax
jmp 0x1000f57b
push edi
lea ecx, [ebp - 8]
mov dword [ebp - 8], esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp - 8], esi
jne 0x1000f541
lea ecx, [eax - 7]
cmp ecx, 0x31ffff8
ja 0x1000f541
add eax, 4
push eax
mov dword [ebp - 0xc], eax
call fcn.1002f940
mov edi, eax
pop ecx
test edi, edi
je 0x1000f541
push dword [ebp - 0xc]
push esi
push edi
call fcn.10038c20
add esp, 0xc
mov dword [ebp - 0xc], esi
lea eax, [ebp - 0xc]
push esi
push eax
push dword [ebp - 4]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000f535
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc], eax
je 0x1000f541
push 1
push edi
call fcn.1002f21b
pop ecx
pop ecx
mov edi, esi
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.1000fefb
test edi, edi
je 0x1000f567
push esi
push dword [ebp - 4]
mov ecx, ebx
push edi
call fcn.1000fc3d
xor esi, esi
inc esi
push esi
push edi
call fcn.1002f21b
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
pop edi
je 0x1000f579
push dword [ebp + 8]
lea ecx, [ebx + 0x14]
call fcn.1000f3ee
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1000f843
Capabilities:
Write file on windows

Disassembly:
push 0x18
mov eax, 0x10067882
call fcn.1002f27f
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 0x18], 0xfeff
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
push edi
push edi
push 0x80
push 2
push edi
push 0x40000000
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.1000a89f
mov ebx, dword [ebp - 0x24]
test eax, eax
jne 0x1000f95d
cmp dword [ebp + 0xc], edi
je 0x1000f8b7
push edi
lea eax, [ebp + 8]
push eax
push 2
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000f8ad
call fcn.1000a888
jmp 0x1000f8af
mov eax, edi
test eax, eax
jne 0x1000f95d
lea eax, [esi + 0x20]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xc]
mov byte [ebp - 4], 1
mov esi, dword [eax]
mov dword [ebp - 0x14], esi
cmp esi, eax
je 0x1000f951
mov eax, dword [ebp - 0x10]
push dword [esi + 0x10]
push str.__s__r_n
push dword [ebp + 0xc]
push ebx
push eax
call fcn.1000f046
add esp, 0x14
test eax, eax
je 0x1000f954
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
cmp ecx, eax
je 0x1000f92a
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push str._s_s_r_n
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10]
call fcn.1000f046
add esp, 0x18
test eax, eax
je 0x1000f954
lea ecx, [ebp + 8]
call fcn.100063ac
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 0x14]
jne 0x1000f8fc
push 0x1006cfa0
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10]
call fcn.1000f046
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.100063ac
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
cmp esi, dword [eax + 0xc]
jne 0x1000f8d7
xor edi, edi
inc edi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1000f968
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.1002f248
ret 8
Function at 0x10010446
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x1008b548]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.update
mov edi, 0x1008e688
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
push str.updatetemp
mov ecx, esi
call fcn.100102e3
push ebx
push edi
push str.productpath
mov ecx, esi
call fcn.100102e3
push ebx
push edi
push str.instdir
mov ecx, esi
call fcn.100102e3
push ebx
push edi
push str.datadir
mov ecx, esi
call fcn.100102e3
push ebx
push 3
push str.clientver
mov ecx, esi
call fcn.10010375
mov edi, 0x11c
lea eax, [ebp - 0x328]
push edi
push ebx
push eax
call fcn.10038c20
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x328], edi
push eax
lea eax, [ebp - 0x328]
mov dword [ebp - 0x32c], ebx
push eax
call fcn.1000d599
add esp, 0x14
add edi, 0xffffffe8
test eax, eax
lea eax, [ebp - 0x20c]
je 0x1001052e
push dword [ebp - 0x31c]
push dword [ebp - 0x320]
push dword [ebp - 0x324]
push str._d._d._04d
push 0x208
push eax
call fcn.1001041c
add esp, 0x18
jmp 0x1001053a
push str.5.0.0000
push edi
push eax
call fcn.1000b08e
push ebx
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
push str.sysver
call fcn.100102e3
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
push 0x1006cf78
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.1000e274
add esp, 0x10
lea eax, [ebp - 0x20c]
mov ecx, esi
push ebx
push eax
push str.syslang
call fcn.100102e3
push ebx
push 0x1006d068
push str.uilang
mov ecx, esi
call fcn.100102e3
push ebx
push str.H_HOME
push str.oemid
mov ecx, esi
call fcn.100102e3
push ebx
push 0x1006c760
push str.userid
mov ecx, esi
call fcn.100102e3
mov ecx, esi
call fcn.10010298
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f237
leave
ret