joyce8/EMBER2024-capa huggingface dataset:
Function at 0x596cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x596eff
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.0045f765
lea ecx, [0x596f10]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005891e0
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x596df5
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x596dcc
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.005891e0
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x596e52
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x596e27
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x596e77
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x596efb
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x596efb
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x69c420]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00408750
mov eax, dword [esp + 8]
lea ecx, [0x89574c]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.0045e260
jmp fcn.00596cd0
Function at 0x5caa50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5cabfa
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x5caa7e
movzx ecx, byte [esp + 0x80]
jmp 0x5caa8b
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x5caac3
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x5cabe1
cmp cl, 0xe4
je 0x5caaa2
cmp ax, 0x303
jmp 0x5caac7
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x5cab55
cmp cl, 0xe3
jne 0x5cab1f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0045fbfe
call fcn.005ca730
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.0049bcd0
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x67e720]
mov dword [esp], eax
lea eax, [0x894b70]
mov dword [esp + 4], eax
call fcn.00433690
nop
call fcn.0045e260
jmp fcn.005caa50
Function at 0x608ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x609073
sub esp, 0x64
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
test ecx, ecx
jne 0x608f14
nop
mov eax, dword [0xa1c3bc]
lea ecx, [0x8964b8]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], eax
lea eax, [0x682040]
mov dword [esp + 4], eax
lea eax, [0xa43ac4]
mov dword [esp + 8], eax
call ecx
mov eax, dword [esp + 0x10]
lea ecx, [0x68ba20]
cmp dword [esp + 0xc], ecx
je 0x608f42
xor eax, eax
test eax, eax
je 0x60906f
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x60906f
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045f76b
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
movzx edx, byte [esp + 0x70]
mov byte [esp + 0x44], dl
lea ebx, [ecx + 0x34]
mov dword [esp + 0x24], ebx
mov dword [esp], ebx
call fcn.00466530
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 0x64]
test edx, edx
je 0x608f9d
mov eax, dword [edx]
jmp 0x608f9f
xor eax, eax
test eax, eax
sete al
movzx edx, byte [esp + 0x70]
and edx, eax
mov byte [esp + 0x45], dl
test dl, dl
je 0x609048
lea esi, [ecx + 0x7c]
mov dword [esp + 0x20], esi
lea edi, [esp + 0x28]
call fcn.0045fc4e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
test ecx, 0x80000000
je 0x608ffb
shl ecx, 1
mov edx, eax
shr eax, 0x1f
or ecx, eax
mov eax, edx
shl edx, 1
mov ebx, ecx
shl ecx, 1
shr edx, 0x1f
or ecx, edx
shr ebx, 0x1f
add ecx, 0xd7b17f80
adc ebx, 0xd
jmp 0x609003
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
test ecx, ecx
sete cl
test ebx, ebx
sete dl
and edx, ecx
test dl, dl
je 0x60901a
test eax, 0x3fffffff
je 0x609048
lea edi, [esp + 0x50]
mov esi, dword [esp + 0x20]
call fcn.0045fc4e
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.0045fc4e
call fcn.00480880
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.004668b0
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx]
lea edi, [esp]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
call eax
add esp, 0x64
ret
add esp, 0x64
ret
call fcn.0045e260
jmp fcn.00608ee0
Function at 0x100c768
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x88]
push eax
push 0x20019
xor edi, edi
push edi
push 0x10014d0
push 0x80000002
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x90], 0x40
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c88e
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x94]
push eax
push edi
push 0x10014bc
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c88e
cmp dword [ebp - 0x94], 1
jne 0x100c88e
push ebx
push esi
push 0x10
mov dword [ebp - 0x8c], 0x2e
xor ebx, ebx
mov dword [0x102f244], edi
call fcn.010161d8
mov esi, eax
cmp esi, edi
pop ecx
je 0x100c81f
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
jmp 0x100c821
xor esi, esi
cmp esi, edi
je 0x100c87d
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x84]
push eax
jmp 0x100c872
push eax
call fcn.010171bf
pop ecx
mov ecx, ebx
sub ecx, edi
je 0x100c865
dec ecx
je 0x100c85d
dec ecx
je 0x100c856
dec ecx
jne 0x100c86a
mov dword [esi + 0xc], eax
mov dword [0x102f244], esi
jmp 0x100c86a
mov dword [esi + 8], eax
push 3
jmp 0x100c862
mov dword [esi + 4], eax
push 2
pop ebx
jmp 0x100c86a
xor ebx, ebx
mov dword [esi], eax
inc ebx
lea eax, [ebp - 0x8c]
push eax
push edi
call fcn.010170ea
cmp eax, edi
pop ecx
pop ecx
jne 0x100c835
cmp dword [0x102f244], edi
jne 0x100c88c
push esi
call fcn.01016242
pop ecx
pop esi
pop ebx
cmp dword [ebp - 0x88], edi
pop edi
je 0x100c8a3
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010171cf
leave
ret

Function at 0x100c8b4
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100c921
push esi
lea eax, [ebp - 0x10]
push eax
push 0x1001524
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
pop esi
je 0x100c921
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100c921
push 0x80040002
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
leave
ret
Function at 0x100cef0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
push eax
xor edi, edi
push edi
push edi
push 0x25
push edi
mov word [eax], di
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jl 0x100cfb8
cmp byte [ebp + 0xc], 0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ebx, 0x80004005
je 0x100cf43
mov eax, dword [0x102f240]
add eax, 0x28
push eax
push dword [ebp + 0x14]
call edi
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add esi, ebx
test esi, esi
jl 0x100cfb8
push dword [ebp + 8]
push dword [ebp + 0x14]
call edi
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x7fffbffb
add esi, ebx
js 0x100cfb8
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jne 0x100cf96
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100cf94
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x100cfb8
mov eax, dword [0x102f248]
test eax, eax
je 0x100cfd5
push dword [ebp + 0x14]
push 0x1001728
push 0
push eax
call fcn.01015821
add esp, 0x10
jmp 0x100cfd5
mov eax, dword [0x102f248]
test eax, eax
je 0x100cfd5
push esi
push dword [ebp + 0x14]
push 0x10016e0
push 1
push eax
call fcn.01015821
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x100cfe4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 1
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x100d022
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 4], esi
je 0x100d030
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, esi
pop edi
sete al
pop esi
leave
ret 0xc
Function at 0x100d042
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe38
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop ecx
lea eax, [ebp - 0xe2c]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push 0x100176c
mov esi, 0x1001748
lea edi, [ebp - 0x28]
push 0x80000002
mov dword [ebp - 0xe2c], ebx
mov dword [ebp - 0xe34], ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d125
mov dword [ebp - 0xe30], ebx
lea esi, [ebp - 0xe28]
mov edi, 0x200
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xe38]
push eax
push esi
push dword [ebp - 0xe34]
mov dword [ebp - 0xe38], 0x100
push dword [ebp - 0xe2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100d0ff
push 0x11
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x100d0f0
inc dword [ebp - 0xe30]
add esi, edi
inc dword [ebp - 0xe34]
cmp dword [ebp - 0xe30], 7
jb 0x100d0ab
cmp dword [ebp - 0xe30], ebx
jbe 0x100d125
mov ebx, dword [ebp - 0xe30]
lea esi, [ebp - 0xe28]
push esi
push dword [ebp - 0xe2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esi, edi
dec ebx
jne 0x100d113
cmp dword [ebp - 0xe2c], ebx
pop edi
pop esi
pop ebx
je 0x100d13c
push dword [ebp - 0xe2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010171cf
leave
ret

Function at 0x100d1bc
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [ebp + 0xc]
push esi
push edi
push 0x44
pop edi
push edi
mov dword [ebp + 0xc], eax
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.01017220
mov dword [ebp - 0x54], edi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100d220
push dword [ebp - 0x10]
call fcn.0100d14d
test eax, eax
jne 0x100d220
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, dword [ebp + 0xc]
pop edi
pop esi
leave
ret 8
Function at 0x100d2a6
Capabilities:
Copy file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102f244]
push ebx
xor ebx, ebx
cmp eax, ebx
mov byte [ebp - 0x415], 1
je 0x100d38d
cmp dword [eax], 3
jne 0x100d38d
cmp dword [eax + 4], 1
jne 0x100d38d
push ebx
mov byte [ebp - 0x415], bl
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100d38d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x100d38d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x100d38d
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x1001960
lea eax, [ebp - 0x20c]
push eax
call esi
cmp eax, 1
jne 0x100d38c
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x100d38c
push 0x1001900
lea eax, [ebp - 0x414]
push eax
call esi
cmp eax, 1
jne 0x100d38c
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100d38c
mov byte [ebp - 0x415], 1
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x415]
xor ecx, ebp
pop ebx
call fcn.010171cf
leave
ret
Function at 0x100f92d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100f987
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100f978
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x100f974
cmp esi, eax
jae 0x100f978
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x100f966
cmp esi, eax
jb 0x100f97c
xor eax, eax
jmp 0x100f986
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x100fdfd
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov eax, 0x80070057
je 0x100fe83
test esi, esi
je 0x100fe83
and word [ebp - 0x20c], 0
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x100fe83
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
js 0x100fe83
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi], eax
je 0x100fe7d
xor eax, eax
jmp 0x100fe83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.010171cf
leave
ret 8

Function at 0x10100f3
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x102f225], bl
jne 0x101020b
push esi
mov esi, dword [ebp + 8]
cmp esi, 0x17e2
jne 0x1010131
push 0x30
push 0x100553c
push 0x1005438
jmp 0x101014c
cmp esi, 0x17e0
je 0x1010161
cmp esi, 0x17f3
je 0x1010161
push 0x30
movzx eax, si
push 0x17db
push eax
push ebx
push dword [0x102f234]
call dword [sym.imp.SHLWAPI.dll_ShellMessageBoxW]
add esp, 0x14
jmp 0x101020a
push 0x1fe
lea eax, [ebp - 0x40a]
push ebx
push eax
mov word [ebp - 0x40c], bx
call fcn.01017220
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call fcn.01017220
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x24
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x101020a
push 0x100541c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, 1
jne 0x101020a
push 0x100
lea eax, [ebp - 0x40c]
push eax
push esi
push dword [0x102f234]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x101020a
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x40c]
push eax
push 0x30
push 0x17db
push 0x10053fc
push ebx
push dword [0x102f234]
call dword [sym.imp.SHLWAPI.dll_ShellMessageBoxW]
add esp, 0x1c
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.010171cf
leave
ret 4
Function at 0x101021f
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push 0x100584c
mov byte [ebp - 1], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1010278
cmp dword [0x102f248], ebx
je 0x10102c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10057f0
push 2
push dword [0x102f248]
call fcn.01015821
add esp, 0x10
jmp 0x10102c4
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x101029d
cmp dword [0x102f248], ebx
je 0x10102c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005778
jmp 0x1010266
cmp dword [ebp - 0x18], ebx
jne 0x10102ab
cmp dword [ebp - 0x1c], 0xf4240
jbe 0x10102c7
mov eax, dword [0x102f248]
cmp eax, ebx
je 0x10102c4
push 0x1005720
push 2
push eax
call fcn.01015821
add esp, 0xc
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
je 0x1010324
mov esi, dword [ebp - 0x1c]
push esi
call fcn.01016252
pop ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x1010324
cmp dword [ebp - 0xc], esi
je 0x1010324
cmp dword [0x102f248], ebx
je 0x1010321
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10056c0
push 2
push dword [0x102f248]
call fcn.01015821
add esp, 0x10
mov byte [ebp - 1], bl
cmp edi, ebx
je 0x101032f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], bl
je 0x1010413
cmp dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
jb 0x1010352
cmp byte [esi], 0xef
jne 0x1010352
cmp byte [esi + 1], 0xbb
jne 0x1010352
cmp byte [esi + 2], 0xbf
je 0x101036e
mov eax, dword [0x102f248]
cmp eax, ebx
je 0x101036b
push 0x1005608
push 2
push eax
call fcn.01015821
add esp, 0xc
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1010413
mov ecx, dword [ebp - 0xc]
push ebx
push ebx
add ecx, 0xfffffffd
push ecx
lea eax, [esi + 3]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 8
mov edi, 0xfde9
push edi
mov dword [ebp - 0x10], ecx
call esi
mov ebx, eax
test ebx, ebx
jne 0x10103c7
cmp dword [0x102f248], eax
je 0x10103c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005568
push 2
push dword [0x102f248]
call fcn.01015821
add esp, 0x10
mov byte [ebp - 1], 0
jmp 0x1010411
xor ecx, ecx
push 2
pop edx
lea eax, [ebx + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01016252
pop ecx
push ebx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 3
push eax
push 8
push edi
call esi
mov esi, dword [ebp - 0x14]
and word [esi + eax*2], 0
mov eax, dword [0x102f22c]
test eax, eax
je 0x101040b
push eax
call fcn.01016242
pop ecx
mov dword [0x102f22c], esi
xor ebx, ebx
cmp dword [ebp - 8], ebx
pop edi
pop esi
pop ebx
je 0x1010424
push dword [ebp - 8]
call fcn.01016242
pop ecx
mov al, byte [ebp - 1]
leave
ret