joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c10e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push 0
push 0x80
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xc]
call fcn.1005113a
push eax
push dword [ebp + 0xc]
push 0x505
push dword [ebp + 8]
call fcn.1001d602
pop eax
cmp eax, 0x80
jne 0x1000c19e
push 0x80
lea eax, [ebp - 0x80]
push eax
call fcn.10037b6c
push 0x400
push 0
call fcn.1003d03c
mov dword [ebp - 0x84], eax
push dword [ebp - 0x84]
push 0x80
lea eax, [ebp - 0x80]
push eax
call fcn.100043ae
lea eax, [ebp - 0x84]
push eax
call fcn.1003d00f
test byte [ebp - 0x78], 1
jne 0x1000c19e
push dword [0x100523e6]
call fcn.100080c9
call fcn.10008691
call fcn.1002fa7e
xor eax, eax
leave
ret 8

Function at 0x1000f89d
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.10050fea
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 8
call fcn.10050fcc
or eax, eax
je 0x1000f93d
mov dword [ebp - 0x10], eax
push 0x224
lea eax, [ebp - 0x234]
push eax
call fcn.100510b0
mov dword [ebp - 0x234], 0x224
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x10]
call fcn.1005107a
cmp eax, 1
jne 0x1000f935
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.1000f7ca
cmp eax, 0xffffffff
je 0x1000f922
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0xc], eax
jmp 0x1000f935
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x10]
call fcn.10051080
or eax, eax
jne 0x1000f8fc
push dword [ebp - 0x10]
call fcn.10050fb4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x1000f979
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd5c
push 4
lea eax, [ebp - 4]
push eax
push 0x47c2df
call fcn.1002ee14
cmp dword [ebp - 4], 0xfffe88b1
je 0x1000f9e4
jmp 0x1000f9d0
push 0xff0000
push 0xff
push 0x1000f99d
call fcn.10030b47
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x2a4], 0
jmp 0x1000fa1a
push 0x1000fa0e
call fcn.1005106e
or eax, eax
je 0x1000fcc3
mov dword [ebp - 0x298], eax
jmp 0x1000fa4c
push 0x1000fa34
push dword [ebp - 0x298]
call fcn.10051020
or eax, eax
je 0x1000fa66
mov dword [ebp - 0x29c], eax
jmp 0x1000fa7c
push 0x1000fa68
push dword [ebp - 0x298]
call fcn.10051020
or eax, eax
je 0x1000fa96
mov dword [ebp - 0x2a0], eax
jmp 0x1000faa7
push 0x1000fa98
push dword [ebp - 0x298]
call fcn.10051020
or eax, eax
je 0x1000fac1
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x29c], 0
je 0x1000fcb8
cmp dword [ebp - 0x2a0], 0
je 0x1000fcb8
cmp dword [ebp - 0x2a4], 0
je 0x1000fcb8
push dword [0x1006b400]
call fcn.10050f0c
or eax, eax
je 0x1000fbb7
lea eax, [ebp - 4]
push eax
push dword [0x1006b400]
call fcn.10050eee
or eax, eax
je 0x1000fbb7
push dword [ebp - 4]
push 8
call fcn.10050fcc
or eax, eax
je 0x1000fbb7
mov dword [ebp - 0xc], eax
push 0x1000
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [ebp - 8], eax
push 0x224
lea eax, [ebp - 0x230]
push eax
call fcn.100510b0
mov dword [ebp - 0x230], 0x224
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0xc]
call fcn.1005107a
cmp eax, 1
jne 0x1000fba6
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
push dword [ebp - 0x2a4]
push dword [ebp - 0x2a0]
push dword [ebp - 0x29c]
call fcn.10010b0d
or eax, eax
jne 0x1000fb93
or byte [0x10052296], 0xff
jmp 0x1000fba6
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0xc]
call fcn.10051080
or eax, eax
jne 0x1000fb65
lea eax, [ebp - 8]
push eax
call fcn.1003d00f
push dword [ebp - 0xc]
call fcn.10050fb4
cmp byte [0x10052296], 0
je 0x1000fcb8
call fcn.10050fea
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 8
call fcn.10050fcc
or eax, eax
je 0x1000fcb8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x294]
push eax
call fcn.1000fcc5
push 0x1000
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [ebp - 8], eax
push 0x224
lea eax, [ebp - 0x230]
push eax
call fcn.100510b0
mov dword [ebp - 0x230], 0x224
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0xc]
call fcn.1005107a
cmp eax, 1
jne 0x1000fca7
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 8]
push dword [ebp - 0x2a4]
push dword [ebp - 0x2a0]
push dword [ebp - 0x29c]
call fcn.1000fcf4
or eax, eax
je 0x1000fc94
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.1001004a
cmp eax, 1
jne 0x1000fc94
cmp byte [0x10052296], 0xff
jne 0x1000fc94
push dword [ebp - 0x218]
push 0x400000
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
call fcn.1002f471
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0xc]
call fcn.10051080
or eax, eax
jne 0x1000fc2b
lea eax, [ebp - 8]
push eax
call fcn.1003d00f
push dword [ebp - 0xc]
call fcn.10050fb4
push dword [ebp - 0x298]
call fcn.10050fe4
leave
ret
Function at 0x10010a01
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
push ebx
mov dword [ebp - 0x18], 1
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10010b03
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 4]
call fcn.10050fc6
or eax, eax
je 0x10010afb
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 4
push dword [ebp - 8]
call fcn.10051074
or eax, eax
je 0x10010af3
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
cmp word [edi], 0x5a4d
jne 0x10010aeb
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
jne 0x10010aeb
mov edi, dword [edi + 0x78]
push edi
push dword [ebp - 0xc]
call fcn.100109af
or eax, eax
je 0x10010aeb
mov edi, eax
push dword [edi + 0x18]
pop dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
je 0x10010aeb
push dword [edi + 0x10]
pop dword [ebp - 0x14]
push dword [edi + 0x20]
push dword [ebp - 0xc]
call fcn.100109af
or eax, eax
je 0x10010aeb
or dword [ebp - 0x18], 0xffffffff
mov esi, eax
jmp 0x10010ae5
push dword [esi]
push dword [ebp - 0xc]
call fcn.100109af
push eax
push dword [ebp + 0xc]
call fcn.10051104
or eax, eax
jne 0x10010adf
mov dword [ebp - 0x18], 0
jmp 0x10010aeb
dec dword [ebp - 0x10]
add esi, 4
cmp dword [ebp - 0x10], 0
ja 0x10010abf
push dword [ebp - 0xc]
call fcn.100510d4
push dword [ebp - 8]
call fcn.10050fb4
push dword [ebp - 4]
call fcn.10050fb4
mov eax, dword [ebp - 0x18]
pop ebx
pop edi
pop esi
leave
ret 8

Function at 0x10014e8c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
lea eax, [ebp - 0x118]
push eax
call fcn.10015a95
or eax, eax
jne 0x10014f44
lea eax, [ebp - 0x118]
push eax
call fcn.1002fd52
push dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.100510f8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x118]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10014f44
mov dword [ebp - 0x11c], eax
push 0
push dword [ebp - 0x11c]
call fcn.10050ff6
cmp eax, 0x4aa1
jne 0x10014f39
mov dword [ebp - 0x120], eax
push 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x120]
push 0x10057efd
push dword [ebp - 0x11c]
call fcn.1005109e
push dword [ebp - 0x11c]
call fcn.10050fb4
leave
ret 8
Function at 0x10014f48
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
lea eax, [ebp - 0x118]
push eax
call fcn.10015a95
or eax, eax
jne 0x10014ff3
lea eax, [ebp - 0x118]
push eax
call fcn.1002fd52
push 0
lea eax, [ebp - 0x118]
push eax
call fcn.10050fba
push dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.100510f8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x118]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10014ff3
mov dword [ebp - 0x11c], eax
push 0
lea eax, [ebp - 0x120]
push eax
push 0x4aa1
push 0x10057efd
push dword [ebp - 0x11c]
call fcn.100510ec
push dword [ebp - 0x11c]
call fcn.10050fb4
leave
ret 8

Function at 0x100153db
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001517d
or eax, eax
je 0x100153fb
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push 0xd
push eax
call fcn.10050f6c
leave
ret 0x10

Function at 0x10015422
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
cmp dword [ebp + 8], 0
jbe 0x10015635
cmp dword [ebp + 8], 0xa
jae 0x10015635
lea eax, [ebp - 0x110]
push eax
call fcn.10015a95
or eax, eax
jne 0x10015635
lea eax, [ebp - 0x110]
push eax
call fcn.1002fd52
jmp 0x1001546f
push dword [ebp + 8]
push 0x10015461
lea eax, [ebp - 0x124]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.100510f8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x110]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x1001550d
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call fcn.10050ff6
cmp eax, 0x11fc
je 0x100154d7
cmp eax, 0x1229
jne 0x10015505
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x100525e0
push dword [ebp - 4]
call fcn.1005109e
cmp byte [0x100525e0], 0xf0
je 0x10015505
push 0x2d
push 0x100537dc
call fcn.1003062f
push dword [ebp - 4]
call fcn.10050fb4
jmp 0x1001551d
push 0
push 0x1001550f
push dword [ebp + 8]
push 0xdae
push dword [0x100523ca]
call fcn.10015b12
jmp 0x10015545
push 0
push 0x10015539
push dword [ebp + 8]
push 0xdaf
push dword [0x100523ca]
call fcn.10015b12
jmp 0x1001556e
push 1
push 0x10015561
push dword [ebp + 8]
push 0x1196
push dword [0x100523c6]
call fcn.10015b12
jmp 0x10015597
push 1
push 0x1001558a
push dword [ebp + 8]
push 0x1195
push dword [0x100523c6]
call fcn.10015b12
jmp 0x100155c1
push 0x100155b3
push dword [ebp + 8]
push dword [0x10052386]
call fcn.1001647d
jmp 0x100155e3
push 0x100155d6
push dword [ebp + 8]
push dword [0x100523f2]
call fcn.100430e6
jmp 0x10015606
push 0x100155f8
push dword [ebp + 8]
call fcn.10014e8c
jmp 0x10015622
push 0x10015615
push dword [ebp + 8]
push dword [0x100523ea]
call fcn.10017233
leave
ret 4
Function at 0x10015639
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
cmp dword [ebp + 8], 0
je 0x1001564e
cmp dword [ebp + 8], 9
jbe 0x10015652
leave
ret 4
lea eax, [ebp - 0x10c]
push eax
call fcn.10015a95
or eax, eax
je 0x10015666
leave
ret 4
push 0x1e
push 0x10053547
push 0x89a
push dword [0x100523ba]
call fcn.100153db
lea eax, [ebp - 0x10c]
push eax
call fcn.1002fd52
push 0
lea eax, [ebp - 0x10c]
push eax
call fcn.10050fba
jmp 0x100156a7
push dword [ebp + 8]
push 0x10015699
lea eax, [ebp - 0x120]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.100510f8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x10c]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
jne 0x100156f8
leave
ret 4
mov dword [ebp - 4], eax
mov byte [0x100525e0], 0xf0
push 0
lea eax, [ebp - 8]
push eax
push 0x11fc
push 0x100525e0
push dword [ebp - 4]
call fcn.100510ec
push dword [ebp - 4]
call fcn.10050fb4
jmp 0x10015732
push 0
push 0x10015724
push dword [ebp + 8]
push 0xdae
push dword [0x100523ca]
call fcn.10015cc4
jmp 0x1001575a
push 0
push 0x1001574e
push dword [ebp + 8]
push 0xdaf
push dword [0x100523ca]
call fcn.10015cc4
jmp 0x10015783
push 1
push 0x10015776
push dword [ebp + 8]
push 0x1196
push dword [0x100523c6]
call fcn.10015cc4
jmp 0x100157ac
push 1
push 0x1001579f
push dword [ebp + 8]
push 0x1195
push dword [0x100523c6]
call fcn.10015cc4
jmp 0x100157d5
push 0x1005fc71
push 0x100157c8
push dword [ebp + 8]
push 0x125e
push dword [0x1005239a]
call fcn.10015f0f
jmp 0x10015802
push 0x100157f4
push dword [ebp + 8]
push dword [0x10052386]
call fcn.10016249
jmp 0x10015824
push 0x10015817
push dword [ebp + 8]
push dword [0x100523f2]
call fcn.10034d5e
jmp 0x10015847
push 0x10015839
push dword [ebp + 8]
call fcn.10014f48
jmp 0x10015863
push 0x10015856
push dword [ebp + 8]
push dword [0x100523ea]
call fcn.1001742d
leave
ret 4

Function at 0x1001587a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
lea eax, [ebp - 0x10c]
push eax
call fcn.10015a95
or eax, eax
je 0x10015897
xor eax, eax
leave
ret
lea eax, [ebp - 0x10c]
push eax
call fcn.1002fd52
jmp 0x100158b1
push 0x100158a5
lea eax, [ebp - 0x10c]
push eax
call fcn.100510f8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x10c]
push eax
call fcn.10050fc0
mov byte [ebp - 0x10c], 0
cmp eax, 0xffffffff
je 0x1001591e
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.1005109e
cmp byte [ebp - 0x10c], 9
jbe 0x10015916
mov byte [ebp - 0x10c], 0
push dword [ebp - 4]
call fcn.10050fb4
movzx eax, byte [ebp - 0x10c]
leave
ret
Function at 0x10015927
Capabilities:
Create directory
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
lea eax, [ebp - 0x110]
push eax
call fcn.10015a95
or eax, eax
je 0x10015944
leave
ret 4
lea eax, [ebp - 0x110]
push eax
call fcn.1002fd52
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.10050fba
jmp 0x1001596c
push 0x10015960
lea eax, [ebp - 0x110]
push eax
call fcn.100510f8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x110]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10015a43
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call fcn.10050ff6
or eax, eax
jne 0x100159c2
push dword [ebp - 4]
call fcn.10050fb4
jmp 0x10015a43
mov dword [ebp - 8], eax
push dword [ebp - 8]
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.1005109e
push dword [ebp - 4]
call fcn.10050fb4
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp + 8]
mov byte [eax], dl
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x110]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10015a38
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.100510ec
push dword [ebp - 4]
call fcn.10050fb4
lea eax, [ebp - 0xc]
push eax
call fcn.1003d00f
jmp 0x10015a91
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x110]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10015a91
mov dword [ebp - 4], eax
push dword [ebp + 8]
pop dword [ebp - 0x110]
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 4]
call fcn.100510ec
push dword [ebp - 4]
call fcn.10050fb4
leave
ret 4

Function at 0x10015a95
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 8]
mov byte [eax], 0
or ebx, 0xffffffff
jmp 0x10015ab3
push 0x10015aa7
push 0
push 4
call fcn.10051092
cmp eax, 0xffffffff
je 0x10015b0b
or eax, eax
je 0x10015b0b
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push dword [ebp - 4]
call fcn.10051074
cmp eax, 0xffffffff
je 0x10015b03
or eax, eax
je 0x10015b03
mov dword [ebp - 8], eax
push 0x104
lea eax, [eax]
push eax
push dword [ebp + 8]
call fcn.10051110
push dword [ebp - 8]
call fcn.100510d4
xor ebx, ebx
push dword [ebp - 4]
call fcn.10050fb4
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x10015b12
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001517d
or eax, eax
je 0x10015cbf
mov dword [ebp - 0x12c], eax
cmp dword [ebp + 0x18], 0
jne 0x10015b51
push 0
push 0
push 0x14b
push dword [ebp - 0x12c]
call fcn.10050f6c
jmp 0x10015b65
push 0
push 0
push 0x184
push dword [ebp - 0x12c]
call fcn.10050f6c
lea eax, [ebp - 0x104]
push eax
call fcn.10015a95
or eax, eax
jne 0x10015cbf
lea eax, [ebp - 0x104]
push eax
call fcn.1002fd52
push dword [ebp + 0x10]
push dword [ebp + 0x14]
lea eax, [ebp - 0x118]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.100510f8
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x104]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10015cbf
mov dword [ebp - 0x11c], eax
push 0
push dword [ebp - 0x11c]
call fcn.10050ff6
or eax, eax
je 0x10015cb4
mov dword [ebp - 0x120], eax
push dword [ebp - 0x120]
push 0
call fcn.1003d03c
or eax, eax
je 0x10015cb4
mov dword [ebp - 0x124], eax
push 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push dword [ebp - 0x11c]
call fcn.1005109e
mov esi, dword [ebp - 0x124]
jmp 0x10015ca3
cmp dword [ebp + 0x18], 0
jne 0x10015c53
push esi
push 0xffffffffffffffff
push 0x158
push dword [ebp - 0x12c]
call fcn.10050f6c
jmp 0x10015c66
push esi
push 0xffffffffffffffff
push 0x1a2
push dword [ebp - 0x12c]
call fcn.10050f6c
cmp eax, 0xffffffff
jne 0x10015c99
cmp dword [ebp + 0x18], 0
jne 0x10015c86
push esi
push 0xffffffffffffffff
push 0x14a
push dword [ebp - 0x12c]
call fcn.10050f6c
jmp 0x10015c99
push esi
push 0xffffffffffffffff
push 0x181
push dword [ebp - 0x12c]
call fcn.10050f6c
push esi
call fcn.1002f5af
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x10015c38
lea eax, [ebp - 0x124]
push eax
call fcn.1003d00f
push dword [ebp - 0x11c]
call fcn.10050fb4
pop esi
leave
ret 0x14
Function at 0x10015cc4
Capabilities:
Create directory
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001517d
or eax, eax
je 0x10015eb9
mov dword [ebp - 0x124], eax
cmp dword [ebp + 0x18], 0
jne 0x10015d04
push 0
push 0
push 0x146
push dword [ebp - 0x124]
call fcn.10050f6c
jmp 0x10015d18
push 0
push 0
push 0x18b
push dword [ebp - 0x124]
call fcn.10050f6c
cmp eax, 0xffffffff
je 0x10015eb9
or eax, eax
je 0x10015eb9
mov dword [ebp - 0x128], eax
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 0x18], 0
jne 0x10015d4e
push 0
push ebx
push 0x149
push dword [ebp - 0x124]
call fcn.10050f6c
jmp 0x10015d61
push 0
push ebx
push 0x18a
push dword [ebp - 0x124]
call fcn.10050f6c
cmp eax, 0xffffffff
je 0x10015d6e
or eax, eax
je 0x10015d6e
lea edi, [eax + edi + 1]
inc ebx
cmp ebx, dword [ebp - 0x128]
jb 0x10015d33
inc edi
mov dword [ebp - 0x120], edi
push dword [ebp - 0x120]
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [ebp - 0x12c], eax
xor ebx, ebx
mov edi, dword [ebp - 0x12c]
cmp dword [ebp + 0x18], 0
jne 0x10015db9
lea eax, [ebp - 0x104]
push eax
push ebx
push 0x148
push dword [ebp - 0x124]
call fcn.10050f6c
jmp 0x10015dd1
lea eax, [ebp - 0x104]
push eax
push ebx
push 0x189
push dword [ebp - 0x124]
call fcn.10050f6c
cmp eax, 0xffffffff
je 0x10015df4
or eax, eax
je 0x10015df4
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.1005110a
add edi, dword [ebp - 0x130]
inc edi
inc ebx
cmp ebx, dword [ebp - 0x128]
jb 0x10015d99
lea eax, [ebp - 0x104]
push eax
call fcn.10015a95
or eax, eax
jne 0x10015ea7
lea eax, [ebp - 0x104]
push eax
call fcn.1002fd52
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.10050fba
push dword [ebp + 0x10]
push dword [ebp + 0x14]
lea eax, [ebp - 0x118]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.100510f8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x104]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x10015ea7
mov dword [ebp - 0x11c], eax
push 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x120]
push dword [ebp - 0x12c]
push dword [ebp - 0x11c]
call fcn.100510ec
push dword [ebp - 0x11c]
call fcn.10050fb4
lea eax, [ebp - 0x12c]
push eax
call fcn.1003d00f
pop ebx
pop edi
leave
ret 0x14
lea eax, [ebp - 0x104]
push eax
call fcn.10015a95
or eax, eax
jne 0x10015f09
lea eax, [ebp - 0x104]
push eax
call fcn.1002fd52
push dword [ebp + 0x10]
push dword [ebp + 0x14]
lea eax, [ebp - 0x118]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.100510f8
lea eax, [ebp - 0x104]
push eax
call fcn.10050fd2
pop ebx
pop edi
leave
ret 0x14
Function at 0x10015f0f
Capabilities:
Create directory
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push esi
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001517d
or eax, eax
je 0x100160ae
mov dword [ebp - 0xc], eax
push 0
push 0
push 0x18b
push dword [ebp - 0xc]
call fcn.10050f6c
cmp eax, 0xffffffff
je 0x100160ae
or eax, eax
je 0x100160ae
mov dword [ebp - 0x10], eax
xor ebx, ebx
xor edi, edi
lea eax, [ebp - 0x11c]
push eax
push ebx
push 0x189
push dword [ebp - 0xc]
call fcn.10050f6c
cmp eax, 0xffffffff
je 0x10015f93
or eax, eax
je 0x10015f93
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x11c]
push eax
call fcn.10031e1d
cmp eax, 0xffffffff
jne 0x10015f93
add edi, dword [ebp - 0x14]
inc edi
inc ebx
cmp ebx, dword [ebp - 0x10]
jb 0x10015f5a
or edi, edi
je 0x100160ae
inc edi
mov dword [ebp - 8], edi
push dword [ebp - 8]
push pe_nt_image_headers32
call fcn.1003d03c
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x11c]
push eax
push ebx
push 0x189
push dword [ebp - 0xc]
call fcn.10050f6c
cmp eax, 0xffffffff
je 0x10016000
or eax, eax
je 0x10016000
push dword [ebp + 0x18]
lea eax, [ebp - 0x11c]
push eax
call fcn.10031e1d
cmp eax, 0xffffffff
jne 0x10016000
lea eax, [ebp - 0x11c]
push eax
push edi
call fcn.1005110a
push edi
call fcn.1002f5af
lea edi, [edi + eax + 1]
inc ebx
cmp ebx, dword [ebp - 0x10]
jb 0x10015fb7
lea eax, [ebp - 0x11c]
push eax
call fcn.10015a95
or eax, eax
jne 0x1001609e
lea eax, [ebp - 0x11c]
push eax
call fcn.1002fd52
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.10050fba
push dword [ebp + 0x10]
push dword [ebp + 0x14]
lea eax, [ebp - 0x130]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.100510f8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x11c]
push eax
call fcn.10050fc0
cmp eax, 0xffffffff
je 0x1001609e
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x18]
push dword [ebp - 4]
call fcn.100510ec
push dword [ebp - 4]
call fcn.10050fb4
lea eax, [ebp - 0x18]
push eax
call fcn.1003d00f
pop ebx
pop edi
pop esi
leave
ret 0x14
lea eax, [ebp - 0x11c]
push eax
call fcn.10015a95
or eax, eax
jne 0x100160fe
lea eax, [ebp - 0x11c]
push eax
call fcn.1002fd52
push dword [ebp + 0x10]
push dword [ebp + 0x14]
lea eax, [ebp - 0x130]
push eax
call fcn.10050e22
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.100510f8
lea eax, [ebp - 0x11c]
push eax
call fcn.10050fd2
pop ebx
pop edi
pop esi
leave
ret 0x14