joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cca0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010a7dd
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x88], edi
cmp dword [esi + 0x10], ebx
jne 0x1000cd00
push ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
push 0x1012307e
mov ecx, edi
mov byte [edi], bl
call fcn.10004560
jmp 0x1000ce51
lea eax, [ebp - 0x138]
push eax
mov byte [ebp - 0x18], bl
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x80], 0x67452301
mov dword [ebp - 0x7c], 0xefcdab89
mov dword [ebp - 0x78], 0x98badcfe
mov dword [ebp - 0x74], 0x10325476
call fcn.1000ee30
mov dword [ebp - 4], 1
cmp dword [esi + 0x14], 8
jb 0x1000cd42
mov ecx, dword [esi]
jmp 0x1000cd44
mov ecx, esi
push 0x21
lea esi, [ebp - 0x128]
call fcn.1000fa30
test eax, eax
jne 0x1000cd79
mov ecx, dword [ebp - 0x138]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + ecx - 0x12c]
lea ecx, [ebp + ecx - 0x138]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x1000cd9a
or eax, 4
jmp 0x1000cd9a
mov edx, dword [ebp - 0x138]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + ecx - 0x100]
lea ecx, [ebp + ecx - 0x138]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
push ebx
push eax
call fcn.100113e0
cmp dword [ebp - 0xd4], ebx
jne 0x1000cde3
push ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
push 0x1012307e
mov ecx, edi
mov byte [edi], bl
call fcn.10004560
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x84], 1
mov byte [ebp - 4], bl
call fcn.1000ef60
lea eax, [ebp - 0xd0]
push eax
jmp 0x1000ce3f
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x80]
mov byte [ebp - 0x18], bl
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x80], 0x67452301
mov dword [ebp - 0x7c], 0xefcdab89
mov dword [ebp - 0x78], 0x98badcfe
mov dword [ebp - 0x74], 0x10325476
call fcn.10012aa0
push edi
lea ecx, [ebp - 0x80]
call fcn.100135e0
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x84], 1
mov byte [ebp - 4], bl
call fcn.1000ef60
lea edx, [ebp - 0xd0]
push edx
mov dword [ebp - 0xd0], vtable.std::ios_base.0
call fcn.1008178a
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1000d020
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101085db
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x10137920]
xor eax, esp
mov dword [esp + 0x274], eax
push esi
push edi
mov eax, dword [0x10137920]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x10], esi
je 0x1000d1af
push 0xffffffffffffffff
push esi
xor eax, eax
push edi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], esi
mov word [esp + 0x1c], ax
call fcn.1000b050
mov dword [esp + 0x290], esi
push 0x2f
lea esi, [esp + 0x14]
call fcn.1000bd60
push 0x5c
call fcn.1000bd60
add esp, 8
cmp dword [esp + 0x20], 3
mov esi, 8
ja case.default.0x1000d0ce
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], esi
jae 0x1000d0c2
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
ja case.default.0x1000d0ce
jmp dword [eax*4 + 0x1000d1d4]
lea ecx, [esp + 0x10]
call fcn.1000b180
jmp 0x1000d1af
lea ecx, [esp + 0x10]
call fcn.1000b180
mov al, 1
jmp 0x1000d1b1
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], esi
jae 0x1000d101
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x1000d171
mov eax, dword [edi + 0x10]
lea ecx, [eax - 1]
cmp eax, ecx
ja 0x1000d126
push str.invalid_string_position
call fcn.10080f9c
mov edx, dword [edi + 0x14]
cmp edx, esi
jb 0x1000d131
mov eax, dword [edi]
jmp 0x1000d133
mov eax, edi
cmp word [eax + ecx*2], 0x5c
je 0x1000d15a
cmp dword [edi + 0x10], ecx
ja 0x1000d149
push str.invalid_string_position
call fcn.10080f9c
cmp edx, esi
jb 0x1000d14f
mov edi, dword [edi]
cmp word [edi + ecx*2], 0x2f
jne case.0x1000d0ce.0
cmp dword [esp + 0x24], esi
jb 0x1000d16d
mov edx, dword [esp + 0x10]
push edx
call fcn.10065453
add esp, 4
mov al, 1
jmp 0x1000d1b1
test byte [esp + 0x2c], 0x10
push eax
je 0x1000d196
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x24], esi
jb 0x1000d16d
mov eax, dword [esp + 0x10]
push eax
call fcn.10065453
add esp, 4
mov al, 1
jmp 0x1000d1b1
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x24], esi
jb 0x1000d1af
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10065453
add esp, 4
xor al, al
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1000d6f0
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10108558
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
xor ebx, ebx
xor ecx, ecx
push ebx
mov word [ebp - 0x2c], cx
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
call fcn.1000b050
lea eax, [ebx + 0x20]
lea edi, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.1000be20
lea edi, [ebx + 8]
cmp dword [ebp - 0x1c], ebx
je 0x1000d76d
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x1000d75d
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
cmp al, bl
jne 0x1000d785
cmp dword [ebp - 0x18], edi
jb 0x1000d77e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
mov al, 1
jmp 0x1000d858
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006669a
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x1000d7b1
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
add eax, 2
push eax
push esi
call fcn.10066bc0
mov edx, dword [ebp - 0x1c]
xor eax, eax
xor ecx, ecx
mov word [esi + edx*2], cx
mov ecx, dword [ebp - 0x1c]
mov word [esi + ecx*2 + 2], ax
mov edx, 0x414
mov dword [ebp - 0x40], eax
or word [ebp - 0x40], dx
add esp, 0xc
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x34], ax
mov dword [ebp - 0x3a], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x36], ebx
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ebx
cmp byte [ebp + 0xc], bl
je 0x1000d819
or word [ebp - 0x40], 0x40
jmp 0x1000d822
mov eax, 0xffbf
and word [ebp - 0x40], ax
lea ecx, [ebp - 0x50]
push ecx
mov byte [ebp - 0x2d], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1000d837
mov byte [ebp - 0x2d], bl
cmp esi, ebx
je 0x1000d844
push esi
call fcn.100654af
add esp, 4
cmp dword [ebp - 0x18], edi
jb 0x1000d855
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10065453
add esp, 4
mov al, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1000dc30
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
push edi
je 0x1000dcdb
mov ebx, 8
cmp dword [esi + 0x14], ebx
jb 0x1000dc51
mov eax, dword [esi]
jmp 0x1000dc53
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x1000dcdb
mov ecx, esi
call fcn.1000d020
test al, al
je 0x1000dc75
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
cmp dword [esi + 0x14], ebx
jb 0x1000dc7e
mov eax, dword [esi]
jmp 0x1000dc80
mov eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
jne 0x1000dcdb
cmp byte [ebp + 0xc], al
je 0x1000dcdb
cmp dword [esi + 0x14], ebx
jb 0x1000dc9b
mov eax, dword [esi]
jmp 0x1000dc9d
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x1000dcbe
and eax, 0xfffffffe
cmp dword [esi + 0x14], ebx
jb 0x1000dcb4
mov ecx, dword [esi]
jmp 0x1000dcb6
mov ecx, esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], ebx
jb 0x1000dcc7
mov eax, dword [esi]
jmp 0x1000dcc9
mov eax, esi
push eax
call edi
test eax, eax
jne 0x1000dcdb
mov ecx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.1000e820
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x1000dcf0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
jne 0x1000dd02
mov al, 1
pop esi
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x1000dd0c
mov eax, dword [esi]
jmp 0x1000dd0e
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1000dd2f
push esi
call fcn.1000d880
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.1000d6f0
add esp, 0xc
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call fcn.1000dc30
add esp, 8
pop esi
pop ebp
ret
Function at 0x1000e820
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101072a7
mov eax, dword fs:[0]
push eax
sub esp, 0xd8
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x7e
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x8e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x90], ax
call fcn.10066620
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea edx, [ebp - 0x90]
push 0x10123340
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x98], 7
mov dword [ebp - 0x9c], ebx
mov word [ebp - 0xac], ax
push 4
push ebx
push str..tmp
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.10009d20
lea ecx, [ebp - 0xe4]
cmp eax, 0xffffffff
je 0x1000e8ed
add eax, 4
push eax
push ebx
push ecx
mov ecx, esi
call fcn.1000c0d0
lea edx, [ebp - 0x90]
push edx
push eax
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 4], 1
call fcn.100102a0
add esp, 0xc
mov byte [ebp - 4], 2
jmp 0x1000e918
push str..tmp
push esi
push ecx
call fcn.10010100
lea edx, [ebp - 0x90]
push edx
push eax
lea eax, [ebp - 0xc8]
push eax
mov byte [ebp - 4], 3
call fcn.100102a0
add esp, 0x18
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0xac]
call fcn.10009ca0
mov edi, 8
cmp dword [ebp - 0xb4], edi
jb 0x1000e940
mov ecx, dword [ebp - 0xc8]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov word [ebp - 0xc8], dx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], 7
cmp dword [ebp - 0xd0], edi
jb 0x1000e970
mov eax, dword [ebp - 0xe4]
push eax
call fcn.10065453
add esp, 4
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x98], edi
jae 0x1000e984
lea eax, [ebp - 0xac]
cmp dword [esi + 0x14], edi
jb 0x1000e98b
mov esi, dword [esi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1000e9e5
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x98], edi
jae 0x1000e9ab
lea eax, [ebp - 0xac]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1000e9ca
cmp dword [ebp - 0x98], edi
jb 0x1000e9fc
mov ecx, dword [ebp - 0xac]
push ecx
jmp 0x1000e9f4
cmp dword [ebp - 0x98], edi
jb 0x1000e9e1
mov edx, dword [ebp - 0xac]
push edx
call fcn.10065453
add esp, 4
mov al, 1
jmp 0x1000e9fe
cmp dword [ebp - 0x98], edi
jb 0x1000e9fc
mov eax, dword [ebp - 0xac]
push eax
call fcn.10065453
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1000ecc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x1000ecd0
xor al, al
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x1000ecd8
mov eax, dword [eax]
push ebx
mov bl, byte [ebp + 0x14]
xor ecx, ecx
push esi
test bl, bl
setne cl
push 0
push 0x80
lea ecx, [ecx + ecx + 2]
push ecx
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000ed0d
pop esi
xor al, al
pop ebx
pop ebp
ret
test bl, bl
je 0x1000ed1e
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push 0
lea edx, [ebp + 8]
push edx
push eax
push ecx
push esi
mov bl, 1
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000ed42
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x1000ed50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x1000ed63
xor al, al
mov esp, ebp
pop ebp
ret
cmp dword [eax + 0x14], 8
jb 0x1000ed6b
mov eax, dword [eax]
push esi
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000ed93
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp + 8]
push eax
push esi
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp + 8], 0
mov edi, eax
je 0x1000edbd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x1000edd5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp edi, eax
jbe 0x1000edf0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x14]
mov dword [edx], edi
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1000edf6
mov eax, edi
mov edx, dword [ebp + 0xc]
push ebx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push edx
push esi
mov bl, 1
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000ee18
xor bl, bl
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push esi
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ee30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10106d07
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10137920]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x10123360
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov dword [ebx + edx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.10010e50
lea esi, [ebx + 0x10]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.10010050
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x1000eec9
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.100113e0
mov dword [ebp - 4], 2
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov ecx, esi
mov dword [ebx + edx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.1000ff20
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x1013b828]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fc00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10106c28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x1000fd21
cmp byte [edi + 0x49], bl
je 0x1000fd21
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x1000fd15
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x1000fc75
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x1000fc8d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x1000fcb6
dec eax
je 0x1000fcba
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x1000fd10
jmp 0x1000fd1c
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x1000fcca
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x1000fcf3
cmp ebx, 0x10
jae 0x1000fcd9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.10067b53
add esp, 0x10
cmp esi, eax
jne 0x1000fd0d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x1000fd19
test esi, esi
jne 0x1000fc81
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10009ad0
jmp 0x1000fc7b
lea ecx, [ebp - 0x2c]
call fcn.100f0520
xor al, al
jmp 0x1000fd23
lea ecx, [ebp - 0x2c]
call fcn.100f0520
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret
Function at 0x1000ff20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10105e8b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10137920]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100818da
push 4
mov dword [ebp - 4], 0
call fcn.100656b5
mov edi, eax
add esp, 4
test edi, edi
je 0x1000ffa0
call fcn.10081543
mov dword [edi], eax
call fcn.10081302
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.10081237
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1000ff96
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1008125f
jmp 0x1000ffa2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011900
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101083c0
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x10137920]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x6c], esi
cmp dword [edi + 0x10], esi
je 0x10011966
cmp dword [edi + 0x14], 8
jb 0x1001193d
mov eax, dword [edi]
jmp 0x1001193f
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
test al, al
je 0x10011966
xor eax, eax
push 0xffffffffffffffff
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], esi
mov word [ebx], ax
push esi
jmp 0x10011b09
cmp byte [edi + 0x134], 0
je 0x10011a0d
cmp dword [edi + 0x128], esi
je 0x10011a0d
call fcn.10019850
lea esi, [ebp - 0x48]
cmp eax, 1
je 0x100119a9
call fcn.1001c410
mov dword [ebp - 0x68], eax
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.1001c3b0
mov byte [ebp - 4], 1
jmp 0x100119c4
call fcn.1001c440
mov dword [ebp - 0x68], eax
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.1001c3e0
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.1000a320
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x118]
push ecx
mov ecx, eax
call fcn.1000a320
mov edx, dword [ebp - 0x68]
push 0xffffffffffffffff
push 0
push edx
mov ecx, eax
call fcn.1000a320
lea ecx, [ebp - 0x2c]
call fcn.1000b180
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], 0xffffffff
call fcn.1000b180
jmp 0x10011af3
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x68], reloc.WS2_32.dll_accept
call fcn.1001c470
mov dword [ebp - 0x6c], eax
lea esi, [ebp - 0x48]
mov dword [ebp - 4], 4
call fcn.1001c320
mov edx, dword [ebp - 0x6c]
push 0
lea ecx, [ebp - 0x68]
push ecx
mov ecx, eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.10011fc0
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.10009ca0
mov esi, 8
cmp dword [ebp - 0x50], esi
jb 0x10011a67
mov edx, dword [ebp - 0x64]
push edx
call fcn.10065453
add esp, 4
xor eax, eax
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], 0
mov word [ebp - 0x64], ax
cmp dword [ebp - 0x34], esi
jb 0x10011a8c
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], dx
cmp dword [ebp - 0x18], esi
jb 0x10011ab8
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10065453
add esp, 4
cmp dword [edi + 0x10], 0
ja 0x10011af3
push 0x10110008
lea esi, [ebp - 0x2c]
call fcn.10012840
push eax
mov ecx, edi
mov dword [ebp - 4], 7
call fcn.10009ca0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x10011af3
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10065453
add esp, 4
xor edx, edx
push 0xffffffffffffffff
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], dx
push edx
push edi
mov ecx, ebx
call fcn.1000b050
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006656c
mov esp, ebp
pop ebp
ret