joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100118f0
Capabilities:
Check if file exists
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100c4758
push 0x1006c790
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a18
call fcn.10061890
mov eax, dword [0x100cd4bc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a2c], esi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x10011a9e
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10011a9e
mov eax, 1
cmp dword [ebp + 0xc], 0
je 0x10011989
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011963
sub ecx, edx
sar ecx, 1
je 0x10011980
push edi
push esi
call fcn.100556f0
add esp, 8
jmp 0x10011989
push esi
call fcn.10055b90
add esp, 4
test eax, eax
je 0x10011a9e
mov dword [ebp - 4], 0
call fcn.10010860
mov dword [ebp - 4], 0xfffffffe
jmp 0x100119bc
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.1006c590
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.1006c590
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10011a9e
push 0x208
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.1006c590
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.1007ba58
lea eax, [ebp - 0x224]
push eax
call fcn.100740ab
add esp, 0x1c
xor esi, esi
cmp dword [ebp - 0x2a28], esi
jbe 0x10011a9e
nop dword [eax]
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + esi*4 - 0x2a24]
call fcn.10011060
add esp, 0xc
test eax, eax
je 0x10011a95
lea eax, [ebp - 0xa24]
push eax
call fcn.100740ab
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1007b7f8
add esp, 0xc
test eax, eax
je 0x10011abc
inc esi
cmp esi, dword [ebp - 0x2a28]
jb 0x10011a50
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret
mov eax, 1
jmp 0x10011aa0
Function at 0x10011ad0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100c4778
push 0x1006c790
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a18
call fcn.10061890
mov eax, dword [0x100cd4bc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a30], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2a2c], edi
test esi, esi
je 0x10011c7a
mov dword [ebp - 4], 0
call fcn.10010860
mov dword [ebp - 4], 0xfffffffe
jmp 0x10011b5b
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.1006c590
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.1006c590
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10011c7a
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.1007ba58
lea eax, [ebp - 0x224]
push eax
call fcn.100740ab
add esp, 0x10
xor esi, esi
cmp dword [ebp - 0x2a28], esi
jbe 0x10011c7a
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + esi*4 - 0x2a24]
call fcn.10011060
add esp, 0xc
test eax, eax
je 0x10011c6d
lea eax, [ebp - 0xa24]
push eax
call fcn.100740ab
add esp, 4
lea eax, [ebp - 0xa24]
push eax
call ebx
lea ecx, [ebp - 0x224]
push ecx
push eax
call fcn.1007b7f8
add esp, 8
test eax, eax
jne 0x10011c6d
test edi, edi
je 0x10011c5a
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10011c37
sub eax, edx
sar eax, 1
je 0x10011c5a
push edi
lea eax, [ebp - 0xa24]
push eax
call fcn.100556f0
add esp, 8
jmp 0x10011c69
lea eax, [ebp - 0xa24]
push eax
call fcn.10055b90
add esp, 4
test eax, eax
jne 0x10011c98
inc esi
cmp esi, dword [ebp - 0x2a28]
jb 0x10011be3
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret
mov eax, 1
jmp 0x10011c7c
Function at 0x10011ca0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100c4798
push 0x1006c790
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2a18
call fcn.10061890
mov eax, dword [0x100cd4bc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2a30], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2a2c], edi
test esi, esi
je 0x10011e39
mov dword [ebp - 4], 0
call fcn.10010860
mov dword [ebp - 4], 0xfffffffe
jmp 0x10011d2b
push 0x800
push 0
lea eax, [ebp - 0xa24]
push eax
call fcn.1006c590
mov dword [ebp - 0x2a28], 0
push 0x2000
push 0
lea eax, [ebp - 0x2a24]
push eax
call fcn.1006c590
add esp, 0x18
lea eax, [ebp - 0x2a28]
push eax
push 0x800
lea eax, [ebp - 0x2a24]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x10011e39
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call fcn.1007ba58
lea eax, [ebp - 0x224]
push eax
call fcn.100740ab
add esp, 0x10
xor esi, esi
cmp dword [ebp - 0x2a28], esi
jbe 0x10011e39
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x400
lea eax, [ebp - 0xa24]
push eax
push dword [ebp + esi*4 - 0x2a24]
call fcn.10011060
add esp, 0xc
test eax, eax
je 0x10011e2c
lea eax, [ebp - 0xa24]
push eax
call fcn.100740ab
add esp, 4
lea eax, [ebp - 0xa24]
push eax
call ebx
lea ecx, [ebp - 0x224]
push ecx
push eax
call fcn.1007b7f8
add esp, 8
test eax, eax
jne 0x10011e2c
test edi, edi
je 0x10011e57
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10011e07
sub eax, edx
sar eax, 1
je 0x10011e57
push edi
lea eax, [ebp - 0xa24]
push eax
call fcn.100556f0
add esp, 8
test eax, eax
jne 0x10011e57
inc esi
cmp esi, dword [ebp - 0x2a28]
jb 0x10011db3
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret
mov eax, 1
jmp 0x10011e3b
Function at 0x100123f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100c4960
push 0x1006c790
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x100cd4bc]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
push 0x200
push 0
lea eax, [ebp - 0x42c]
push eax
call fcn.1006c590
push edi
push str.SYSTEMCurrentControlSetServices_sParameters
push 0xff
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x430]
push eax
push 0x20219
push 0
lea eax, [ebp - 0x42c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10012509
mov dword [ebp - 0x438], eax
push 0x210
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.1006c590
add esp, 0xc
mov dword [ebp - 0x434], 0x210
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
push str.ServiceDll
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10012509
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jle 0x10012509
push ecx
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 4], 0xfffffffe
call fcn.1001253b
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016dd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, ecx
push 0
push eax
call fcn.1006c590
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x10016e3e
nop dword [eax + eax]
lea eax, [ebp - 0x20c]
push eax
call ebx
sub esi, 1
jne 0x10016e30
push str.netwarp.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10016ecc
cmp dword [edi], 0
jne 0x10016ea2
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10016ecc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x10016ea2
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x10016ecc
cmp dword [edi + 4], 0
je 0x10016ecc
cmp dword [edi + 0xc], 0
je 0x10016ecc
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100612dc
mov esp, ebp
pop ebp
ret 4
Function at 0x10017ea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e008
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x100cd4bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push dword [ebp + 8]
mov dword [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10017f4c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10017f4c
lea eax, [ebp + 0x10]
push eax
lea ecx, [edi + 0xc]
call fcn.100015d0
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x100bf9a0
call fcn.10002180
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x14], esp
mov esi, esp
mov byte [ebp - 4], 3
push eax
mov dword [ebp - 0x18], esi
call fcn.100016d0
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov esi, esp
add eax, 0xfffffff0
mov byte [ebp - 4], 4
push eax
mov dword [ebp - 0x18], esi
call fcn.100016d0
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.10017fc0
mov edx, dword [ebp + 8]
or esi, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10017f6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0xc]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10017f8b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10017faa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10020500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x706d6f43
mov dword [ebp - 0xc], 0x56657261
mov dword [ebp - 8], 0x69737265
mov word [ebp - 4], 0x6e6f
mov byte [ebp - 2], 0
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x1002057d
mov eax, dword [ecx]
push 1
push 0xe
call dword [eax]
test eax, eax
je 0x10020587
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xe
jl 0x10020573
mov dword [eax - 0xc], 0xe
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xe
push eax
push 0xe
mov byte [ecx + 0xe], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3

Function at 0x10020590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x50746547
mov dword [ebp - 0xc], 0x75646f72
mov dword [ebp - 8], 0x614e7463
mov word [ebp - 4], 0x656d
mov byte [ebp - 2], 0
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x1002060d
mov eax, dword [ecx]
push 1
push 0xe
call dword [eax]
test eax, eax
je 0x10020617
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xe
jl 0x10020603
mov dword [eax - 0xc], 0xe
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xe
push eax
push 0xe
mov byte [ecx + 0xe], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3

Function at 0x10020730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x100a6210]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x776f4c68
mov dword [ebp - 0xc], 0x76697250
mov dword [ebp - 8], 0x67656c69
mov word [ebp - 4], 0x65
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x100207b4
mov eax, dword [ecx]
push 1
push 0x1d
call dword [eax]
test eax, eax
je 0x100207be
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x1d
jl 0x100207aa
mov dword [eax - 0xc], 0x1d
lea eax, [ebp - 0x20]
mov ecx, dword [esi]
push 0x1d
push eax
push 0x1d
mov byte [ecx + 0x1d], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3
Function at 0x1002f5a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1002f629
cmp dword [ebp + 0x10], 0
je 0x1002f629
cmp dword [ebp + 0x14], 0
je 0x1002f629
cmp dword [ebp + 0xc], 0x104
jge 0x1002f5d9
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002f5d9
push esi
push dword [edi + 8]
call fcn.10033d70
jmp 0x1002f5e2
push esi
push dword [edi + 8]
call fcn.10033fd0
add esp, 8
test eax, eax
jne 0x1002f610
push eax
push 0xffffffffffffffff
push eax
push dword [edi + 8]
call fcn.100326d0
add esp, 0x10
test eax, eax
jne 0x1002f610
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push eax
call fcn.1002f180
pop edi
pop esi
pop ebp
ret 0x10
push dword [ebp + 0x14]
mov eax, 1
mov ecx, edi
push dword [ebp + 0x10]
push eax
call fcn.1002f180
pop edi
pop esi
pop ebp
ret 0x10
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10

Function at 0x1003a460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x1003a482
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x44], eax
mov eax, dword [esi + 0x70]
push 1
add eax, 4
push eax
call fcn.1006cde3
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov byte [esi + 6], cl
cmp dword [eax + 0x58], 0
je 0x1003a4a4
push ecx
push esi
call fcn.1003a5e0
mov eax, dword [esi + 0x10]
push esi
mov eax, dword [eax + 0x58]
call eax
add esp, 0xc
push 1
call fcn.1007fb12
int3

Function at 0x1003d4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, 1
call fcn.10032360
add esp, 4
sub eax, esi
je 0x1003d520
mov edi, dword [ebp + 0x10]
dec eax
push edi
push ebx
mov dword [ebp - 8], eax
call fcn.100331c0
add esp, 8
cmp eax, 3
jne 0x1003d542
test esi, esi
je 0x1003d516
push edi
push ebx
call fcn.100330c0
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.10033330
add esp, 0x10
test eax, eax
jg 0x1003d56a
xor esi, esi
mov eax, dword [ebp - 8]
inc edi
test eax, eax
jne 0x1003d4e1
call fcn.1006f9b7
mov edi, dword [eax]
test esi, esi
je 0x1003d571
push 1
push ebx
call fcn.10032740
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.10033750
add esp, 0xc
test esi, esi
je 0x1003d516
push dword [ebp + 0xc]
push dword [ebp - 4]
push 1
push eax
call fcn.1008082e
add esp, 0x10
cmp eax, dword [ebp - 4]
jne 0x1003d516
mov esi, 1
jmp 0x1003d518
push ebx
call fcn.100328c0
push edi
call fcn.1007e642
push eax
push 0x100a68c8
push ebx
call fcn.10032800
push edi
push ebx
call fcn.10032830
add esp, 0x1c
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10054ec0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a0d7b
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x20], 8
lea esi, [edi + 0xc]
jb 0x10054efb
mov esi, dword [esi]
push 0x180
push 0x40
push 0x8101
lea ebx, [edi + 0x24]
push esi
push ebx
call fcn.10088263
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x10054fcc
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.1006c590
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.10053cc0
push 0x100ab6c4
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push esi
push str.open
push eax
call fcn.10009210
add esp, 8
push eax
call fcn.10009210
add esp, 8
push eax
call fcn.10009210
add esp, 8
mov ecx, eax
call fcn.10014ed0
push eax
call fcn.10009210
add esp, 8
lea eax, [ebp - 0xc4]
lea ecx, [ebp - 0xa8]
push eax
call fcn.10055010
cmp dword [eax + 0x14], 8
jb 0x10054faf
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xc4]
call fcn.10003aa0
lea ecx, [ebp - 0xa8]
call fcn.10003f50
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x10054fe5
push 2
push 0
push eax
call fcn.10088791
add esp, 0xc
mov dword [edi + 4], eax
jmp 0x10054fec
mov dword [edi + 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret
Function at 0x10055350
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a0e78
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x44]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
cmp eax, 2
je 0x10055532
cmp eax, 1
jne 0x1005554a
cmp byte [edi + 8], 0
je 0x100553a6
call fcn.10054ec0
mov byte [edi + 8], 0
cmp dword [edi + 4], 0x40000000
jle 0x100553e2
mov eax, dword [edi + 0x24]
cmp eax, 0xffffffff
je 0x100553c7
push eax
call fcn.1008832d
add esp, 4
mov dword [edi + 0x24], 0xffffffff
cmp dword [edi + 0x20], 8
lea eax, [edi + 0xc]
jb 0x100553d2
mov eax, dword [eax]
push eax
call fcn.10087818
add esp, 4
mov ecx, edi
call fcn.10054ec0
cmp dword [edi + 0x28], 0
jne 0x1005547d
push 0
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.100550d0
add esp, 0xc
push 2
push 0x100ab6fc
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.10006cd0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
mov ecx, dword [edi + 0x24]
cmovae eax, dword [ebp - 0x48]
cmp ecx, 0xffffffff
je 0x10055462
push dword [ebp - 0x38]
push eax
push ecx
call fcn.10088d62
add esp, 0xc
jmp 0x10055465
or eax, 0xffffffff
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x2c], eax
call fcn.10002630
lea ecx, [ebp - 0x60]
call fcn.10002630
jmp 0x10055526
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 1
push esi
push eax
call fcn.100550d0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
lea ecx, [edi + 0x2c]
push ecx
push eax
call fcn.1005ff70
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.10002630
test esi, esi
jne 0x100554d8
push 0xd
push str.write_failed.
lea ecx, [ebp - 0x28]
call fcn.100143c0
push 0x100ab6fc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.10053580
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x100554f8
mov eax, dword [eax]
mov ecx, dword [edi + 0x24]
cmp ecx, 0xffffffff
je 0x1005550d
push edx
push eax
push ecx
call fcn.10088d62
add esp, 0xc
jmp 0x10055510
or eax, 0xffffffff
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x2c], eax
call fcn.10002630
lea ecx, [ebp - 0x28]
call fcn.10002630
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x10055532
add dword [edi + 4], eax
jmp 0x1005554a
cmp dword [esi + 0x14], 8
jb 0x1005553a
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x100a5ec8
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret 4