joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.10003d00]
mov dword [ebp - 4], eax
jmp 0x10003d11
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x10003d35
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10003d35
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [0x10028a9c]
add ecx, 0xfffff00b
mov dword [0x10028a9c], ecx
mov dword [ebp - 4], eax
jmp 0x10003d11

Function at 0x10004480
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x30
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, 0x187f
xor edx, edx
mov esi, dword [ebp - 8]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [0x10028a9c], 0x187f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
add ecx, 0xffffe734
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], esi
je 0x10004572
jmp 0x10004547
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x2a], dx
mov eax, 1
mov cx, word [ebp - 0x2a]
cmp cx, 0x6c
mov dword [ebp - 0x30], eax
je 0x100045e0
jmp 0x100045cf
mov eax, dword [0x10028a9c]
add eax, 0xffffddda
mov dword [0x10028a9c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1000458f
jmp 0x100045cf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x100045af
jmp 0x100045cf
mov dword [0x10028aa0], 0x1ef9
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, dword [ebp - 0x20]
mov edx, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
jl 0x100044bd
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x10028a9c], ecx
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
je 0x10004510
jmp 0x100045cf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x100045cf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10004533
jmp 0x100045cf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
sete dl
mov byte [ebp - 0x31], dl
mov al, byte [ebp - 0x31]
test al, 1
jne 0x100044e5
jmp 0x100045cf
mov dword [0x10028a9c], 0x1713
xor eax, eax
mov dword [ebp - 0x30], eax
jmp 0x100045e0
mov eax, dword [ebp - 0x30]
add esp, 0x30
pop esi
pop ebp
ret
Function at 0x100166d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100166e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10016724
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10016720
lea ebx, [ebx]
cmp esi, edx
jae 0x10016724
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10016710
cmp esi, edx
jb 0x10016729
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10016ca0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064a98
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100834b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
lea eax, [ebp + 8]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.10012c30
lea ecx, [ebp - 0x28]
call fcn.10017820
mov esi, eax
add esp, 0x18
lea eax, [ebp + 8]
cmp eax, esi
je 0x10016d31
cmp dword [ebp + 0x1c], 0x10
jb 0x10016d16
push dword [ebp + 8]
call fcn.1002518b
add esp, 4
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
call fcn.10011e90
cmp dword [ebp - 0x14], 0x10
jb 0x10016d42
push dword [ebp - 0x28]
call fcn.1002518b
add esp, 4
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmovae eax, dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x10016d6c
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call esi
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 0x10
jb 0x10016d90
push dword [ebp + 8]
call fcn.1002518b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017470
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064bd0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100834b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
lea eax, [ebp + 8]
mov dword [ebp - 0x14], 7
push eax
mov dword [ebp - 0x18], 0
call fcn.100122c0
sub esp, 0x18
mov byte [ebp - 4], 1
mov esi, esp
xor eax, eax
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.100122c0
mov ecx, esi
call fcn.1001a070
add esp, 0x18
call fcn.10016b40
add esp, 0x18
mov bl, al
cmp dword [ebp - 0x14], 8
jb 0x10017513
push dword [ebp - 0x28]
call fcn.1002518b
add esp, 4
test bl, bl
jne 0x1001751b
mov bl, 1
jmp 0x10017549
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0x80
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x1001755a
push dword [ebp + 8]
call fcn.1002518b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018e90
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065010
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae eax, dword [ebp + 8]
push eax
movzx eax, cx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10018f45
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x10018f45
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10018f45
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10018f45
cmp dword [ebp + 0x34], 0x10
lea ecx, [ebp + 0x20]
push 0
cmovae ecx, dword [ebp + 0x20]
push 0
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x10018f99
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
cmp dword [ebp + 0x1c], 0x10
jb 0x10018f58
push dword [ebp + 8]
call fcn.1002518b
add esp, 4
cmp dword [ebp + 0x34], 0x10
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
jb 0x10018f7b
push dword [ebp + 0x20]
call fcn.1002518b
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10030010
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
lea eax, [ebp + 0x20]
mov ecx, esp
push eax
call fcn.10012d60
call fcn.10016b40
add esp, 0x18
mov bl, al
jmp 0x10018f47

Function at 0x10018fc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0x10
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x24]
push eax
movzx eax, cx
push eax
push edi
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x1001903c
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x1001903c
cmp dword [ebp - 8], 0
jne 0x1001900f
mov eax, dword [ebp - 4]
mov bl, 1
mov dword [eax], esi
jmp 0x1001903e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001903c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1001903c
push esi
push eax
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp - 8]
call fcn.10030fb2
add esp, 0x10
mov bl, 1
jmp 0x1001903e
xor bl, bl
cmp dword [ebp + 0x1c], 0x10
jb 0x1001904f
push dword [ebp + 8]
call fcn.1002518b
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006542a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1004d8a7
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x100194c6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.1003f1c3
push 0x10080bd0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.10031496
push edi
push esi
call fcn.1004a684
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10030010
mov esp, ebp
pop ebp
ret 4

Function at 0x100194f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006542a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x18], esi
call fcn.1004d8a7
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10019596
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.1003f1c3
push 0x10080bd0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.10031496
push edi
push 0x3f
push esi
call fcn.1004c42f
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10030010
mov esp, ebp
pop ebp
ret 8

Function at 0x1001a5b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1001a5e1
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1001a5d0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1001ade0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1001ae11
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1001ae00
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1001d2b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1001d2bb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1001d385
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
dec edi
jne 0x1001d2d0
pop edi
test esi, esi
je 0x1001d3aa
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x10076460]
dec esi
jne 0x1001d390
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1001d3c0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x10076460]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x10076460]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x1001d410
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov bl, dl
mov edx, ecx
push edi
mov edi, dword [edx + 8]
mov esi, edi
mov ecx, dword [edx]
and esi, 0xfffd
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor bl, al
movsx eax, bl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x10076460]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
and eax, 0xff
xor edi, dword [eax*4 + 0x10076460]
mov al, bl
mov dword [edx + 8], edi
pop edi
pop esi
pop ebx
ret
Function at 0x1001db80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp byte [edi], 0
je 0x1001dbc6
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001dbc1
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x1001dbee
mov edx, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x1001dbd7
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 8]
call fcn.10037500
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
div ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10030010
mov esp, ebp
pop ebp
ret

Function at 0x1001dc10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
mov edi, 1
cmp byte [esi], 0
je 0x1001dc55
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 5]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001dc50
mov byte [esi + 8], 1
mov edi, dword [ebp - 0xc]
jmp 0x1001dc82
mov ebx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1001dc66
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp - 5]
push eax
call fcn.10037500
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
cmp edi, 1
jne 0x1001dca0
movzx eax, byte [ebp - 5]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030010
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x1001dc8d
cmp byte [esi + 8], 0
je 0x1001dc8d
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10030010
mov esp, ebp
pop ebp
ret
Function at 0x1001dd60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x1001dda9
cmp byte [edi + 1], 0
je 0x1001dd97
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1001ddaf
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030010
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], eax
cmp byte [edi], 0
push ebx
je 0x1001ddd4
cmp byte [edi + 1], 0
je 0x1001ddcd
push 1
push 0
push 0
push dword [edi + 4]
call ecx
mov ebx, eax
sub ebx, dword [edi + 0xc]
jmp 0x1001ddd7
xor ebx, ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001dde6
mov ebx, dword [edi + 0x1c]
mov eax, 0xffff
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
cmp ebx, eax
jae 0x1001dde9
mov dword [ebp - 0x10], ebx
push esi
push 0x404
call fcn.10031404
mov esi, eax
add esp, 4
test esi, esi
jne 0x1001de11
pop esi
pop ebx
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10030010
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov eax, 4
mov dword [ebp - 0xc], 0xffffffff
cmp ecx, eax
jbe 0x1001df18
jmp 0x1001de30
add eax, 0x400
cmp eax, ecx
mov edx, eax
mov eax, 0x404
cmova edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x20], edx
sub ebx, ecx
mov dword [ebp - 0x1c], ecx
cmp ebx, 0x404
cmova ebx, eax
cmp byte [edi], 0
je 0x1001de7a
cmp byte [edi + 1], 0
je 0x1001df18
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1001de7d
mov dword [edi + 0x1c], ecx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 0x18], ebx
je 0x1001dea5
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001dea0
mov byte [edi + 8], 1
mov eax, dword [ebp - 8]
jmp 0x1001dece
mov edx, dword [edi + 0x1c]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
jbe 0x1001deb8
mov ecx, dword [edi + 0x18]
sub ecx, edx
mov dword [ebp - 0x18], ecx
push ecx
mov ecx, dword [edi + 0x14]
add ecx, edx
push ecx
push esi
call fcn.10037500
mov eax, dword [ebp - 0x18]
add esp, 0xc
add dword [edi + 0x1c], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x1001df18
lea eax, [ebx - 3]
test eax, eax
js 0x1001df00
mov edi, edi
dec eax
cmp byte [eax + esi], 0x50
jne 0x1001defc
cmp byte [eax + esi + 1], 0x4b
jne 0x1001defc
cmp byte [eax + esi + 2], 5
jne 0x1001defc
cmp byte [eax + esi + 3], 6
je 0x1001df35
test eax, eax
jns 0x1001dee0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x1001df18
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
cmp eax, ecx
jb 0x1001de30
push esi
call fcn.10030a83
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 0xc]
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.10030010
mov esp, ebp
pop ebp
ret
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x1001df03
Function at 0x1001edd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x1001ee77
cmp dword [esi + 4], 0xffffffff
jne 0x1001ee77
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ee02
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x1001ee39
cmp eax, 0x2f
je 0x1001ee39
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x1001ee26
mov eax, dword [0x1007525c]
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.1001dae0
add esp, 8
test eax, eax
jne 0x1001ee58
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
call fcn.1001df40
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
cmove ecx, edx
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001f590
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100834b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x1001f5c2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001f5c2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x1001f6ac
push edi
mov edi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x1001f5df
cmp ax, 0x5c
jne 0x1001f5e1
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x1001f5d3
cmp edi, ebx
je 0x1001f62a
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.10037500
add esp, 0xc
cmp edi, 0x208
jae 0x1001f6bc
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, esi
mov word [ebp + edi - 0x414], ax
call fcn.1001f590
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x1001f650
lea ecx, [ebp - 0x20c]
sub ecx, esi
nop
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x1001f640
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x1001f652
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
jmp 0x1001f670
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1001f670
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x1001f6ac
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10030010
mov esp, ebp
pop ebp
ret
call fcn.100339c4
int3