joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100043b0
Capabilities:
Unmount volume via ioctl

Disassembly:
push 0xffffffffffffffff
push 0x1001a290
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebp
push esi
push edi
mov eax, dword [0x10020040]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov edi, dword [esp + 0x64]
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x1c]
push eax
xor ebp, ebp
push ecx
lea esi, [esp + 0x30]
mov dword [esp + 0x18], ebp
call fcn.10003f70
mov dword [esp + 0x5c], ebp
cmp dword [esp + 0x68], ebp
jne 0x10004461
lea edx, [esp + 0x10]
push edx
mov eax, esi
call fcn.10004130
mov esi, eax
lea eax, [esp + 0x28]
test esi, esi
jne 0x1000453e
mov ebp, dword [esp + 0x10]
push 0x90018
mov edx, ebp
call fcn.100040d0
mov esi, eax
mov edx, ebp
lea eax, [esp + 0x28]
test esi, esi
jne 0x10004457
push 0x90020
call fcn.100040d0
mov esi, eax
test esi, esi
je 0x10004461
push 0x9001c
mov edx, ebp
lea eax, [esp + 0x2c]
call fcn.100040d0
mov edx, ebp
lea eax, [esp + 0x28]
call fcn.10004190
jmp 0x1000453a
mov eax, dword [esp + 0x48]
mov dword [eax], 0x20002
mov ecx, dword [esp + 0x48]
push 0x40
push 0x40
lea esi, [esp + 0x30]
mov dword [ecx + 0x18], ebp
call fcn.10004220
test eax, eax
jne 0x1000449d
mov edx, dword [esp + 0x50]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100044af
call fcn.10003e30
test eax, eax
je 0x100044af
mov esi, eax
mov edx, ebp
lea eax, [esp + 0x28]
call fcn.10004190
jmp 0x1000453a
mov eax, dword [esp + 0x48]
cmp dword [eax + 4], 0
je 0x100044cb
mov edx, ebp
lea eax, [esp + 0x28]
mov esi, 0x80004005
call fcn.10004190
jmp 0x1000453a
cmp dword [edi + 8], 0
je 0x10004515
mov dword [esp + 0x64], 0
mov byte [esp + 0x5c], 1
mov esi, dword [0x10021e00]
test esi, esi
je 0x100044f0
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
mov dword [esp + 0x64], esi
test esi, esi
je 0x10004504
mov eax, dword [edi + 8]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x20]
push eax
push esi
call edx
mov byte [esp + 0x5c], 0
test esi, esi
je 0x10004515
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov ax, word [edi + 0x14]
lea esi, [esp + 0x14]
call fcn.10003ec0
mov esi, eax
lea eax, [esp + 0x28]
call fcn.10004000
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x50
ret 8
Function at 0x10004c50
Capabilities:
Unmount volume via ioctl

Disassembly:
sub esp, 0x2c
push edi
mov edi, dword [esp + 0x34]
mov eax, dword [edi + 8]
cmp eax, dword [esp + 0x38]
je 0x10004c6d
mov eax, 0x80070057
pop edi
add esp, 0x2c
ret 0xc
mov ecx, dword [edi + 0x20]
mov edx, dword [edi + 0x1c]
push esi
push ecx
push edx
lea esi, [esp + 0x10]
mov dword [esp + 0x40], 0
call fcn.10003f70
lea eax, [esp + 0x38]
push eax
mov eax, esi
call fcn.10004130
cmp dword [esp + 0x40], 1
mov esi, eax
lea eax, [esp + 8]
jne 0x10004ce8
test esi, esi
jne 0x10004cec
mov esi, dword [esp + 0x38]
push 0x90020
mov edx, esi
call fcn.100040d0
mov edx, esi
lea eax, [esp + 8]
call fcn.10004190
mov eax, dword [edi + 8]
test eax, eax
je 0x10004cd5
mov dword [edi + 8], 0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 8]
call fcn.10004000
pop esi
xor eax, eax
pop edi
add esp, 0x2c
ret 0xc
test esi, esi
je 0x10004cfb
call fcn.10004000
mov eax, esi
pop esi
pop edi
add esp, 0x2c
ret 0xc
mov esi, dword [esp + 0x38]
push ebx
push 0x90018
mov edx, esi
call fcn.100040d0
mov ebx, eax
test ebx, ebx
je 0x10004d31
mov edx, esi
lea eax, [esp + 0xc]
call fcn.10004190
lea eax, [esp + 0xc]
call fcn.10004000
mov eax, ebx
pop ebx
pop esi
pop edi
add esp, 0x2c
ret 0xc
mov eax, dword [edi + 8]
test eax, eax
je 0x10004d47
mov dword [edi + 8], 0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0x90020
mov edx, esi
lea eax, [esp + 0x10]
call fcn.100040d0
mov edi, eax
lea eax, [esp + 0xc]
test edi, edi
jne 0x10004d77
push 0x9001c
mov edx, esi
call fcn.100040d0
mov edi, eax
lea eax, [esp + 0xc]
test edi, edi
je 0x10004d87
call fcn.10004000
pop ebx
pop esi
mov eax, edi
pop edi
add esp, 0x2c
ret 0xc
mov edx, esi
call fcn.10004190
mov esi, eax
lea eax, [esp + 0xc]
call fcn.10004000
test esi, esi
je 0x10004da8
pop ebx
mov eax, esi
pop esi
pop edi
add esp, 0x2c
ret 0xc
pop ebx
pop esi
xor eax, eax
pop edi
add esp, 0x2c
ret 0xc
Function at 0x10005980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1001a831
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10020040]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
xor esi, esi
mov dword [edi + 4], esi
mov dword [edi], vtable.CVirtualFile.0
mov dword [edi + 0xc], esi
lea ebx, [edi + 0x20]
xor eax, eax
mov dword [esp + 0x1c], esi
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea eax, [edi + 0x30]
push eax
mov byte [esp + 0x20], 1
call fcn.10008010
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x1c], 2
mov dword [edi + 8], ecx
mov eax, dword [edi + 0xc]
cmp ebp, eax
je 0x10005a0f
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp ebp, esi
je 0x10005a0c
push ebp
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi + 0xc], eax
cmp eax, esi
jne 0x10005a0f
push 0x8007000e
call fcn.10001000
mov dword [edi + 0xc], esi
mov edx, dword [esp + 0x34]
mov ax, word [esp + 0x38]
mov ecx, dword [esp + 0x28]
mov dword [edi + 0x10], edx
mov word [edi + 0x14], ax
mov dword [edi + 0x18], ecx
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
mov dword [ebx + 4], ebx
mov dword [ebx], ebx
call fcn.10001310
mov ebp, eax
lea esi, [ebp + 0x30]
push 1
mov eax, 0x1001cca4
call fcn.10002fe0
cmp dword [esi + 0x18], 8
jb 0x10005a52
mov esi, dword [esi + 4]
jmp 0x10005a55
add esi, 4
mov dword [ebp + 0x24], esi
mov dword [ebp + 0x2c], 0xfffffffe
mov dword [ebp], 0x10
mov ecx, dword [ebx + 4]
lea eax, [ebp + 0x5c]
mov dword [eax], ebx
mov dword [ebp + 0x60], ecx
mov dword [ecx], eax
mov dword [ebx + 4], eax
lea eax, [ebp + 0x54]
mov dword [ebp + 0x58], eax
mov dword [eax], eax
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
Function at 0x10007d70
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1001a228
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10020040]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x100212ec]
mov edx, dword [eax + 0xc]
mov ecx, 0x100212ec
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 0
movzx edx, word [ecx + 0x14]
push eax
push edx
push str._c:_s
lea edi, [esp + 0x1c]
call fcn.10003c80
mov esi, dword [esp + 0x1c]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebx, 0xffffffff
push 0
push esi
cmp eax, ebx
jne 0x10007df8
push 0x2005
push 0x800
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x10007e27
mov edi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push 0x1005
test al, 0x10
je 0x10007e17
push 4
call edi
push 0
push esi
push 0x1005
push 8
jmp 0x10007e25
push 0x10
call edi
push 0
push esi
push 0x1005
push 2
call edi
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
mov dword [esp + 0x1c], ebx
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x10007e44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8

Function at 0x10008c40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10008c57
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10008c88
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10008c84
cmp esi, eax
jae 0x10008c88
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10008c74
cmp esi, eax
jb 0x10008c8e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x10008df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10008e5e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x10008e2f
cmp eax, 2
jne 0x10008e4a
mov eax, dword [esp]
test esi, esi
je 0x10008e58
test eax, eax
je 0x10008e53
test al, 1
jne 0x10008e4a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x10008e58
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x10008fd0
Capabilities:
Get disk information

Disassembly:
sub esp, 0xd4
mov eax, dword [0x10020040]
xor eax, esp
mov dword [esp + 0xd0], eax
mov eax, dword [0x1001cdac]
mov cx, word [0x1001cdb0]
mov dx, word [esp + 0xdc]
mov dword [esp], eax
push 0x64
lea eax, [esp + 0xc]
mov word [esp + 8], cx
push eax
lea ecx, [esp + 8]
push ecx
mov word [esp + 0xc], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x10009037
call fcn.10003e30
mov ecx, dword [esp + 0xd0]
xor ecx, esp
call fcn.1000e9b7
add esp, 0xd4
ret 8
push str.DeviceKZipVirtualDisk
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea edx, [esp + 0xc]
push edx
push str.DeviceKZipVirtualDisk
call fcn.1000f24c
mov ecx, dword [esp + 0xdc]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, esp
neg eax
call fcn.1000e9b7
add esp, 0xd4
ret 8
Function at 0x10009780
Capabilities:
Create thread
Get system information on windows

Disassembly:
sub esp, 0x24
push edi
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push str..KZDriver
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [esp + 0x2c]
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
jne 0x100097b9
call fcn.10003e30
pop edi
add esp, 0x24
ret 4
mov ecx, dword [edi + 8]
push 0
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
je 0x100097ad
push esi
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
lea ecx, [eax + eax]
xor esi, esi
test ecx, ecx
jbe 0x10009814
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push edi
push 0x10009920
push 0
push 0
call ebp
push eax
call ebx
mov edx, dword [esp + 0x24]
inc esi
lea eax, [edx + edx]
cmp esi, eax
jb 0x100097f3
pop ebp
pop ebx
push str.KZModule.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x10], eax
pop esi
xor eax, eax
pop edi
add esp, 0x24
ret 4

Function at 0x10009cc0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10019f08
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10020040]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edi, dword [esp + 0x20]
xor ebx, ebx
shr edi, 1
cmp ebx, ebx
ja 0x10009d28
jb 0x10009d15
cmp edi, 0x2000000
jae 0x10009d1c
mov edi, 0x2000000
jmp 0x10009d2d
cmp ebx, ebx
ja 0x10009d28
cmp edi, 0x40000000
jbe 0x10009d2d
mov edi, 0x40000000
mov dword [esp + 0x10], ebx
mov dword [esp + 0x40], ebx
mov esi, dword [0x10021e00]
cmp esi, ebx
je 0x10009d47
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
mov dword [esp + 0x10], esi
cmp esi, ebx
je 0x10009d59
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
push ebx
push edi
push esi
call ecx
mov dword [esp + 0x40], 0xffffffff
cmp esi, ebx
je 0x10009d6d
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a2c0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x24
call fcn.1000efae
add esp, 4
test eax, eax
je 0x1000a2e8
xor ecx, ecx
mov dword [eax + 0x1c], 7
mov dword [eax + 0x18], 0
mov word [eax + 8], cx
mov edi, eax
jmp 0x1000a2ea
xor edi, edi
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [edi + 0x20], eax
mov eax, dword [esp + 0x10]
mov ecx, eax
mov dword [edi], edx
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x1000a300
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [edi + 4]
call fcn.10002fe0
push 0
push 0
push edi
push 0x1000a4a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret 0xc
Function at 0x1000a340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10019fc0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10020040]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, ecx
mov eax, dword [edi + 0xc]
push str.GetFactory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x28], ebx
call eax
mov eax, dword [edi + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x30]
push ebp
push eax
push ecx
mov ecx, dword [edx + 0x1c]
call ecx
mov esi, eax
cmp esi, ebx
je 0x1000a3c8
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1000a3c1
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, esi
jmp 0x1000a482
mov dword [esp + 0x30], ebx
mov byte [esp + 0x24], 1
mov esi, dword [ebp]
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x1000a3e4
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x28], 2
mov eax, dword [esi]
mov edx, dword [eax]
push str.sVS:ZF
push esi
call edx
cmp dword [esp + 0x30], ebx
je 0x1000a447
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x24], 3
mov edi, dword [edi + 0x10]
mov eax, dword [edi]
mov edx, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
push 0x1001cfe8
push edi
call edx
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x1000a436
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0xc]
push ecx
call eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x24], 2
cmp eax, ebx
je 0x1000a447
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x24], 1
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x1000a468
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1000a480
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x1000de30
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x10020040]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.1000f780
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000de8e
cmp eax, 0x104
ja 0x1000de8e
push str.KZCache_
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1000dea4
call fcn.10003e30
test eax, eax
jl 0x1000df2f
cmp eax, 1
je 0x1000df2f
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000dee0
push 0
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000dee0
call fcn.10003e30
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1000e9b7
add esp, 0x20c
ret
push edi
push 0
push 0x1001d0a4
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1000dec5
mov dword [edi + 0x20c], esi
neg esi
push 0
sbb esi, esi
and esi, 0x20000000
or esi, 0x4000000
push esi
push 2
push 0
push 0
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x208], eax
cmp eax, 0xffffffff
je 0x1000dec5
xor eax, eax
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.1000e9b7
add esp, 0x20c
ret
Function at 0x1000e040
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, eax
mov ebx, ecx
mov esi, edx
test edi, edi
je 0x1000e167
mov ebp, dword [esi + 0x208]
cmp ebp, 0xffffffff
je 0x1000e173
cmp dword [esp + 0x1c], 0
je 0x1000e173
cmp dword [esi + 0x20c], 0
je 0x1000e0af
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push 0
push 0x200
push eax
push ecx
call fcn.10019de0
or eax, edx
jne 0x1000e097
test edi, 0x1ff
je 0x1000e0af
mov edx, dword [esp + 0x1c]
push edi
push edx
push ebx
mov eax, esi
call fcn.1000e2d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push 0
push 0
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1000e0d4
call fcn.10003e30
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi + 0x208]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [esp + 0x18]
push edx
push edi
push ebp
push eax
mov dword [esp + 0x28], 0
call ebx
test eax, eax
jne 0x1000e167
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x1000e128
cmp eax, 0x3e6
je 0x1000e128
test eax, eax
jle 0x1000e178
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
call fcn.1000dfd0
test eax, eax
jl 0x1000e178
cmp eax, 1
je 0x1000e178
mov edx, dword [esi + 0x210]
mov eax, dword [esi + 0x208]
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push edx
push eax
call ebx
test eax, eax
je 0x1000e0c5
mov ecx, dword [esi + 0x210]
push edi
push ecx
push ebp
call fcn.10012500
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, 0x80070057
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x1000e190
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, eax
mov ebx, ecx
mov esi, edx
test edi, edi
jne 0x1000e1ab
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x1000e2b5
cmp dword [esi + 0x208], 0xffffffff
je 0x1000e2b5
cmp dword [esi + 0x20c], 0
je 0x1000e1f9
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push 0
push 0x200
push eax
push ecx
call fcn.10019de0
or eax, edx
jne 0x1000e1e8
test edi, 0x1ff
je 0x1000e1f9
push edi
push ebp
push ebx
mov eax, esi
call fcn.1000e420
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
push 0
push 0
push edx
push eax
mov eax, dword [esi + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1000e2a9
mov edx, dword [esi + 0x208]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push ebp
push edx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
jne 0x1000e1a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f8
je 0x1000e26a
cmp eax, 0x3e6
je 0x1000e26a
test eax, eax
jle 0x1000e2ba
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
pop ebx
ret 4
call fcn.1000dfd0
test eax, eax
jl 0x1000e2ba
cmp eax, 1
je 0x1000e2ba
mov eax, dword [esi + 0x210]
push edi
push ebp
push eax
call fcn.10012500
mov edx, dword [esi + 0x210]
mov eax, dword [esi + 0x208]
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push edi
push edx
push eax
call ebx
test eax, eax
jne 0x1000e1a2
call fcn.10003e30
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov eax, 0x80070057
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1000e2d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x18], 0
push ebx
push ebp
push esi
push edi
mov esi, eax
je 0x1000e3f7
cmp dword [esp + 0x24], 0
je 0x1000e403
cmp dword [esi + 0x208], 0xffffffff
je 0x1000e403
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1000e403
mov ebx, dword [eax + 4]
mov edi, dword [eax]
push 0
push 0x200
push ebx
push edi
call fcn.10019d30
push 0
push 0x200
push edx
push eax
call fcn.100194f0
mov ebp, eax
mov eax, dword [esp + 0x28]
xor ecx, ecx
sub eax, ebp
sbb ecx, edx
add eax, edi
adc ecx, ebx
push 0
add eax, 0x1ff
push 0x200
adc ecx, 0
push ecx
push eax
mov dword [esp + 0x28], edx
call fcn.10019d30
mov edi, eax
shl edi, 9
call fcn.1000dfd0
test eax, eax
jl 0x1000e408
cmp eax, 1
je 0x1000e408
mov edx, dword [esp + 0x18]
mov eax, dword [esi + 0x208]
push 0
push 0
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1000e398
call fcn.10003e30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
mov edx, dword [esi + 0x210]
mov eax, dword [esi + 0x208]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000e389
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov ecx, dword [esp + 0x10]
sub eax, ebp
cmp ecx, eax
jbe 0x1000e3f7
mov edx, dword [esp + 0x28]
sub ecx, eax
cmp ecx, edx
jb 0x1000e3dc
mov ecx, edx
test ecx, ecx
jbe 0x1000e3f7
mov edx, dword [esi + 0x210]
push ecx
add edx, eax
mov eax, dword [esp + 0x28]
push edx
push eax
call fcn.10012500
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
mov eax, 0x80070057
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x1000e420
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x18], 0
push ebx
push ebp
push esi
push edi
mov esi, eax
jne 0x1000e43c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
cmp dword [esp + 0x24], 0
je 0x1000e582
cmp dword [esi + 0x208], 0xffffffff
je 0x1000e582
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1000e582
mov edi, dword [eax]
mov eax, dword [eax + 4]
push 0
push 0x200
push eax
push edi
mov dword [esp + 0x28], eax
call fcn.10019d30
push 0
push 0x200
push edx
push eax
call fcn.100194f0
mov ebx, eax
mov eax, dword [esp + 0x28]
xor ecx, ecx
sub eax, ebx
mov ebp, edx
sbb ecx, ebp
add eax, edi
adc ecx, dword [esp + 0x18]
push 0
add eax, 0x1ff
push 0x200
adc ecx, 0
push ecx
push eax
call fcn.10019d30
mov edi, eax
shl edi, 9
call fcn.1000dfd0
test eax, eax
jl 0x1000e587
cmp eax, 1
je 0x1000e587
mov edx, dword [esi + 0x208]
push 0
push 0
push ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1000e573
mov ecx, dword [esi + 0x210]
mov edx, dword [esi + 0x208]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000e573
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov eax, dword [eax]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x210]
sub eax, ebx
push edx
add ecx, eax
push ecx
call fcn.10012500
mov edx, dword [esi + 0x208]
add esp, 0xc
push 0
push 0
push ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1000e573
mov ecx, dword [esi + 0x210]
mov edx, dword [esi + 0x208]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000e430
call fcn.10003e30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
mov eax, 0x80070057
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x1000e9b7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10020040]
jne 0x1000e9c1
repz ret
jmp fcn.1000ff2a