joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001500
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x10001536
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0xc], edx
jge 0x10001676
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
je 0x1000155f
mov dword [ebp - 0x14], 1
jmp 0x10001566
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x40000000
je 0x10001583
mov dword [ebp - 0x18], 1
jmp 0x1000158a
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x80000000
je 0x100015a7
mov dword [ebp - 0x1c], 1
jmp 0x100015ae
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
je 0x100015e0
push 0x4000
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [0x1000548c]
jmp 0x10001524
mov eax, dword [ebp - 0x20]
shl eax, 4
mov ecx, dword [ebp - 0x24]
lea edx, [eax + ecx*8 + 0x1000505c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
je 0x10001612
mov ecx, dword [ebp - 0x10]
or ecx, 0x200
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001652
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x40
je 0x10001639
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 8], edx
jmp 0x10001652
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
je 0x10001652
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jbe 0x10001671
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [0x10005484]
jmp 0x10001524
mov esp, ebp
pop ebp
ret
Function at 0x10002890
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.10001e60
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100028c4
xor eax, eax
jmp 0x100029e4
mov dword [ebp - 0x10], 0
mov edx, 1
test edx, edx
je 0x1000295d
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10001ca0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100028f3
jmp 0x1000295d
push 0x80
push 0x100043c8
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10002912
push str.SVP7.PNG
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
add eax, 1
and eax, 0x80000001
jns 0x10002935
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10001e60
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002958
xor eax, eax
jmp 0x100029e4
jmp 0x100028cb
mov eax, dword [ebp - 0x10]
add eax, 9
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
sub edx, ecx
mov dword [ebp - 0x1c], edx
push 0x400
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10001cf0
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call fcn.100018e0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x100029a2
xor eax, eax
jmp 0x100029e4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.10001ae0
add esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100029d6
call dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
push eax
call fcn.10001be0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100029f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x43
mov byte [ebp - 9], 0x68
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x6d
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x45
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0x66
mov byte [ebp - 1], 0
lea eax, [ebp - 0x10]
push eax
call fcn.10002890
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4013c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40141b
cmp byte [esi + ebx - 1], 0xa
je 0x4013ef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4040a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x401c08
mov edi, dword [0x4040a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x401b28
test byte [0x40202c], 8
jne 0x401bb0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x40203c], 8
jne 0x401b78
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401aca
cmp esi, 3
jbe 0x401b30
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x401adb
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x403130]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401aca
mov dword [esp], 0x40203c
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401aa1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401aa1
mov dword [esp], 0x40202c
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401a8e
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401a94
mov eax, 0xffffffff
jmp 0x401b28

Function at 0x401c90
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x1f643fa8
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x7cc1806
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401550
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x4015b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4016a6
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x401620
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x4015f5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x401605
cmp byte [esp + 0x1e], 0
je 0x401605
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x401605
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401550
nop

Function at 0x401940
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x405030
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x405048]
sub esp, 4
test ebx, ebx
je 0x40198b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401984
test esi, esi
je 0x401984
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401960
mov dword [esp], 0x405030
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x675c6e99
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x9b6014e
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x203342a0
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0xd63216a
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1000cf70
Capabilities:
Get system information on windows

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
add esp, 0xffffff80
mov eax, dword [edi]
mov dword [ebp - 0x74], ecx
mov edx, dword [edi + 4]
xor edi, edi
mov dword [ebp - 0x70], eax
mov eax, dword [eax + 8]
mov dword [ebp - 0x78], edx
neg eax
and eax, esi
mov dword [ebp - 0x6c], eax
cmp esi, dword [ebx + 0x10]
jne 0x1000cfb8
jmp 0x1000cfe1
add edi, 1
cmp dword [ebx + 0x10], esi
je 0x1000cfe1
mov eax, dword [0x10076044]
cmp eax, 0xffffffff
je 0x1000d070
cmp edi, eax
jl 0x1000cfb0
mov dword [esp], 0
xor edi, edi
call dword [sym.imp.kernel32.dll_Sleep]
sub esp, 4
cmp dword [ebx + 0x10], esi
jne 0x1000cfb8
mov eax, dword [ebp - 0x6c]
cmp esi, eax
je 0x1000d0d0
mov edi, dword [ebx + 8]
movd xmm0, dword [0x100809e0]
mov dword [ebp - 0x5c], ebx
lea edx, [ebp - 0x68]
mov eax, 0x1000cf00
movd xmm1, eax
punpckldq xmm0, xmm1
movq qword [ebp - 0x64], xmm0
mov eax, dword fs:[0]
mov dword [edx], eax
mov dword fs:[0], edx
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x70]
sub esi, edx
mov edx, dword [ebp - 0x78]
mov eax, dword [ecx]
test edx, edx
je 0x1000d0b0
mov edx, dword [ebp - 0x74]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 8], edx
call dword [eax + 4]
sub esp, 0xc
mov ecx, esi
mov eax, 1
shl eax, cl
or dword [edi + 4], eax
mov eax, dword [ebp - 0x68]
mov dword fs:[0], eax
lock add dword [ebx + 0x10], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
lea eax, [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
sub esp, 4
cmp dword [ebp - 0x54], 1
jbe 0x1000d0a0
mov dword [0x10076044], 0xfa0
mov eax, 0xfa0
jmp 0x1000cfc6
mov dword [0x10076044], 0
jmp 0x1000cfca
mov ecx, dword [ebp - 0x74]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x70]
call dword [eax]
sub esp, 0xc
jmp 0x1000d047
mov ecx, dword [ebp - 0x70]
mov eax, dword [ecx]
call dword [eax + 0x10]
xor edx, edx
mov edi, eax
mov dword [eax], 0
mov dword [eax + 4], 0
lea esi, [esi]
xor eax, eax
mov ecx, 1
lock cmpxchg dword [ebx], ecx
test eax, eax
je 0x1000d170
mov eax, dword [0x10076044]
cmp eax, 0xffffffff
je 0x1000d140
cmp eax, edx
jle 0x1000d122
add edx, 1
jmp 0x1000d0f0
mov dword [0x10076044], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_Sleep]
xor edx, edx
sub esp, 4
jmp 0x1000d0f0
lea eax, [ebp - 0x68]
mov dword [ebp - 0x7c], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x7c]
sub esp, 4
cmp dword [ebp - 0x54], 1
jbe 0x1000d118
mov dword [0x10076044], 0xfa0
mov eax, 0xfa0
jmp 0x1000d109
mov eax, dword [ebx + 8]
test eax, eax
je 0x1000d179
mov dword [eax], edi
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], edi
test ecx, ecx
je 0x1000d190
mov dword [ebx], 0
jmp 0x1000cfef
mov dword [ebx + 4], edi
jmp 0x1000d183
Function at 0x10018650
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x9c
test byte [0x10078b48], 8
jne 0x10018750
movzx eax, byte [esi + 0x3d]
test al, al
je 0x10018740
mov edx, dword [esi + 0x38]
test edx, edx
je 0x10018737
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], 0xffffffff
call dword [eax + 0xc]
mov ecx, eax
sub esp, 4
xor eax, eax
cmp ecx, 0xffffffff
je 0x10018737
lea eax, [esi + 0x40]
lea edi, [ebp - 0x90]
mov dword [ebp - 0x94], eax
lea ebx, [ebp - 0x8c]
lea eax, [ebp - 0xc]
mov ecx, dword [esi + 0x38]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sym.msvcp110.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const
sub esp, 0x10
cmp eax, 1
je 0x100186ee
cmp eax, 3
je 0x10018720
test eax, eax
jne 0x10018780
mov byte [esi + 0x3d], 0
mov eax, dword [esi + 0x48]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], ebx
sub eax, ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcr110.dll_fwrite]
test eax, eax
je 0x10018780
cmp byte [esi + 0x3d], 0
jne 0x100186b5
lea esi, [esi]
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], 0xffffffff
call dword [eax + 0xc]
sub esp, 4
cmp eax, 0xffffffff
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x10081b02
mov dword [esp + 8], str.basic_filebuf_char__Endwrite
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1001866b
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1001a2a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x9c
test byte [0x10078b48], 8
jne 0x1001a3a0
movzx eax, byte [esi + 0x3e]
test al, al
je 0x1001a390
mov edx, dword [esi + 0x38]
test edx, edx
je 0x1001a388
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], 0xffff
call dword [eax + 0xc]
mov ecx, eax
sub esp, 4
xor eax, eax
cmp cx, 0xffff
je 0x1001a388
lea eax, [esi + 0x40]
lea edi, [ebp - 0x90]
mov dword [ebp - 0x94], eax
lea ebx, [ebp - 0x8c]
lea eax, [ebp - 0xc]
mov ecx, dword [esi + 0x38]
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call sym.msvcp110.dll_public:_int___thiscall_std::codecvt_unsigned_short_int__char__int_::unshift_int___char___char___char___const
sub esp, 0x10
cmp eax, 1
je 0x1001a33f
cmp eax, 3
je 0x1001a370
test eax, eax
jne 0x1001a3d0
mov byte [esi + 0x3e], 0
mov eax, dword [esi + 0x48]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], ebx
sub eax, ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcr110.dll_fwrite]
test eax, eax
je 0x1001a3d0
cmp byte [esi + 0x3e], 0
jne 0x1001a306
lea esi, [esi]
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], 0xffff
call dword [eax + 0xc]
sub esp, 4
cmp ax, 0xffff
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x10081b02
mov dword [esp + 8], str.basic_filebuf_wchar__Endwrite
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1001a2bb
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x1003dc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10078b48], 8
jne 0x1003dc70
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
sub esp, 8
test eax, eax
mov eax, 0
cmovne eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
test ebx, ebx
je 0x1003dcf0
mov eax, ebx
shr eax, 0x10
test eax, eax
je 0x1003dcd8
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrA]
mov edx, eax
sub esp, 8
mov eax, 0x10081ba3
test edx, edx
jne 0x1003dca8
mov edx, 0xffffffff
mov eax, ebx
call fcn.10012f50
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 8], str.tr2_sys__Current_get
mov dword [esp + 4], 0x10078b48
mov dword [esp], 3
call fcn.10013100
jmp 0x1003dc43
mov dword [esp + 4], ebx
mov dword [esp], 0x10081bad
call fcn.10012ca0
jmp 0x1003dca8
mov eax, 0x10081b9c
jmp 0x1003dca8