joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fa510
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
lea ecx, [esi + 0x70]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x1002f0d0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.10104ae0
add esp, 0x10
mov dword [esi + 8], esp
lea ebx, [esi + 0x20]
mov dword [ebx + 8], edi
mov dword [ebx + 4], edi
mov dword [ebx], edi
mov byte [ebx + 0xc], 0xff
sub esp, 0x1c
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.10079170
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0xd
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.10031240
add esp, 0x1c
mov esp, dword [esi + 8]
lea edi, [esi + eax]
add edi, 0x20
push dword [ebp + 0x10]
push edi
push ebx
call fcn.100f9e90
add esp, 0xc
mov dword [esi + 8], eax
pcmpeqd xmm0, xmm0
lea ebx, [esi + 0x30]
movdqu xmmword [ebx + 0x1e], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10078a50
lea eax, [esi + 0x70]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
push edi
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.100fb0e0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x100fa64a
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x78], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x30]
push eax
push dword [ebp + 0xc]
push edi
call fcn.100faf60
add esp, 0x1c
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x100fa6f0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x1002f0e0
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.10104ae0
add esp, 0x10
mov dword [esi + 8], esp
lea eax, [esi + 0x20]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [eax], xmm0
mov ebx, eax
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.10079170
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.10031240
add esp, 0x20
mov esp, dword [esi + 8]
lea ebx, [esi + eax]
add ebx, 0x20
push dword [ebp + 0x10]
push ebx
lea eax, [esi + 0x20]
push eax
call fcn.100f9e90
add esp, 0xc
mov dword [esi + 8], eax
lea edi, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x4a], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10078a50
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push edi
push ebx
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.100fb0e0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x100fa852
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.100faf60
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x10107ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.100c1c01
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x10107b20
push ecx
push ecx
call fcn.100d10fa
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x10107b0f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x1010a060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x10146014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x1014b860], 0
je 0x1010a098
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c2603
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x1014b84c]
test esi, esi
je 0x1010a132
test byte [0x10147bfc], 1
je 0x1010a081
cmp byte [esi + 0xb], 0
jns 0x1010a0b7
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x10138c70]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1014b860], eax
inc eax
cmp eax, 1
ja 0x1010a081
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.100c5370
add esp, 0xc
mov word [esi - 2], 0
lea edi, [ebp - 0x218]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1010a1d7
xor ebx, ebx
jmp 0x1010a081
push 0xc
call fcn.100c1c01
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.100c5370
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.1002cc60
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1010a187
mov eax, dword [esi + 4]
mov ecx, dword [esi]
jmp 0x1010a18c
and eax, 0x7f
mov ecx, esi
test eax, eax
jne 0x1010a1a9
mov ecx, esi
push 9
push 0x10138cd8
call fcn.10030920
mov dword [0x1014b84c], esi
jmp 0x1010a0a6
lea edi, [eax + eax]
test edi, edi
je 0x1010a190
lea edx, [edi - 2]
cmp word [ecx + edi - 2], 0x5c
mov edi, edx
jne 0x1010a1ac
cmp edx, 0xfffffffe
je 0x1010a190
sar edx, 1
inc edx
cmp eax, edx
jb 0x1010a277
mov ecx, esi
push edx
call fcn.1010a6d0
jmp 0x1010a190
mov esi, dword [0x1014b84c]
push edi
call fcn.100da260
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.10030620
mov ecx, dword [0x1014b84c]
call fcn.1002e900
cmp word [eax], 0x5c
je 0x1010a212
mov ecx, dword [0x1014b84c]
push 1
push 0x10138cd4
call fcn.10030920
mov ecx, dword [0x1014b84c]
push 9
push 0x10138cd8
call fcn.10030920
mov eax, dword [0x1014b84c]
cmp byte [eax + 0xb], 0
jns 0x1010a231
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x10138c70]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1014b860], eax
inc eax
cmp eax, 1
ja 0x1010a081
mov dword [0x1014b860], 0
jmp 0x1010a12b
call fcn.100d5450
int3
Function at 0x10129040
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x10146014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x18], eax
add esi, edi
cmp edi, esi
jae 0x1012909a
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
sub eax, edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete dl
mov ecx, dword [ebp - 0x14]
test ecx, ecx
sete al
or al, dl
jne 0x10129094
mov ebx, ecx
add edi, ebx
cmp al, 1
jne 0x10129064
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c2603
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x402160
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
test eax, eax
jne 0x401d4b
add esp, 8
ret
push ebp
push esi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x401de1
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x401dcc
lea eax, [edi + 2]
push eax
call fcn.0045353a
mov esi, eax
add esp, 4
test esi, esi
je 0x401dcc
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
push esi
push ebp
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401dcc
cmp edi, dword [esp + 0xc]
jne 0x401dcc
push edi
push esi
mov byte [edi + esi], 0
mov byte [edi + esi + 1], 0
call fcn.00401cb0
add esp, 8
mov dword [esp + 0x10], eax
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
test esi, esi
je 0x401de1
push esi
call fcn.0045352f
add esp, 4
mov eax, dword [esp + 0xc]
pop esi
pop ebp
add esp, 8
ret
mov eax, dword [esp + 4]
jmp 0x401d40

Function at 0x402590
Capabilities:
Clear file content
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, eax
xor eax, eax
mov dword [esp + 8], eax
test ebx, ebx
je 0x40269d
cmp word [ebx], ax
je 0x40269d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push edi
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push 0xfde9
call ebp
lea esi, [eax + 1]
push esi
call fcn.0046fc69
mov edi, eax
add esp, 4
test edi, edi
je 0x402696
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call ebp
test eax, eax
jle 0x4025f5
mov byte [edi + eax], 0
mov eax, dword [esp + 0x1c]
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x402673
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x14]
push ecx
push 3
push 0x49ae8c
push esi
call ebx
test eax, eax
je 0x402673
push 0
lea edx, [esp + 0x14]
push edx
push 0x27
push str.__xml_version_1.0__encoding_UTF_8____
push esi
call ebx
test eax, eax
je 0x402673
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402650
push 0
lea ecx, [esp + 0x14]
push ecx
sub eax, edx
push eax
push edi
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebx, 1
jmp 0x402677
mov ebx, dword [esp + 0x14]
push edi
call fcn.0046fb04
add esp, 4
cmp esi, 0xffffffff
je 0x40268c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x403200
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x468
mov eax, dword [0x4ae830]
xor eax, esp
mov dword [esp + 0x464], eax
cmp dword [ebp + 0x10], 0x10
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0xc], ecx
jge 0x403242
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x464]
xor ecx, esp
call fcn.0046fd33
mov esp, ebp
pop ebp
ret
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4032fa
push esi
lea edx, [esp + 0xc]
push edx
push 0x400
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call esi
test eax, eax
je 0x4032e1
jmp 0x4032b0
mov eax, dword [esp + 8]
test eax, eax
je 0x4032e1
lea ecx, [esp + 0x68]
push ecx
lea ecx, [esp + 0x14]
call fcn.00409120
add esp, 4
push 0
lea edx, [esp + 0xc]
push edx
push 0x400
lea eax, [esp + 0x74]
push eax
push edi
call esi
test eax, eax
jne 0x4032b0
mov ecx, dword [esp + 0xc]
lea esi, [esp + 0x10]
call fcn.004091d0
push edi
mov esi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x46c]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0046fd33
mov esp, ebp
pop ebp
ret
Function at 0x408830
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x408852
jmp 0x408840
imul eax, eax, 0xf4243
movzx ecx, cl
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x408840
ret
Function at 0x41a8f0
Capabilities:
Create thread

Disassembly:
sub esp, 0x24
mov eax, dword [0x4ae830]
xor eax, esp
mov dword [esp + 0x20], eax
cmp byte [esi + 0x20], 0
je 0x41a915
xor al, al
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0046fd33
add esp, 0x24
ret
cmp byte [esi + 0x21], 0
jne 0x41a97f
lea eax, [esp]
push eax
push 0
push esi
push 0x41a8e0
push 0
push 0
mov byte [esi + 0x21], 1
mov dword [esp + 0x18], 0
call fcn.00474ba6
add esp, 0x18
mov dword [esi + 0x1c], eax
test eax, eax
je 0x41a904
cmp dword [esi + 0x14], 0
je 0x41a97f
lea ecx, [esp + 4]
push 0
push ecx
mov ecx, esi
call fcn.0041ccc0
mov eax, dword [esp + 0x10]
add esp, 8
cmp dword [esp + 0x1c], 0x10
jae 0x41a96c
lea eax, [esp + 8]
mov edx, dword [esp]
push eax
push edx
call fcn.0041ac40
lea ecx, [esp + 4]
call fcn.00402720
mov ecx, dword [esp + 0x20]
xor ecx, esp
mov al, 1
call fcn.0046fd33
add esp, 0x24
ret

Function at 0x41be20
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [esi]
push ebx
push ebp
push edi
test eax, eax
je 0x41be37
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
cmp dword [esi + 0x30], 8
jb 0x41be42
mov eax, dword [esi + 0x1c]
jmp 0x41be45
lea eax, [esi + 0x1c]
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x41beee
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x41be91
lea ecx, [esp + 0xc]
push ecx
push ebp
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov edx, dword [esp + 0x14]
add dword [esi + 0x10], edx
mov eax, dword [esp + 0x18]
mov edi, dword [esi + 0x10]
adc dword [esi + 0x14], eax
mov ebx, dword [esi + 0x14]
push 0
push 0x4000
push ebx
push edi
call fcn.0047f1f0
test edx, edx
jl 0x41bed0
jg 0x41bebd
test eax, eax
jbe 0x41bed0
sub edi, eax
sbb ebx, edx
add edi, 0x4000
adc ebx, 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ebx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
push 0
push ecx
push edx
push 4
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebp
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x41c0b0
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x48e465
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x4ae830]
xor eax, esp
mov dword [esp + 0x27c], eax
push ebx
push ebp
push esi
mov eax, dword [0x4ae830]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [edi], ebp
mov dword [edi + 0x2c], ebp
mov ebx, 7
mov dword [edi + 0x30], ebx
xor eax, eax
mov word [edi + 0x1c], ax
mov dword [esp + 0x10], edi
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], ebp
lea eax, [edi + 0x38]
push eax
mov dword [esp + 0x29c], ebp
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea esi, [esp + 0x68]
mov byte [esp + 0x298], 1
call fcn.0041c690
push 0x206
lea edx, [esp + 0x8a]
xor ecx, ecx
push ebp
mov byte [esp + 0x2a0], 2
push edx
mov word [esp + 0x90], cx
call fcn.0046fba0
add esp, 0xc
push 2
xor eax, eax
push 0x49ccf8
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], ebp
mov word [esp + 0x3c], ax
call fcn.00417aa0
mov bl, 3
lea ecx, [esp + 0x14]
mov byte [esp + 0x298], bl
call fcn.0041d770
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2a4], 4
call fcn.00417990
mov esi, 8
mov byte [esp + 0x298], bl
cmp dword [esp + 0x2c], esi
jb 0x41c1be
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0045352f
add esp, 4
push 9
push str.gst_log_
lea ecx, [esp + 0x38]
call fcn.0041c970
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0x3c]
call fcn.00417990
push 4
push str..txt
lea ecx, [esp + 0x38]
call fcn.0041c970
mov ebx, 7
xor eax, eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], ebp
mov word [esp + 0x50], ax
lea ecx, [esp + 0x84]
push ecx
push 0x104
mov byte [esp + 0x2a0], 5
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x41c271
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], esi
jae 0x41c230
lea eax, [esp + 0x34]
push eax
lea edx, [esp + 0x88]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, 1
jne 0x41c271
lea eax, [esp + 0x84]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x41c250
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x54]
call fcn.00417aa0
lea ecx, [esp + 0x4c]
push ecx
mov ecx, edi
call fcn.0041c030
cmp dword [esp + 0x64], esi
jb 0x41c290
mov edx, dword [esp + 0x50]
push edx
call fcn.0045352f
add esp, 4
xor eax, eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x60], ebp
mov word [esp + 0x50], ax
cmp dword [esp + 0x48], esi
jb 0x41c2b2
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0045352f
add esp, 4
xor edx, edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebp
mov word [esp + 0x34], dx
cmp dword [esp + 0x80], esi
jb 0x41c2d7
mov eax, dword [esp + 0x6c]
push eax
call fcn.0045352f
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x27c]
xor ecx, esp
call fcn.0046fd33
add esp, 0x28c
ret
Function at 0x41ca90
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x48d3d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4ae830]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.00417270
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41caf0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.0041c970
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00417270
cmp dword [esp + 0x28], 8
jb 0x41cb3d
mov eax, dword [esp + 0x14]
push eax
call fcn.0045352f
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x41cf80
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x48da88
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4ae830]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
push edi
mov eax, dword [0x4ae830]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov eax, dword [ebx + 0x14]
xor edi, edi
cmp eax, edi
je 0x41d0a1
cmp eax, 3
jb 0x41d0a1
cmp eax, 1
jae 0x41cfd1
call fcn.00471538
mov ebp, 8
cmp dword [ebx + 0x18], ebp
jb 0x41cfe0
mov eax, dword [ebx + 4]
jmp 0x41cfe3
lea eax, [ebx + 4]
cmp word [eax + 2], 0x3a
jne 0x41d0a1
push 0xffffffffffffffff
push edi
xor eax, eax
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], edi
mov word [esp + 0x28], ax
call fcn.00417270
mov dword [esp + 0x5c], edi
mov eax, dword [esp + 0x2c]
lea esi, [eax - 1]
cmp esi, eax
jbe 0x41d022
call fcn.00471538
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], ebp
jae 0x41d030
lea eax, [esp + 0x1c]
movzx eax, word [eax + esi*2]
mov ebp, 0x2f
cmp ax, 0x5c
je 0x41d04d
cmp ax, bp
je 0x41d04d
lea esi, [esp + 0x18]
call fcn.0041de30
push 1
push edi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0x5c
call fcn.0041dec0
push 1
push edi
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x24]
mov esi, eax
mov dword [esp + 0x1c], ebp
call fcn.0041dec0
cmp esi, 0xffffffff
jne 0x41d084
or esi, esi
cmp eax, 0xffffffff
jne 0x41d08b
or eax, eax
mov edi, esi
cmp esi, eax
jb 0x41d093
mov edi, eax
cmp edi, 0xffffffff
jne 0x41d0c1
lea ecx, [esp + 0x18]
call fcn.00417080
xor eax, eax
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0046fd33
add esp, 0x50
ret
mov dword [esp + 0x14], 1
lea esp, [esp]
push edi
push 0
lea eax, [esp + 0x3c]
push eax
mov ecx, ebx
call fcn.0041ddf0
mov eax, dword [esp + 0x38]
mov esi, 8
cmp dword [esp + 0x4c], esi
jae 0x41d0f2
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x41d125
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x4c], esi
jae 0x41d10b
lea eax, [esp + 0x38]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41d125
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41d18e
push 1
lea esi, [edi + 1]
push esi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0x5c
call fcn.0041dec0
push 1
push esi
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x24]
mov edi, eax
mov dword [esp + 0x1c], ebp
call fcn.0041dec0
cmp edi, 0xffffffff
jne 0x41d15f
or edi, edi
cmp eax, 0xffffffff
jne 0x41d166
or eax, eax
cmp edi, eax
jb 0x41d16c
mov edi, eax
cmp edi, 0xffffffff
je 0x41d1a9
cmp dword [esp + 0x4c], 8
jb 0x41d0d0
mov eax, dword [esp + 0x38]
push eax
call fcn.0045352f
add esp, 4
jmp 0x41d0d0
lea ecx, [esp + 0x34]
xor esi, esi
call fcn.00417080
lea ecx, [esp + 0x18]
call fcn.00417080
mov eax, esi
jmp 0x41d0a3
lea ecx, [esp + 0x34]
call fcn.00417080
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.00417080
mov eax, esi
jmp 0x41d0a3