joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046120
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x100acec8
push 0x100acee8
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x18], 1
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
xor eax, eax
cmp dword [esp], 1
sete al
add esp, 0xc
ret

Function at 0x10046300
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0
call fcn.100863d2
mov ebp, dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
add esp, 4
mov esi, eax
mov eax, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
mov edi, edx
lea edx, [esp + 0x20]
push edx
push 0x100acf1c
push 0x100acee8
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x28], 0
call ebp
mov eax, dword [esp + 0x10]
push 0
push 0x15180
push 0
push eax
call fcn.100943a0
push 0
push 0x15180
push edi
push esi
mov ebx, eax
mov dword [esp + 0x2c], edx
call fcn.100943a0
cmp eax, ebx
jne 0x100463c2
cmp edx, dword [esp + 0x1c]
jne 0x100463c2
mov eax, 4
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 0x100acf40
push 0x100acee8
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x28], 0
call ebp
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret

Function at 0x10046470
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edx, 0x100acf84
mov esi, 0x100ac280
lea ecx, [esp + 8]
xor edi, edi
call fcn.10061510
mov esi, dword [esp + 8]
cmp dword [esi - 8], edi
je 0x1004650b
mov ecx, dword [esp + 0x14]
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100464c6
cmp dx, di
je 0x100464c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100464c6
add eax, 4
add ecx, 4
cmp dx, di
jne 0x100464a0
xor eax, eax
jmp 0x100464cb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x1004650b
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x100acf68
push 0x100ac280
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 4
mov dword [esp + 0x24], 4
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
mov edi, dword [esp + 0x14]
lea eax, [esi - 0xc]
cmp eax, 0x100bc65c
je 0x1004652c
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1004652c
push esi
call fcn.1008441c
add esp, 4
mov eax, edi
pop edi
pop esi
add esp, 8
ret 4
Function at 0x10046f20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x100ad0ec
push 0x100ad100
push SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
test eax, eax
je 0x10046f69
mov eax, 1
add esp, 0xc
ret
xor eax, eax
cmp dword [esp], eax
setne al
add esp, 0xc
ret

Function at 0x10047720
Capabilities:
Create thread

Disassembly:
cmp dword [esi + 0x4c], 0
jne 0x1004774c
cmp dword [esi + 4], 0
jne 0x10047745
push 0
push 0
push esi
push 0x100476f0
push 0
push 0
call fcn.100869f0
add esp, 0x18
mov dword [esi + 4], eax
mov dword [esi + 0x4c], 1
ret

Function at 0x100488a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
xor eax, eax
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x100ad1fc
push 0x100ad214
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x24], 3
mov dword [esp + 0x20], 0x10
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
test eax, eax
jne 0x1004893c
movzx ecx, word [esp + 0x1c]
mov eax, dword [esp + 0x24]
movzx edi, word [esp + 0x12]
push ecx
movzx ecx, word [esp + 0x1e]
push ecx
movzx ecx, word [esp + 0x20]
push ecx
movzx ecx, word [esp + 0x22]
add eax, 0x1c
push ecx
movzx ecx, word [esp + 0x20]
lea edx, [eax + 4]
push edx
push eax
mov dword [eax], 0
mov dword [edx], 0
call fcn.1005e920
add esp, 0x18
mov eax, 1
pop edi
add esp, 0x1c
ret 4
xor eax, eax
pop edi
add esp, 0x1c
ret 4

Function at 0x10048950
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
push 0x10
lea ecx, [esp + 4]
push ecx
push 3
push 0x100ad1fc
push 0x100ad214
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.SHLWAPI.DLL_SHSetValueW]
add esp, 0x14
ret

Function at 0x10048990
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x100ad244
push 0x100ad214
push reloc.OLEAUT32.DLL_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.SHLWAPI.DLL_SHGetValueW]
mov eax, dword [esp]
add esp, 0xc
ret
Function at 0x10048a30
Capabilities:
Check if file exists
Read .ini file

Disassembly:
test esi, esi
jne 0x10048a37
xor eax, eax
ret
mov eax, dword [ebx + 4]
push edi
push eax
xor edi, edi
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x10048a65
mov eax, dword [ebx + 4]
push eax
push 0x10
push esi
push 0x100ad1e0
push 0x100ad1ec
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStructW]
mov edi, eax
test edi, edi
jne 0x10048a72
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, edi
pop edi
ret

Function at 0x10050ad0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
lea esi, [esp + 4]
call fcn.10060990
mov esi, dword [eax]
mov eax, 1
test byte [0x100c7b10], al
jne 0x10050b07
or dword [0x100c7b10], eax
push 0x100a3510
mov dword [0x100c7b0c], 0
call fcn.1008416d
add esp, 4
push esi
push 0x100c7b0c
mov edx, 0x100a7638
mov ecx, 0x100ad7a0
mov eax, 0x100aa814
call fcn.10006000
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x10050b4e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10050b4e
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.1008441c
add esp, 4
mov eax, dword [edi + 0x2c]
mov edx, dword [eax + 0x28]
lea esi, [edi + 0x2c]
mov ecx, esi
call edx
test eax, eax
je 0x10050b89
mov eax, dword [edi + 0x34]
push ebx
mov ebx, dword [sym.imp.USER32.DLL_KillTimer]
push 0x3e9
push eax
call ebx
mov ecx, dword [edi + 0x34]
push 0x3e8
push ecx
call ebx
mov edx, dword [edi + 0x34]
push 0
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
pop ebx
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
mov ecx, esi
call edx
xor eax, eax
pop esi
pop ecx
ret

Function at 0x10050ca0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp eax, 0x3e8
jne 0x10050cec
push edi
mov edi, dword [sym.imp.USER32.DLL_KillTimer]
push eax
mov eax, dword [esi + 0x34]
push eax
call edi
mov edx, dword [esi + 0x2c]
mov eax, dword [edx + 0x28]
lea ecx, [esi + 0x2c]
call eax
test eax, eax
je 0x10050ce9
mov ecx, dword [esi + 0x34]
push 0x3e9
push ecx
call edi
mov edx, dword [esi + 0x34]
push 0x3e8
push edx
call edi
mov eax, dword [esi + 0x34]
push 0
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
pop edi
pop esi
ret
cmp eax, 0x3e9
jne 0x10050cea
mov ecx, dword [esi + 0x34]
push eax
push ecx
call dword [sym.imp.USER32.DLL_KillTimer]
mov edx, dword [esi + 0xe8]
mov eax, dword [esi + 0xe4]
push edx
push eax
call fcn.10050d70
pop esi
ret

Function at 0x10050d70
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x34]
push 0x3e8
push eax
call dword [sym.imp.USER32.DLL_KillTimer]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
mov eax, dword [esi + 0x34]
push 0x15
push 0
push 0
push ecx
push edx
push 0
push eax
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov ecx, dword [esi + 0x34]
mov dword [esp + 8], 8
mov dword [esp + 4], ecx
jmp dword [sym.imp.USER32.DLL_ShowWindow]
Function at 0x10050e00
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x2c]
mov edx, dword [eax + 0x28]
lea ecx, [esi + 0x2c]
call edx
test eax, eax
je 0x10050e39
mov eax, dword [esi + 0x34]
push edi
mov edi, dword [sym.imp.USER32.DLL_KillTimer]
push 0x3e9
push eax
call edi
mov ecx, dword [esi + 0x34]
push 0x3e8
push ecx
call edi
mov edx, dword [esi + 0x34]
push 0
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
pop edi
ret
Function at 0x10053310
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp eax, 0x3e8
jne 0x1005334d
push edi
mov edi, dword [sym.imp.USER32.DLL_KillTimer]
push eax
mov eax, dword [esi + 0x34]
push eax
call edi
mov ecx, dword [esi + 0x34]
push 0x3e9
push ecx
call edi
mov edx, dword [esi + 0x34]
push 0x3e8
push edx
call edi
mov eax, dword [esi + 0x34]
push 0
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
pop edi
pop esi
ret
cmp eax, 0x3e9
jne 0x10053372
mov ecx, dword [esi + 0x34]
push eax
push ecx
call dword [sym.imp.USER32.DLL_KillTimer]
mov edx, dword [esi + 0x84]
mov eax, dword [esi + 0x80]
push edx
push eax
call fcn.100533d0
pop esi
ret

Function at 0x100533d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x34]
push edi
mov edi, dword [sym.imp.USER32.DLL_KillTimer]
push 0x3e9
push eax
call edi
mov ecx, dword [esi + 0x34]
push 0x3e8
push ecx
call edi
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x34]
push 0x15
push 0
push 0
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.DLL_SetWindowPos]
pop edi
mov dword [esp + 8], 8
mov edx, dword [esi + 0x34]
mov dword [esp + 4], edx
jmp dword [sym.imp.USER32.DLL_ShowWindow]

Function at 0x10053420
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x34]
push edi
mov edi, dword [sym.imp.USER32.DLL_KillTimer]
push 0x3e9
push eax
call edi
mov ecx, dword [esi + 0x34]
push 0x3e8
push ecx
call edi
mov edx, dword [esi + 0x34]
push 0
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
pop edi
ret
Function at 0x10057050
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [edi + 0x50]
mov eax, dword [eax]
test eax, eax
je 0x10057087
lea ecx, [esp]
mov dword [esp], 0
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
test eax, eax
je 0x10057087
xor eax, eax
cmp dword [esp], 0x103
setne al
test eax, eax
je 0x10057125
mov eax, dword [edi + 0x4c]
add eax, 0x38
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x100570a4
mov dword [esp], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
jmp 0x100570b8
mov ecx, dword [0x100bc66c]
push eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
call fcn.100035a0
push ebx
push esi
lea eax, [esp + 8]
call fcn.10057c80
lea eax, [esp + 8]
call fcn.10057c20
mov ebx, dword [esp + 8]
cmp dword [ebx - 8], 0
jne 0x100570f6
mov esi, dword [edi + 0x58]
mov edx, dword [esi + 0x30]
add esi, 0x2c
push edx
call dword [sym.imp.USER32.DLL_IsWindow]
test eax, eax
je 0x100570f6
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
mov ecx, dword [edi + 0x50]
push ecx
mov eax, ebx
call fcn.1005b200
lea edx, [ebx - 0xc]
cmp edx, 0x100bc65c
je 0x10057123
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10057123
push esi
call fcn.1008441c
add esp, 4
pop esi
pop ebx
pop ecx
ret

Function at 0x10057940
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.DLL_IsWindow]
test eax, eax
je 0x1005795a
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.DLL_ShowWindow]
ret

Function at 0x10057ef0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x210
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x20c], eax
cmp dword [esp + 0x214], 0xd
push esi
mov esi, ecx
jne 0x10057fa6
push ebx
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.10087b80
mov eax, dword [esi + 4]
add esp, 0xc
push 0x104
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.DLL_GetWindowTextW]
lea ebx, [esp + 0x10]
lea edi, [esp + 0xc]
call fcn.100036f0
mov edi, dword [esp + 0xc]
mov eax, dword [edi - 8]
mov ecx, dword [esi + 4]
push eax
push eax
push 0xb1
push ecx
call dword [sym.imp.USER32.DLL_SendMessageW]
lea edx, [edi - 0xc]
cmp edx, 0x100bc65c
je 0x10057f8c
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x10057f8c
push esi
call fcn.1008441c
add esp, 4
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.10083dbb
add esp, 0x210
ret 4
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.DLL_SetFocus]
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
call fcn.10083dbb
add esp, 0x210
ret 4
Function at 0x10058240
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
je 0x10058286
cmp dword [esi + 0x30], 0
je 0x10058286
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.DLL_IsWindowVisible]
test eax, eax
je 0x1005827c
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.DLL_ShowWindow]
mov edx, dword [esi + 4]
push 0x100a7638
push edx
call dword [sym.imp.USER32.DLL_SetWindowTextW]
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
ret 4

Function at 0x10058290
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esi + 0x30], 0
je 0x100582c9
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.DLL_IsWindowVisible]
test eax, eax
je 0x100582bf
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.DLL_ShowWindow]
mov edx, dword [esi + 4]
push 0x100a7638
push edx
call dword [sym.imp.USER32.DLL_SetWindowTextW]
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov eax, 1
ret

Function at 0x10058380
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
cmp dword [esi + 0x2c], 0
je 0x100583e7
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x100583a6
push 0x80004003
call fcn.100830f0
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x40]
call eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 4]
push edx
call dword [sym.imp.USER32.DLL_CopyRect]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 4]
push ecx
push eax
call dword [sym.imp.USER32.DLL_MoveWindow]
add esp, 0x20
ret
Function at 0x10058490
Capabilities:
Check if file exists
Get graphical window text

Disassembly:
sub esp, 0x410
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x40c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x41c]
mov eax, dword [ebp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.DLL_GetWindow]
push 5
xor ebx, ebx
push eax
mov dword [ebp + 0x28], ebx
call edi
mov esi, eax
test esi, esi
je 0x100584e0
push esi
call dword [sym.imp.USER32.DLL_IsWindow]
test eax, eax
je 0x100584e0
push 5
push esi
call edi
test eax, eax
jne 0x100585c8
mov eax, dword [ebp + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x100585c8
cmp dword [ebp + 0x44], 0xffffffff
jne 0x10058508
mov edi, dword [ebp + 0x3c]
call fcn.1000ed10
test eax, eax
je 0x100585c8
push 0x200
lea ecx, [esp + 0x220]
push 0
push ecx
call fcn.10087b80
mov esi, 0xf
call fcn.1003f150
mov edx, dword [ebp + 4]
push eax
push edx
push 0x100add74
lea eax, [esp + 0x234]
push 0xff
push eax
call fcn.10084751
mov eax, dword [ebp + 0x3c]
push 0xffffffffffffffff
lea ecx, [esp + 0x240]
push 1
push ecx
call fcn.10035ad0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x4a]
push eax
mov word [esp + 0x4c], dx
call fcn.10087b80
mov edx, dword [ebp + 4]
add esp, 0x38
push 0x104
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.DLL_GetWindowTextW]
lea ebx, [esp + 0x14]
lea edi, [esp + 0x10]
call fcn.100036f0
push 0x7ee
mov eax, edi
push eax
mov eax, ebp
call fcn.100583f0
mov ebx, eax
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, 0x100bc65c
je 0x100585c8
lea esi, [eax - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x100585c8
push esi
call fcn.1008441c
add esp, 4
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x100585d5
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], 1
pop ebp
pop ebx
xor ecx, esp
call fcn.10083dbb
add esp, 0x410
ret 4
Function at 0x10058730
Capabilities:
Check if file exists
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 5
mov ebp, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push ebp
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x100588db
mov eax, dword [esp + 0x38]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1005884b
lea ecx, [esp + 0x28]
push ecx
xor ebp, ebp
push ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
jne 0x100587c8
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call esi
push edi
call esi
dec dword [esp + 0x18]
mov dword [esp + 0x14], ebp
jmp 0x100588c5
mov ebp, dword [esp + 0x28]
cmp ebp, 0x100000
jb 0x100587d9
mov ebp, 0x100000
push 0x100c5a78
push ebp
call fcn.1008589d
mov esi, eax
xor eax, eax
add esp, 8
cmp esi, eax
je 0x1005883a
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
push 0
lea edx, [esp + 0x20]
push edx
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
mov eax, dword [esp + 0x1c]
je 0x10058813
test eax, eax
je 0x10058829
push 0
lea ecx, [esp + 0x28]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x100587f7
jmp 0x10058831
mov dword [esp + 0x14], 1
push esi
call fcn.1008441c
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebp, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.DLL_CreateFileW]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [esp + 0x14], 0
je 0x10058915
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ebp
call esi
mov edx, dword [esp + 0x34]
mov dword [edx + 0x44], eax
cmp eax, 0xffffffff
je 0x10058915
call fcn.1000a7d0
test eax, eax
je 0x100588b7
mov edi, dword [esp + 0x3c]
lea esi, [esp + 0x20]
mov eax, 0x100c67f8
mov dword [esp + 0x20], 0xffffffff
call fcn.10001220
test eax, eax
je 0x100588b7
mov eax, dword [esp + 0x20]
cmp eax, 3
je 0x100588b7
cmp eax, 0xffffffff
jne 0x10058915
dec dword [esp + 0x18]
mov dword [esp + 0x14], 0
xor ebp, ebp
cmp dword [esp + 0x18], ebp
jg 0x10058747
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
push ebp
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
je 0x10058915
mov edi, ebp
call fcn.1000ed10
test eax, eax
je 0x10058915
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ebp
call esi
mov ecx, dword [esp + 0x34]
mov dword [ecx + 0x44], eax
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x10058930
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x100bb300]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
push 0
push 0x1a
lea eax, [esp + 0x14]
push eax
push 0
mov edi, ecx
call dword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.DLL_PathAppendW]
push 0x100add98
lea ecx, [esp + 0x10]
push ecx
call esi
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsW]
test eax, eax
jne 0x10058989
push eax
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.DLL_SHCreateDirectoryExW]
push 0x100add58
lea ecx, [esp + 0x10]
push ecx
call esi
lea ebx, [esp + 0xc]
call fcn.100036f0
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10083dbb
add esp, 0x20c
ret
Function at 0x1005a3e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp dword [ebp + 0x90], 0
push esi
push edi
je 0x1005a3fd
mov ecx, dword [ebp + 0x90]
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
mov esi, dword [esp + 0x14]
push ebx
mov ebx, 0x100ade70
lea edi, [esp + 0x18]
add esi, 0xfffff7e4
call fcn.100036f0
cmp esi, 2
jae 0x1005a4cd
mov ecx, dword [ebp + 0x6c]
sub ecx, dword [ebp + 0x68]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x1005a4cd
mov ecx, dword [ebp + 0x6c]
sub ecx, dword [ebp + 0x68]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp esi, ecx
jb 0x1005a45c
call fcn.100848cc
mov eax, dword [ebp + 0x68]
lea edx, [esi + esi*2]
lea eax, [eax + edx*4 + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jl 0x1005a47c
mov esi, eax
lea ecx, [esi - 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
jmp 0x1005a494
mov edx, dword [0x100bc66c]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
call fcn.100035a0
mov esi, dword [esp + 0x14]
cmp dword [esi - 8], 0
je 0x1005a4ac
push esi
push 0x100ade94
lea ecx, [esp + 0x20]
call fcn.10001df0
add esp, 8
lea eax, [esi - 0xc]
cmp eax, 0x100bc65c
je 0x1005a4cd
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1005a4cd
push esi
call fcn.1008441c
add esp, 4
mov edi, dword [esp + 0x18]
push edi
mov edx, 0x100a920c
xor ecx, ecx
call fcn.1001e400
mov eax, 1
add esp, 4
test byte [0x100c7cd0], al
jne 0x1005a50b
or dword [0x100c7cd0], eax
mov esi, 0x100c7c48
call fcn.100469f0
push 0x100a35e0
call fcn.1008416d
add esp, 4
push 0x100adebc
mov ebx, 0x100adeac
mov eax, 0x100ade1c
mov ecx, 0x100c7c48
call fcn.10047bb0
mov ecx, dword [ebp + 0x30]
push ecx
call dword [sym.imp.USER32.DLL_IsWindow]
pop ebx
test eax, eax
je 0x1005a53f
mov edx, dword [ebp + 0x30]
push 0
push edx
call dword [sym.imp.USER32.DLL_ShowWindow]
lea eax, [edi - 0xc]
cmp eax, 0x100bc65c
je 0x1005a560
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x1005a560
push esi
call fcn.1008441c
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret 8