joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099f5
Capabilities:
Create directory

Disassembly:
push 0x5c
mov eax, 0x4364b4
call fcn.0042c1e1
mov esi, dword [ebp + 8]
push esi
call fcn.0040a371
cmp eax, 0xffffffff
je 0x409a1a
test al, 0x10
je 0x409a1a
mov al, 1
jmp 0x409bec
push esi
call fcn.0040af70
test al, al
jne 0x409bea
push esi
call fcn.0040b0b3
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp + 8], eax
call fcn.00407f8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00408346
test eax, eax
js 0x409a77
mov edx, dword [ebp - 0x14]
lea ecx, [edx - 1]
cmp eax, ecx
jne 0x409a77
cmp edx, 1
jne 0x409a6b
mov bl, dl
push dword [ebp - 0x18]
call fcn.0042bcbf
pop ecx
mov al, bl
jmp 0x409bec
mov edx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x14], ecx
mov word [edx + ecx*2], ax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
call fcn.00408009
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp byte [0x4423f0], 0
mov ebx, dword [ebp - 0x18]
jne 0x409aba
push ebx
lea eax, [ebp - 0x30]
push eax
call fcn.00408413
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x30]
mov edi, eax
call fcn.0042bcbf
pop ecx
test edi, edi
jmp 0x409ac5
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x409bac
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
jne 0x409b21
lea ecx, [ebp - 0x68]
call fcn.00409f19
lea ecx, [ebp - 0x40]
call fcn.00407f69
push 0
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.0040a498
push dword [ebp - 0x40]
mov byte [ebp - 4], 1
test al, al
jne 0x409b0c
call fcn.0042bcbf
pop ecx
jmp 0x409b21
mov ebx, dword [ebp - 0x48]
shr ebx, 4
call fcn.0042bcbf
and bl, 1
pop ecx
jne 0x409bac
call edi
cmp eax, 0xb7
je 0x409bc8
lea ecx, [ebp - 0x18]
call fcn.00408346
mov esi, eax
test esi, esi
js 0x409bd8
je 0x409bd8
mov ecx, dword [ebp - 0x18]
cmp esi, 1
jne 0x409b5b
movzx eax, word [ecx]
cmp eax, 0x5c
je 0x409bc8
cmp eax, 0x2f
je 0x409bc8
lea eax, [esi + 1]
cmp dword [ebp + 8], eax
jae 0x409bc8
cmp esi, dword [ebp - 0x14]
jae 0x409a8a
xor eax, eax
mov dword [ebp - 0x14], esi
mov word [ecx + esi*2], ax
jmp 0x409a8a
mov eax, dword [ebp - 0x24]
lea eax, [eax + esi*2 + 2]
push eax
call fcn.0040ad99
test eax, eax
jns 0x409b90
mov esi, dword [ebp - 0x20]
jmp 0x409b94
lea esi, [esi + eax + 1]
push esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
call fcn.004080fc
push dword [ebp - 0x18]
call fcn.00409545
test al, al
je 0x409bc8
cmp esi, dword [ebp - 0x20]
jl 0x409b7a
push dword [ebp - 0x24]
call fcn.0042bcbf
push dword [ebp - 0x18]
call fcn.0042bcbf
pop ecx
pop ecx
jmp 0x409a13
push dword [ebp - 0x24]
call fcn.0042bcbf
pop ecx
xor bl, bl
jmp 0x409a5b
push dword [ebp - 0x24]
call fcn.0042bcbf
push dword [ebp - 0x18]
call fcn.0042bcbf
pop ecx
pop ecx
xor al, al
call fcn.0042c2b9
ret 4
Function at 0x40a371
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4423f0], 0
jne 0x40a3a5
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408413
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0042bcbf
pop ecx
mov eax, esi
pop esi
jmp 0x40a3b5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40a3b5
or eax, eax
leave
ret 4

Function at 0x40a973
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a99d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40a99d
xor al, al
jmp 0x40a9b2
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x419cc2
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x436266
call fcn.0042c1e1
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.00419c48
push 0xce4
lea eax, [ebp - 0x18]
push eax
call fcn.0041907c
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040b98e
push dword [ebp - 0x18]
call fcn.0042bcbf
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.0042c2b9
ret 8

Function at 0x41a834
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41a85f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41a85f
xor al, al
jmp 0x41a874
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 8

Function at 0x41a879
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x43f160]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor ebx, ebx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0042b8b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x210], eax
cmp eax, 0xffffffff
je 0x41a92a
push esi
push eax
call fcn.0041a834
push dword [esi]
mov dword [ebp - 0x214], ebx
call fcn.0042bcd5
pop ecx
push ebx
lea ecx, [ebp - 0x214]
push ecx
mov dword [edi], eax
push dword [esi]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b86b
leave
ret 8
Function at 0x42b86b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f160]
jne 0x42b875
repz ret
jmp fcn.0042fdc5

Function at 0x432b2c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f160]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0042f7ee
and dword [ebp - 0x14], 0
cmp dword [0x443058], 0
mov dword [ebp - 0x18], eax
jne 0x432bdf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x432c87
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43aad0
push ebx
call edi
test eax, eax
je 0x432c87
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x443058], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44305c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x443060], eax
call edi
push eax
call esi
mov dword [0x443068], eax
test eax, eax
je 0x432bdf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x443064], eax
mov eax, dword [0x443064]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x432c38
cmp dword [0x443068], ecx
je 0x432c38
push eax
call esi
push dword [0x443068]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x432c38
test ebx, ebx
je 0x432c38
call edi
test eax, eax
je 0x432c2f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x432c2f
test byte [ebp - 8], 1
jne 0x432c38
or dword [ebp + 0x10], 0x200000
jmp 0x432c6b
mov eax, dword [0x44305c]
cmp eax, dword [ebp - 0x18]
je 0x432c6b
push eax
call esi
test eax, eax
je 0x432c6b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x432c6b
mov eax, dword [0x443060]
cmp eax, dword [ebp - 0x18]
je 0x432c6b
push eax
call esi
test eax, eax
je 0x432c6b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x443058]
call esi
test eax, eax
je 0x432c87
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x432c89
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b86b
leave
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10001480
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.100025a0
test esi, esi
jne 0x100014b6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.1000268c
jmp 0x100014d4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.10001334
mov edi, eax
test esi, esi
je 0x100014d4
cmp dword [ebx], 0
je 0x100014d4
dec esi
jmp 0x100014bd
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x10001a94
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x10009008], 0x8088405
inc edx
mov dword [ebx + 0x10009008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x10003728
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x100037b8
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x100037b8
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x1000376b
test edx, 3
jne 0x1000375a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x10003765
jmp 0x1000376b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x1000376b
cmp dword [ecx - 8], 1
je 0x10003775
mov edx, ebx
or edx, 3
call fcn.100029ac
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x10003787
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.100025a0

Function at 0x10003a58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.10002918
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x10003a71
test al, 0x10
je 0x10003a75
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x10003c48
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10002908
xor eax, eax
push ebp
push 0x10003dc9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
call fcn.100025a0
mov byte [ebp - 0x1a], 0xfc
mov byte [ebp - 0x18], 0xf0
mov byte [ebp - 0x16], 0xc0
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, 2
xor eax, eax
mov dword [ebp - 0x14], eax
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.10002720
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 0xc]
jge 0x10003d90
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
sub eax, 0x3d
jns 0x10003ced
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi]
call fcn.100026bc
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.10002728
inc dword [ebp - 0x10]
inc esi
xor ebx, ebx
mov edi, 2
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x10003d87
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
sub al, 0x3d
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x10003d90
mov eax, dword [ebp - 0x14]
add eax, 6
cmp eax, 8
jl 0x10003d71
mov al, byte [ebp - 0x1d]
and al, 0x3f
and eax, 0xff
mov dword [ebp - 0x24], eax
mov ecx, 6
sub ecx, edi
shr dword [ebp - 0x24], cl
xor eax, eax
mov al, bl
or eax, dword [ebp - 0x24]
test al, al
je 0x10003d4d
lea eax, [ebp - 0x30]
xor edx, edx
mov dl, bl
or edx, dword [ebp - 0x24]
call fcn.100026bc
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
call fcn.10002728
jmp 0x10003d5a
lea eax, [ebp - 0x28]
mov edx, 0x10003de0
call fcn.10002728
inc dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp edi, 6
jl 0x10003d6e
mov edi, 2
jmp 0x10003d86
add edi, 2
mov ecx, edi
mov bl, byte [ebp - 0x1d]
shl bl, cl
and bl, byte [ebp + edi - 0x1c]
mov eax, 8
sub eax, edi
add dword [ebp - 0x14], eax
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x10003cb3
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
call fcn.100029ac
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x28]
call fcn.100025f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10003dd0
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.100025c4
lea eax, [ebp - 4]
call fcn.100025a0
ret
Function at 0x10004e3c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x10005057
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x10005070
mov edx, dword [ebp - 0xc]
call fcn.1000276c
mov eax, dword [ebp - 0x15c]
call fcn.10002918
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x10005028
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.10002708
xor eax, eax
push ebp
push 0x10004f54
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x18]
mov eax, 0x1000507c
call fcn.10002964
test eax, eax
jg 0x10004f2e
mov edx, dword [ebp - 0x18]
mov eax, 0x1000508c
call fcn.10002964
test eax, eax
jg 0x10004f2e
mov edx, dword [ebp - 0x18]
mov eax, 0x1000509c
call fcn.10002964
test eax, eax
jg 0x10004f2e
mov edx, dword [ebp - 0x18]
mov eax, 0x100050ac
call fcn.10002964
test eax, eax
jle 0x10004f4a
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.1000276c
mov eax, dword [ebp - 0x160]
call fcn.100050e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10004f5e
xor eax, eax
push ebp
push 0x10004fb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x18]
mov eax, 0x100050bc
call fcn.10002964
test eax, eax
jle 0x10004fac
cmp dword [ebp - 4], 0
jne 0x10004f8e
cmp dword [ebp - 8], 0xa8c000
jae 0x10004fac
jmp 0x10004f90
jge 0x10004fac
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.1000276c
mov eax, dword [ebp - 0x164]
call fcn.100052f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10004fc0
cmp dword [ebp - 0x14], 0x10
jne 0x1000500a
mov eax, dword [ebp - 0x18]
mov edx, 0x100050cc
call fcn.10002864
je 0x1000500a
mov eax, dword [ebp - 0x18]
mov edx, 0x100050d8
call fcn.10002864
je 0x1000500a
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0x100050e4
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.100027e0
mov eax, dword [ebp - 0x168]
call fcn.10004e3c
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x10004eae
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000505e
lea eax, [ebp - 0x168]
mov edx, 4
call fcn.100025c4
lea eax, [ebp - 0x18]
call fcn.100025a0
ret
Function at 0x100050e8
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10002908
xor eax, eax
push ebp
push 0x100051ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 0x10005204
call fcn.10003c48
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x100052f0
call fcn.10002964
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.10002924
push 0
push 0x80
push 3
push 0
push 0
push 0x10000000
mov eax, dword [ebp - 4]
call fcn.10002918
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.10002720
sub esi, eax
push esi
push ebx
call sub.kernel32.dll_SetFilePointer_1
mov eax, dword [ebp - 0xc]
call fcn.10002720
call fcn.10003708
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.10002720
push eax
push esi
push ebx
call sub.kernel32.dll_ReadFile_1
mov eax, dword [ebp - 0xc]
call fcn.10002918
mov edi, eax
mov al, byte [edi]
cmp al, byte [esi]
je 0x100051c9
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.10002720
push eax
push edi
push ebx
call sub.kernel32.dll_WriteFile_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100051f4
lea eax, [ebp - 0xc]
call fcn.100025a0
lea eax, [ebp - 4]
call fcn.100025a0
ret
Function at 0x100055e0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10002908
mov eax, dword [ebp - 8]
call fcn.10002908
mov eax, dword [ebp - 0xc]
call fcn.10002908
mov eax, dword [ebp + 8]
call fcn.10002908
xor eax, eax
push ebp
push 0x1000575a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x1000572d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0xc]
call fcn.10002918
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10005719
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov esi, eax
mov eax, esi
call fcn.10003708
mov edi, eax
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
push ebx
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x10005719
push 0
mov eax, dword [ebp + 8]
call fcn.10002918
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10005719
push 0
push 0
mov dx, 2
mov ax, 4
call fcn.100055d8
push eax
mov eax, dword [ebp - 4]
call fcn.10002918
push eax
mov eax, dword [ebp - 8]
call fcn.10002918
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UpdateResourceA
push esi
push edi
mov dx, 2
mov ax, 4
call fcn.100055d8
push eax
mov eax, dword [ebp - 4]
call fcn.10002918
push eax
mov eax, dword [ebp - 8]
call fcn.10002918
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UpdateResourceA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x10005712
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_EndUpdateResourceA
mov eax, edi
call fcn.100011cc
mov byte [ebp - 0xd], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10005737
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10005761
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.100025c4
lea eax, [ebp + 8]
call fcn.100025a0
ret