joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x706d6f43
mov dword [ebp - 0xc], 0x56657261
mov dword [ebp - 8], 0x69737265
mov word [ebp - 4], 0x6e6f
mov byte [ebp - 2], 0
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x1002057d
mov eax, dword [ecx]
push 1
push 0xe
call dword [eax]
test eax, eax
je 0x10020587
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xe
jl 0x10020573
mov dword [eax - 0xc], 0xe
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xe
push eax
push 0xe
mov byte [ecx + 0xe], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3

Function at 0x10020590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x50746547
mov dword [ebp - 0xc], 0x75646f72
mov dword [ebp - 8], 0x614e7463
mov word [ebp - 4], 0x656d
mov byte [ebp - 2], 0
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x1002060d
mov eax, dword [ecx]
push 1
push 0xe
call dword [eax]
test eax, eax
je 0x10020617
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xe
jl 0x10020603
mov dword [eax - 0xc], 0xe
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xe
push eax
push 0xe
mov byte [ecx + 0xe], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3

Function at 0x10020730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x100a6260]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x776f4c68
mov dword [ebp - 0xc], 0x76697250
mov dword [ebp - 8], 0x67656c69
mov word [ebp - 4], 0x65
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x100207b4
mov eax, dword [ecx]
push 1
push 0x1d
call dword [eax]
test eax, eax
je 0x100207be
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x1d
jl 0x100207aa
mov dword [eax - 0xc], 0x1d
lea eax, [ebp - 0x20]
mov ecx, dword [esi]
push 0x1d
push eax
push 0x1d
mov byte [ecx + 0x1d], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3
Function at 0x100207d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x53746547
mov dword [ebp - 8], 0x56666c65
mov word [ebp - 4], 0x7265
mov byte [ebp - 2], 0
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x10020846
mov eax, dword [ecx]
push 1
push 0xa
call dword [eax]
test eax, eax
je 0x10020850
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x1002083c
mov dword [eax - 0xc], 0xa
lea eax, [ebp - 0xc]
mov ecx, dword [esi]
push 0xa
push eax
push 0xa
mov byte [ecx + 0xa], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3

Function at 0x10020a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x41746547
mov dword [ebp - 0xc], 0x61447070
mov dword [ebp - 8], 0x69446174
mov word [ebp - 4], 0x72
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x10020a79
mov eax, dword [ecx]
push 1
push 0xd
call dword [eax]
test eax, eax
je 0x10020a83
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x10020a6f
mov dword [eax - 0xc], 0xd
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xd
push eax
push 0xd
mov byte [ecx + 0xd], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3

Function at 0x10020a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x75537349
mov dword [ebp - 0xc], 0x726f7070
mov dword [ebp - 8], 0x6e794474
mov word [ebp - 4], 0x7057
mov byte [ebp - 2], 0
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x10020b0d
mov eax, dword [ecx]
push 1
push 0xe
call dword [eax]
test eax, eax
je 0x10020b17
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xe
jl 0x10020b03
mov dword [eax - 0xc], 0xe
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xe
push eax
push 0xe
mov byte [ecx + 0xe], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3
Function at 0x10020b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x50646e45
mov dword [ebp - 8], 0x65636f72
mov word [ebp - 4], 0x7373
mov byte [ebp - 2], 0
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x10020b96
mov eax, dword [ecx]
push 1
push 0xa
call dword [eax]
test eax, eax
je 0x10020ba0
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x10020b8c
mov dword [eax - 0xc], 0xa
lea eax, [ebp - 0xc]
mov ecx, dword [esi]
push 0xa
push eax
push 0xa
mov byte [ecx + 0xa], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3

Function at 0x10020cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x64616f4c
mov dword [ebp - 0xc], 0x4f6d6f43
mov dword [ebp - 8], 0x63656a62
mov word [ebp - 4], 0x74
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x10020d49
mov eax, dword [ecx]
push 1
push 0xd
call dword [eax]
test eax, eax
je 0x10020d53
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x10020d3f
mov dword [eax - 0xc], 0xd
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xd
push eax
push 0xd
mov byte [ecx + 0xd], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3

Function at 0x10020d60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x64616552
mov dword [ebp - 0xc], 0x6c616d53
mov dword [ebp - 8], 0x6c69466c
mov word [ebp - 4], 0x65
call fcn.10001ca0
mov ecx, eax
test ecx, ecx
je 0x10020dd9
mov eax, dword [ecx]
push 1
push 0xd
call dword [eax]
test eax, eax
je 0x10020de3
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x10020dcf
mov dword [eax - 0xc], 0xd
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xd
push eax
push 0xd
mov byte [ecx + 0xd], 0
push dword [esi]
call fcn.10008170
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100015b0
push 0x80004005
call fcn.100015b0
call fcn.10001810
int3
Function at 0x1002f5a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1002f629
cmp dword [ebp + 0x10], 0
je 0x1002f629
cmp dword [ebp + 0x14], 0
je 0x1002f629
cmp dword [ebp + 0xc], 0x104
jge 0x1002f5d9
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002f5d9
push esi
push dword [edi + 8]
call fcn.10033d70
jmp 0x1002f5e2
push esi
push dword [edi + 8]
call fcn.10033fd0
add esp, 8
test eax, eax
jne 0x1002f610
push eax
push 0xffffffffffffffff
push eax
push dword [edi + 8]
call fcn.100326d0
add esp, 0x10
test eax, eax
jne 0x1002f610
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push eax
call fcn.1002f180
pop edi
pop esi
pop ebp
ret 0x10
push dword [ebp + 0x14]
mov eax, 1
mov ecx, edi
push dword [ebp + 0x10]
push eax
call fcn.1002f180
pop edi
pop esi
pop ebp
ret 0x10
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10

Function at 0x1003a460
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x1003a482
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x44], eax
mov eax, dword [esi + 0x70]
push 1
add eax, 4
push eax
call fcn.1006cde3
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov byte [esi + 6], cl
cmp dword [eax + 0x58], 0
je 0x1003a4a4
push ecx
push esi
call fcn.1003a5e0
mov eax, dword [esi + 0x10]
push esi
mov eax, dword [eax + 0x58]
call eax
add esp, 0xc
push 1
call fcn.1007fb12
int3

Function at 0x1003d4c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, 1
call fcn.10032360
add esp, 4
sub eax, esi
je 0x1003d520
mov edi, dword [ebp + 0x10]
dec eax
push edi
push ebx
mov dword [ebp - 8], eax
call fcn.100331c0
add esp, 8
cmp eax, 3
jne 0x1003d542
test esi, esi
je 0x1003d516
push edi
push ebx
call fcn.100330c0
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.10033330
add esp, 0x10
test eax, eax
jg 0x1003d56a
xor esi, esi
mov eax, dword [ebp - 8]
inc edi
test eax, eax
jne 0x1003d4e1
call fcn.1006f9b7
mov edi, dword [eax]
test esi, esi
je 0x1003d571
push 1
push ebx
call fcn.10032740
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.10033750
add esp, 0xc
test esi, esi
je 0x1003d516
push dword [ebp + 0xc]
push dword [ebp - 4]
push 1
push eax
call fcn.1008082e
add esp, 0x10
cmp eax, dword [ebp - 4]
jne 0x1003d516
mov esi, 1
jmp 0x1003d518
push ebx
call fcn.100328c0
push edi
call fcn.1007e642
push eax
push 0x100a6918
push ebx
call fcn.10032800
push edi
push ebx
call fcn.10032830
add esp, 0x1c
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d9a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
mov dword [ebp - 0x218], ebx
call fcn.10033600
mov edi, dword [ebp + 0x10]
add esp, 8
mov ebx, dword [ebp - 0x214]
mov esi, 0x200
nop word [eax + eax]
lea eax, [ebp - 0x210]
push eax
call fcn.10034360
cmp esi, edi
mov ecx, edi
push ebx
cmovbe ecx, esi
mov esi, ecx
push esi
push 1
push eax
call fcn.1007e0fa
add dword [ebp - 0x210], eax
add esp, 0x14
sub edi, eax
je 0x1003da20
cmp eax, esi
je 0x1003d9f0
lea eax, [ebp - 0x210]
push eax
call fcn.100343a0
mov ebx, dword [ebp - 0x218]
add esp, 4
test edi, edi
je 0x1003da59
push 0xffffffffffffffff
push ebx
call fcn.10032660
add esp, 8
test eax, eax
jne 0x1003da59
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100612dc
mov esp, ebp
pop ebp
ret
Function at 0x1004da90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a05ca
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 1
call fcn.10001d50
mov ecx, eax
test ecx, ecx
je 0x1004dbb1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push 0
push eax
mov dword [ebp - 0x220], 0x208
mov dword [ebp - 0x224], 1
call fcn.1006c590
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004db73
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1004db55
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10001950
mov edi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1004db92
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.100015b0
int3
Function at 0x1004ee30
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a07ce
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push ebx
push esi
push edi
mov eax, dword [0x100cd4bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0
cmp dword [esi + 4], 0
mov dword [ebp - 4], 0
je 0x1004ee87
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x38]
mov dword [esi + 8], 0
push eax
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
call fcn.1004ebe0
push esi
push 0
push esi
push 0x1004f0d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x1004ef26
call fcn.10054ac0
test eax, eax
je 0x1004ef1f
call fcn.10054ac0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x1004ef1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.10054ac0
lea ecx, [ebp - 0xd0]
mov ebx, eax
call fcn.10003290
mov esi, eax
push str.CWorkThread::Start__CreateThread_failed__errno
push esi
mov byte [ebp - 4], 1
call fcn.10003e90
add esp, 8
mov ecx, esi
push edi
call fcn.1001d150
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0xd0]
call fcn.10003f50
xor edi, edi
jmp 0x1004efc2
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esi + 8], 0
mov dword [ebp - 0x10], eax
jne 0x1004efbd
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jae 0x1004ef55
push 0xa
call ebx
cmp dword [esi + 8], 0
je 0x1004ef41
cmp dword [esi + 8], 0
jne 0x1004efbd
call fcn.10054ac0
test eax, eax
je 0x1004ef1f
call fcn.10054ac0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x1004ef1f
call fcn.10054ac0
lea ecx, [ebp - 0x168]
mov edi, eax
call fcn.10003290
mov esi, eax
push str.CWorkThread::Start__wait_thread_running_timeout_
push esi
mov byte [ebp - 4], 2
call fcn.10003e90
add esp, 8
mov ecx, esi
push dword [ebp + 8]
call fcn.10014ed0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0x168]
call fcn.10003f50
xor edi, edi
jmp 0x1004efc2
mov edi, 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1004efda
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10054ec0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a0d7b
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x20], 8
lea esi, [edi + 0xc]
jb 0x10054efb
mov esi, dword [esi]
push 0x180
push 0x40
push 0x8101
lea ebx, [edi + 0x24]
push esi
push ebx
call fcn.10088263
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x10054fcc
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.1006c590
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.10053cc0
push 0x100ab714
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push esi
push str.open
push eax
call fcn.10009210
add esp, 8
push eax
call fcn.10009210
add esp, 8
push eax
call fcn.10009210
add esp, 8
mov ecx, eax
call fcn.10014ed0
push eax
call fcn.10009210
add esp, 8
lea eax, [ebp - 0xc4]
lea ecx, [ebp - 0xa8]
push eax
call fcn.10055010
cmp dword [eax + 0x14], 8
jb 0x10054faf
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xc4]
call fcn.10003aa0
lea ecx, [ebp - 0xa8]
call fcn.10003f50
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x10054fe5
push 2
push 0
push eax
call fcn.10088791
add esp, 0xc
mov dword [edi + 4], eax
jmp 0x10054fec
mov dword [edi + 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret
Function at 0x10055350
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a0e78
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x44]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
cmp eax, 2
je 0x10055532
cmp eax, 1
jne 0x1005554a
cmp byte [edi + 8], 0
je 0x100553a6
call fcn.10054ec0
mov byte [edi + 8], 0
cmp dword [edi + 4], 0x40000000
jle 0x100553e2
mov eax, dword [edi + 0x24]
cmp eax, 0xffffffff
je 0x100553c7
push eax
call fcn.1008832d
add esp, 4
mov dword [edi + 0x24], 0xffffffff
cmp dword [edi + 0x20], 8
lea eax, [edi + 0xc]
jb 0x100553d2
mov eax, dword [eax]
push eax
call fcn.10087818
add esp, 4
mov ecx, edi
call fcn.10054ec0
cmp dword [edi + 0x28], 0
jne 0x1005547d
push 0
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.100550d0
add esp, 0xc
push 2
push 0x100ab74c
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.10006cd0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
mov ecx, dword [edi + 0x24]
cmovae eax, dword [ebp - 0x48]
cmp ecx, 0xffffffff
je 0x10055462
push dword [ebp - 0x38]
push eax
push ecx
call fcn.10088d62
add esp, 0xc
jmp 0x10055465
or eax, 0xffffffff
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x2c], eax
call fcn.10002630
lea ecx, [ebp - 0x60]
call fcn.10002630
jmp 0x10055526
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 1
push esi
push eax
call fcn.100550d0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
lea ecx, [edi + 0x2c]
push ecx
push eax
call fcn.1005ff70
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.10002630
test esi, esi
jne 0x100554d8
push 0xd
push str.write_failed.
lea ecx, [ebp - 0x28]
call fcn.100143c0
push 0x100ab74c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.10053580
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x100554f8
mov eax, dword [eax]
mov ecx, dword [edi + 0x24]
cmp ecx, 0xffffffff
je 0x1005550d
push edx
push eax
push ecx
call fcn.10088d62
add esp, 0xc
jmp 0x10055510
or eax, 0xffffffff
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x2c], eax
call fcn.10002630
lea ecx, [ebp - 0x28]
call fcn.10002630
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x10055532
add dword [edi + 4], eax
jmp 0x1005554a
cmp dword [esi + 0x14], 8
jb 0x1005553a
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x100a5f18
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100612dc
mov esp, ebp
pop ebp
ret 4
Function at 0x10056010
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x100cd4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x100561d8
test eax, eax
je 0x100561d8
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x100561d8
push ecx
push ebx
push eax
call fcn.1006c590
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x100561d8
cmp edi, 0xffffffff
je 0x100561d1
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1000d4a0
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100561d1
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x10056167
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x100561d1
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x10056167
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x10056100
cmp edi, esi
jae 0x10056167
nop
sub esi, edi
sbb ecx, eax
js 0x10056115
jg 0x10056110
cmp esi, 0x400000
jb 0x10056115
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x10056167
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1000d4f0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x1005615b
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x10056100
jg 0x10056167
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x10056100
lea eax, [ebp - 0x6c]
push eax
call fcn.1000d390
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
push 3
push edi
call fcn.100168d0
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x10056180
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.10089328
add esp, 8
mov esi, 1
test ebx, ebx
je 0x100561bd
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x100561cb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100612dc
mov esp, ebp
pop ebp
ret