joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40452c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp byte [0x430268], 0
jne 0x404673
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
xor eax, eax
mov ecx, eax
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, cl
and edx, 0xf
movzx edx, byte [edx + str.0123456789ABCDEF]
mov ecx, 0x18
sub ecx, eax
mov byte [ecx + str.LocalFastMM_PID_________], dl
inc eax
cmp eax, 8
jne 0x404548
push str.LocalFastMM_PID_________
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x430264], eax
cmp dword [0x430264], 0
jne 0x404616
mov eax, dword [sym.imp.rtl160.bpl__System_IsLibrary]
cmp byte [eax], 0
jne 0x4045d1
push str.LocalFastMM_PID_________
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x430264], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x430264]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [eax], 0x43024c
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov dword [0x43024c], fcn.00402f3c
mov dword [0x430250], 0x403220
mov dword [0x430254], 0x4033a0
mov dword [0x430258], 0x403630
mov dword [0x43025c], 0x403808
mov dword [0x430260], 0x403854
mov byte [0x430269], 1
jmp 0x404658
push 0
push 0
push 0
push 4
mov eax, dword [0x430264]
push eax
call sub.kernel32.dll_MapViewOfFile
mov edx, dword [eax]
mov esi, edx
mov edi, 0x43024c
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [0x430264]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
mov dword [0x430264], eax
mov byte [0x430269], 0
mov eax, 0x430234
call sub.rtl160.bpl__System_GetMemoryManager_qqrr23System_TMemoryManagerEx
mov eax, 0x43024c
call sub.rtl160.bpl__System_SetMemoryManager_qqrrx23System_TMemoryManagerEx
mov byte [0x430268], 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a348
Capabilities:
Inspect section memory permissions

Disassembly:
xor eax, eax
test edx, 0x20000000
je 0x40a380
test edx, 0x40000000
je 0x40a36c
test edx, 0x80000000
je 0x40a367
or eax, 0x40
jmp 0x40a3aa
or eax, 0x20
jmp 0x40a3aa
test edx, 0x80000000
je 0x40a37b
or eax, 0x80
jmp 0x40a3aa
or eax, 0x10
jmp 0x40a3aa
test edx, 0x40000000
je 0x40a39a
test edx, 0x80000000
je 0x40a395
or eax, 4
jmp 0x40a3aa
or eax, 2
jmp 0x40a3aa
test edx, 0x80000000
je 0x40a3a7
or eax, 8
jmp 0x40a3aa
or eax, 1
test edx, 0x4000000
je 0x40a3b7
or eax, 0x200
ret
Function at 0x40a4c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
lea eax, [ebx + 0x44]
mov edx, 0xf8
call fcn.00402428
lea edx, [ebx + 4]
mov ecx, 0x40
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
xor ecx, ecx
mov edx, dword [ebx + 0x40]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebx + 0x44]
mov ecx, 4
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebx + 0x48]
mov ecx, 0x14
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
movzx ecx, word [ebx + 0x58]
lea edx, [ebx + 0x5c]
mov eax, dword [ebx + 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
cmp word [ebx + 4], 0x5a4d
jne 0x40a54c
cmp dword [ebx + 0x44], 0x4550
jne 0x40a54c
cmp word [ebx + 0x48], 0x14c
je 0x40a562
mov ecx, 0x40a574
mov dl, 1
mov eax, dword [sym.imp.rtl160.bpl__System_Sysutils_Exception_]
call sub.rtl160.bpl__System_Sysutils_Exception__bctr_qqrx20System_UnicodeString
call sub.rtl160.bpl__System__RaiseExcept_qqrv
pop esi
pop ebx
pop ebp
ret
Function at 0x408bd0
Capabilities:
Initialize winsock library

Disassembly:
in al, dx
adc byte [esi - 0x74a9f3b3], ch
mov eax, dword [0x8d006a10]
push ebp
test byte [edx], ch
mov eax, dword [esi]
push edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], ecx
push eax
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x10]
push 0x32
push ecx
push eax
mov dword [ebp - 4], 0xf100
mov dword [ebp + 0x70], 0
mov edx, dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x408bb3
push edi
mov esp, dword [edi + 0x98c1d8]
call edi
test eax, eax
mov bl, 0x2c
mov dword [esi], eax
call 0x5e2616f9
ret 0xc
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop esi
fstpnce st(0), st(0)
sbb ebx, dword [ebx + 0x25]
sub dh, 0x28
inc dword [0x1f97e]
sbb ebp, esp
mov es, edx
cdq
add byte [eax - 0x74aa6f70], dl
push ebp
mov ebp, esp
mov ecx, dword [ebx + 0x458dcb4d]
jg 0x408c2b
push 0xe9046626
push ecx
mov dword [ebp - 4], 0x970000a7
adc al, 0x15
mov ah, 0xc1
inc eax
add byte [ebx + 0x1e75fff8], al
push esi
mov esi, dword [sym.imp.WSOCK32.dll_WSAStartup]
call esi
test eax, eax
xchg byte [0x5de58b5e], al
ret
cmc
jle 0x408c94
add al, 0x11
push ecx
mov dword [ebp + 0x29], 1
call dword [0x12c1b4]
cmp eax, 0xffffffff
jne 0x408c61
push esi
mov esi, dword [0x3ac1d8]
call esi
stc
sal byte [ebp + 5], 0x5e
mov esp, ebp
pop ebp
ret
xor eax, eax
invalid
push esi
add al, 0x69
push ebx
test bh, bh
invalid
Function at 0x4011e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x220
mov eax, dword [0x427070]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push esi
push 0x20a
mov esi, edx
lea edx, [esp + 0x20]
push 0
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
xor bl, bl
call fcn.00401f80
push 0x104
push esi
lea eax, [esp + 0x30]
push 0x104
push eax
call fcn.00402307
add esp, 0x1c
push 0
lea ecx, [esp + 0x20]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
test eax, eax
je 0x4012e5
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00401ad8
mov esi, eax
add esp, 4
test esi, esi
je 0x4012e5
mov eax, dword [esp + 0xc]
push esi
push eax
push 0
lea ecx, [esp + 0x28]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4012dc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push 0x424a98
push esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x34
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4012dc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 0xa]
mov word [edi], cx
mov dx, word [eax + 8]
mov word [ebp], dx
movzx ecx, word [eax + 0xe]
mov edx, dword [esp + 0x14]
mov word [edx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [esp + 0x18]
mov word [ecx], ax
mov bl, 1
push esi
call fcn.004020d6
add esp, 4
mov ecx, dword [esp + 0x228]
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.00401aee
add esp, 0x220
ret
Function at 0x401300
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x62c
mov eax, dword [0x427070]
xor eax, esp
mov dword [esp + 0x628], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22e]
push ecx
mov word [esp + 0x230], ax
call fcn.00401f80
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x32]
push eax
mov word [esp + 0x34], dx
call fcn.00401f80
mov eax, 0x428da0
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401356
sub eax, edx
sar eax, 1
jne 0x401398
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
push 0x428da0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x428da0
call fcn.004027d8
add esp, 8
test eax, eax
je 0x401398
xor ecx, ecx
mov word [eax], cx
mov eax, 0x428da0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4013a0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x4013d0
push 0x428da0
lea edx, [esp + 0x228]
push 0x104
push edx
call fcn.00402298
add esp, 0xc
push 0x104
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x40142a
call fcn.00401130
test eax, eax
je 0x40142a
mov ecx, eax
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x401400
sub ecx, esi
sar ecx, 1
cmp ecx, 0x104
jae 0x40142a
push eax
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.00402298
add esp, 0xc
lea ebx, [esp + 0x1c]
mov esi, ebx
call fcn.00401760
mov byte [esp + 0xc], 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x10]
push eax
sub esp, 0xc
mov eax, esp
lea ecx, [esp + 0x238]
mov dword [eax], ecx
mov edx, 0x104
xor esi, esi
mov dword [eax + 4], esi
lea ecx, [esp + 0x238]
mov dword [eax + 8], edx
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.004018c0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x452]
push ecx
mov word [esp + 0x454], ax
call fcn.00401f80
lea edx, [esp + 0x24c]
push edx
push 0x424a9c
push 1
mov edi, 0x104
lea esi, [esp + 0x460]
call fcn.004010e0
add esp, 0x34
mov eax, esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x428d84], eax
test eax, eax
je 0x4014f1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4014f1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x628]
xor ecx, esp
call fcn.00401aee
add esp, 0x62c
ret
push 0x424ab0
call fcn.00402a34
mov ecx, dword [esp + 0x638]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00401aee
add esp, 0x62c
ret
Function at 0x41c112
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040479c
and dword [ebp - 4], 0
cmp dword [0x428a74], 0
mov ebx, eax
jne 0x41c1c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41c274
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41c274
push eax
call fcn.0040472a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428a74], eax
call esi
push eax
call fcn.0040472a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428a78], eax
call esi
push eax
call fcn.0040472a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x428a7c], eax
call esi
push eax
call fcn.0040472a
pop ecx
mov dword [0x428a84], eax
test eax, eax
je 0x41c1c3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040472a
pop ecx
mov dword [0x428a80], eax
mov eax, dword [0x428a80]
cmp eax, ebx
je 0x41c21b
cmp dword [0x428a84], ebx
je 0x41c21b
push eax
call fcn.004047a5
push dword [0x428a84]
mov esi, eax
call fcn.004047a5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41c21b
test edi, edi
je 0x41c21b
call esi
test eax, eax
je 0x41c212
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41c212
test byte [ebp - 0xc], 1
jne 0x41c21b
or dword [ebp + 0x10], 0x200000
jmp 0x41c254
mov eax, dword [0x428a78]
cmp eax, ebx
je 0x41c254
push eax
call fcn.004047a5
pop ecx
test eax, eax
je 0x41c254
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41c254
mov eax, dword [0x428a7c]
cmp eax, ebx
je 0x41c254
push eax
call fcn.004047a5
pop ecx
test eax, eax
je 0x41c254
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428a74]
call fcn.004047a5
pop ecx
test eax, eax
je 0x41c274
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41c276
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
inc ebp
clc
inc ebp
clc
jae 0x10003bb7
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x10003ba8
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10003963
sti
pop es
mov al, 0x3a
lea eax, [ebp - 0x58]
push eax
call fcn.10003973
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10003928
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10003c51
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10003963
push es
mov esp, 0x458d8382
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x10004090
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000403a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10004058
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100040b6
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
invalid
invalid
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000409d
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100040a6
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100040b0
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10004092
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000401c
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10004103
dec eax
je 0x100040fa
sub eax, 3
je 0x100040f1
mov dword [ebp - 4], 0x40
jmp 0x10004120
mov dword [ebp - 4], 4
jmp 0x10004106
mov dword [ebp - 4], 0x20
jmp 0x10004106
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10004152
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100040d2
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10003963
cmp byte [eax + 0x19], cl
jecxz 0x10004146
push dword [ebp + 0x14]
jne 0x1000415d
push 1
push esi
call edi
mov eax, esi
jmp 0x1000415e
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100059f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x10005a04
jmp 0x10005a09
jmp fcn.10005305
cmp dword [ebp - 0x37c], 0
jne 0x10005ab3
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
invalid
invalid
Function at 0x10001250
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
push ebx
push esi
push edi
lea eax, [esp + 0x20]
mov edi, edx
push eax
push edi
mov dword [esp + 0x18], edi
mov esi, ecx
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x10001433
mov al, byte [edi]
mov ecx, edi
mov dword [esp + 0x14], edi
test al, al
je 0x100012a4
inc ecx
cmp al, 0x5c
je 0x1000129a
cmp al, 0x2f
jne 0x1000129e
mov dword [esp + 0x14], ecx
mov al, byte [ecx]
test al, al
jne 0x10001291
xor edx, edx
jmp 0x100012b0
mov al, byte [esp + edx + 0x4c]
lea edx, [edx + 1]
mov cl, byte [edx + 0x1003cb3f]
cmp al, cl
jb 0x100012d4
ja 0x100012d4
test al, al
je 0x1000140e
cmp al, cl
je 0x100012b0
jmp 0x1000140e
xor edx, edx
jmp 0x100012e0
mov al, byte [esp + edx + 0x4c]
lea edx, [edx + 1]
mov cl, byte [edx + 0x1003cb43]
cmp al, cl
jb 0x10001304
ja 0x10001304
test al, al
je 0x1000140e
cmp al, cl
je 0x100012e0
jmp 0x1000140e
test byte [esp + 0x20], 0x10
mov eax, dword [esp + 0x14]
mov byte [eax], 0
je 0x100013ce
test byte [esi + 8], 1
je 0x1000134f
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1000134f
push 0
push 0
push 0
lea edx, [esp + 0x58]
call fcn.10005890
add esp, 0xc
test eax, eax
je 0x1000134f
inc dword [esi + 0x14]
lea eax, [esp + 0x20]
push eax
mov edx, edi
mov ecx, esi
call fcn.10001030
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x10001407
test byte [esi + 8], 4
je 0x10001407
push 1
push 0
lea eax, [esp + 0x54]
push eax
push edi
call fcn.10001600
mov ecx, dword [esi]
add esp, 0xc
add eax, 3
xor edx, edx
push eax
call fcn.10002050
mov edi, eax
add esp, 8
test edi, edi
je 0x100013c6
push edi
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x18]
call fcn.10001600
add esp, 0xc
push edi
push 0x1003cb48
push edi
call fcn.10001600
add esp, 0xc
mov edx, edi
mov ecx, esi
call fcn.10001250
mov ecx, dword [esi]
mov edx, edi
push 1
mov ebx, eax
call fcn.10002320
mov edi, dword [esp + 0x14]
jmp 0x10001404
mov edi, dword [esp + 0x10]
xor ebx, ebx
jmp 0x10001407
test byte [esi + 8], 2
je 0x10001407
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10001407
push 0
push 0
push 0
lea edx, [esp + 0x58]
call fcn.10005890
add esp, 0xc
test eax, eax
je 0x10001407
inc dword [esi + 0x18]
lea eax, [esp + 0x20]
push eax
mov edx, edi
mov ecx, esi
call fcn.10001030
mov ebx, eax
add esp, 4
mov eax, dword [esp + 0x14]
mov byte [eax], 0x2a
test ebx, ebx
je 0x10001429
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100012a4
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100016e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, 1
test esi, esi
je 0x10001823
push edi
xor edi, edi
cmp byte [esi], 0
je 0x10001811
inc edi
cmp byte [edi + esi], 0
jne 0x10001702
test edi, edi
je 0x10001811
xor eax, eax
mov ecx, edi
add ecx, ebx
adc eax, eax
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002100
mov edx, eax
add esp, 8
mov dword [ebp - 4], edx
test edx, edx
je 0x1000181a
mov ecx, edx
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x10001735
add edi, edx
mov esi, edx
xor ecx, ecx
lea esp, [esp]
cmp esi, edi
jae 0x100017bd
mov al, byte [esi]
mov byte [ebp + 0xf], al
movsx eax, al
cmp eax, 0x7c
ja case.0x10001768.32
movzx eax, byte [eax + 0x1000183c]
jmp dword [eax*4 + 0x1000182c]
test ecx, ecx
je 0x1000177e
lea eax, [edx - 1]
cmp ecx, eax
jb 0x1000177e
xor ecx, ecx
jmp 0x100017b4
xor ebx, ebx
jmp 0x100017b4
test ecx, ecx
je 0x100017ab
push 0
push edx
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100017a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne case.0x10001768.0
mov al, byte [ebp + 0xf]
mov edx, dword [ebp - 4]
mov byte [esi], al
xor ecx, ecx
jmp 0x100017b4
test ecx, ecx
cmove ecx, esi
inc esi
test ebx, ebx
jne 0x10001750
jmp 0x100017bd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edi, dword [esi + 0x1c]
and edi, 1
je 0x100017d6
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
mov dword [ebp + 0xc], ecx
jmp 0x100017dd
mov dword [ebp + 0xc], 0
push eax
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x10001811
test byte [esi + 0x1c], 2
je 0x100017fa
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
sub dword [esi + 0x28], eax
add dword [esi + 0x2c], 0xfffffffc
test byte [esi + 0x1c], 2
je 0x10001811
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001782
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, 1
test esi, esi
je 0x10001823
push edi
xor edi, edi
cmp byte [esi], 0
je 0x10001811
inc edi
cmp byte [edi + esi], 0
jne 0x10001702
test edi, edi
je 0x10001811
xor eax, eax
mov ecx, edi
add ecx, ebx
adc eax, eax
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002100
mov edx, eax
add esp, 8
mov dword [ebp - 4], edx
test edx, edx
je 0x1000181a
mov ecx, edx
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x10001735
add edi, edx
mov esi, edx
xor ecx, ecx
lea esp, [esp]
cmp esi, edi
jae 0x100017bd
mov al, byte [esi]
mov byte [ebp + 0xf], al
movsx eax, al
cmp eax, 0x7c
ja case.0x10001768.32
movzx eax, byte [eax + 0x1000183c]
jmp dword [eax*4 + 0x1000182c]
test ecx, ecx
je 0x1000177e
lea eax, [edx - 1]
cmp ecx, eax
jb 0x1000177e
xor ecx, ecx
jmp 0x100017b4
xor ebx, ebx
jmp 0x100017b4
test ecx, ecx
je 0x100017ab
push 0
push edx
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100017a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne case.0x10001768.0
mov al, byte [ebp + 0xf]
mov edx, dword [ebp - 4]
mov byte [esi], al
xor ecx, ecx
jmp 0x100017b4
test ecx, ecx
cmove ecx, esi
inc esi
test ebx, ebx
jne 0x10001750
jmp 0x100017bd
xor ebx, ebx
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edi, dword [esi + 0x1c]
and edi, 1
je 0x100017d6
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
mov dword [ebp + 0xc], ecx
jmp 0x100017dd
mov dword [ebp + 0xc], 0
push eax
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x10001811
test byte [esi + 0x1c], 2
je 0x100017fa
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
sub dword [esi + 0x28], eax
add dword [esi + 0x2c], 0xfffffffc
test byte [esi + 0x1c], 2
je 0x10001811
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret