joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434c5f
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x434c6d
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x434cba
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.00437a90
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.004344a8
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.00434546
test eax, eax
jne 0x434d16
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.00437a90
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.004344a8
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.00437510
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.00437510
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.00434546
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x434d1b
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x434d52
test edi, edi
je 0x434d52
call fcn.00434c5f
test eax, eax
jne 0x434d57
push 0x20
mov edx, esi
mov ecx, esi
call fcn.004344a8
push 0x20
push esi
push edi
call fcn.00437510
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x4344d2
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x434e0a
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x434ea4
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x434ea4
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.004304ed
mov dword [esp + 0xc], eax
test eax, eax
jne 0x434ea9
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x434e6a
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00434df4
mov ecx, ebx
mov esi, eax
call fcn.00434df4
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x434e44
jmp 0x434e8f
mov ecx, dword [esp + 0x10]
jmp 0x434e8f
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.00434df4
mov ecx, ebx
mov esi, eax
call fcn.00434df4
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x434e70
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x434ea9
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x44cce6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044cb65
Function at 0x1804bbba
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.1804a0e0
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x1804bbf0
cmp dword [edi], ebx
je 0x1804bbf0
push ecx
mov ecx, edi
call fcn.1803cb31
test eax, eax
js 0x1804bc5d
add edi, 0x24
jne 0x1804bbdb
lfence
cmp byte [esi + 0x3c], bl
je 0x1804bc69
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x30], eax
test eax, eax
je 0x1804bc62
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 0x1804e6a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1804bc32
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x30], ebx
test ebx, ebx
je 0x1804bc62
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x1804bc54
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x34]
add ecx, ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1804bc71
lfence
jmp 0x1804bc7e
mov edi, 0x80004005
jmp 0x1804bc75
call dword [sym.imp.ole32.dll_CoResumeClassObjects]
mov edi, eax
test edi, edi
jns 0x1804bc7c
mov ecx, esi
call fcn.1804a1fd
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret 4
Function at 0x18072c66
Capabilities:
Inspect section memory permissions

Disassembly:
test eax, 0xeb0c5d89
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x18072c8a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x18072ca8
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x18072d06
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x18072ced
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x18072cf6
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x18072d00
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x18072ce2
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x18072c6c
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x18072d53
dec eax
je 0x18072d4a
sub eax, 3
je 0x18072d41
mov dword [ebp - 4], 0x40
jmp 0x18072d70
mov dword [ebp - 4], 4
jmp 0x18072d56
mov dword [ebp - 4], 0x20
jmp 0x18072d56
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x18072da2
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x18072d22
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.180725b3
xlatb
adc al, 0xe8
test eax, 0x6a1475ff
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x18072dae
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x18073506
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.180725c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.18072578
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.180725b3
pop ebp
pop ebp
mov eax, dword [0x1046875]
add byte [eax], al
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.180725b3
push es
cmp bl, byte es:[eax + eax*4]
loopne 0x180735d1
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.180725c3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.18072578
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x1807365f
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x1807367f
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x1807369c
invalid
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x18073703
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
and eax, 0x80
test eax, eax
je 0x180736ce
invalid
test dword [eax], esi
cld
invalid
Function at 0x10e2433
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0x8c]
mov ecx, dword [eax]
call fcn.010fc8d0
test eax, eax
jne 0x10e2458
xor al, al
pop esi
add esp, 0x24
ret 8
mov eax, dword [esi + 0x7c]
push ebx
cmp eax, 1
jne 0x10e2466
lea ebx, [eax + 6]
jmp 0x10e2471
xor ebx, ebx
cmp eax, 2
sete bl
add ebx, 8
push edi
lea ecx, [esp + 0x20]
call fcn.00da1090
cmp dword [esi + 0x78], ebx
je 0x10e24be
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0x20]
call fcn.00da1120
cmp edi, 0xffffffff
jne 0x10e2496
or eax, edi
jmp 0x10e24a5
mov ecx, edi
sub ecx, eax
mov eax, 0
sets al
dec eax
and eax, ecx
mov ecx, dword [esi + 0x8c]
mov ecx, dword [ecx]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x58]
call eax
test al, al
je 0x10e24c9
cmp dword [esi + 0x78], ebx
jne 0x10e2484
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x24
ret 8
mov ecx, dword [esi + 0x8c]
mov ecx, dword [ecx]
call fcn.010fc8d0
test eax, eax
je 0x10e24be
mov dword [esp + 0x1c], 0x130c074
mov edx, 0x130c074
mov eax, 1
lock xadd dword [edx], eax
mov ecx, dword [esi + 0x8c]
mov ecx, dword [ecx]
mov edi, dword [esi + 4]
call fcn.00ecf100
cmp dword [esi + 0x78], 7
mov ebx, eax
je 0x10e25de
cmp ebx, 5
ja case.0x10e2515.3
jmp dword [ebx*4 + 0x10e2668]
push 0
push 0x12b6f18
lea edx, [esp + 0x3c]
push edx
mov ecx, 0x12bcefc
call fcn.00d48a60
lea eax, [esp + 0x34]
push eax
push 0xe
mov ecx, edi
call fcn.010e1230
lea ecx, [esp + 0x34]
call fcn.00d21000
jmp 0x10e2613
push 0
push 0x12b6ef0
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x12bcefc
call fcn.00d48a60
lea edx, [esp + 0xc]
push edx
push 0xf
mov ecx, edi
call fcn.010e1230
lea ecx, [esp + 0xc]
call fcn.00d21000
jmp 0x10e2613
push 0
push 0x12b6ed8
lea eax, [esp + 0x18]
push eax
mov ecx, 0x12bcefc
call fcn.00d48a60
lea ecx, [esp + 0x10]
push ecx
push 0x11
mov ecx, edi
call fcn.010e1230
lea ecx, [esp + 0x10]
call fcn.00d21000
jmp 0x10e2613
mov eax, dword [esi + 0x8c]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
call fcn.00d45920
push eax
push ebx
mov ecx, edi
call fcn.010e1230
mov ecx, dword [esp + 0x14]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10e2613
mov eax, dword [esp + 0x14]
push eax
jmp 0x10e260b
mov edx, dword [esi + 0x8c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edx]
call fcn.00d45920
push eax
push ebx
mov ecx, edi
call fcn.010e1230
mov eax, dword [esp + 0x18]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10e2613
mov edx, dword [esp + 0x18]
push edx
call fcn.00d33020
add esp, 4
push 0
mov ecx, edi
call fcn.00f741d0
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x78], 0xa
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10e263d
mov edx, dword [esp + 0x1c]
push edx
call fcn.00d33020
add esp, 4
mov edi, dword [esp + 0x38]
test edi, edi
je 0x10e265a
mov eax, dword [esi + 0x8c]
mov ecx, dword [eax]
call fcn.00ecf100
cmp eax, 5
jne 0x10e265a
mov byte [edi], 1
pop edi
pop ebx
xor al, al
pop esi
add esp, 0x24
ret 8
Function at 0x10f9c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push 8
mov esi, ecx
call fcn.01126532
add esp, 4
test eax, eax
je 0x10f9c7c
push 0
mov ecx, eax
call fcn.00d66c90
jmp 0x10f9c7e
xor eax, eax
mov dword [esi + 0xc], eax
call fcn.00d51070
mov ecx, dword [esi + 0xc]
push eax
call fcn.00d30ca0
mov eax, dword [esi + 0xc]
push eax
mov ecx, esi
call fcn.00d30ca0
mov ecx, dword [esi + 0xc]
push 7
call fcn.00d6fe80
mov ecx, esi
pop esi
jmp fcn.010f9670
Function at 0x115cae0
Capabilities:
Encrypt data using speck

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x18], 0
je 0x115cd20
push ebx
mov ebx, dword [esp + 0x18]
movzx edx, word [ebx]
push ebp
push esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.0114d2d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
cmp ecx, 0x1e
jne 0x115cb45
mov ecx, 0x1f
mov dword [esp + 0xc], ecx
mov al, 1
mov dl, byte [edi]
and al, 1
or al, 2
add al, al
add al, al
and dl, 0xfb
or al, dl
mov byte [edi], al
mov eax, dword [esp + 0x24]
mov esi, 1
mov ebp, ecx
cmp eax, esi
jbe 0x115cd18
jmp 0x115cb57
cmp ecx, 0x1c
je 0x115cb1d
cmp ecx, 0x1f
je 0x115cb1d
xor al, al
jmp 0x115cb1f
mov ebx, dword [esp + 0x20]
movzx eax, byte [esi + edi]
and al, 0xfb
or al, 8
lea ecx, [esp + 0x10]
mov byte [esi + edi], al
movzx eax, word [ebx + esi*2]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
call fcn.0114d2d0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [eax + eax*4]
movzx eax, byte [edx + ecx*2 + 0x12d16b0]
mov edx, dword [esp + 0x1c]
add al, al
add al, al
add al, al
xor al, byte [esi + edi]
add esp, 0xc
and al, 8
xor byte [esi + edi], al
cmp edx, 0x1b
jne 0x115cc28
movzx ecx, word [ebx + esi*2]
mov eax, ecx
and eax, 0xfc00
mov edx, 0xd800
cmp ax, dx
jne 0x115cbe0
mov edx, dword [esp + 0x24]
dec edx
cmp esi, edx
jae 0x115cbe0
mov dx, word [ebx + esi*2 + 2]
mov ebx, 0xfc00
and dx, bx
mov ebx, 0xdc00
cmp dx, bx
je 0x115cd09
mov edx, 0xdc00
cmp ax, dx
jne 0x115cc43
mov eax, dword [esp + 0x20]
movzx eax, word [eax + esi*2 - 2]
mov edx, eax
and edx, 0xfc00
cmp edx, 0xd800
jne 0x115cc43
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x18]
push edx
shl eax, 0xa
lea edx, [eax + ecx - 0x35fdc00]
push edx
call fcn.0114d2d0
mov edx, dword [esp + 0x1c]
add esp, 0xc
and byte [esi + edi], 0xf7
cmp edx, 0x1c
jl 0x115cc31
or byte [esi + edi], 4
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 0x1e
jl 0x115cc4e
mov eax, 3
jmp 0x115cc5d
mov edx, 0xb
mov dword [esp + 0x10], edx
jmp 0x115cc31
cmp ecx, 0x1d
jne 0x115cc5d
lea eax, [edx - 0x1e]
neg eax
sbb eax, eax
and eax, 3
cmp edx, 0x1c
je 0x115ccf2
cmp edx, 0x1d
jge case.default.0x115cc9a
mov ebx, edx
cmp edx, 0x1a
jl 0x115cc7b
mov ebx, 0xb
cmp ecx, 0x1a
jl 0x115cc89
mov ecx, 0xb
mov dword [esp + 0xc], ecx
imul ecx, ecx, 0x1a
movzx ecx, byte [ecx + ebx + 0x12d1400]
dec ecx
cmp ecx, 3
ja case.default.0x115cc9a
jmp dword [ecx*4 + 0x115cd24]
mov ebx, dword [esp + 0x20]
mov ecx, 0xad
mov eax, 2
cmp word [ebx + esi*2 - 2], cx
jne case.default.0x115cc9a
mov eax, 1
jmp case.default.0x115cc9a
xor eax, eax
cmp ebp, 0x1c
setne al
dec eax
and eax, 2
jmp case.default.0x115cc9a
xor eax, eax
cmp ebp, 0x1c
jne 0x115ccf2
cmp esi, 1
jbe case.default.0x115cc9a
mov cl, byte [esi + edi - 2]
and cl, 0xfe
or cl, 2
mov byte [esi + edi - 2], cl
jmp case.default.0x115cc9a
xor eax, eax
cmp ebp, 0x1c
jne 0x115ccf2
mov dword [esp + 0xc], edx
mov cl, byte [esi + edi - 1]
xor cl, al
mov ebp, edx
mov edx, dword [esp + 0x14]
and cl, 3
xor byte [esi + edi - 1], cl
mov dword [esp + 0x18], edx
inc esi
cmp esi, dword [esp + 0x24]
jb 0x115cb53
mov eax, dword [esp + 0x24]
or byte [eax + edi - 1], 3
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x117e0de
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1190200
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x1314370]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ecx, esi
call fcn.00d2d1b0
mov edi, eax
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00d2da50
and dword [esp + 0x30], 0
mov ecx, edi
call 0xe1c780
movzx eax, al
push eax
lea ecx, [esp + 0x18]
call fcn.00d611f0
or edi, 0xffffffff
push edi
push 0x12f1e58
mov byte [esp + 0x38], 1
call fcn.00d37160
pop ecx
pop ecx
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x24]
mov byte [esp + 0x38], 2
call fcn.00d284bb
mov ecx, eax
call fcn.00d21b46
lea ecx, [esp + 0x14]
push ecx
push eax
call 0xd25ae0
pop ecx
pop ecx
mov byte [esp + 0x30], 1
mov eax, dword [esp + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x117e195
push dword [esp + 0xc]
call fcn.00d33020
pop ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.00d603b0
push esi
call fcn.0117de65
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x10]
lock xadd dword [eax], edi
jne 0x117e1c1
push dword [esp + 0x10]
call fcn.00d33020
pop ecx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10001690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057bf6
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x1006dd60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], 0
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.1002c440
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x224]
call fcn.1000fd00
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x230], edx
mov dword [ebp - 4], 0
push str.EBookBuilder_
mov eax, dword [ebp - 0x230]
push eax
lea ecx, [ebp - 0x220]
push ecx
call fcn.100051c0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x224]
call fcn.1000fd80
lea ecx, [ebp - 0x220]
call fcn.1000d230
push eax
call fcn.10046de0
add esp, 4
lea edx, [ebp - 0x220]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000f400
mov eax, dword [ebp - 0x228]
or eax, 1
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.1000fd80
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ac1f
mov esp, ebp
pop ebp
ret
Function at 0x100030d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push eax
call fcn.10002fb0
add esp, 4
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10002ff0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.10044f60
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.100198f0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x10003123
xor eax, eax
jmp 0x100031c4
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
push 0x40
push 0x8000
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.1002dd2a
add esp, 0x14
test eax, eax
jne 0x100031af
push 0x10061938
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1002dd4a
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100031a3
mov edx, dword [ebp - 0x14]
push edx
push 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.1002e17e
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10003080
add esp, 0xc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
push edx
call fcn.1002ca2a
add esp, 4
jmp 0x100031af
mov eax, dword [ebp - 0x10]
push eax
call fcn.1002e237
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.100198fb
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x100031d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
call fcn.10002fb0
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.10002f10
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
call fcn.100198f0
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003210
xor eax, eax
jmp 0x1000328d
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10003030
add esp, 0xc
test eax, eax
je 0x10003278
mov dword [ebp - 0x10], 0
push 0x10061344
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.1002c77c
add esp, 0xc
test eax, eax
jne 0x10003278
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.1002c931
add esp, 0x10
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
push eax
call fcn.1002ca2a
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.100198fb
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10003580
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057118
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1006dd60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
call fcn.10044f60
add esp, 4
cmp eax, 0xa00000
jbe 0x100035d1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100032a0
add esp, 0xc
jmp 0x1000368b
cmp dword [ebp + 0x10], 0
je 0x100035ec
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100035ec
xor eax, eax
jmp 0x1000368b
lea ecx, [ebp - 0x10]
call fcn.10005b60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.10019520
push eax
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jge 0x1000362d
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10019290
mov eax, dword [ebp - 0x14]
jmp 0x1000368b
lea ecx, [ebp - 0x10]
call fcn.1000d230
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.100030d0
add esp, 8
test eax, eax
jne 0x10003661
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10019290
mov eax, dword [ebp - 0x18]
jmp 0x1000368b
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000d230
push eax
call fcn.100031d0
add esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10019290
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100045f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x44]
cmp dword [eax + 8], 0
je 0x10004611
mov eax, dword [ebp - 0x3c]
jmp 0x100046a6
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1002e862
add esp, 8
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], ecx
mov dword [ebp - 4], 0
push 0x10061938
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 4]
push eax
call fcn.1002c77c
add esp, 0xc
test eax, eax
jne 0x100046a3
cmp dword [ebp - 4], 0
je 0x100046a3
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 4]
push edx
call fcn.100198f0
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x44]
cmp dword [edx + 8], 0
je 0x10004697
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 8]
push ecx
call fcn.1002e17e
add esp, 0x10
mov dword [ebp - 0x3c], 1
mov edx, dword [ebp - 4]
push edx
call fcn.1002ca2a
add esp, 4
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret 4