joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a30bc9e
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a30bc9e
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a30bc9e
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a30bc9e
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a30bc9e
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a30bc9e
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10
Function at 0x40c86d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418c98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a3e1
mov dword [ebp - 0x14], eax
cmp dword [0x81787c], esi
jne 0x40c960
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c8ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ca40
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40ca40
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ca40
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x81787c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x817880], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x817884], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81788c], eax
test eax, eax
je 0x40c95d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x817888], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c985
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c978
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c99a
push 4
pop eax
jmp 0x40ca42
cmp dword [ebp - 0x14], esi
je 0x40c99a
push dword [0x81787c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c97f
mov eax, dword [0x817888]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c9f8
cmp dword [0x81788c], edi
je 0x40c9f8
push eax
call ebx
push dword [0x81788c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c9f8
test eax, eax
je 0x40c9f8
call ecx
test eax, eax
je 0x40c9ed
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c9ed
test byte [ebp - 8], 1
jne 0x40c9f8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40ca28
mov eax, dword [0x817880]
cmp eax, edi
je 0x40ca25
push eax
call ebx
test eax, eax
je 0x40ca25
call eax
mov esi, eax
test esi, esi
je 0x40ca25
mov eax, dword [0x817884]
cmp eax, edi
je 0x40ca25
push eax
call ebx
test eax, eax
je 0x40ca25
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x81787c]
call ebx
test eax, eax
je 0x40ca40
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40ca42
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004044c8
mov esp, ebp
pop ebp
ret
Function at 0x10019b5b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10019b6a
pop dword [ebp - 0x3c]
mov eax, 0x2fa53225
sub eax, 0x1fa396bb
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x8bab1f77
sub dword [ebp - 0x4c], 0x3d58da2c
mov dword [ebp - 0x48], 0xa28d0863
sub dword [ebp - 0x48], 0x7059bc1e
mov dword [ebp - 0x44], 0x18a00cf2
sub dword [ebp - 0x44], 0xcc53c8c4
mov dword [ebp - 0x40], 0xe4dcf006
add dword [ebp - 0x40], 0x1b230ffa
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x44eef271
sub eax, 0x34ed1221
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xbbd670
sub dword [ebp - 0x4c], 0x8c496d1a
mov dword [ebp - 0x48], 0x5c6400
add dword [ebp - 0x48], 0x410ffd75
mov dword [ebp - 0x44], 0x83e9e6cf
sub dword [ebp - 0x44], 0x207a7a63
mov dword [ebp - 0x40], 0x751d54f0
add dword [ebp - 0x40], 0x8ae2ab10
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac22
push 0
call eax
mov ecx, 0x125d8d0d
sub ecx, 0x125d4b0c
mov edi, eax
mov ebx, 0x847a6d95
add ebx, 0x8b886e6b
add ebx, dword [ebp - 0x3c]
mov esi, 0xbcd57b96
sub esi, 0x342b7b29
sub dword [ebp - 0x20], 0x94424b15
mov edx, dword [ebx]
add dword [ebp - 0x2c], 0x7eb82307
add edx, esi
xor dword [ebp - 0x2c], eax
mov dword [edi], edx
xor dword [ebp - 8], 0xbfcb5868
add edi, 0xbe0332c9
add edi, 0x41fccd3b
add ebx, 0xf340a2ea
sub ebx, 0xf340a2e6
loop 0x10019c87
add eax, 0x47b84dcd
sub eax, 0x47b752f6
mov ebx, eax
add eax, 0x4e4017ab
sub eax, 0x4e4017a6
mov ecx, 0xbe29cc01
add ecx, 0x51d633ff
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x2a83c387
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2a83c396
pop dword [ebp - 0xc]
mov eax, 0xb10fef11
add eax, 0x7973d485
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x46888678
sub dword [ebp - 0x1c], 0xf836412d
mov dword [ebp - 0x18], 0x9dd2feb9
add dword [ebp - 0x18], 0x94604d8c
mov dword [ebp - 0x14], 0xfe56ebf8
add dword [ebp - 0x14], 0x4df55836
mov dword [ebp - 0x10], 0x630c0a5
sub dword [ebp - 0x10], 0x630c0a5
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x5e65244d
add eax, 0xcc1ffcf7
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xa67aac43
add dword [ebp - 0x1c], 0xcdf7bd13
mov dword [ebp - 0x18], 0xac1b4980
add dword [ebp - 0x18], 0x955117f5
mov dword [ebp - 0x14], 0x2769cd3d
sub dword [ebp - 0x14], 0xc3fa60d1
mov dword [ebp - 0x10], 0x127071df
sub dword [ebp - 0x10], 0x127071df
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xaa3e03bc
sub eax, 0x7fb8e280
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x47dc5
push 0
call eax
mov ecx, 0x344509e8
sub ecx, 0x3444cca7
mov edi, eax
mov edx, 0x2a87ea00
add edx, dword [ebp - 0xc]
mov esi, 0xcee26b5f
xor dword [ebp - 8], ecx
mov ebx, dword [edx]
add dword [ebp - 4], 0xdc62911e
add ebx, esi
mov dword [ebp - 4], 0x1ea6f37d
mov dword [edi], ebx
add dword [ebp - 4], 0xe5fcf917
add edi, 4
add edx, 0x7a1c448a
add edx, 0x85e3bb7a
loop 0x2a83c4ac
add eax, 0x9a7e2523
sub eax, 0x9a7d3d4c
mov ebx, eax
add eax, 0x75595a28
sub eax, 0x75595a23
mov ecx, 0x2a800000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1009b454
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1014fef1
call fcn.10147df8
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.1008f6dc
xor ebx, ebx
mov dword [esi], vtable.ScObjects::Thread.0
push 0x10
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
je 0x1009b49b
mov dword [eax], vtable.ScObjects::ThreadData.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x1009b49d
mov eax, ebx
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x1009b680
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
cmp ecx, 0xffffffff
jne 0x1009b4d0
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0x20
mov dword [esi + 0xc], ebx
mov dword [eax + 4], ebx
jmp 0x1009b4dc
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov dword [eax + 4], ecx
mov eax, esi
call fcn.10147dc1
ret

Function at 0x1009b790
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0x10], 0
jne 0x1009b7a2
mov eax, dword [ecx + 8]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x100a1d60
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x2c
mov eax, 0x10150bd0
call fcn.10147e2c
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x38], esi
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], edi
call fcn.1009b955
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], 1
call fcn.100a1e88
test eax, eax
jne 0x100a1da4
push 0xffffffffffffffff
push 0x10159980
mov ecx, esi
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
jmp 0x100a1dea
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, esi
push 0xffffffffffffffff
push 0x10159980
test eax, eax
je 0x100a1d9d
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
movzx eax, byte [ebp + edi - 0x20]
push eax
lea eax, [ebp - 0x30]
push 0x10165c80
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
lea eax, [ebp - 0x30]
push eax
push esi
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
add esp, 0x14
inc edi
cmp edi, 0x10
jb 0x100a1dc3
mov eax, esi
call fcn.10147dd6
ret

Function at 0x100a1e88
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
mov esi, dword [0x107d4410]
test esi, esi
jne 0x100a1edc
push edi
push esi
push 1
push esi
push esi
mov edi, 0x107d4410
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x100a1ed5
push 8
push 1
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [0x107d4410], esi
jmp 0x100a1edb
mov esi, dword [0x107d4410]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100afdae
Capabilities:
Create mailslot

Disassembly:
push 0x14
mov eax, 0x10152d8e
call fcn.10147df8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [0x10191e8c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100ab64a
xor ebx, ebx
mov dword [esi], vtable.WinInterAppStream.0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.1009b955
lea eax, [esi + 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
pop ecx
pop ecx
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
push 0xc
lea edi, [esi + 0x56]
push ebx
push edi
call sub.VCRUNTIME140.dll_memset
push edi
mov ecx, ebx
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
add esp, 0x18
test al, al
je 0x100afe21
cmp dword [esi + 0x5a], ebx
cmovne ecx, edi
push ecx
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_CreateMailslotA]
lea ecx, [ebp - 0x20]
mov dword [esi + 0x52], eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
mov eax, esi
call fcn.10147dc1
ret 8

Function at 0x100affb0
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x101509dd
call fcn.10147df8
mov esi, ecx
push esi
lea ecx, [ebp - 0x1c]
call fcn.1008f6a9
and dword [ebp - 4], 0
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1009b803
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
push dword [eax + 8]
push dword [eax + 4]
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
push 0
xor ecx, ecx
lea eax, [esi + 0x56]
cmp dword [esi + 0x5a], ecx
push 0x80
push 3
cmovne ecx, eax
push ecx
push ebx
push 0x40000000
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_CreateFileA]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x100b004b
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0
push ecx
push dword [edi + 8]
push dword [edi + 4]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x100b004b
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi + 8]
je 0x100b004d
xor bl, bl
lea ecx, [ebp - 0x2c]
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
lea ecx, [ebp - 0x1c]
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
mov al, bl
call fcn.10147dc1
ret 8
Function at 0x100f8ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100f8ecf
pop dword [ebp - 0x48]
mov eax, 0x93c9cfd7
sub eax, 0x83ba4108
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x97649002
sub dword [ebp - 0x58], 0x49124ab7
mov dword [ebp - 0x54], 0xeaf40371
sub dword [ebp - 0x54], 0xb8c0b72c
mov dword [ebp - 0x50], 0x3be6ab8b
sub dword [ebp - 0x50], 0xef9a675d
mov dword [ebp - 0x4c], 0x33b10237
add dword [ebp - 0x4c], 0xcc4efdc9
lea eax, [ebp - 0x58]
push eax
mov eax, 0x76cb7b13
sub eax, 0x66b6285b
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xe5c6f2c4
sub dword [ebp - 0x58], 0x7154896e
mov dword [ebp - 0x54], 0xbbbbe155
add dword [ebp - 0x54], 0x85b08020
mov dword [ebp - 0x50], 0xb649474f
add dword [ebp - 0x50], 0xad26251d
mov dword [ebp - 0x4c], 0x2958dadf
add dword [ebp - 0x4c], 0xd6a72521
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7ee50ec6
sub eax, 0x6ecfbc2a
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x73bab
push 0
call eax
mov ecx, 0x9f9524b
sub ecx, 0x9f9069e
mov edx, eax
mov esi, 0x107ec400
add esi, dword [ebp - 0x48]
mov ebx, 0xa86654fe
sub ebx, 0xaade6436
mov edi, dword [esi]
xor dword [ebp - 0xc], 0x1e43eb11
sub edi, ebx
sub dword [ebp - 0x24], 0xa6da9bed
mov dword [edx], edi
add dword [ebp - 0x10], esi
add edx, 0x36e1662b
add edx, 0xc91e99d9
add esi, 4
loop 0x100f8feb
add eax, 0x12187
xor ebx, ebx
add ebx, eax
add eax, 0xadc85da7
sub eax, 0xadc85da2
mov ecx, 0x58fd76ab
sub ecx, 0x48fd76ab
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10127680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1012771b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x101276d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x101276d2
cmp esi, ebx
jge 0x101276d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10127715
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10127715
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x10155aa8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1012772d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10127950
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
mov eax, dword [ebp + 8]
je 0x10127978
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10127992
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10147db0
leave
ret 4

Function at 0x10127b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10127b96
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10127bf5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10147db0
leave
ret 0x10
Function at 0x10127c10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10127c3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10127c6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10127c6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10127c6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10147db0
leave
ret 8
Function at 0x10136c00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
xor ebx, ebx
inc edx
mov edi, dword [esi]
cmp dword [edi + 0x254], ebx
je 0x10136c60
cmp dword [edi + 0x264], ebx
je 0x10136c59
cmp byte [0x107d44f4], 0
push edi
push dword [edi + 0x250]
je 0x10136c48
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x10136c4e
call dword [sym.imp.kernel32.dll_FindNextFileA]
mov ecx, dword [esi]
xor edx, edx
inc edx
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
jmp 0x10136d40
mov eax, dword [edi + 0x25c]
test eax, eax
je 0x10136dcf
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [esi]
cmp dword [ecx + 0x260], ebx
je 0x10136cae
lea eax, [ebp - 0x234]
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
mov eax, dword [esi]
push dword [eax + 0x260]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov ecx, dword [esi]
add esp, 0xc
test byte [ecx + 0x268], 1
push 0x10
pop eax
lea edx, [eax + 0x70]
cmove eax, edx
mov dword [ecx], eax
cmp byte [0x107d44f4], 0
je 0x10136cda
push dword [esi]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x10136cfc
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x234]
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
push dword [esi]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ecx, dword [esi]
mov dword [ecx + 0x250], eax
xor eax, eax
mov ecx, dword [esi]
cmp dword [ecx + 0x250], 0xffffffff
setne al
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10136d2a
mov dword [eax + 0x250], ebx
mov eax, dword [esi]
xor edx, edx
inc edx
mov dword [eax + 0x254], edx
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10136d40
mov dword [esi + 4], edx
mov ecx, eax
cmp dword [eax + 0x264], ebx
je 0x10136d67
cmp byte [0x107d44f4], 0
jne 0x10136d67
push dword [eax + 0x258]
add eax, 0x2c
push eax
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
mov ecx, dword [esi]
xor edx, edx
inc edx
mov eax, dword [ecx]
mov dword [ecx + 0x26c], eax
mov edi, dword [esi]
mov ebx, dword [edi + 0x26c]
shr ebx, 4
and ebx, edx
je 0x10136d9c
push esi
xor ebx, ebx
call sym.rt3d.dll_protected:_void___stdcall_TSPRITE::UpdatePoint_struct_E3MPOINT__
xor edx, edx
inc edx
cmp word [eax], 0x2e
je 0x10136d98
test byte [edi + 0x268], 3
jne 0x10136da6
mov ebx, edx
jmp 0x10136da6
test byte [edi + 0x268], 1
cmovne ebx, edx
mov eax, dword [edi + 0x264]
test eax, eax
je 0x10136dca
push 0
test ebx, ebx
pop ebx
jne 0x10136c20
test byte [edi + 0x26c], 2
jne 0x10136c20
test eax, eax
setne al
jmp 0x10136dd1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10147db0
leave
ret 4