joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051bec
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor edi, edi
push dword [0x101ad648]
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], edi
call fcn.10094520
mov esi, 0x10160bc0
lea ecx, [ebp - 4]
push esi
call fcn.100984d0
push esi
lea ecx, [ebp - 4]
call fcn.10095910
push str.dtframe32.dll
lea ecx, [ebp - 4]
call fcn.10095910
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10051cfe
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x14], edi
xor ebx, ebx
call fcn.1000988d
lea eax, [ebp - 0x48]
push edi
push eax
push dword [ebp - 4]
call fcn.100b09c0
add esp, 0xc
test eax, eax
je 0x10051c70
mov ecx, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x44]
xor eax, eax
xor edx, edx
or eax, ecx
or ebx, edx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x48]
call fcn.100098ed
lea eax, [ebp - 8]
push eax
call fcn.10051722
mov eax, dword [ebp - 8]
pop ecx
cmp dword [eax - 8], edi
je 0x10051cf6
lea ecx, [ebp - 0x48]
xor esi, esi
call fcn.1000988d
lea eax, [ebp - 0x48]
push esi
push eax
push dword [ebp - 8]
call fcn.100b09c0
add esp, 0xc
test eax, eax
je 0x10051cb4
mov eax, dword [ebp - 0x40]
mov edi, dword [ebp - 0x44]
xor ecx, ecx
or esi, eax
or edi, ecx
lea ecx, [ebp - 0x48]
call fcn.100098ed
cmp edi, 0x10002
jl 0x10051cef
jg 0x10051cce
cmp esi, 0x4680000
jb 0x10051cef
cmp ebx, edi
jg 0x10051cdd
jl 0x10051cd9
cmp dword [ebp - 0x14], esi
ja 0x10051cdd
or esi, edi
jne 0x10051cef
push 0
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10051cf6
mov dword [ebp - 0xc], 1
lea ecx, [ebp - 8]
call fcn.10094cc0
lea ecx, [ebp - 4]
call fcn.10094cc0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100527ef
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10052807
xor eax, eax
jmp 0x1005296a
push ebx
mov ebx, 0x101ad158
mov ecx, ebx
call fcn.10057c87
test eax, eax
je 0x1005295c
push 0x1019f4bc
lea ecx, [ebp - 8]
call fcn.10094520
push dword [0x101ad648]
lea eax, [ebp - 8]
push str._sOeaViewer.exe
push eax
call fcn.10097c40
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10052954
push edi
mov ecx, ebx
call fcn.1005764c
mov edi, eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0xc], edi
call fcn.1000988d
lea eax, [ebp - 0x50]
push esi
push eax
push dword [ebp - 8]
call fcn.100b09c0
mov eax, dword [edi + 0x30]
mov edi, 0x101868d8
push edi
mov dword [ebp - 4], eax
call fcn.1007e283
push eax
push edi
push dword [ebp - 4]
call fcn.1007e952
add esp, 0x1c
test eax, eax
je 0x1005294b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 4]
cmp eax, dword [ebp - 0x4c]
jb 0x100528b7
jne 0x1005294b
mov eax, dword [ecx + 8]
cmp eax, dword [ebp - 0x48]
jae 0x1005294b
push 0x1019f4bc
lea ecx, [ebp - 4]
call fcn.10094520
mov edi, dword [0x101ad648]
mov ecx, ebx
call fcn.100aa320
push eax
push edi
lea eax, [ebp - 4]
push str.__sOeaViewer.exe___Update:_s
push eax
call fcn.10097c40
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x90]
mov dword [ebp - 0x94], esi
push 0x10
mov dword [ebp - 0x1c], esi
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x18]
lea ecx, [ebp - 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x94]
push eax
push esi
push esi
push 0x4000410
push esi
push esi
push esi
push 0x104
call fcn.10095990
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.10095a60
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.100aaea0
pop ecx
pop ecx
lea ecx, [ebp - 4]
call fcn.10094cc0
lea ecx, [ebp - 0x50]
call fcn.100098ed
pop edi
lea ecx, [ebp - 8]
call fcn.10094cc0
push dword [ebp + 8]
mov ecx, 0x101a9bf0
call fcn.10008703
pop ebx
pop esi
leave
ret 4
Function at 0x10053c01
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
cmp dword [0x101b4218], 0
push esi
push edi
mov esi, 0x101b421c
jne 0x10053cc6
push 4
push 0
push esi
mov dword [0x101b4218], 1
call fcn.1007e1e0
and word [ebp - 0x208], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x206]
rep stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
lea eax, [ebp - 0x208]
mov edi, 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x10053cc6
lea eax, [ebp - 0x208]
push eax
call fcn.1007e283
test eax, eax
pop ecx
jbe 0x10053c8c
cmp word [ebp + eax*2 - 0x20a], 0x5c
lea eax, [ebp + eax*2 - 0x20a]
jne 0x10053c8c
and word [eax], 0
lea eax, [ebp - 0x208]
push 0x7e
push eax
call fcn.1007e735
pop ecx
test eax, eax
pop ecx
je 0x10053cb1
push edi
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
jmp 0x10053cc6
lea eax, [ebp - 0x208]
push 0x103
push eax
push esi
call fcn.1007e246
add esp, 0xc
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x1005681f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov ecx, dword [ebp + 8]
push esi
test ecx, ecx
je 0x100568a7
push edi
mov esi, 0x10160ac4
lea edi, [ebp - 0xc]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 6]
and word [ebp - 0x80c], 0
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [ecx]
mov ecx, 0x1ff
and ax, 0xffdf
lea edi, [ebp - 0x80a]
mov word [ebp - 0xc], ax
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x400
lea eax, [ebp - 0x80c]
push esi
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
pop edi
jbe 0x100568a7
cmp eax, esi
jae 0x100568a7
push 0x17
lea eax, [ebp - 0x80c]
push str.DeviceTSafeDiskVolume
push eax
call fcn.1007f884
add esp, 0xc
test eax, eax
jne 0x100568a7
push 1
pop eax
jmp 0x100568a9
xor eax, eax
pop esi
leave
ret
Function at 0x100570d2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x724
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
push edi
je 0x100571f4
cmp word [ebx], si
je 0x100571f4
cmp dword [ebp + 0xc], esi
je 0x100571f4
mov ecx, 0x1c7
xor eax, eax
lea edi, [ebp - 0x720]
push esi
rep stosd dword es:[edi], eax
mov dword [ebp - 0x724], esi
mov dword [ebp - 0x720], 0x720
call fcn.1007fadc
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.1007f97c
pop ecx
cmp eax, esi
pop ecx
je 0x10057163
push dword [eax]
mov ecx, dword [eax + 0x10]
inc ecx
push dword [eax + 4]
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
add eax, 0x76c
push ecx
push eax
push str._d__d__d__d:_d:_d
lea eax, [ebp - 0x71c]
push 0x1f
push eax
call fcn.1007e75e
add esp, 0x24
mov eax, dword [0x101ad164]
mov dword [ebp - 0x434], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x103
mov ecx, 0x101ad158
mov dword [ebp - 0x430], eax
call fcn.100aa1c0
push eax
lea eax, [ebp - 0x63c]
push eax
call fcn.1007e246
push 0x428
lea eax, [ebp - 0x42c]
push dword [ebp + 0xc]
push eax
call fcn.1007dea0
add esp, 0x18
push esi
push 0x80
push 2
push esi
push 1
push 0x10000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100571f4
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x724]
push dword [ebp - 0x720]
mov dword [ebp - 4], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x100571f6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005a5c8
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
xor edx, edx
push esi
cmp dword [0x101aea30], edx
push edi
jne 0x1005a6ae
push 0x44
xor eax, eax
pop ecx
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
push 0x46
lea edi, [ebp - 0x13c]
pop ecx
mov dword [ebp - 0x140], edx
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 8
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov dword [0x101aea30], 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x114
push eax
call esi
cmp dword [ebp - 0x244], 2
jne 0x1005a6ae
lea eax, [ebp - 0x140]
push ebx
push eax
mov dword [ebp - 0x140], 0x11c
call esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.GetNativeSystemInfo
push edi
call esi
push str.GetProductInfo
push edi
mov ebx, eax
call esi
lea eax, [ebp - 0x24]
test ebx, ebx
push eax
je 0x1005a67b
call ebx
jmp 0x1005a681
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x13c], 6
pop ebx
jae 0x1005a69d
cmp dword [ebp - 0x13c], 5
jne 0x1005a6ae
cmp dword [ebp - 0x138], 2
jb 0x1005a6ae
cmp word [ebp - 0x24], 9
jne 0x1005a6ae
mov dword [0x101aea2c], 1
mov eax, dword [0x101aea2c]
pop edi
pop esi
leave
ret
Function at 0x100645a8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
xor esi, esi
push esi
call fcn.100680fb
cmp dword [ebp + 8], 0xffffffff
pop ecx
je 0x10064726
cmp dword [ebp + 0xc], 0xffffffff
je 0x10064726
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 0x14], esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push eax
push dword [ebp + 0xc]
call fcn.100615fb
add esp, 0xc
test eax, eax
je 0x10064716
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push esi
push esi
push dword [ebp + 8]
call edi
push esi
push esi
push esi
push dword [ebp + 0xc]
call edi
cmp dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
jne 0x10064624
cmp dword [ebp - 8], esi
je 0x100646d0
cmp dword [ebp - 4], esi
mov eax, 0x10000
push ebx
mov ebx, eax
jne 0x10064639
cmp dword [ebp - 8], eax
jae 0x10064639
mov ebx, dword [ebp - 8]
push ebx
call fcn.1007e238
pop ecx
mov edi, eax
push ebx
push esi
push edi
call fcn.1007e1e0
push esi
lea eax, [ebp - 8]
push esi
push eax
push ebx
push edi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call fcn.1007354a
add esp, 0x24
test eax, eax
je 0x10064697
cmp dword [ebp - 8], ebx
jae 0x10064675
cmp dword [ebp - 8], esi
mov dword [ebp - 0xc], 1
je 0x100646b5
lea eax, [ebp - 0x18]
push esi
push eax
mov dword [ebp - 0x18], esi
push dword [ebp - 8]
push edi
push dword [ebp + 0xc]
call fcn.10073654
add esp, 0x14
test eax, eax
je 0x100646a0
cmp dword [ebp - 0xc], esi
je 0x10064642
jmp 0x100646b5
push 0x10af
push 0xd
jmp 0x100646a7
push 0x10be
push 0xe
call fcn.100680dd
pop ecx
mov dword [ebp - 0x10], 1
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call fcn.1007de95
cmp dword [ebp - 0xc], esi
pop ecx
pop ebx
je 0x10064710
cmp dword [ebp - 0x10], esi
jne 0x10064710
test byte [ebp + 0x10], 2
mov dword [ebp - 0x14], 1
je 0x10064710
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x40], esi
push 0x28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 8]
call fcn.10073251
add esp, 0xc
test eax, eax
je 0x10064710
lea eax, [ebp - 0x40]
push 0x28
push eax
push dword [ebp + 0xc]
call fcn.1007327e
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
jmp 0x10064736
push 0x1090
push 0x25
call fcn.100680dd
pop ecx
pop ecx
jmp 0x10064710
push 0x1080
push 1
call fcn.100680dd
pop ecx
xor eax, eax
pop ecx
pop esi
leave
ret
Function at 0x10066b50
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
and byte [ebp - 0x50], 0
push ebx
push esi
push edi
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x4f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x50]
push 0x40
push eax
push dword [ebp + 0xc]
call fcn.10066281
push eax
call fcn.1005fb73
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x10066b90
push 0x18b3
push 0xc
jmp 0x10066bbc
mov ecx, dword [ebp + 0x14]
call fcn.10066cbe
mov edi, eax
mov eax, dword [esi]
sub edi, dword [ebp + 0x14]
mov ecx, esi
push edi
call dword [eax + 8]
push eax
mov dword [ebp - 4], eax
call fcn.1007e238
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10066bca
push 0x18bd
push 0x21
call fcn.100680dd
pop ecx
xor eax, eax
pop ecx
jmp 0x10066cb9
push dword [ebp - 4]
push 0
push ebx
call fcn.1007e1e0
add esp, 0xc
lea eax, [ebp + 0xc]
mov edx, dword [esi]
and dword [ebp - 8], 0
push eax
and dword [ebp + 0xc], 0
push dword [ebp - 4]
lea eax, [ebp - 0x50]
mov dword [ebp - 0xc], edx
push ebx
push edi
push dword [ebp + 0x14]
push eax
call fcn.1007e450
pop ecx
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x10066c98
mov esi, dword [ebp + 0x10]
mov edi, dword [esi + 0x378]
mov eax, dword [esi + 0x37c]
test edi, edi
mov dword [ebp + 0x14], eax
jne 0x10066c39
test eax, eax
jne 0x10066c39
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [ebp + 0x14]
push 0
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x10]
push 0
push eax
and dword [ebp - 0x10], 0
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call fcn.10073654
add esp, 0x14
test eax, eax
je 0x10066ca1
mov eax, dword [ebp + 0x14]
push dword [ebp - 4]
mov dword [esi + 0x37c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esi + 0x378], edi
mov dword [esi + 0x380], eax
call fcn.10074cb0
pop ecx
mov dword [esi + 0x384], eax
pop ecx
mov dword [ebp - 8], 1
jmp 0x10066caf
push 0x18c9
push 0x11
jmp 0x10066ca8
push 0x18d8
push 0xe
call fcn.100680dd
pop ecx
pop ecx
push ebx
call fcn.1007de95
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10068077
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x388
push edi
push 0
call fcn.100680fb
and byte [ebp - 0x388], 0
mov ecx, 0xe1
xor eax, eax
lea edi, [ebp - 0x387]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x388]
push eax
push dword [ebp + 8]
call fcn.10066407
add esp, 0xc
test eax, eax
pop edi
jne 0x100680c6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
leave
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100680d5
mov ecx, dword [ebp - 0x36c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x370]
leave
ret
Function at 0x10069087
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
and byte [ebp - 0x50], 0
push ebx
push esi
push edi
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x4f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x50]
push 0x40
push eax
push dword [ebp + 0xc]
call fcn.10066281
push eax
call fcn.1005fb73
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x100690c7
push 0x20a6
push 0xc
jmp 0x100690f3
mov ecx, dword [ebp + 0x14]
call fcn.10066cbe
mov edi, eax
mov eax, dword [esi]
sub edi, dword [ebp + 0x14]
mov ecx, esi
push edi
call dword [eax + 8]
push eax
mov dword [ebp - 4], eax
call fcn.1007e238
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10069101
push 0x20b0
push 0x21
call fcn.100680dd
pop ecx
xor eax, eax
pop ecx
jmp 0x100691ee
push dword [ebp - 4]
push 0
push ebx
call fcn.1007e1e0
add esp, 0xc
lea eax, [ebp + 0xc]
mov edx, dword [esi]
and dword [ebp - 8], 0
push eax
and dword [ebp + 0xc], 0
push dword [ebp - 4]
lea eax, [ebp - 0x50]
mov dword [ebp - 0xc], edx
push ebx
push edi
push dword [ebp + 0x14]
push eax
call fcn.1007e450
pop ecx
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x100691cd
mov esi, dword [ebp + 0x10]
mov edi, dword [esi + 0x378]
mov eax, dword [esi + 0x37c]
test edi, edi
mov dword [ebp + 0x14], eax
jne 0x10069170
test eax, eax
jne 0x10069170
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [ebp + 0x14]
push 0
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x10]
push 0
push eax
and dword [ebp - 0x10], 0
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100691d6
mov eax, dword [ebp + 0x14]
push dword [ebp - 4]
mov dword [esi + 0x37c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esi + 0x378], edi
mov dword [esi + 0x380], eax
call fcn.10074cb0
pop ecx
mov dword [esi + 0x384], eax
pop ecx
mov dword [ebp - 8], 1
jmp 0x100691e4
push 0x20bc
push 0x11
jmp 0x100691dd
push 0x20cb
push 0xe
call fcn.100680dd
pop ecx
pop ecx
push ebx
call fcn.1007de95
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1006ada4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0xf
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x53]
mov byte [ebp - 0x54], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x54]
push eax
movzx eax, word [ebp + 0xc]
push eax
call fcn.10066281
push eax
call fcn.1005fb73
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x1006ade7
push 0x26ff
push 0xc
jmp 0x1006ae08
mov eax, dword [esi]
push dword [ebp + 0x18]
mov ecx, esi
call dword [eax + 8]
mov edi, eax
push edi
call fcn.1007e238
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x1006ae16
push 0x2708
push 0x21
call fcn.100680dd
pop ecx
xor eax, eax
pop ecx
jmp 0x1006aedb
push edi
push ebx
push eax
call fcn.1007e1e0
add esp, 0xc
lea eax, [ebp - 4]
mov edx, dword [esi]
mov dword [ebp - 8], ebx
push eax
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x54]
mov dword [ebp - 4], ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov dword [ebp + 0x14], edx
push eax
call fcn.1007e450
pop ecx
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp + 0x14]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x1006aeb8
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push 1
stosd dword es:[edi], eax
pop edi
lea eax, [ebp - 0x10]
push edi
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push ebx
mov dword [ebp - 0xc], ebx
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006aec1
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
push eax
mov dword [esi + 8], eax
push dword [ebp + 0xc]
call fcn.10074cb0
pop ecx
mov dword [esi + 0xc], eax
pop ecx
mov dword [ebp - 8], edi
jmp 0x1006aecf
push 0x2714
push 0x15
jmp 0x1006aec8
push 0x2720
push 0xe
call fcn.100680dd
pop ecx
pop ecx
push dword [ebp + 0xc]
call fcn.1007de95
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1006aee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [eax]
push edi
cmp eax, dword [esi + 0x10]
jae 0x1006aeff
push 0x273b
push 1
jmp 0x1006af17
push dword [esi + 8]
call fcn.1007e238
mov ebx, eax
xor edi, edi
cmp ebx, edi
pop ecx
jne 0x1006af25
push 0x2742
push 0x21
call fcn.100680dd
pop ecx
xor eax, eax
pop ecx
jmp 0x1006b019
push dword [esi + 8]
mov dword [ebp - 8], edi
push edi
push ebx
call fcn.1007e1e0
add esp, 0xc
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push edi
push eax
push dword [esi + 8]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006b001
mov eax, dword [esi + 8]
cmp dword [ebp + 0x10], eax
jb 0x1006b001
push dword [esi + 0xc]
push eax
push ebx
call fcn.10074c8c
add esp, 0xc
test eax, eax
je 0x1006afe6
and byte [ebp - 0x48], 0
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x47]
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x48]
push eax
movzx eax, word [ebp + 0xc]
push eax
call fcn.10066281
push eax
call fcn.1005fb73
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1006afef
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0x18]
mov edx, dword [edi]
push dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], edx
push dword [eax]
lea eax, [ebp - 0x48]
push dword [esi + 8]
push ebx
push eax
call fcn.1007e450
pop ecx
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
mov ecx, edi
call dword [eax + 0x14]
test eax, eax
je 0x1006aff8
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], 1
mov dword [ecx], eax
jmp 0x1006b00f
push 0x2757
push 0x1c
jmp 0x1006b008
push 0x2762
push 0xc
jmp 0x1006b008
push 0x276a
push 0x12
jmp 0x1006b008
push 0x2750
push 0xd
call fcn.100680dd
pop ecx
pop ecx
push ebx
call fcn.1007de95
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1006b5ed
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x388
push edi
push 0
call fcn.100680fb
and byte [ebp - 0x388], 0
mov ecx, 0xe1
xor eax, eax
lea edi, [ebp - 0x387]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x388]
push eax
push dword [ebp + 8]
call fcn.1006b6c4
add esp, 0xc
test eax, eax
pop edi
jne 0x1006b63c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
leave
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1006b64b
mov ecx, dword [ebp - 0x36c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x370]
leave
ret
Function at 0x1006bccb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0xffffffff
push esi
je 0x1006bd28
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x1006bd28
cmp dword [ebp + 0x10], esi
je 0x1006bd28
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x1006bd36
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call fcn.1007e1e0
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006bd23
push 0x2a78
push 0xd
jmp 0x1006bd2f
push 1
pop eax
jmp 0x1006bd38
push 0x2a6b
push 1
call fcn.100680dd
pop ecx
pop ecx
xor eax, eax
pop esi
leave
ret