joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78afa955
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x78b54610]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x78b589ec]
test dword [ebp + 8], eax
je 0x78afa9ea
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea ebx, [ebp - 0x808]
call fcn.78afcb30
xor eax, eax
pop ecx
mov word [ebp - 8], ax
mov eax, dword [0x78b555ec]
pop ecx
pop ebx
test eax, eax
je 0x78afa9dd
lea ecx, [ebp - 0x808]
push ecx
push eax
call sym.MSVCR100.dll_fwprintf
pop ecx
pop ecx
push 0
push 0x32
push dword [0x78b589f4]
push dword [0x78b589f0]
call fcn.78ac8210
add dword [0x78b589f0], 1
adc dword [0x78b589f4], 0
or eax, edx
jne 0x78afa9ea
push dword [0x78b555ec]
call sym.MSVCR100.dll_fflush
pop ecx
jmp 0x78afa9ea
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.78ab0807
leave
ret

Function at 0x78afcb30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x78afcb3f
pop dword [ebp - 0x28]
mov eax, 0x30278ed
sub eax, 0x8a52adae
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x54cac
push 0
mov eax, 0x1d526b06
sub eax, 0xa4a8597e
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x1d503dc6
sub ecx, 0x1d4fefbb
xor edx, edx
add edx, eax
mov edi, 0xadd5704c
add edi, 0xcae07db4
add edi, dword [ebp - 0x28]
mov esi, 0x58cb4180
sub esi, 0x9a5c6094
xor dword [ebp - 0x1c], 0xe5c105e2
mov ebx, dword [edi]
xor dword [ebp - 0x1c], esi
sub ebx, esi
xor dword [ebp - 8], 0x957bd827
mov dword [edx], ebx
sub dword [ebp - 0x1c], edi
add edx, 0x5f3cee9
sub edx, 0x5f3cee5
add edi, 0xb7f90db2
add edi, 0x4806f252
loop 0x78afcba0
add eax, 0x12aff
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4b3fd320
sub ecx, 0xd295d320
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x78afe8af
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x78afe8d6
call sym.MSVCR100.dll___doserrno
mov dword [eax], esi
call sym.MSVCR100.dll__errno
push 0x16
pop esi
mov dword [eax], esi
call sym.MSVCR100.dll__invalid_parameter_noinfo
mov eax, esi
jmp 0x78afe92b
test dword [ebp + 0xc], 0xfffffff9
jne 0x78afe8bc
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78afe903
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.78afcb30
pop ecx
call sym.MSVCR100.dll__errno
mov eax, dword [eax]
jmp 0x78afe92b
test al, 0x10
jne 0x78afe929
test al, 1
je 0x78afe929
test byte [ebp + 0xc], 2
je 0x78afe929
call sym.MSVCR100.dll___doserrno
mov dword [eax], 5
call sym.MSVCR100.dll__errno
mov dword [eax], 0xd
jmp 0x78afe8fa
xor eax, eax
pop esi
pop ebp
ret
Function at 0x78afe946
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x78afe96e
call sym.MSVCR100.dll___doserrno
and dword [eax], 0
call sym.MSVCR100.dll__errno
mov dword [eax], 0x16
call sym.MSVCR100.dll__invalid_parameter_noinfo
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78afe98b
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.78afcb30
pop ecx
jmp 0x78afe969
test byte [ebp + 0xc], 0x80
je 0x78afe996
and eax, 0xfffffffe
jmp 0x78afe999
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78afe97c
xor eax, eax
pop ebp
ret

Function at 0x78b00307
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x78b0032f
call sym.MSVCR100.dll___doserrno
and dword [eax], 0
call sym.MSVCR100.dll__errno
mov dword [eax], 0x16
call sym.MSVCR100.dll__invalid_parameter_noinfo
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78b0034c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.78afcb30
pop ecx
jmp 0x78b0032a
test byte [ebp + 0xc], 0x80
je 0x78b00357
and eax, 0xfffffffe
jmp 0x78b0035a
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78b0033d
xor eax, eax
pop ebp
ret

Function at 0x78b2c16f
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x78b58650], eax
mov dword [0x78b5864c], ecx
mov dword [0x78b58648], edx
mov dword [0x78b58644], ebx
mov dword [0x78b58640], esi
mov dword [0x78b5863c], edi
mov word [0x78b58668], ss
mov word [0x78b5865c], cs
mov word [0x78b58638], ds
mov word [0x78b58634], es
mov word [0x78b58630], fs
mov word [0x78b5862c], gs
pushfd
pop dword [0x78b58660]
mov eax, dword [ebp]
mov dword [0x78b58654], eax
mov eax, dword [ebp + 4]
mov dword [0x78b58658], eax
lea eax, [ebp + 8]
mov dword [0x78b58664], eax
mov eax, dword [ebp - 0x320]
mov dword [0x78b585a0], 0x10001
mov eax, dword [0x78b58658]
mov dword [0x78b58554], eax
mov dword [0x78b58548], 0xc0000409
mov dword [0x78b5854c], 1
mov eax, dword [0x78b54610]
mov dword [ebp - 0x328], eax
mov eax, dword [0x78b553f8]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x78b58598], eax
push 1
call sym.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x78b2c270
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x78b58598], 0
jne 0x78b2c25b
push 1
call sym.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10003b36
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
mov dword [esp], ecx
test ecx, ecx
je 0x10003ba0
movzx esi, word [eax + 0x2c]
test esi, esi
je 0x10003b95
mov ebx, dword [eax + 0x30]
xor ebp, ebp
mov edi, 0x4de8
mov cl, byte [ebx + ebp]
test cl, cl
jne 0x10003b76
inc ebp
cmp ebp, esi
jb 0x10003b68
jmp 0x10003b9a
mov ch, cl
add ch, 0xe0
cmp cl, 0x61
movzx edx, cl
movzx ecx, ch
cmovb ecx, edx
mov edx, edi
shl edx, 5
add edx, edi
movzx edi, cl
add edi, edx
jmp 0x10003b6f
mov edi, 0x4de8
cmp edi, dword [esp + 0x18]
jne 0x10003b4a
mov eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10003bab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 0x78]
mov edx, dword [eax + ecx + 0x20]
add edx, ecx
mov dword [esp + 0xc], edx
mov edx, dword [eax + ecx + 0x14]
mov dword [esp + 8], edx
mov edx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], edx
mov edx, dword [eax + ecx + 0x1c]
add edx, ecx
mov dword [esp], edx
mov eax, dword [eax + ecx + 0x24]
add eax, ecx
mov dword [esp + 4], eax
xor edx, edx
cmp edx, dword [esp + 0x10]
je 0x10003c77
mov eax, edx
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + edx*4]
add edx, dword [esp + 0x28]
xor edi, edi
inc edi
mov esi, edx
dec edi
cmp byte [esi], 0
lea esi, [esi + 1]
jne 0x10003c08
test edi, edi
je 0x10003c4b
neg edi
xor ebp, ebp
mov esi, 0x4de8
mov bl, byte [edx + ebp]
test bl, bl
jne 0x10003c2c
inc ebp
cmp ebp, edi
jb 0x10003c1e
jmp 0x10003c50
mov bh, bl
add bh, 0xe0
cmp bl, 0x61
movzx ecx, bl
movzx ebx, bh
cmovb ebx, ecx
mov ecx, esi
shl ecx, 5
add ecx, esi
movzx esi, bl
add esi, ecx
jmp 0x10003c25
mov esi, 0x4de8
lea edx, [eax + 1]
cmp esi, dword [esp + 0x2c]
jne 0x10003bec
mov ecx, dword [esp + 4]
movzx eax, word [ecx + eax*2]
mov ecx, dword [esp + 8]
cmp ecx, eax
jbe 0x10003c81
mov ecx, dword [esp + 0x28]
mov edx, dword [esp]
add ecx, dword [edx + eax*4]
mov eax, ecx
jmp 0x10003c79
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10054710
push ecx
push eax
call fcn.100538f0
Function at 0x1000d6a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x38]
mov ebx, 0xb
push 1
push ebx
call fcn.100101fa
add esp, 8
lea ecx, [esp + 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [ecx + 8], ebx
xor edi, edi
push edi
push ebx
push ecx
call fcn.10001f90
add esp, 0xc
lea eax, [0x1005236d]
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ecx]
mov dword [ecx], 0xdd5c909a
mov ebx, esp
push dword [ebx]
push eax
call fcn.100074fe
add esp, 8
mov dword [ebx + 8], edi
xorps xmm0, xmm0
movsd qword [ebx], xmm0
mov ecx, 0xfffffffc
mov edx, dword [ecx + 0x1005553d]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 4], edx
add ecx, 4
cmp ecx, 8
jb 0x1000d705
mov ebp, esp
mov eax, dword [ebp + 8]
lea ebx, [esp + 0xc]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp]
movsd qword [ebx], xmm0
push 0xc
push ebx
call fcn.1000d642
add esp, 8
mov edi, eax
lea eax, [0x1004bc20]
mov dword [ebp], eax
mov eax, dword [ebp]
mov dword [ebp], 0xb399cf4c
mov ebp, esp
push dword [ebp]
push eax
call fcn.10007325
add esp, 8
xorps xmm0, xmm0
movsd qword [ebp], xmm0
mov dword [ebp + 8], 0
mov ecx, 0xfffffffc
mov edx, dword [ecx + 0x10055549]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 4], edx
add ecx, 4
cmp ecx, 8
jb 0x1000d772
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
movsd xmm0, qword [esp]
movsd qword [esp + 0xc], xmm0
push 0x11
push 0x10055551
push 0xc
push ebx
call fcn.1000d526
add esp, 0x10
push 7
push dword [esp + 0x20]
call eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
movsd xmm0, qword [esp + 0x18]
movsd qword [esp], xmm0
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
push eax
push dword [esp + 8]
push 0x10055562
push ebx
call fcn.100021cc
add esp, 0x10
push ebp
call fcn.10001590
add esp, 4
push ebp
call fcn.10010490
add esp, 4
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 7
jbe 0x1000d817
cmp byte [edi + 7], 0xbf
jg 0x1000d819
push 0x100556b4
push 7
push 0
push eax
push edi
call fcn.10053c30
jne 0x1000d807
mov ebp, 7
push 0
push ebp
call fcn.100101fa
add esp, 8
mov ecx, dword [edi]
mov edi, dword [edi + 3]
mov dword [edx], ecx
mov dword [edx + 3], edi
mov dword [esi], eax
mov dword [esi + 4], edx
mov dword [esi + 8], ebp
push ebx
call fcn.10001590
add esp, 4
push ebx
call fcn.10010490
add esp, 4
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10016574
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10c
mov esi, dword [esp + 0x128]
mov ebx, dword [esp + 0x124]
lea eax, [esp + 0xa]
push dword [esp + 0x130]
push dword [esp + 0x130]
push eax
call fcn.1001663d
add esp, 0xc
push 0
push esi
call fcn.100101fa
add esp, 8
mov dword [esp], eax
mov ebp, edx
push esi
push ebx
push edx
call fcn.10045a70
add esp, 0xc
test esi, esi
je 0x10016620
mov cl, byte [esp + 0x10a]
mov al, byte [esp + 0x10b]
inc cl
movzx ecx, cl
mov dword [esp + 4], ecx
xor edx, edx
mov ecx, dword [esp + 4]
lea ebx, [ecx + edx]
movzx ebx, bl
mov ah, byte [esp + ebx + 0xa]
add al, ah
mov edi, esi
movzx esi, al
mov cl, byte [esp + esi + 0xa]
mov byte [esp + ebx + 0xa], cl
mov byte [esp + esi + 0xa], ah
add ah, byte [esp + ebx + 0xa]
mov ecx, dword [esp + 0x124]
mov cl, byte [ecx + edx]
movzx esi, ah
xor cl, byte [esp + esi + 0xa]
mov esi, edi
mov byte [ebp + edx], cl
inc edx
cmp edi, edx
jne 0x100165df
mov eax, dword [esp + 0x120]
mov ecx, dword [esp]
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], esi
add esp, 0x10c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001a110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x68
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100343a0
mov esi, ecx
lea eax, [ebp - 0x18]
mov edi, edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x1006b9a9]
push 4
push 0x1ec
call fcn.1000f0c0
add esp, 8
test eax, eax
je 0x1001a2da
mov ebx, dword [edi]
mov dword [ebp - 0x3c], esi
mov esi, dword [edi + 8]
mov dword [eax + 0xb0], 0
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], eax
movzx ecx, word [ebx + 0x1ea]
mov edi, esi
not edi
add edi, ecx
mov dword [ebp - 0x20], ecx
lea ecx, [esi + esi*8]
lea ecx, [ecx + ecx*2]
mov word [eax + 0x1ea], di
add ecx, esi
mov edx, dword [ebx + ecx + 0xcc]
mov dword [ebp - 0x40], edx
movsd xmm0, qword [ebx + ecx + 0xc4]
movsd qword [ebp - 0x48], xmm0
movsd xmm0, qword [ebx + ecx + 0xb4]
movsd xmm1, qword [ebx + ecx + 0xbc]
mov ecx, esi
shl ecx, 4
cmp edi, 0xb
movsd qword [ebp - 0x50], xmm1
movsd qword [ebp - 0x58], xmm0
mov eax, dword [ebx + ecx]
mov edx, dword [ebx + ecx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
ja 0x1001a2e6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], esi
inc esi
sub eax, esi
cmp eax, edi
jne 0x1001a2ff
mov edx, dword [ebx + ecx + 0xc]
mov ecx, dword [ebx + ecx + 8]
lea eax, [ebx + 0xb4]
add eax, esi
mov dword [ebp - 0x30], edx
lea edx, [esi + esi*8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x28]
lea edx, [edx + edx*2]
add eax, edx
lea edx, [edi + edi*8]
lea edx, [edx + edx*2]
add edx, edi
add ecx, 0xb4
push edx
push eax
push ecx
call fcn.10045a70
add esp, 0xc
shl esi, 4
shl edi, 4
add esi, ebx
push edi
push esi
mov esi, dword [ebp - 0x28]
push esi
call fcn.10045a70
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x24]
mov word [ebx + 0x1ea], ax
mov dword [ecx + 0x2c], ebx
mov eax, dword [ebp - 0x40]
movsd xmm0, qword [ebp - 0x58]
movsd xmm1, qword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x38]
movsd qword [ebp - 0x74], xmm0
movsd xmm0, qword [ebp - 0x48]
movsd qword [ebp - 0x6c], xmm1
mov edx, dword [ebp - 0x5c]
movsd xmm1, qword [ebp - 0x6c]
mov eax, dword [eax + 4]
movsd qword [ebp - 0x64], xmm0
movsd xmm0, qword [ebp - 0x74]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x18], edx
movsd qword [ecx], xmm0
movsd xmm0, qword [ebp - 0x64]
mov edx, dword [ebp - 0x2c]
movsd qword [ecx + 8], xmm1
movsd qword [ecx + 0x10], xmm0
mov dword [ecx + 0x1c], edi
mov dword [ecx + 0x20], edx
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x24], edx
mov dword [ecx + 0x34], esi
mov dword [ecx + 0x38], 0
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x68
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1ec
push 4
call fcn.100536e0
mov dword [ebp - 0x10], 0
push 0x1005a600
push 0xb
push edi
call fcn.10053bb0
add esp, 0xc
jmp 0x1001a31a
mov dword [ebp - 0x10], 0
push 0x1005a5f0
push 0x28
push str.assertion_failed:_src.len____dst.len__
call fcn.10053850
add esp, 0xc
ud2
Function at 0x1001c950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x448
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10034410
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 0
cmp edi, 0x201
jae 0x1001c9e0
jmp 0x1001c9ce
jbe 0x1001ca66
cmp edi, 0x201
jae 0x1001c9e0
mov dword [ebp - 0x30], 0x200
lea ebx, [ebp - 0x454]
mov esi, edi
jmp 0x1001ca11
mov esi, dword [ebp - 0x34]
sub edi, esi
je 0x1001ca05
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
mov edx, esi
push edi
call fcn.10052dd0
add esp, 4
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x1001ca35
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1001cad3
cmp edi, esi
jne 0x1001c9c0
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001caf2
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x1001c9ce
jmp 0x1001c9e0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 0
cmp edi, eax
ja 0x1001cb0f
lea eax, [ebp - 0x44]
push edi
push ebx
push eax
call fcn.10020770
add esp, 0xc
movsd xmm0, qword [ebp - 0x44]
movsd xmm1, qword [ebp - 0x3c]
mov esi, dword [ebp + 8]
movsd qword [ebp - 0x4c], xmm1
movsd qword [ebp - 0x54], xmm0
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1001cabd
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.1000f0d0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x448
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001caad
jmp 0x1001cabd
mov dword [ebp - 0x10], 0
push 0x1005c774
push 0x28
push 0x1005a6e4
call fcn.10053850
add esp, 0xc
jmp 0x1001cb1e
push 0x1005c764
push eax
push edi
call fcn.10053bb0
add esp, 0xc
ud2
Function at 0x10024150
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.10045020
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10034620
mov ebx, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.10045910
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x1002afb0
push eax
push 0x1000
push esi
push ebx
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x100242a4
mov esi, dword [sym.imp.kernel32.dll_SleepEx]
mov dword [ebp - 0x20], ebx
push 1
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x30], 0
je 0x100241da
cmp dword [ebp - 0x2c], 0
jne 0x100242b5
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x100242b5
cmp edi, 0x1000
ja 0x100242ef
xor ebx, ebx
nop dword [eax]
mov eax, edi
sub eax, ebx
jb 0x100242d7
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + ebx - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x1002afb0
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x100242ac
nop dword [eax]
push 1
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x30], 0
je 0x10024250
cmp dword [ebp - 0x2c], 0
jne 0x100242b2
add ebx, dword [ebp - 0x28]
cmp ebx, edi
jne 0x10024210
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x1002afb0
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov ebx, dword [ebp - 0x20]
push ebx
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x100241da
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x100242b5
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, dword [ebp - 0x20]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x1005c1e4
push edi
push ebx
call fcn.10053bd0
add esp, 0xc
jmp 0x10024309
mov dword [ebp - 0x10], 0
push 0x1005c1e4
push 0x1000
push edi
call fcn.10053bb0
add esp, 0xc
ud2
Function at 0x100283a0
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov ecx, esp
push dword [esp + 0x34]
call fcn.10031300
add esp, 4
mov eax, dword [esp]
cmp eax, 0x80000000
jne 0x100283ca
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
jmp 0x10028404
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push 1
call fcn.10032a00
add esp, 4
mov edi, dword [esp + 0xc]
cmp edi, 0x80000000
jne 0x10028410
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
ret
mov ebx, dword [esp + 0x10]
push 0
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x1002842a
mov byte [esi], 4
test edi, edi
jne 0x1002843a
jmp 0x10028409
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test edi, edi
je 0x10028409
add edi, edi
push 2
push edi
push ebx
call fcn.1000f0d0
add esp, 0x30
pop esi
pop edi
pop ebx
ret

Function at 0x10029820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x10029864
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1002986a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1002989f
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x100298af
mov dword [esi + 4], 0
jmp 0x100298c1
cmp eax, 0x103
je 0x100298db
test eax, eax
js 0x100298cc
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x100298c4
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1005c044
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.100200b0
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.100183d0
mov ecx, 7
int 0x29
ud2
Function at 0x10029940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x10029984
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1002998a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x100299c6
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x100299eb
test eax, eax
js 0x100299d5
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x100299e1
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1005c044
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.100200b0
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.100183d0
mov ecx, 7
int 0x29
ud2