joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015d0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x41d4c4]
mov ecx, dword [eax + 4]
mov dword [ecx], 0
mov esi, dword [eax]
test esi, esi
jne 0x401591
push 0x30
push dword [0x41d4c4]
call fcn.0040175f
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x30
push esi
call fcn.0040175f
add esp, 8
mov esi, edi
test edi, edi
je 0x40156a
mov edi, dword [esi]
mov eax, dword [esi + 0x1c]
cmp eax, 0x10
jb 0x401580
mov ecx, dword [esi + 8]
lea ebx, [eax + 1]
cmp ebx, 0x1000
jae 0x4015b5
push ebx
push ecx
call fcn.0040175f
add esp, 8
jmp 0x401580
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x4015cb
add eax, 0x24
mov ebx, eax
mov ecx, edx
jmp 0x4015a9
call fcn.004071d8
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1008
call fcn.004125f0
mov esi, ecx
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x41d4e4], 0
jne 0x401634
push str.PATH
call fcn.00407637
add esp, 4
lea edi, [ebp - 0x1010]
push eax
push str.bin_synergy_bin
push str._s__s
push 0x1000
push edi
call fcn.004016b0
add esp, 0x14
push edi
push str.PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov byte [0x41d4e4], 1
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40164e
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x401694
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x4187a1
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40167b
push dword [esi + 8]
call eax
add esp, 4
call eax
mov dword [esi + 4], eax
test eax, eax
setne bl
jmp 0x40167d
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00402198
mov eax, ebx
add esp, 0x1008
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1014], str.Failed_to_load_static_module_
lea eax, [ebp - 0x1014]
push 0x41b4d8
push eax
call fcn.00402675
int3

Function at 0x401a7e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x401ab3
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x401ab0
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x401abc
add edx, 0x28
cmp edx, esi
jne 0x401a9e
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401ab9

Function at 0x401f87
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401fc6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401fc6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401fc6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401fc6
cmp dword [ecx + 0x74], 0xe
jbe 0x401fc6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4087f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40881d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40881d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408b6d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415720
push 0x415718
push str.FlsAlloc
push 0x1e
call fcn.00408e50
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408ba1
push dword [ebp + 8]
mov ecx, esi
call dword [0x41abd0]
call esi
jmp 0x408ba7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408beb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415730
push 0x415728
push str.FlsGetValue
push 0x20
call fcn.00408e50
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408c22
push dword [ebp + 8]
mov ecx, esi
call dword [0x41abd0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40db18
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40dbb5
push ebx
push esi
call fcn.0040dbb8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040da61
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40db62
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40dbb4
push edi
push eax
call fcn.0040a98d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40db82
call fcn.0040a114
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40dbb3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040da61
add esp, 0x20
test eax, eax
jne 0x40dba1
push edi
call fcn.0040a114
jmp 0x40dba9
push ebx
call fcn.0040a114
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10002f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10002f79
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10002f79
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10002f68
cmp esi, edx
jae 0x10002f79
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10002f56
cmp esi, edx
jae 0x10002f79
cmp word [esi], 0
je 0x10002f79
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10003390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10093e08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov edi, esp
mov dword [ebp - 0x2c], edi
call fcn.10003080
mov ebx, eax
test ebx, ebx
je 0x100034a9
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi], eax
push str.kernel32.dll
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.100046b0
test al, al
jne 0x1000340b
push 0xc
push str.kernel32.dll
mov ecx, edi
call fcn.100050e0
mov dword [ebp - 4], 0xffffffff
call fcn.1002cd10
add esp, 4
test eax, eax
jne 0x10003422
xor eax, eax
jmp 0x1000348d
push 0x100ad5b0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000341e
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov byte [ebp - 0x24], 0xe9
lea eax, [ebp - 0x30]
mov ecx, method.std::_Ref_count_obj_alloc_class___ExceptionPtr__struct__StaticAllocator_int__.virtual_12
push eax
push 5
lea eax, [ebp - 0x24]
sub ecx, edi
push eax
sub ecx, 5
push edi
mov dword [ebp - 0x23], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
test esi, esi
je 0x1000348b
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
int3
Function at 0x10003ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0xffff
push edi
mov edi, ecx
cmp ax, bx
jne 0x10003f25
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x10003f63
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [ecx + esi*2]
cmp ecx, eax
jae 0x10003f63
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop edi
mov ax, bx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x1000403a
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x10003f8d
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x10003f9d
push dword [edi + 0x4c]
push ebx
jmp 0x10003fe3
mov word [ebp - 0x28], bx
mov esi, dword [eax]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [esi + 0x1c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x1009c3c4]
mov ecx, dword [ebp - 0x34]
call esi
test eax, eax
js 0x1000403a
cmp eax, 1
jle 0x1000400d
cmp eax, 3
jne 0x1000403a
push dword [edi + 0x4c]
push dword [ebp - 0x28]
call fcn.1007373a
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, bx
jne 0x1000403f
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x1000402a
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.10074627
add esp, 0x10
cmp esi, eax
jne 0x1000403a
lea eax, [ebp - 0x28]
mov byte [edi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x10003f4d
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.1005771b
mov esp, ebp
pop ebp
ret 4
Function at 0x10004b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x38], 0
je 0x10004bc7
cmp byte [ebx + 0x3e], 0
je 0x10004bc7
mov eax, dword [ebx]
push 0xffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, ebx
call esi
mov ecx, 0xffff
cmp cx, ax
je 0x10004b7d
push edi
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [edi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
mov esi, dword [esi + 0x20]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x10004b8f
sub eax, 1
je 0x10004b93
sub eax, 2
je 0x10004bc7
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3e], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x10004bb0
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.10074627
add esp, 0x10
cmp esi, eax
jne 0x10004b7d
cmp byte [ebx + 0x3e], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.1005771b
mov esp, ebp
pop ebp
ret

Function at 0x10004f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10093d60
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100c006c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1005773a
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10041f74
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012630
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094dad
mov eax, dword fs:[0]
push eax
mov eax, 0x2014
call fcn.10058b40
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x201c], edi
mov dword [ebp - 4], 0
push 0x3ec
mov dword [ebp - 0x2020], edi
push edx
mov dword [ebp - 0x2018], 0
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
push eax
lea eax, [ebp - 0x2014]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [edi], 0
call fcn.10003080
mov ebx, eax
test ebx, ebx
je 0x10012747
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x2014]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.100046b0
test al, al
jne 0x10012711
lea eax, [ebp - 0x2014]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100126f3
sub eax, edx
mov ecx, edi
sar eax, 1
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.100050e0
mov dword [ebp - 4], 0
mov ecx, edi
mov dword [ebp - 0x2018], 1
call fcn.100376b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
int3

Function at 0x10012760
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094e0d
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x218], edi
mov dword [ebp - 4], 0
push 0x3ee
mov dword [ebp - 0x21c], edi
push edx
mov dword [ebp - 0x214], 0
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
push eax
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [edi], 0
call fcn.10003080
mov ebx, eax
test ebx, ebx
je 0x10012874
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1009c3c4]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x210]
mov dword [ebp - 4], 1
push eax
mov ecx, edi
call fcn.100046b0
test al, al
jne 0x1001283e
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10012820
sub eax, edx
mov ecx, edi
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.100050e0
mov dword [ebp - 4], 0
mov ecx, edi
mov dword [ebp - 0x214], 1
call fcn.100376b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002e30
int3
Function at 0x1001e4b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095d40
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100c006c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
xor bl, bl
cmp dword [0x100c563c], 0
je 0x1001e63f
mov edx, dword [ebp + 0x18]
sub edx, esi
mov byte [0x100c5859], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
cmp dword [ebp + 0x18], edx
jb 0x1001e68c
or ecx, 0xffffffff
lea eax, [ebp + 8]
cmp esi, 0xffffffff
cmovb ecx, esi
cmp dword [ebp + 0x1c], 0x10
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
add eax, edx
push eax
call fcn.10004870
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x48]
call fcn.10003730
cmp dword [ebp - 0x34], 0x10
lea ecx, [ebp - 0x14]
push 0
push ecx
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], 0
cmovae eax, dword [ebp - 0x48]
push esi
push eax
push dword [0x100c563c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x34]
test eax, eax
jne 0x1001e5aa
cmp edx, 0x10
jb 0x1001e5a6
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e59c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e691
push edx
push ecx
call fcn.1005772c
add esp, 8
xor bl, bl
jmp 0x1001e5dd
cmp edx, 0x10
jb 0x1001e5db
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e5d1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e696
push edx
push ecx
call fcn.1005772c
add esp, 8
mov bl, 1
cmp byte [0x100c58cf], 1
mov byte [ebp - 0x14], bl
jne 0x1001e60f
push dword [ebp - 0x14]
mov edx, str.AddCRCustomData_result
push ecx
mov ecx, 0x100c0de8
call fcn.1000c4c0
add esp, 4
mov ecx, eax
call fcn.10009ff0
push eax
call fcn.1000c8a0
add esp, 4
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x1001e63f
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e635
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e69b
push edx
push ecx
call fcn.1005772c
add esp, 8
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x1001e66f
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e665
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e6a0
push edx
push ecx
call fcn.1005772c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005771b
mov esp, ebp
pop ebp
ret
call fcn.10004fd0
call fcn.10073127
call fcn.10073127
call fcn.10073127
call fcn.10073127
int3
Function at 0x10021690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100216bb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10022640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100216dd
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100216df
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10021763
jg 0x100216f4
test esi, esi
je 0x10021763
test ecx, ecx
jl 0x1002173d
jg 0x100216fe
test eax, eax
je 0x1002173d
cmp edi, ecx
jg 0x10021712
jl 0x10021708
cmp esi, eax
jae 0x10021712
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.1006f4e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10021740
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10021763
jg 0x1002174a
test esi, esi
je 0x10021763
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10021763
push eax
push esi
push 1
push edx
call fcn.10074627
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10021780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x100217ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10022730
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x100217cd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x100217cf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x1002186e
jg 0x100217ec
test esi, esi
je 0x1002186e
test ecx, ecx
jl 0x10021839
jg 0x100217f6
test eax, eax
je 0x10021839
cmp ebx, ecx
jg 0x1002180a
jl 0x10021800
cmp esi, eax
jae 0x1002180a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.1006f4e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10021840
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x1002186e
jg 0x1002184a
test esi, esi
je 0x1002186e
cmp dword [edi + 0x4c], 0
je 0x1002186e
mov ecx, edi
call fcn.10022d70
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.10074874
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc