joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007a440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1012ef80]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007a4a3
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1007d393
test eax, eax
jne 0x1007a4ce
mov eax, 0xa
jmp 0x1007a5d0
cmp dword [ebp + 0xc], 0
je 0x1007a51a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x1007a518
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x1007a556
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1007a541
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x1007a556
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1007d393
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1007d393
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1007d393
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1007a5f4]
call fcn.1007d33f
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.1007d393
mov esp, ebp
pop ebp
ret
Function at 0x1007acc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x1012ef78]
mov dword [ebp - 4], eax
jmp 0x1007ace7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1007ad00
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1007acfe
mov eax, dword [ebp - 4]
jmp 0x1007ad84
jmp 0x1007acdf
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1007d393
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1007ad81
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x1007ad43
mov edx, dword [ebp - 4]
mov eax, dword [0x1012ef78]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1012ef78], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1007d393
mov esp, ebp
pop ebp
ret

Function at 0x1007b270
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1007b2c0
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x1007b2c0
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x1007b2c0
xor eax, eax
jmp 0x1007b301
mov dword [ebp - 4], 1
jmp 0x1007b2d2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1007b2fc
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x1007b2fa
xor eax, eax
jmp 0x1007b301
jmp 0x1007b2c9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10001a80
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x101f65f8]
test eax, eax
jne 0x10001adc
mov dword [0x101f65f8], 1
call fcn.100f52c0
test eax, eax
je 0x10001acc
push 0
push 0x104
push 0x101f65fc
call fcn.100faeb0
add esp, 0xc
test eax, eax
je 0x10001adc
push str.SysWow64
push 0x101f65fc
call fcn.100c9d55
add esp, 8
mov eax, 0x101f65fc
ret
push 0x104
push 0x101f65fc
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x101f65fc
ret
Function at 0x10002860
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x10002893
mov eax, dword [0x10274670]
test eax, eax
je 0x1000288c
push str.winbrosqlite3_module_is_Loaded
push str.History
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x10
mov eax, 1
pop esi
ret
push str.winbrosqlite3.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x28], eax
jne 0x100028d6
mov eax, dword [0x10274670]
test eax, eax
je 0x100029f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.winbrosqlite3_module_load_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
xor eax, eax
pop esi
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sqlite3_open16
push eax
call edi
mov dword [esi + 4], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_prepare16_v2
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_bind_int64
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_bind_text16
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_step
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_column_int64
push ecx
mov dword [esi + 0x14], eax
call edi
mov edx, dword [esi + 0x28]
push str.sqlite3_column_text16
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x28]
push str.sqlite3_close
push eax
call edi
mov ecx, dword [esi + 0x28]
push str.sqlite3_finalize
push ecx
mov dword [esi + 0x20], eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x24], eax
test ecx, ecx
pop edi
je 0x100029c1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100029c1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x100029c1
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x100029c1
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100029c1
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x100029c1
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x100029c1
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100029c1
test eax, eax
je 0x100029c1
mov eax, dword [0x10274670]
test eax, eax
je 0x100029b7
push str.winbrosqlite3_module_load_successful
push str.History
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x10
mov eax, 1
mov dword [esi + 0x2c], eax
pop esi
ret
mov eax, dword [0x10274670]
test eax, eax
je 0x100029ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.get_winbrosqlite3_function_failed__err__0x_08x_
push str.History
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
mov ecx, esi
call fcn.10002a00
xor eax, eax
pop esi
ret
Function at 0x1000ac90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10182d48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call fcn.1017397b
mov eax, dword [esp + 0x2c]
push 0
push 0x3001
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 2
call fcn.10173b2d
test eax, eax
je 0x1000ad89
lea ecx, [esp + 0xc]
call fcn.10173e27
cmp eax, 0xa00000
jb 0x1000acf6
push 0
lea ecx, [esp + 0x10]
call fcn.10173dfb
mov ecx, dword [0x101e2494]
mov dword [esp], ecx
lea edx, [esp + 4]
mov byte [esp + 0x24], 3
push edx
call fcn.101224e0
lea eax, [esp + 8]
push str._Y__m__d__H:_M:_S
push eax
lea ecx, [esp + 0xc]
call fcn.10122a90
mov ecx, dword [esp + 0x30]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 8]
push str._s__s_r_n
push eax
mov byte [esp + 0x34], 4
call fcn.10170a41
add esp, 0x10
lea ecx, [esp + 8]
mov byte [esp + 0x24], 3
call fcn.10173267
mov edx, dword [esp + 0xc]
push 2
push 0
lea ecx, [esp + 0x14]
call dword [edx + 0x28]
mov eax, dword [esp]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.10173c84
lea ecx, [esp + 0xc]
call fcn.10173d48
lea ecx, [esp]
mov byte [esp + 0x24], 2
call fcn.10173267
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.10173a70
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 0
call fcn.10173267
lea ecx, [esp + 0x30]
mov dword [esp + 0x24], 0xffffffff
call fcn.10173267
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x1000c6e0
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x64]
test eax, eax
je 0x1000c7e7
mov eax, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x7530
push 1
push eax
call edi
mov eax, dword [esi + 0x64]
cmp eax, 1
je 0x1000c732
cmp eax, 0x10
je 0x1000c732
cmp eax, 0x100
je 0x1000c732
cmp eax, 0x40
je 0x1000c732
cmp eax, 0x80
je 0x1000c732
cmp eax, 0x800
je 0x1000c732
cmp eax, 0x20000
jne 0x1000c741
mov ecx, dword [esi + 0x1c]
push 0
push 0x2710
push 2
push ecx
call edi
mov eax, dword [esi + 0x64]
cmp eax, 2
je 0x1000c7d8
cmp eax, 0x80
je 0x1000c7d8
cmp eax, 0x200
je 0x1000c7d8
cmp eax, 0x400
je 0x1000c7d8
cmp eax, 0x1000
je 0x1000c7d8
cmp eax, 0x10000
je 0x1000c7d8
cmp eax, 0x400000
je 0x1000c7d8
cmp eax, 0x800000
je 0x1000c7d8
cmp eax, 0x800
je 0x1000c7d8
cmp eax, 0x2000000
je 0x1000c7d8
cmp eax, 0x4000000
je 0x1000c7d8
cmp eax, 0x20000000
je 0x1000c7d8
cmp eax, 0x40000000
je 0x1000c7d8
cmp eax, 0x11
je 0x1000c7d8
cmp eax, 0x12
je 0x1000c7d8
cmp eax, 0x14
je 0x1000c7d8
cmp eax, 0x8000
je 0x1000c7d8
cmp eax, 0x20000
je 0x1000c7d8
cmp eax, 8
je 0x1000c7d8
cmp eax, 0x15
je 0x1000c7d8
cmp eax, 0x20
je 0x1000c7d8
cmp eax, 0x10000000
jne 0x1000c7e7
mov edx, dword [esi + 0x1c]
push 0
push 0x1388
push 3
push edx
call edi
pop edi
pop esi
ret

Function at 0x1000c7f0
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x64]
test eax, eax
je 0x1000c8ce
mov eax, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 1
push eax
call edi
mov eax, dword [esi + 0x64]
cmp eax, 1
je 0x1000c83b
cmp eax, 0x10
je 0x1000c83b
cmp eax, 0x100
je 0x1000c83b
cmp eax, 0x40
je 0x1000c83b
cmp eax, 0x80
je 0x1000c83b
cmp eax, 0x800
je 0x1000c83b
cmp eax, 0x20000
jne 0x1000c843
mov ecx, dword [esi + 0x1c]
push 2
push ecx
call edi
mov eax, dword [esi + 0x64]
cmp eax, 2
je 0x1000c8c6
cmp eax, 0x80
je 0x1000c8c6
cmp eax, 0x200
je 0x1000c8c6
cmp eax, 0x400
je 0x1000c8c6
cmp eax, 0x1000
je 0x1000c8c6
cmp eax, 0x10000
je 0x1000c8c6
cmp eax, 0x400000
je 0x1000c8c6
cmp eax, 0x800000
je 0x1000c8c6
cmp eax, 0x800
je 0x1000c8c6
cmp eax, 0x2000000
je 0x1000c8c6
cmp eax, 0x4000000
je 0x1000c8c6
cmp eax, 0x20000000
je 0x1000c8c6
cmp eax, 0x40000000
je 0x1000c8c6
cmp eax, 0x11
je 0x1000c8c6
cmp eax, 0x12
je 0x1000c8c6
cmp eax, 0x14
je 0x1000c8c6
cmp eax, 0x8000
je 0x1000c8c6
cmp eax, 0x20000
je 0x1000c8c6
cmp eax, 8
je 0x1000c8c6
cmp eax, 0x20
jne 0x1000c8ce
mov edx, dword [esi + 0x1c]
push 3
push edx
call edi
pop edi
pop esi
ret
Function at 0x10011990
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x88]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100119c1
mov ecx, dword [esi + 0x88]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
jne 0x100119c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x101fa2dc]
push 0x1388
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10011a1b
mov eax, dword [0x10274670]
test eax, eax
je 0x10011a02
mov eax, dword [0x101fa2dc]
push eax
push str.CDealThread::Kill___Terminate__th__0x_08x
push str.IMCD
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
mov ecx, dword [0x101fa2dc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x88], 0
lea ecx, [esi + 0x6c]
call fcn.1000c8e0
mov eax, 1
pop esi
ret

Function at 0x10015f10
Capabilities:
Get graphical window text

Disassembly:
call fcn.100f53a0
test eax, eax
je 0x10015f2f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebp, ebp
test edi, edi
je 0x10015fb0
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x10015fb0
lea ecx, [esi + esi]
xor eax, eax
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.10173930
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10015fb0
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
push ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebp, eax
test ebp, ebp
je 0x10015fb0
push esi
mov esi, dword [esp + 0x1c]
push esi
push 0xffffffffffffffff
push ebx
xor ebp, ebp
call fcn.10013060
add esp, 0x10
test eax, eax
je 0x10015fb0
push esi
call fcn.100c9da4
add esp, 4
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x10016460
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov ecx, 0x101fa508
jmp 0x10016470
push 0xffffffffffffffff
push 0x10183ca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
mov ecx, dword [0x1019bf94]
mov dword [esp], eax
mov dword [eax + 0x14], ecx
mov edx, dword [0x1019bf94]
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [eax + 0x18], edx
mov edx, dword [0x1019bf94]
mov byte [esp + 0xc], 1
mov dword [eax + 0x1c], edx
mov edx, dword [0x1019bf94]
mov byte [esp + 0xc], 2
mov dword [eax + 0x20], edx
mov edx, dword [0x1019bf94]
mov byte [esp + 0xc], 3
mov dword [eax + 0x24], edx
mov edx, dword [0x1019bf94]
mov byte [esp + 0xc], 4
mov dword [eax + 0x28], edx
mov edx, dword [0x1019bf94]
mov byte [esp + 0xc], 5
mov dword [eax + 0x2c], edx
mov edx, dword [0x1019bf94]
mov byte [esp + 0xc], 6
mov dword [eax + 0x30], edx
mov byte [esp + 0xc], 7
mov word [eax], cx
mov word [eax + 2], cx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], 0xffffffff
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1001a8b0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ecx
mov eax, dword [0x101fadec]
push esi
test eax, eax
jne 0x1001a922
call fcn.1001a770
test eax, eax
je 0x1001a922
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
mov eax, dword [0x10274670]
test eax, eax
je 0x1001a908
mov ecx, dword [esp + 8]
push esi
push ecx
push edi
push str.HookLineBoard___x____x____x_
push str.LINE
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x1c
test esi, esi
pop edi
je 0x1001a922
push esi
push 0
push 0x1001a850
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x101fadec], eax
pop esi
pop ecx
ret
Function at 0x1001be30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10184190
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 8
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov esi, ecx
je 0x1001be86
mov edi, dword [esp + 0x28]
cmp edi, ebp
je 0x1001be86
push 0x103
push eax
push esi
call fcn.100c9dc1
push 0x103
lea eax, [esi + 0x208]
push edi
push eax
call fcn.100c9dc1
add esp, 0x18
mov dword [esi + 0x61c], ebp
cmp dword [esi + 0x61c], ebp
jne 0x1001c014
mov ecx, dword [0x101e2494]
push ebx
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x2c]
push esi
push edx
mov dword [esp + 0x28], ebp
call fcn.10001b90
add esp, 8
mov ebx, 1
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], bl
call fcn.101733ae
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.10173267
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001beee
mov ecx, dword [esp + 0x28]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
mov eax, dword [0x10274670]
cmp eax, ebp
je 0x1001bf86
lea edx, [esi + 0x410]
lea ecx, [esp + 0x14]
push edx
call fcn.100e29f0
mov edi, eax
lea eax, [esi + 0x208]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x24], 2
call fcn.100e29f0
mov ebp, eax
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 3
call fcn.100e29f0
mov ecx, dword [edi]
mov edx, dword [ebp]
mov eax, dword [eax]
push ebx
push ecx
push edx
push eax
push str.CIMMessageFile::Init_1___s____s____s____d_
push str.CIMMessageFile
push 0xffffffffffffffff
push 0x10273ddc
mov byte [esp + 0x40], 4
call fcn.10119f10
add esp, 0x20
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 3
call fcn.100e3260
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.100e3260
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 0
call fcn.100e3260
test ebx, ebx
pop ebx
je 0x1001c003
push 0x5c
lea ecx, [esp + 0x28]
call fcn.1017367f
lea ebp, [esi + 0x410]
mov ecx, 0x82
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24]
push 0x103
push ecx
push ebp
call fcn.100c9dc1
mov eax, dword [0x10274670]
add esp, 0xc
test eax, eax
je 0x1001bffc
push ebp
lea ecx, [esp + 0x2c]
call fcn.100e29f0
mov edx, dword [eax]
mov byte [esp + 0x1c], 5
push edx
push str.CIMMessageFile::Init_2___s_
push str.CIMMessageFile
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call fcn.100e3260
mov ecx, esi
call fcn.1001c030
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.10173267
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x1001c590
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10184228
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x10274670]
push esi
push edi
xor esi, esi
mov edi, ecx
cmp eax, esi
mov dword [esp + 0x1c], edi
je 0x1001c5d4
push str.CIMMessageFile::CompareMessage_
push str.CIMMessageFile
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x10
cmp dword [esp + 0x34], esi
jne 0x1001c5ef
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0x14
push ebx
lea ecx, [esp + 0x24]
call fcn.100c2a00
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x38], esi
mov dword [esp + 0x18], esi
call fcn.10124d90
add esp, 8
add edi, 0x410
push eax
lea edx, [esp + 0x10]
push edi
push edx
mov byte [esp + 0x3c], 1
call fcn.10173580
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 3
call fcn.10173267
mov eax, dword [esp + 0xc]
push esi
push esi
push 3
push esi
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov eax, dword [0x10274670]
cmp eax, esi
je 0x1001c678
mov ecx, dword [esp + 0xc]
push ecx
push ebx
push str.CIMMessageFile::CompareMessage_1___x____s_
push str.CIMMessageFile
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x18
cmp ebx, 0xffffffff
je 0x1001c796
lea edx, [esp + 0x14]
push ebp
push edx
push ebx
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
mov eax, dword [0x10274670]
test eax, eax
je 0x1001c6bc
mov eax, dword [esp + 0x18]
push eax
push ebp
push str.CIMMessageFile::CompareMessage_2___d____d_
push str.CIMMessageFile
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x18
test ebp, ebp
jbe 0x1001c723
mov edi, ebp
shr edi, 1
inc edi
lea ecx, [edi*4]
push ecx
call fcn.10173930
mov esi, eax
add esp, 4
test esi, esi
je 0x1001c723
lea ecx, [edi + edi]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push ebp
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x1001c723
mov ecx, dword [esp + 0x3c]
push esi
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.1001c320
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 0
call fcn.10173267
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop ebp
je 0x1001c746
push esi
call fcn.10173959
add esp, 4
mov eax, dword [0x10274670]
pop ebx
test eax, eax
je 0x1001c76e
mov edx, dword [esp + 0xc]
push edx
push str.CIMMessageFile::CompareMessage____d_
push str.CIMMessageFile
push 0xffffffffffffffff
push 0x10273ddc
call fcn.10119f10
add esp, 0x14
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], 0xffffffff
call fcn.100c2a20
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 0x14
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.10173267
jmp 0x1001c746