joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100449c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10069d98], eax
je 0x100449e5
mov eax, 0x10dd
jmp 0x10044b8d
cmp dword [0x10069d9c], 0
je 0x100449f8
mov eax, dword [0x10069d9c]
jmp 0x10044b8d
cmp dword [ebp + 0xc], 0
jne 0x10044a08
mov eax, 0x57
jmp 0x10044b8d
cmp dword [ebp + 8], 0
jne 0x10044a18
mov eax, 6
jmp 0x10044b8d
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10044a41
mov dword [ebp - 0xc], 6
mov ecx, dword [ebp - 0xc]
mov dword [0x10069d9c], ecx
mov edx, dword [ebp + 8]
mov dword [0x10069da0], edx
mov eax, dword [ebp - 0xc]
jmp 0x10044b8d
push 0x18
call fcn.100379ee
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10044a9a
mov dword [ebp - 0xc], 8
mov ecx, dword [ebp - 0xc]
mov dword [0x10069d9c], ecx
cmp dword [ebp - 0x18], 0
je 0x10044a89
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.100378fa
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x10069da0], ecx
mov eax, dword [ebp - 0xc]
jmp 0x10044b8d
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10043080
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10043080
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x10044ada
cmp dword [ebp - 8], 0x1e
jbe 0x10044af6
mov dword [ebp - 0xc], 9
cmp dword [0x10069d90], 0
je 0x10044af1
jmp 0x10044a6a
jmp 0x10044a61
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x10044b1d
mov dword [ebp - 0xc], 9
cmp dword [0x10069d90], 0
je 0x10044b18
jmp 0x10044a6a
jmp 0x10044a61
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10044b4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x10044a61
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x10069da8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x10069da8], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10044ba0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10069dd4], 0
je 0x10044bb6
xor eax, eax
jmp 0x10044dd2
cmp dword [0x10069dd0], 0
je 0x10044bc9
mov eax, dword [0x10069dd0]
jmp 0x10044dd2
push 0x24
push 0
push 0x10069dac
call fcn.10039730
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10069dac], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x10069db0], eax
cmp dword [0x10069db0], 0
jne 0x10044c6e
mov dword [0x10069dd4], 1
cmp dword [0x10069db0], 0
je 0x10044c21
mov eax, dword [0x10069db0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10069db4], 0
mov dword [0x10069db8], 0
mov dword [0x10069dbc], 0
mov dword [0x10069dc0], 0
mov dword [0x10069dc4], 0
mov dword [0x10069dc8], 0
mov dword [0x10069dcc], 0
xor eax, eax
jmp 0x10044dd2
push str.ImagehlpApiVersionEx
mov ecx, dword [0x10069db0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069db4], eax
push str.SymInitialize
mov edx, dword [0x10069db0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069db8], eax
push str.SymSetOptions
mov eax, dword [0x10069db0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069dbc], eax
push str.SymGetOptions
mov ecx, dword [0x10069db0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069dc0], eax
push str.SymLoadModule64
mov edx, dword [0x10069db0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069dc4], eax
push str.SymGetModuleInfo64
mov eax, dword [0x10069db0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069dc8], eax
push str.SymFromName
mov ecx, dword [0x10069db0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10069dcc], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.10039730
add esp, 0xc
mov eax, 0xb
mov word [ebp - 8], ax
cmp dword [0x10069db4], 0
je 0x10044d53
cmp dword [0x10069db8], 0
je 0x10044d53
cmp dword [0x10069dc4], 0
je 0x10044d53
cmp dword [0x10069dc8], 0
je 0x10044d53
cmp dword [0x10069dcc], 0
jne 0x10044d58
jmp 0x10044c02
lea ecx, [ebp - 8]
push ecx
call dword [0x10069db4]
movzx edx, word [ebp - 8]
cmp edx, 0xb
jge 0x10044d70
jmp 0x10044c02
push 0
push 0
mov eax, dword [0x10069dac]
push eax
call dword [0x10069db8]
test eax, eax
jne 0x10044d89
jmp 0x10044c02
cmp dword [0x10069dc0], 0
je 0x10044dc3
cmp dword [0x10069dbc], 0
je 0x10044dc3
call dword [0x10069dc0]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0xfffffff8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
or edx, 0x2704
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [0x10069dbc]
mov dword [0x10069dd0], 0x10069dac
mov eax, dword [0x10069dd0]
mov esp, ebp
pop ebp
ret
Function at 0x10002be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046557
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10062698]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x1004c2a0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x50], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi]
lea esi, [edi + 4]
push 0
push esi
mov dword [ebp - 4], 0
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.10005ee0
mov eax, dword [edi]
push 8
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], esi
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1001b10d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10002ca7
push 1
mov byte [ebp - 4], 3
call fcn.1001258d
add esp, 4
mov dword [ebx + 4], eax
jmp 0x10002ca9
xor ebx, ebx
lea eax, [esi + 4]
mov dword [esi + 0x34], ebx
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov dword [esi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003e20
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.1001b4d0
mov eax, dword [0x10062698]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10003e50
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.10023e50
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.100311fa
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret
Function at 0x10003ee0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x10062698]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x10003fbb
test ecx, ecx
je 0x10003fbb
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10003fbb
mov ax, word [ebp - 0x4bc]
xor esi, esi
test ax, ax
je 0x10003fbb
xor ecx, ecx
movzx edx, ax
nop dword [eax + eax]
mov ax, word [ebp + ecx - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push 0x64
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], dx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10003fa6
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push dword [ebp - 0x4c4]
call fcn.100313b2
add esp, 0xc
test eax, eax
je 0x10003fce
add esi, 4
lea ecx, [esi + esi]
movzx eax, word [ebp + ecx - 0x4bc]
mov edx, eax
test ax, ax
jne 0x10003f50
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x4c0]
call fcn.100052a0
xor ecx, ecx
test edi, edi
je 0x10003fec
cmp edi, 0x7fffffff
jbe 0x10003ff1
mov ecx, 0x80070057
test ecx, ecx
js 0x10004027
mov eax, dword [ebp - 0x4c0]
mov esi, edi
test edi, edi
je 0x1000400f
cmp word [eax], 0
je 0x1000400f
add eax, 2
sub esi, 1
jne 0x10004001
xor eax, eax
mov ecx, 0x80070057
test esi, esi
cmovne ecx, eax
mov eax, edi
sub eax, esi
neg esi
sbb esi, esi
and esi, eax
jmp 0x10004029
xor esi, esi
test ecx, ecx
js 0x1000407a
mov eax, dword [ebp - 0x4c0]
mov edx, edi
lea ecx, [eax + esi*2]
sub edx, esi
je 0x1000406d
mov eax, edx
sub eax, edi
mov edi, dword [ebp - 0x4c4]
add eax, 0x7fffffff
add esi, eax
lea eax, [ebx + ebx]
sub eax, ecx
add edi, eax
test esi, esi
je 0x1000406d
movzx eax, word [edi + ecx]
test ax, ax
je 0x1000406d
mov word [ecx], ax
dec esi
add ecx, 2
sub edx, 1
jne 0x10004054
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret
Function at 0x10004150
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10062698]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10063d28], 0
je 0x1000417c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100041d1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
mov dword [0x10063d28], 1
pop esi
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret

Function at 0x10004600
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.1001b4d0
mov eax, dword [0x10062698]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.10023e50
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x100046f7
test edi, edi
je 0x100046f7
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x100046f7
cmp eax, 0x3fff
ja 0x100046f7
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x100046f7
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x1004c084
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100046f7
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.10023e50
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push esi
lea eax, [esi - 1]
push eax
push edi
call fcn.100069f0
add esp, 0x2c
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret
Function at 0x100048c0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046718
mov eax, dword fs:[0]
push eax
mov eax, 0x2808
call fcn.1001b4d0
mov eax, dword [0x10062698]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x800
xor edi, edi
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.10023e50
push 0x2000
lea eax, [ebp - 0x2810]
mov dword [ebp - 0x2814], edi
push edi
push eax
call fcn.10023e50
add esp, 0x18
lea eax, [ebp - 0x2814]
push eax
push 0x800
lea eax, [ebp - 0x2810]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x100049a6
xor esi, esi
cmp dword [ebp - 0x2814], esi
jbe 0x100049a6
nop word [eax + eax]
push 0x400
lea eax, [ebp - 0x810]
push eax
push dword [ebp + esi*4 - 0x2810]
call fcn.10004710
add esp, 0xc
test eax, eax
je 0x10004985
lea eax, [ebp - 0x810]
push eax
push dword [ebp + 8]
call fcn.1003123d
add esp, 8
test eax, eax
je 0x10004990
inc esi
cmp esi, dword [ebp - 0x2814]
jb 0x10004950
jmp 0x100049a6
push dword [ebp + esi*4 - 0x2810]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100049c8
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret
Function at 0x10004ba0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046756
mov eax, dword fs:[0]
push eax
sub esp, 0x130
push ebx
push esi
push edi
mov eax, dword [0x10062698]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 0xffffffff
je 0x10004cab
test al, 0x10
je 0x10004cab
push ebx
mov esi, 1
call fcn.10003e20
add esp, 4
test eax, eax
jne 0x10004d33
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10004d33
push ebx
test esi, esi
jne 0x10004d2b
call edi
test eax, eax
je 0x10004d33
call fcn.10016840
test eax, eax
je 0x10004d33
call fcn.10016840
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x10004d33
call fcn.10016840
lea ecx, [ebp - 0x13c]
mov edi, eax
call fcn.10002be0
mov esi, eax
push 0x1004c2e4
push esi
mov dword [ebp - 4], 1
call fcn.10002760
test ebx, ebx
mov ecx, 0x1004c2a8
cmovne ecx, ebx
push ecx
push esi
call fcn.10002760
push str._suceesss
push esi
call fcn.10002760
mov eax, dword [edi]
add esp, 0x18
mov ecx, edi
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0x13c]
call fcn.10003760
jmp 0x10004d33
push ebx
call edi
test eax, eax
je 0x10004c04
call fcn.10016840
test eax, eax
je 0x10004d33
call fcn.10016840
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x10004d33
call fcn.10016840
lea ecx, [ebp - 0xa4]
mov edi, eax
call fcn.10002be0
mov esi, eax
push 0x1004c2e4
push esi
mov dword [ebp - 4], 0
call fcn.10002760
test ebx, ebx
mov ecx, 0x1004c2a8
cmovne ecx, ebx
push ecx
push esi
call fcn.10002760
push str._suceesss
push esi
call fcn.10002760
mov eax, dword [edi]
add esp, 0x18
mov ecx, edi
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0xa4]
call fcn.10003760
jmp 0x10004d33
call fcn.10003e20
add esp, 4
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100050c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x100050d7
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0
push 0x80
push 2
push 1
push 0x40000000
push dword [ebp + 8]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.10003d80
mov edi, dword [ebp - 8]
test eax, eax
js 0x10005155
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x10005115
mov esi, dword [esi]
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10005133
call fcn.10003bd0
mov esi, eax
test esi, esi
js 0x1000514e
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x1000514c
call fcn.10003bd0
mov esi, eax
not esi
shr esi, 0x1f
jmp 0x10005157
xor esi, esi
not esi
shr esi, 0x1f
jmp 0x10005157
xor esi, esi
test edi, edi
je 0x10005162
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10005369
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10005369
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000535a
cmp esi, edx
jae 0x10005369
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10005348
cmp esi, edx
jae 0x10005369
cmp word [esi], 0
je 0x10005369
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100070f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046981
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x10062698]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x100072dc
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100072dc
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100072d3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetLuaExplain
push ebx
call esi
push str.GetLuaExplainEx
push ebx
mov dword [ebp - 0x12c], eax
call esi
mov ebx, eax
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x10007177
call eax
mov dword [edi], eax
cmp dword [edi], 0
jne 0x100072d3
test ebx, ebx
je 0x100072d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xc8
mov esi, eax
lea eax, [ebp - 0x124]
push 0
push eax
call fcn.10023e50
push 0xa
lea eax, [ebp - 0x124]
push eax
push esi
call fcn.1003174b
xor eax, eax
mov dword [ebp - 0x5c], 0x460038
add esp, 0x18
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x320044
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x54], 0x410038
mov dword [ebp - 0x50], 0x320038
push eax
mov dword [ebp - 0x4c], 0x34002d
mov dword [ebp - 0x48], 0x430042
mov dword [ebp - 0x44], 0x2d0030
mov dword [ebp - 0x40], 0x450034
mov dword [ebp - 0x3c], 0x430039
mov dword [ebp - 0x38], 0x42002d
mov dword [ebp - 0x34], 0x340033
mov dword [ebp - 0x30], 0x2d0036
mov dword [ebp - 0x2c], 0x380039
mov dword [ebp - 0x28], 0x320043
mov dword [ebp - 0x24], 0x390036
mov dword [ebp - 0x20], 0x390043
mov dword [ebp - 0x1c], 0x430034
mov dword [ebp - 0x18], 0x310042
call fcn.10002a30
lea eax, [ebp - 0x124]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x130]
call fcn.10002a30
lea eax, [ebp - 0x12c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.10013b80
add esp, 0xc
lea ecx, [ebp - 0x130]
call fcn.10003330
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 4
call fcn.10003330
mov eax, dword [ebp - 0x128]
cmp dword [eax - 4], 1
jle 0x100072bc
push dword [eax - 0xc]
lea ecx, [ebp - 0x128]
call fcn.10001bd0
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x124]
push ecx
push eax
call ebx
lea ecx, [ebp - 0x128]
mov dword [edi], eax
call fcn.10003330
xor eax, eax
cmp dword [edi], eax
setne al
jmp 0x100072de
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001b4ae
mov esp, ebp
pop ebp
ret 4