joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009bca0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025e858
push 0x100739b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x102f7aec]
xor ebx, ebx
cmp eax, ebx
jne 0x1009be00
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1009bdfb
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x102a8c4c
lea edx, [ebp - 0x42c]
push edx
call fcn.1006ca01
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.1023d8fc
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x1009bdfb
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1009bdf2
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1009bdf2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x102f7aec], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x1009bdf2
push esi
call fcn.1023d925
add esp, 4
mov eax, dword [0x102f7aec]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1009c390
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x102f7d60]
test eax, eax
jne 0x1009c44e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x102f7b00
mov dword [0x102f7d60], 1
mov dword [0x102f7b00], 0x114
call esi
mov edx, dword [0x102f7b10]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x102c3744], eax
je 0x1009c442
push 0x102f7c18
mov dword [0x102f7c18], 0x11c
call esi
push 0x102ba934
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x102f7d5c], eax
push 0x102f7d38
je 0x1009c410
call eax
jmp 0x1009c416
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x102f7c1c]
cmp eax, 6
jae 0x1009c42e
cmp eax, 5
jne 0x1009c442
cmp dword [0x102f7c20], 2
jb 0x1009c442
cmp word [0x102f7d38], 9
jne 0x1009c442
mov dword [0x102f7af4], 1
call fcn.1009c460
mov eax, 1
pop esi
ret
mov eax, 1
ret
Function at 0x1009caa0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025e868
push 0x100739b4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x102f7d64]
xor ebx, ebx
cmp eax, ebx
jne 0x1009cc00
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1009cbfb
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x102a8c4c
lea edx, [ebp - 0x42c]
push edx
call fcn.1006ca01
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.1023d8fc
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x1009cbfb
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1009cbf2
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1009cbf2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x102f7d64], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x1009cbf2
push esi
call fcn.1023d925
add esp, 4
mov eax, dword [0x102f7d64]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1009d640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1025431f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x1025e6e4]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], 1
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x30]
push str._08lX__04lX__04lX__02lX_02lX__02lX_02lX_02lX_02lX_02lX_02lX
push ecx
call fcn.100864e0
mov esi, dword [esp + 0x50]
add esp, 0x34
lea edx, [esp + 4]
mov ecx, esi
push edx
call fcn.10082b60
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.10083560
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1009d9e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1009d9eb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
mov esi, edi
not eax
jb 0x1009daed
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x1025e874]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1025e874]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1025e874]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1025e874]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1025e874]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1025e874]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1025e874]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1025e874]
xor eax, edx
inc ecx
dec edi
jne 0x1009da06
test esi, esi
je 0x1009db0f
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1025e874]
xor eax, edx
inc ecx
dec esi
jne 0x1009daf1
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x1009e590
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1025447b
push eax
mov dword fs:[0], esp
sub esp, 0x260
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x274]
push esi
mov esi, dword [esp + 0x27c]
push eax
push ebp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x1009e5f7
push 0x104
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
add esp, 0x26c
ret
mov ecx, dword [0x1025e6e4]
push edi
mov dword [esp + 0xc], ecx
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x278], 0
call fcn.10084230
mov esi, eax
mov ecx, 0x41
xor eax, eax
mov edi, esi
push 0x104
push ebp
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dx, word [esi]
mov eax, esi
test dx, dx
pop edi
je 0x1009e66a
mov ecx, edx
cmp cx, 0x5c
je 0x1009e64e
cmp cx, 0x2f
jne 0x1009e65e
mov cx, word [eax + 2]
cmp cx, 0x5c
je 0x1009e66a
cmp cx, 0x2f
je 0x1009e66a
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x1009e642
cmp word [eax], 0
je 0x1009e6cb
mov cx, word [eax + 4]
add eax, 4
test cx, cx
je 0x1009e694
cmp cx, 0x5c
je 0x1009e694
cmp cx, 0x2f
je 0x1009e694
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x1009e67c
cmp word [eax], 0
je 0x1009e69d
add eax, 2
mov cx, word [eax]
test cx, cx
je 0x1009e6bd
cmp cx, 0x5c
je 0x1009e6bd
cmp cx, 0x2f
je 0x1009e6bd
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x1009e6a5
cmp word [eax], 0
je 0x1009e6f6
mov word [eax + 2], 0
jmp 0x1009e6f6
test dx, dx
je 0x1009e6ea
mov eax, edx
cmp ax, 0x5c
je 0x1009e6ea
cmp ax, 0x2f
je 0x1009e6ea
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x1009e6d2
cmp word [esi], 0
je 0x1009e6f6
mov word [esi + 2], 0
or esi, 0xffffffff
lea ecx, [esp + 8]
push esi
call fcn.10084300
mov ecx, dword [esp + 8]
push 0
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1009e74f
lea ecx, [esp + 8]
mov dword [esp + 0x270], esi
call fcn.10083560
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
add esp, 0x26c
ret
test byte [esp + 0xc], 2
jne 0x1009e75d
push ebp
call dword [sym.imp.USER32.dll_CharUpperW]
test byte [esp + 0xc], 4
jne 0x1009e792
mov eax, dword [esp + 0x27c]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x1009e792
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x44]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 8]
mov dword [esp + 0x270], esi
call fcn.10083560
mov ecx, dword [esp + 0x268]
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x26c
ret
Function at 0x1009e810
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
je 0x1009e86f
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 4]
push edi
lea eax, [esp + 0x14]
push 0
push eax
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1009e856
mov edi, dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1009e856
push edi
push eax
push eax
call fcn.1009de60
push eax
call fcn.1009dbf0
add esp, 0xc
mov eax, dword [esp + 0x14]
pop edi
cmp eax, ebx
je 0x1009e86f
mov eax, dword [esi + 0xc]
push eax
push 0xffffffffffffffff
push 0xd
call fcn.1009dbf0
add esp, 0xc
pop esi
pop ebx
ret 8

Function at 0x1009ee60
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
sub esp, 0x18
xor eax, eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov ecx, 0x87
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push 0x104
lea ecx, [esi + 0x12]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp + 4]
cmp eax, 0xffffffff
je 0x1009ef71
lea edx, [esp + 0x20]
lea ecx, [esp + 0x18]
push edx
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x1009eebb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov eax, dword [ebp + 4]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
jne 0x1009eedc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 4
mov ebp, dword [ebp + 0xc]
cmp dword [ebp - 8], ebx
jne 0x1009eee9
mov byte [esi + 0x10], bl
jmp 0x1009eefd
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1009eefa
mov byte [esi + 0x10], bl
jmp 0x1009eefd
mov byte [esi + 0x10], al
lea ecx, [esp + 0x10]
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x34]
call fcn.100953a0
push eax
mov ecx, esi
call fcn.10095030
lea edx, [esp + 0x18]
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x34]
lea ebx, [esi + 8]
call fcn.100953a0
push eax
mov ecx, ebx
call fcn.10095030
lea eax, [esp + 0x20]
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x34]
lea edi, [esi + 4]
call fcn.100953a0
push eax
mov ecx, edi
call fcn.10095030
mov ecx, esi
call fcn.10095050
test eax, eax
jne 0x1009ef5e
push edi
mov ecx, esi
call fcn.10095030
mov ecx, ebx
call fcn.10095050
test eax, eax
jne 0x1009ef71
push edi
mov ecx, ebx
call fcn.10095030
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 4
Function at 0x1009f7b0
Capabilities:
Get file size

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 8]
mov dword [esp + 8], edi
cmp eax, 0xffffffff
jne 0x1009f7f7
mov eax, dword [esi + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x1009f7f7
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push edi
push 0x80
push ecx
mov ecx, dword [esi + 0xc]
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x1009f7f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [esi + 8]
cmp esi, 0xffffffff
je 0x1009f80d
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1009f81b
mov ecx, dword [esp + 8]
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ecx
ret 4

Function at 0x1009fd40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0xffffffff
jne 0x1009fd85
mov eax, dword [esi + 4]
xor edi, edi
cmp dword [eax - 8], edi
je 0x1009fd87
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push edi
push 0x80
push ecx
mov ecx, dword [esi + 0xc]
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x1009fd87
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x1009fd87
xor edi, edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x1009fe62
push 1
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x28]
mov ebx, eax
mov dword [esp + 0x18], edi
mov ebp, dword [edx]
lea eax, [ebx + ebp]
cmp eax, ebx
jb 0x1009fdb9
cmp eax, ebp
mov dword [esp + 0x18], edi
jae 0x1009fdc1
mov dword [esp + 0x18], 1
mov ecx, dword [esi + 0x20]
cmp ecx, edi
mov dword [esp + 0x10], ecx
je 0x1009fe0c
mov edx, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x20], edi
lea edi, [ecx + edx]
cmp edi, ecx
jb 0x1009fde5
cmp edi, edx
jb 0x1009fde5
xor edx, edx
jmp 0x1009fdea
mov edx, 1
cmp ecx, ebx
ja 0x1009fe0c
cmp dword [esp + 0x18], edx
ja 0x1009fe0c
jb 0x1009fdfa
cmp eax, edi
ja 0x1009fe0c
mov eax, dword [esp + 0x10]
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x14
ret 4
push ebp
mov ecx, esi
call fcn.100a0100
test eax, eax
je 0x1009fe62
mov ebp, dword [esp + 0x28]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 8]
lea edi, [esi + 0x28]
mov eax, dword [ebp]
push 0
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009fe4d
mov eax, dword [edi]
pop edi
mov dword [ebp], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x2c], ebx
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov dword [edi], 0
mov dword [esi + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 4
Function at 0x1009fd45
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0xffffffff
jne 0x1009fd85
mov eax, dword [esi + 4]
xor edi, edi
cmp dword [eax - 8], edi
je 0x1009fd87
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push edi
push 0x80
push ecx
mov ecx, dword [esi + 0xc]
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x1009fd87
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x1009fd87
xor edi, edi
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x1009fe62
push 1
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x28]
mov ebx, eax
mov dword [esp + 0x18], edi
mov ebp, dword [edx]
lea eax, [ebx + ebp]
cmp eax, ebx
jb 0x1009fdb9
cmp eax, ebp
mov dword [esp + 0x18], edi
jae 0x1009fdc1
mov dword [esp + 0x18], 1
mov ecx, dword [esi + 0x20]
cmp ecx, edi
mov dword [esp + 0x10], ecx
je 0x1009fe0c
mov edx, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x20], edi
lea edi, [ecx + edx]
cmp edi, ecx
jb 0x1009fde5
cmp edi, edx
jb 0x1009fde5
xor edx, edx
jmp 0x1009fdea
mov edx, 1
cmp ecx, ebx
ja 0x1009fe0c
cmp dword [esp + 0x18], edx
ja 0x1009fe0c
jb 0x1009fdfa
cmp eax, edi
ja 0x1009fe0c
mov eax, dword [esp + 0x10]
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x14
ret 4
push ebp
mov ecx, esi
call fcn.100a0100
test eax, eax
je 0x1009fe62
mov ebp, dword [esp + 0x28]
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 8]
lea edi, [esi + 0x28]
mov eax, dword [ebp]
push 0
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009fe4d
mov eax, dword [edi]
pop edi
mov dword [ebp], eax
mov eax, dword [esi + 0x20]
mov dword [esi + 0x2c], ebx
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov dword [edi], 0
mov dword [esi + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 4

Function at 0x1009ff00
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
test ebx, ebx
mov esi, ecx
je 0x1009ff7f
mov edi, dword [esp + 0x14]
test edi, edi
je 0x1009ff7f
cmp dword [esi + 8], 0xffffffff
jne 0x1009ff51
mov eax, dword [esi + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x1009ff51
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
push 0
push 0x80
push ecx
mov ecx, dword [esi + 0xc]
push 0
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x1009ff51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [esi + 8]
cmp esi, 0xffffffff
je 0x1009ff7f
lea edx, [esp + 0x10]
push 0
push edx
push edi
push ebx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009ff7f
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x100a2300
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x100a23c0
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.1006caa8
add esp, 8
test eax, eax
je 0x100a234f
mov word [eax], 0
mov edi, dword [esp + 0x218]
test edi, edi
je 0x100a23b9
mov ebx, dword [esp + 0x21c]
test ebx, ebx
je 0x100a23b9
lea edx, [esp + 0xc]
test edx, edx
je 0x100a23b9
mov eax, dword [esp + 0x220]
mov esi, 0x7a
test eax, eax
je 0x100a2396
push eax
lea eax, [esp + 0x10]
push eax
push 0x102a8c4c
push ebx
push edi
call fcn.1006c991
add esp, 0x14
xor esi, esi
jmp 0x100a23c8
lea ecx, [esp + 0xc]
push ecx
call fcn.1006b93e
add esp, 4
cmp ebx, eax
jbe 0x100a23c8
lea edx, [esp + 0xc]
push edx
push edi
call fcn.1006bf80
add esp, 8
xor esi, esi
jmp 0x100a23c8
mov esi, 0x57
jmp 0x100a23c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
mov dword [0x102f7dd8], esi
je 0x100a23d9
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x208
ret

Function at 0x100a24f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x100a25b0
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.1006caa8
add esp, 8
test eax, eax
je 0x100a253f
mov word [eax], 0
mov edi, dword [esp + 0x218]
test edi, edi
je 0x100a25a9
mov ebx, dword [esp + 0x21c]
test ebx, ebx
je 0x100a25a9
lea edx, [esp + 0xc]
test edx, edx
je 0x100a25a9
mov eax, dword [esp + 0x220]
mov esi, 0x7a
test eax, eax
je 0x100a2586
push eax
lea eax, [esp + 0x10]
push eax
push 0x102a8c4c
push ebx
push edi
call fcn.1006c991
add esp, 0x14
xor esi, esi
jmp 0x100a25b8
lea ecx, [esp + 0xc]
push ecx
call fcn.1006b93e
add esp, 4
cmp ebx, eax
jbe 0x100a25b8
lea edx, [esp + 0xc]
push edx
push edi
call fcn.1006bf80
add esp, 8
xor esi, esi
jmp 0x100a25b8
mov esi, 0x57
jmp 0x100a25b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
mov dword [0x102f7dd8], esi
je 0x100a25c9
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x208
ret
Function at 0x100a84e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x100a8501
push 0x57
mov dword [0x102f7dd8], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x100a8532
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100a8532
test al, 0x10
jne 0x100a8532
test al, 1
je 0x100a84fc
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x100a85a0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x100a85c1
push 0x57
mov dword [0x102f7dd8], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x100a85f2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100a85f2
test al, 0x10
jne 0x100a85f2
test al, 1
je 0x100a85bc
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret