joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cd00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e81b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100505e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10023e18
push 4
mov dword [ebp - 4], 0
call fcn.10025364
mov edi, eax
add esp, 4
test edi, edi
je 0x1000cd80
call fcn.10023be5
mov dword [edi], eax
call fcn.10023a13
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.10023d69
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1000cd76
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.10023d91
jmp 0x1000cd82
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d960
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100505e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.1002a240
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call esi
test eax, eax
jne 0x1000d9ba
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x114
call esi
cmp dword [ebp - 0x110], 2
pop esi
jne 0x1000d9e0
cmp dword [ebp - 0x11c], 6
jb 0x1000d9e0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10024280
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10024280
mov esp, ebp
pop ebp
ret

Function at 0x1000d9f0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100505e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.1002a240
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call esi
test eax, eax
jne 0x1000da4a
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x114
call esi
cmp dword [ebp - 0x110], 2
pop esi
jne 0x1000da6a
cmp dword [ebp - 0x11c], 6
jb 0x1000da6a
mov eax, 1
cmp dword [ebp - 0x118], eax
jae 0x1000da6c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10024280
mov esp, ebp
pop ebp
ret
Function at 0x1000da80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100505e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.1002a240
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call esi
test eax, eax
jne 0x1000dada
lea edx, [ebp - 0x120]
push edx
mov dword [ebp - 0x120], 0x114
call esi
mov ecx, 2
pop esi
cmp dword [ebp - 0x110], ecx
jne 0x1000db13
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x1000db13
cmp dword [ebp - 0x118], ecx
jae 0x1000db00
cmp eax, 6
jbe 0x1000db13
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10024280
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10024280
mov esp, ebp
pop ebp
ret

Function at 0x1000db30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1000db95
mov eax, 4
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.EnableUAC
push ecx
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000e4f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x402c
call fcn.10037d10
mov eax, dword [0x100505e4]
xor eax, esp
mov dword [esp + 0x4028], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov dword [esp + 0x18], esi
call sym.Common.dll_Ordinal_31
lea eax, [esp + 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push edi
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000e640
xor ecx, ecx
push 0x3ffe
push ecx
lea edx, [esp + 0x3a]
push edx
mov word [esp + 0x3c], cx
call fcn.1002a240
mov ecx, dword [esp + 0x18]
add esp, 0xc
push 0x2000
lea eax, [esp + 0x34]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1000e635
xor edx, edx
mov eax, edi
mov word [esp + 0x18], dx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e597
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0x18]
call fcn.1000e890
push 1
push 0x1004307c
mov eax, esi
call fcn.1000e760
lea eax, [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e5c7
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x1c]
call fcn.1000e760
mov eax, dword [esp + 0x18]
mov esi, 8
cmp dword [esp + 0x2c], esi
jae 0x1000e5f8
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call sym.Common.dll_Ordinal_33
inc ebx
cmp dword [esp + 0x2c], esi
jb 0x1000e617
mov edx, dword [esp + 0x18]
push edx
call fcn.10024e42
add esp, 4
mov ecx, dword [esp + 0xc]
push 0x2000
lea eax, [esp + 0x34]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1000e57b
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x4034]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10024280
mov esp, ebp
pop ebp
ret 8
Function at 0x100151e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test eax, eax
jne 0x100151f6
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10015289
mov eax, dword [ebp + 8]
test eax, eax
je 0x10015294
test edi, edi
je 0x10015294
push 0
push edi
push eax
mov ecx, esi
call fcn.10014790
test eax, eax
jne 0x10015243
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esi + 0x224]
mov eax, dword [esi + 0x224]
sub edi, dword [esi + 0x220]
sub eax, dword [esi + 0x220]
mov dword [ebp - 4], 0
jne 0x10015269
call fcn.10024d29
mov esi, dword [esi + 0x220]
push 0
lea ecx, [ebp - 4]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
test eax, eax
jne 0x10015295
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100152b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003f128
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x100505e4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100153e9
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100153e9
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10015326
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100153e9
cmp dword [esp + 0x18], 0
jne 0x1001531a
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0xf]
push ecx
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x17], 0
call fcn.10015d80
mov dword [esp + 0x40], 0
cmp dword [esp + 0x14], 0
je 0x10015390
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
mov dword [esp + 0x10], 0
jne 0x1001536b
call fcn.10024d29
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10015390
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100153e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x2c]
sub esi, dword [esp + 0x28]
jne 0x100153c3
lea esi, [esp + 0x1c]
call fcn.10013c10
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test esi, esi
ja 0x100153cc
call fcn.10024d29
mov ecx, dword [esp + 0x28]
push 0
push esi
push ecx
mov ecx, dword [ebp + 8]
call fcn.10014940
test eax, eax
jne 0x100153a1
lea esi, [esp + 0x1c]
call fcn.10013c10
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10015cf0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10015d71
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 4
jl 0x10015d71
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10015d55
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.1002608d
add esp, 8
test eax, eax
je 0x10015d49
xor eax, eax
xor edx, edx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10015d6a
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016640
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push str.SOFTWAREEnigmaSoftwareGroupSpyHunterSpyHunterConfig
push 0x80000002
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [ebp + 0xc]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10016671
sub eax, esi
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [ebp - 4]
push ecx
push edx
mov edx, dword [ebp + 8]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1001669e
lea edi, [eax + 1]
mov eax, dword [ebp - 4]
test eax, eax
je 0x100166ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10016790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SOFTWAREEnigmaSoftwareGroupSpyHunterSpyHunterConfig
push 0x80000002
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100167d6
lea esi, [eax + 1]
mov eax, dword [ebp - 4]
test eax, eax
je 0x100167e4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10016d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
mov ebx, dword [esi + 0x10]
push edi
cmp dword [esi + 0xc], ebx
jbe 0x10016d68
call fcn.10024d29
mov edi, dword [esi + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
cmp edi, dword [esi + 0x10]
jbe 0x10016d7a
call fcn.10024d29
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi]
push ebx
push ecx
push edi
push eax
lea ebx, [ebp - 0xc]
call fcn.10013d70
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push ebx
push ecx
call edi
test eax, eax
jne 0x10016ddd
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10016ddd
push eax
push ecx
mov eax, esi
call fcn.10013c60
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0xc]
jne 0x10016dc8
call fcn.10024d29
mov esi, dword [esi + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push ebx
push edx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001cb20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f0ca
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100505e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x18], edi
cmp esi, edi
je 0x1001cb5a
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov eax, dword [ebp + 0xc]
push 0x10046c28
push eax
call fcn.10026545
mov ebx, eax
add esp, 8
cmp ebx, edi
jne 0x1001cb9f
cmp esi, edi
je 0x1001cb7b
mov dword [esi], 0xa
mov ecx, dword [0x10056fe4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp ecx, edi
je 0x1001cb8d
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push edi
push ebx
call fcn.10025180
add esp, 0xc
push ebx
call fcn.10027ccc
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], 0
test edi, edi
jne 0x1001cbfe
test esi, esi
je 0x1001cbcb
mov dword [esi], 3
push ebx
call fcn.100252cd
mov edx, dword [0x10056fe4]
mov eax, dword [ebp + 8]
mov ecx, edx
add esp, 4
mov dword [eax], edx
test ecx, ecx
je 0x1001cd27
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push ebx
call fcn.10025180
lea eax, [edi + 4]
add esp, 0xc
push eax
call fcn.10027294
add esp, 4
push ebx
push edi
mov esi, eax
push 1
push esi
call fcn.1002693a
push ebx
mov edi, eax
call fcn.100252cd
add esp, 0x14
push 0
push edi
push esi
mov byte [esi + edi], 0
mov byte [esi + edi + 1], 0
mov byte [esi + edi + 2], 0
mov byte [esi + edi + 3], 0
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test al, al
jne 0x1001cc86
cmp byte [esi], 0xef
jne 0x1001cc65
cmp byte [esi + 1], 0xbb
jne 0x1001cc65
cmp byte [esi + 2], 0xbf
mov eax, 3
je 0x1001cc68
mov eax, dword [ebp - 0x10]
lea ebx, [esi + eax]
call fcn.1001b2b0
push esi
mov edi, eax
call fcn.10024587
add esp, 4
mov esi, edi
mov dword [ebp - 0x10], 0
jmp 0x1001ccaa
mov al, byte [esi]
cmp al, 0xef
jne 0x1001cc99
cmp byte [esi + 1], 0xff
jne 0x1001cc99
mov dword [ebp - 0x10], 2
cmp al, 0xff
jne 0x1001ccaa
cmp byte [esi + 1], 0xfe
jne 0x1001ccaa
mov dword [ebp - 0x10], 2
test esi, esi
jne 0x1001ccdf
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1001ccbb
mov dword [eax], 0xe
mov ecx, dword [0x10056fe4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
test ecx, ecx
je 0x1001cd27
inc dword [ecx + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
push edx
lea ecx, [esi + eax]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.1001c900
add esp, 0xc
push esi
call fcn.10024587
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x1001cd0e
inc dword [eax + 0x30]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x18], 1
call fcn.1001cdc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100213c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x100213cb
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.100213e0
Function at 0x10023480
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003ec28
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x100505e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
lea ebx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.10023690
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100234c9
cmp dword [ebp + 0x20], 8
jb 0x1002353d
mov eax, dword [ebp + 0xc]
push eax
jmp 0x10023535
or eax, 0xffffffff
lea esi, [ebp + 8]
call fcn.1000ec80
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x100234e0
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002352b
push 2
lea ebx, [ebp + 8]
call fcn.10023690
cmp eax, 0xffffffff
je 0x10023516
sub esp, 0x1c
mov ecx, ebx
mov esi, esp
mov dword [ebp - 0x10], esp
lea edx, [eax + 1]
push ecx
call fcn.10023380
call fcn.10023480
add esp, 0x1c
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x10023522
lea eax, [ebp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [ebp + 0x20], 8
jb 0x1002353d
mov edx, dword [ebp + 0xc]
push edx
call fcn.10024e42
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023550
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003f390
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x100505e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
cmp esi, ebx
je 0x1002364d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 4
jl 0x1002364d
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 0xffffffff
jne 0x1002361a
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.1002608d
add esp, 8
cmp eax, ebx
je 0x10023602
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.UTILS_tFileSizeUint64:_tCan_not_open:__s__lerror___d_n
xor ecx, ecx
call fcn.10011b20
add esp, 0xc
xor eax, eax
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10023646
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.UTILS_tFileSizeUint64:_t_File_size_failed___s___lerror__d_n
xor ecx, ecx
call fcn.10011b20
add esp, 0xc
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10024280
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100505e4]
jne 0x1002428a
repz ret
jmp fcn.1002bb0d
Function at 0x100339f5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1002de27
and dword [ebp - 4], 0
cmp dword [0x10052a44], 0
mov ebx, eax
jne 0x10033aa6
push 0x10041954
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10033b57
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x10033b57
push eax
call fcn.1002ddb5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10052a44], eax
call esi
push eax
call fcn.1002ddb5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10052a48], eax
call esi
push eax
call fcn.1002ddb5
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x10052a4c], eax
call esi
push eax
call fcn.1002ddb5
pop ecx
mov dword [0x10052a54], eax
test eax, eax
je 0x10033aa6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1002ddb5
pop ecx
mov dword [0x10052a50], eax
mov eax, dword [0x10052a50]
cmp eax, ebx
je 0x10033afe
cmp dword [0x10052a54], ebx
je 0x10033afe
push eax
call fcn.1002de30
push dword [0x10052a54]
mov esi, eax
call fcn.1002de30
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10033afe
test edi, edi
je 0x10033afe
call esi
test eax, eax
je 0x10033af5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10033af5
test byte [ebp - 0xc], 1
jne 0x10033afe
or dword [ebp + 0x10], 0x200000
jmp 0x10033b37
mov eax, dword [0x10052a48]
cmp eax, ebx
je 0x10033b37
push eax
call fcn.1002de30
pop ecx
test eax, eax
je 0x10033b37
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10033b37
mov eax, dword [0x10052a4c]
cmp eax, ebx
je 0x10033b37
push eax
call fcn.1002de30
pop ecx
test eax, eax
je 0x10033b37
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10052a44]
call fcn.1002de30
pop ecx
test eax, eax
je 0x10033b57
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10033b59
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret