joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x53746547
mov dword [ebp - 8], 0x56666c65
mov word [ebp - 4], 0x7265
mov byte [ebp - 2], 0
call fcn.10002b70
mov ecx, eax
test ecx, ecx
je 0x10026bd6
mov eax, dword [ecx]
push 1
push 0xa
call dword [eax]
test eax, eax
je 0x10026be0
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x10026bcc
mov dword [eax - 0xc], 0xa
lea eax, [ebp - 0xc]
mov ecx, dword [esi]
push 0xa
push eax
push 0xa
mov byte [ecx + 0xa], 0
push dword [esi]
call fcn.1000c160
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001810
push 0x80004005
call fcn.10001810
call fcn.100026e0
int3

Function at 0x10026d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x41746547
mov dword [ebp - 0xc], 0x61447070
mov dword [ebp - 8], 0x69446174
mov word [ebp - 4], 0x72
call fcn.10002b70
mov ecx, eax
test ecx, ecx
je 0x10026e09
mov eax, dword [ecx]
push 1
push 0xd
call dword [eax]
test eax, eax
je 0x10026e13
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x10026dff
mov dword [eax - 0xc], 0xd
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xd
push eax
push 0xd
mov byte [ecx + 0xd], 0
push dword [esi]
call fcn.1000c160
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001810
push 0x80004005
call fcn.10001810
call fcn.100026e0
int3

Function at 0x10026e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x75537349
mov dword [ebp - 0xc], 0x726f7070
mov dword [ebp - 8], 0x6e794474
mov word [ebp - 4], 0x7057
mov byte [ebp - 2], 0
call fcn.10002b70
mov ecx, eax
test ecx, ecx
je 0x10026e9d
mov eax, dword [ecx]
push 1
push 0xe
call dword [eax]
test eax, eax
je 0x10026ea7
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xe
jl 0x10026e93
mov dword [eax - 0xc], 0xe
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xe
push eax
push 0xe
mov byte [ecx + 0xe], 0
push dword [esi]
call fcn.1000c160
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001810
push 0x80004005
call fcn.10001810
call fcn.100026e0
int3
Function at 0x10026eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0x50646e45
mov dword [ebp - 8], 0x65636f72
mov word [ebp - 4], 0x7373
mov byte [ebp - 2], 0
call fcn.10002b70
mov ecx, eax
test ecx, ecx
je 0x10026f26
mov eax, dword [ecx]
push 1
push 0xa
call dword [eax]
test eax, eax
je 0x10026f30
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xa
jl 0x10026f1c
mov dword [eax - 0xc], 0xa
lea eax, [ebp - 0xc]
mov ecx, dword [esi]
push 0xa
push eax
push 0xa
mov byte [ecx + 0xa], 0
push dword [esi]
call fcn.1000c160
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001810
push 0x80004005
call fcn.10001810
call fcn.100026e0
int3

Function at 0x10027060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x64616f4c
mov dword [ebp - 0xc], 0x4f6d6f43
mov dword [ebp - 8], 0x63656a62
mov word [ebp - 4], 0x74
call fcn.10002b70
mov ecx, eax
test ecx, ecx
je 0x100270d9
mov eax, dword [ecx]
push 1
push 0xd
call dword [eax]
test eax, eax
je 0x100270e3
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x100270cf
mov dword [eax - 0xc], 0xd
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xd
push eax
push 0xd
mov byte [ecx + 0xd], 0
push dword [esi]
call fcn.1000c160
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001810
push 0x80004005
call fcn.10001810
call fcn.100026e0
int3

Function at 0x100270f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x64616552
mov dword [ebp - 0xc], 0x6c616d53
mov dword [ebp - 8], 0x6c69466c
mov word [ebp - 4], 0x65
call fcn.10002b70
mov ecx, eax
test ecx, ecx
je 0x10027169
mov eax, dword [ecx]
push 1
push 0xd
call dword [eax]
test eax, eax
je 0x10027173
push esi
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0xd
jl 0x1002715f
mov dword [eax - 0xc], 0xd
lea eax, [ebp - 0x10]
mov ecx, dword [esi]
push 0xd
push eax
push 0xd
mov byte [ecx + 0xd], 0
push dword [esi]
call fcn.1000c160
add esp, 0x10
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001810
push 0x80004005
call fcn.10001810
call fcn.100026e0
int3
Function at 0x10035910
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x10035999
cmp dword [ebp + 0x10], 0
je 0x10035999
cmp dword [ebp + 0x14], 0
je 0x10035999
cmp dword [ebp + 0xc], 0x104
jge 0x10035949
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10035949
push esi
push dword [edi + 8]
call fcn.1003a250
jmp 0x10035952
push esi
push dword [edi + 8]
call fcn.1003a4b0
add esp, 8
test eax, eax
jne 0x10035980
push eax
push 0xffffffffffffffff
push eax
push dword [edi + 8]
call fcn.10038bb0
add esp, 0x10
test eax, eax
jne 0x10035980
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push eax
call fcn.100354f0
pop edi
pop esi
pop ebp
ret 0x10
push dword [ebp + 0x14]
mov eax, 1
mov ecx, edi
push dword [ebp + 0x10]
push eax
call fcn.100354f0
pop edi
pop esi
pop ebp
ret 0x10
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10

Function at 0x100359b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x100db55c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.10086fab
add esp, 4
call fcn.10013960
test eax, eax
jne 0x100359ee
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [0x100dd788]
test edi, edi
jne 0x10035a55
push 0x100da0c0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100dd788], edi
jne 0x10035a44
push 0x10
call fcn.1006a76e
mov ecx, eax
add esp, 4
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x10035a36
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edi
jmp 0x10035a38
xor ecx, ecx
xchg dword [ebp - 0x210], eax
mov dword [0x100dd788], ecx
push 0x100da0c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x100dd788]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10076710
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call esi
push str.netcurl.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10035afe
cmp dword [edi], 0
jne 0x10035afe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10035afe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x10035afe
call eax
mov dword [edi + 0xc], eax
push ebx
call fcn.1002f3b0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
Function at 0x10040940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x10040962
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x44], eax
mov eax, dword [esi + 0x70]
push 1
add eax, 4
push eax
call fcn.10076f63
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 0xc]
mov byte [esi + 6], cl
cmp dword [eax + 0x58], 0
je 0x10040984
push ecx
push esi
call fcn.10040ac0
mov eax, dword [esi + 0x10]
push esi
mov eax, dword [eax + 0x58]
call eax
add esp, 0xc
push 1
call fcn.1008b122
int3

Function at 0x100439a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, 1
call fcn.10038840
add esp, 4
sub eax, esi
je 0x10043a00
mov edi, dword [ebp + 0x10]
dec eax
push edi
push ebx
mov dword [ebp - 8], eax
call fcn.100396a0
add esp, 8
cmp eax, 3
jne 0x10043a22
test esi, esi
je 0x100439f6
push edi
push ebx
call fcn.100395a0
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.10039810
add esp, 0x10
test eax, eax
jg 0x10043a4a
xor esi, esi
mov eax, dword [ebp - 8]
inc edi
test eax, eax
jne 0x100439c1
call fcn.10079b37
mov edi, dword [eax]
test esi, esi
je 0x10043a51
push 1
push ebx
call fcn.10038c20
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.10039c30
add esp, 0xc
test esi, esi
je 0x100439f6
push dword [ebp + 0xc]
push dword [ebp - 4]
push 1
push eax
call fcn.1008be3e
add esp, 0x10
cmp eax, dword [ebp - 4]
jne 0x100439f6
mov esi, 1
jmp 0x100439f8
push ebx
call fcn.10038da0
push edi
call fcn.10089c62
push eax
push 0x100b2f38
push ebx
call fcn.10038ce0
push edi
push ebx
call fcn.10038d10
add esp, 0x1c
mov eax, 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10043e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100db55c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
mov dword [ebp - 0x218], ebx
call fcn.10039ae0
mov edi, dword [ebp + 0x10]
add esp, 8
mov ebx, dword [ebp - 0x214]
mov esi, 0x200
nop word [eax + eax]
lea eax, [ebp - 0x210]
push eax
call fcn.1003a840
cmp esi, edi
mov ecx, edi
push ebx
cmovbe ecx, esi
mov esi, ecx
push esi
push 1
push eax
call fcn.1008971a
add dword [ebp - 0x210], eax
add esp, 0x14
sub edi, eax
je 0x10043f00
cmp eax, esi
je 0x10043ed0
lea eax, [ebp - 0x210]
push eax
call fcn.1003a880
mov ebx, dword [ebp - 0x218]
add esp, 4
test edi, edi
je 0x10043f39
push 0xffffffffffffffff
push ebx
call fcn.10038b40
add esp, 8
test eax, eax
jne 0x10043f39
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
Function at 0x10051760
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100db55c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.10076710
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.10076710
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100517c3
cmp dword [ebp - 0x114], 6
mov eax, 0x30
jae 0x100517c8
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x100517e6
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x100517e8
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x100517fc
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x100dda34]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10056240
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac90a
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x100db55c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x21c], 0
mov dword [ebp - 4], 1
call fcn.10002c20
mov ecx, eax
test ecx, ecx
je 0x10056361
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 1
push 0
push eax
mov dword [ebp - 0x220], 0x208
mov dword [ebp - 0x224], 1
call fcn.10076710
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10056323
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10056305
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10002820
mov edi, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10056342
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10001810
int3
Function at 0x100575f0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acb0e
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push ebx
push esi
push edi
mov eax, dword [0x100db55c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0
cmp dword [esi + 4], 0
mov dword [ebp - 4], 0
je 0x10057647
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x38]
mov dword [esi + 8], 0
push eax
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
call fcn.100573a0
push esi
push 0
push esi
push 0x10057890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x100576e6
call fcn.1005d6c0
test eax, eax
je 0x100576df
call fcn.1005d6c0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100576df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1005d6c0
lea ecx, [ebp - 0xd0]
mov ebx, eax
call fcn.10006650
mov esi, eax
push str.CWorkThread::Start__CreateThread_failed__errno
push esi
mov byte [ebp - 4], 1
call fcn.100072a0
add esp, 8
mov ecx, esi
push edi
call fcn.100234e0
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0xd0]
call fcn.10007360
xor edi, edi
jmp 0x10057782
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esi + 8], 0
mov dword [ebp - 0x10], eax
jne 0x1005777d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jae 0x10057715
push 0xa
call ebx
cmp dword [esi + 8], 0
je 0x10057701
cmp dword [esi + 8], 0
jne 0x1005777d
call fcn.1005d6c0
test eax, eax
je 0x100576df
call fcn.1005d6c0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100576df
call fcn.1005d6c0
lea ecx, [ebp - 0x168]
mov edi, eax
call fcn.10006650
mov esi, eax
push str.CWorkThread::Start__wait_thread_running_timeout_
push esi
mov byte [ebp - 4], 2
call fcn.100072a0
add esp, 8
mov ecx, esi
push dword [ebp + 8]
call fcn.10019500
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0x168]
call fcn.10007360
xor edi, edi
jmp 0x10057782
mov edi, 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1005779a
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005dac0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad08b
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x100db55c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x20], 8
lea esi, [edi + 0xc]
jb 0x1005dafb
mov esi, dword [esi]
push 0x180
push 0x40
push 0x8101
lea ebx, [edi + 0x24]
push esi
push ebx
call fcn.10093863
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x1005dbcc
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.10076710
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.1005c890
push 0x100b7f54
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push esi
push str.open
push eax
call fcn.1000d200
add esp, 8
push eax
call fcn.1000d200
add esp, 8
push eax
call fcn.1000d200
add esp, 8
mov ecx, eax
call fcn.10019500
push eax
call fcn.1000d200
add esp, 8
lea eax, [ebp - 0xc4]
lea ecx, [ebp - 0xa8]
push eax
call fcn.1005dc10
cmp dword [eax + 0x14], 8
jb 0x1005dbaf
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xc4]
call fcn.10006e60
lea ecx, [ebp - 0xa8]
call fcn.10007360
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x1005dbe5
push 2
push 0
push eax
call fcn.10093d91
add esp, 0xc
mov dword [edi + 4], eax
jmp 0x1005dbec
mov dword [edi + 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret
Function at 0x1005df60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad188
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100db55c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x44]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
cmp eax, 2
je 0x1005e142
cmp eax, 1
jne 0x1005e15a
cmp byte [edi + 8], 0
je 0x1005dfb6
call fcn.1005dac0
mov byte [edi + 8], 0
cmp dword [edi + 4], 0x40000000
jle 0x1005dff2
mov eax, dword [edi + 0x24]
cmp eax, 0xffffffff
je 0x1005dfd7
push eax
call fcn.1009392d
add esp, 4
mov dword [edi + 0x24], 0xffffffff
cmp dword [edi + 0x20], 8
lea eax, [edi + 0xc]
jb 0x1005dfe2
mov eax, dword [eax]
push eax
call fcn.10092e18
add esp, 4
mov ecx, edi
call fcn.1005dac0
cmp dword [edi + 0x28], 0
jne 0x1005e08d
push 0
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.1005dcd0
add esp, 0xc
push 2
push 0x100b7f8c
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1000ac50
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
mov ecx, dword [edi + 0x24]
cmovae eax, dword [ebp - 0x48]
cmp ecx, 0xffffffff
je 0x1005e072
push dword [ebp - 0x38]
push eax
push ecx
call fcn.10094362
add esp, 0xc
jmp 0x1005e075
or eax, 0xffffffff
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x2c], eax
call fcn.100057d0
lea ecx, [ebp - 0x60]
call fcn.100057d0
jmp 0x1005e136
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 1
push esi
push eax
call fcn.1005dcd0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
lea ecx, [edi + 0x2c]
push ecx
push eax
call fcn.10069440
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.100057d0
test esi, esi
jne 0x1005e0e8
push 0xd
push str.write_failed.
lea ecx, [ebp - 0x28]
call fcn.100183a0
push 0x100b7f8c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.1005c150
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x1005e108
mov eax, dword [eax]
mov ecx, dword [edi + 0x24]
cmp ecx, 0xffffffff
je 0x1005e11d
push edx
push eax
push ecx
call fcn.10094362
add esp, 0xc
jmp 0x1005e120
or eax, 0xffffffff
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x2c], eax
call fcn.100057d0
lea ecx, [ebp - 0x28]
call fcn.100057d0
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x1005e142
add dword [edi + 4], eax
jmp 0x1005e15a
cmp dword [esi + 0x14], 8
jb 0x1005e14a
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x100b2530
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret 4
Function at 0x1005ec20
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x100db55c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x1005ede8
test eax, eax
je 0x1005ede8
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x1005ede8
push ecx
push ebx
push eax
call fcn.10076710
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x1005ede8
cmp edi, 0xffffffff
je 0x1005ede1
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10011490
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1005ede1
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x1005ed77
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x1005ede1
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x1005ed77
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x1005ed10
cmp edi, esi
jae 0x1005ed77
nop
sub esi, edi
sbb ecx, eax
js 0x1005ed25
jg 0x1005ed20
cmp esi, 0x400000
jb 0x1005ed25
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x1005ed77
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.100114e0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x1005ed6b
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x1005ed10
jg 0x1005ed77
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x1005ed10
lea eax, [ebp - 0x6c]
push eax
call fcn.10011380
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
push 3
push edi
call fcn.1001d190
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x1005ed90
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.10094928
add esp, 8
mov esi, 1
test ebx, ebx
je 0x1005edcd
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x1005eddb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006a7ac
mov esp, ebp
pop ebp
ret