joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10128250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 1
jl 0x10128268
cmp dword [ebp + 0xc], 8
jg 0x10128268
mov byte [ebp - 1], 1
jmp 0x1012826c
mov byte [ebp - 1], 0
push str.bad_pack_level
movzx eax, byte [ebp - 1]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10125c90
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af78], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6af70], 0
jne 0x101282b5
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af78], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af70], 0x10000
mov eax, 4
imul ecx, eax, 0x7fff
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x4af70], 0
push 0x1fffc
push 0
mov eax, dword [ebp + 8]
add eax, 0x4af70
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x101840ea]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af98], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x101840e8]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af9c], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x101840ec]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6afa0], edx
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx*8 + 0x101840ee]
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af94], edx
cmp dword [ebp + 0xc], 2
jg 0x1012834d
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx]
or edx, 4
mov eax, dword [ebp + 0x10]
mov word [eax], dx
jmp 0x10128362
cmp dword [ebp + 0xc], 8
jl 0x10128362
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx]
or edx, 2
mov eax, dword [ebp + 0x10]
mov word [eax], dx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af84], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af74], 0
mov dword [ebp - 8], 0x8000
mov eax, dword [ebp - 8]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x1af70
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af90], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x6af90], 0
je 0x101283c9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x6af90], 0xffffffff
jne 0x101283e5
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af8c], 1
mov edx, dword [ebp + 8]
mov dword [edx + 0x6af90], 0
jmp 0x1012845d
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af8c], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x6af90], 0x106
jae 0x1012840d
mov edx, dword [ebp + 8]
push edx
call fcn.10128810
add esp, 4
mov eax, dword [ebp + 8]
mov dword [eax + 0x6af7c], 0
mov dword [ebp - 8], 0
jmp 0x1012842c
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 2
jae 0x1012845d
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x6af7c]
shl eax, 5
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x1af70]
xor eax, edx
and eax, 0x7fff
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x6af7c], eax
jmp 0x10128423
mov esp, ebp
pop ebp
ret
Function at 0x1012a210
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x1012a220
xor eax, eax
jmp 0x1012a3bd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x1012a37e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x101841b0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x101841b0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x101841b0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x101841b0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x101841b0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x101841b0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x101841b0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x101841b0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x1012a229
cmp dword [ebp + 0x10], 0
je 0x1012a3b7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x101841b0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x1012a384
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x1012a3c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
imul eax, ecx, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 8
xor eax, dword [edx*4 + 0x101841b0]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
shl edx, 0
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx]
and ecx, 0xff
mov eax, dword [ebp + 8]
add ecx, dword [eax + edx]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
imul eax, dword [edx + ecx], 0x8088405
add eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx]
shr ecx, 0x18
mov edx, dword [ebp + 8]
xor ecx, dword [edx + eax]
and ecx, 0xff
mov eax, 4
shl eax, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax]
shr eax, 8
xor eax, dword [ecx*4 + 0x101841b0]
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
pop ebp
ret
Function at 0x1012ae30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x2d]
test edx, edx
je 0x1012af14
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
je 0x1012ae82
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x40]
cmp edx, dword [ebp + 0xc]
jae 0x1012ae82
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x3c], 0
jne 0x1012aeaf
mov edx, dword [ebp + 0xc]
shl edx, 1
push edx
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x3c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x40], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
push ecx
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x1012aed8
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x1012af0b
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 8]
movzx ecx, byte [edx + eax]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x30
push edx
call fcn.1012a4e0
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x3c]
mov ecx, dword [ebp - 8]
mov byte [edx + ecx], al
jmp 0x1012aecf
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x20], 0
je 0x1012af6f
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx + 0x28]
jb 0x1012af3c
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0x30000
xor eax, eax
jmp 0x1012afa4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x24]
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp + 0xc]
jmp 0x1012afa4
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x1012af98
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x18]
jmp 0x1012afa4
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1012b5f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x1012b6b2
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x8c]
cmp eax, dword [edx + 0x88]
jb 0x1012b624
xor eax, eax
jmp 0x1012b722
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x88]
sub eax, dword [edx + 0x8c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jbe 0x1012b647
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x84]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x8c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x8c]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x78]
push edx
call fcn.1012a210
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 8]
jmp 0x1012b722
mov edx, dword [ebp - 4]
cmp dword [edx + 0x7c], 0
je 0x1012b716
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1012b6e3
xor eax, eax
jmp 0x1012b722
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x74]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x74], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x78]
push edx
call fcn.1012a210
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x78], eax
mov eax, dword [ebp - 0xc]
jmp 0x1012b722
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], 0x1000000
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x10132160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
push 0x666
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1013218e
mov byte [ebp - 1], 1
push 0x3e8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x10132230
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x101322d8
mov ecx, dword [ebp + 8]
push ecx
push str._DlpMonh_OpenPipeName_:_ls
call fcn.1010da30
add esp, 8
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0xffffffff
je 0x1013227f
jmp 0x101322d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
je 0x101322a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreatePipeFile_GetLastError:_d
call fcn.1010da30
add esp, 8
xor eax, eax
jmp 0x10132319
push str.WaitNamedPipe_wcsPipeName__20000_
call fcn.1010da30
add esp, 4
push 0x4e20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x101322c8
xor eax, eax
jmp 0x10132319
push str.CNamePipeClient_Initialize
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10132239
mov dword [ebp - 8], 2
push 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10132314
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetNamedPipeHandleState_GetLastError:_d
call fcn.1010da30
add esp, 8
xor eax, eax
jmp 0x10132319
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x10132320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10132350
xor eax, eax
jmp 0x10132366
mov edx, dword [ebp + 0xc]
push edx
push str.CNamePipeClient_Send_size:_d
call fcn.1010da30
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x10145ce0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e6cb
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push 0
push eax
call fcn.10146380
add esp, 8
cmp byte [0x101b1e56], 0
mov dword [ebp - 4], 0
je 0x10145e05
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x114]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [esi + 0x14], 0x10
jb 0x10145d70
mov ecx, dword [esi]
jmp 0x10145d72
mov ecx, esi
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
push ecx
cmovae eax, dword [ebp - 0x144]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12c]
push str.__d._d._s._s___s_n
push eax
call fcn.10146990
add esp, 0x1c
lea eax, [ebp - 0x12c]
cmp dword [ebp - 0x118], 0x10
cmovae eax, dword [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [ebp - 0x118], 0x10
jb 0x10145dea
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [0x101b1e5c]
test eax, eax
jne 0x10145e35
push 0x18
call fcn.101507ca
add esp, 4
mov dword [0x101b1e5c], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
push eax
movq qword [eax + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [0x101b1e5c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.1014bbd0
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
test eax, eax
jne 0x10145e5f
push eax
push eax
call fcn.10145940
add esp, 8
push dword [0x101b1e5c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1014bbd0
cmp dword [esi + 0x10], 0
mov edi, eax
je case.default.0x10145e8d
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp + 8]
cmp ecx, eax
jg case.default.0x10145e8d
cmp ecx, 3
ja case.default.0x10145e8d
jmp dword [ecx*4 + 0x10145eec]
push esi
mov ecx, edi
call fcn.1014b690
jmp case.default.0x10145e8d
push esi
mov ecx, edi
call fcn.1014bca0
jmp case.default.0x10145e8d
push esi
mov ecx, edi
call fcn.1014c170
jmp case.default.0x10145e8d
push esi
mov ecx, edi
call fcn.1014b9d0
cmp dword [ebp - 0x130], 0x10
jb 0x10145ed1
push dword [ebp - 0x144]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret
Function at 0x10146780
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e7d0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.10147300
add esp, 4
cmp dword [ebp + 0x18], 0
jle 0x1014695c
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10003800
call fcn.10146bc0
add esp, 0x18
test al, al
je 0x101467ff
mov bl, 1
jmp 0x1014695e
call fcn.10146f30
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1000bcd0
mov esi, eax
add esp, 0xc
lea eax, [ebp + 8]
cmp eax, esi
je 0x1014684c
cmp dword [ebp + 0x1c], 8
jb 0x1014682f
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.10003400
cmp dword [ebp - 0x14], 8
jb 0x1014685d
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [ebp + 8]
push eax
call fcn.10146dd0
mov ecx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
cmp ecx, esi
jbe 0x1014690d
cmp ecx, esi
jbe 0x10146951
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
cmp word [eax + esi*2], 0x5c
jne 0x10146904
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.10018a50
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.10003800
call fcn.10146bc0
add esp, 0x18
test al, al
jne 0x101468ec
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x10146901
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp + 0x18]
inc esi
cmp ecx, esi
ja 0x10146887
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call edi
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10003800
call fcn.10146bc0
add esp, 0x18
test al, al
je 0x1014695c
mov bl, 1
jmp 0x1014695e
push str.invalid_string_position
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xout_of_range_char_const__]
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x1014696f
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret
Function at 0x10146bc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e868
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x101ac034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.10146dd0
add esp, 4
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x10146c1e
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1014e190
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015f3e9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ac034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
call fcn.10002180
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.10002180
push 0xffffffffffffffff
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov dword [ecx + 0x14], 0xf
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.10002180
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 2
call fcn.10150640
add esp, 4
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 3
call fcn.101503c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1014fea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push dword [0x101b1f48]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1014fef4
push esi
push 0x10
call fcn.101507ca
add esp, 4
test eax, eax
je 0x1014feca
mov ecx, eax
call fcn.1014f650
mov esi, eax
jmp 0x1014fecc
xor esi, esi
push dword [0x101b1f48]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1014fee4
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push esi
push dword [0x101b1f48]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret