joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006ba0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
mov dword [esi], vtable.FileDownLoadManager::MyDownload.0
test edi, edi
je 0x10006c1a
cmp dword [edi + 0x48], 0
push ebx
je 0x10006bd0
cmp dword [edi + 0x4c], 8
jb 0x10006bc6
mov eax, dword [edi + 0x38]
jmp 0x10006bc9
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x68]
test eax, eax
je 0x10006be7
push eax
call fcn.10026ded
add esp, 4
mov dword [edi + 0x68], 0
lea ecx, [edi + 0x50]
call fcn.10006db0
lea ecx, [edi + 0x38]
call fcn.10006db0
lea ecx, [edi + 0x20]
call fcn.10006db0
lea ecx, [edi + 8]
call fcn.10006db0
push 0x74
push edi
call fcn.10026a62
add esp, 8
mov dword [esi + 8], 0
pop ebx
test byte [ebp + 8], 1
mov dword [esi], vtable.RC::IVersionUpdateCallback.0
je 0x10006c31
push 0x14
push esi
call fcn.10026a62
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10006d20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov esi, dword [edi + 8]
mov ecx, dword [esi + 8]
add ecx, 0x50
call fcn.10006f10
mov ecx, dword [esi + 8]
push dword [ebp + 0xc]
add ecx, 0x20
call fcn.10006f10
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x70], eax
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x10]
test eax, eax
je 0x10006d60
mov ecx, dword [edi + 8]
mov dword [ecx + 0xc], eax
mov esi, dword [edi + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x10006b20
push 0
push 0
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
test eax, eax
je 0x10006da4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10006da4
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc
Function at 0x100074d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e078
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0x101c5068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x634], edi
mov dword [ebp - 0x638], edi
xor eax, eax
mov dword [edi], 0
mov dword [edi + 0x1c], 7
mov dword [edi + 0x18], 0
mov word [edi + 8], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x34], 7
mov dword [edi + 0x30], eax
mov word [edi + 0x20], ax
mov dword [edi + 0x4c], 7
mov dword [edi + 0x48], eax
mov word [edi + 0x38], ax
mov dword [edi + 0x64], 7
mov dword [edi + 0x60], eax
mov word [edi + 0x50], ax
mov byte [ebp - 4], 3
push eax
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
call fcn.1013af6f
push eax
call fcn.10144a0f
push 0x20c
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.10136bc0
add esp, 0x14
lea eax, [ebp - 0x21c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x10007605
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x630]
push eax
call fcn.10136bc0
add esp, 0xc
lea eax, [ebp - 0x630]
push 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x100075f6
test eax, eax
je 0x100075f6
add eax, eax
cmp eax, 0x412
jae 0x10007669
xor ecx, ecx
mov word [ebp + eax - 0x630], cx
lea eax, [ebp - 0x630]
jmp 0x100075fc
lea eax, [ebp - 0x21c]
push eax
lea ecx, [edi + 0x20]
call fcn.10006f10
mov eax, dword [edi + 0x30]
test eax, eax
je 0x10007638
cmp dword [edi + 0x34], 8
mov edx, eax
jb 0x10007619
mov ecx, dword [edi + 0x20]
jmp 0x1000761c
lea ecx, [edi + 0x20]
cmp word [ecx + edx*2 - 2], 0x5c
je 0x10007634
push 0x101be964
lea ecx, [edi + 0x20]
call fcn.10008910
mov eax, dword [edi + 0x30]
test eax, eax
jne 0x10007645
push 0x101be968
lea ecx, [edi + 0x20]
call fcn.10006f10
mov dword [edi + 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026dd3
mov esp, ebp
pop ebp
ret
call fcn.10027acd
int3
Function at 0x1000c860
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e691
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101c5068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 7
mov word [ebx + 4], ax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 7
mov dword [ebp - 4], eax
mov word [ebx + 0x1c], ax
lea ecx, [ebx + 0x34]
mov byte [ebp - 4], 1
call fcn.1000e5a0
push 0
push 0x10161558
lea ecx, [ebx + 4]
mov byte [ebp - 4], 2
mov word [ebx], 0x100
mov byte [ebx + 2], 1
call fcn.10009a50
push 0
push 0x10161558
lea ecx, [ebx + 0x1c]
call fcn.10009a50
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011ca0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101c5068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x1a
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011cd2
sub ecx, edx
sar ecx, 1
je 0x10011daf
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10011cf1
mov eax, dword [0x10161770]
lea edx, [ebp - 0x20c]
mov dword [edi], eax
add edx, 0xfffffffe
nop dword [eax]
mov cx, word [edx + 2]
lea edx, [edx + 2]
test cx, cx
jne 0x10011d10
mov ecx, dword [str.HKTcsc]
lea edi, [ebp - 0x20c]
mov dword [edx], ecx
add edi, 0xfffffffe
mov ecx, dword [0x10162214]
mov dword [edx + 4], ecx
mov ecx, dword [0x10162218]
mov dword [edx + 8], ecx
mov cx, word [0x1016221c]
mov word [edx + 0xc], cx
nop word [eax + eax]
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x10011d50
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
test eax, eax
jne 0x10011d7f
lea eax, [ebp - 0x20c]
push eax
call fcn.10017821
add esp, 4
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10011d90
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [esi + 0x1c]
call fcn.10009a50
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10026dd3
mov esp, ebp
pop ebp
ret

Function at 0x10011eb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x34
cmp dword [ecx + 0x14], 8
jb 0x10011ebe
mov ecx, dword [ecx]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop ebp
ret 0xc
Function at 0x100124f0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015ee3b
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x101c5068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x48], 8
lea eax, [esi + 0x34]
jb 0x1001252b
mov eax, dword [eax]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.HaoKaRgf.exe
push str.4bb5c
push str.StSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012556
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
lea edi, [esi + 0x64]
push ecx
push eax
mov ecx, edi
call fcn.10009a50
cmp dword [esi + 0x74], 0
je 0x10012596
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x10012587
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100126cd
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
mov dword [ebp - 4], 0
jb 0x100125c6
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0x224]
push ecx
push 0x10162304
push eax
call fcn.100178a9
mov ebx, dword [ebp - 0x220]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x224]
mov ecx, ebx
sub ecx, esi
add esp, 0x10
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10012625
cmp edi, esi
je 0x10012625
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1001260e
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, edi
push eax
call fcn.10009a50
mov ebx, dword [ebp - 0x220]
mov esi, dword [ebp - 0x224]
test esi, esi
je 0x100126cd
cmp esi, ebx
je 0x1001268a
mov ecx, dword [esi + 0x14]
cmp ecx, 8
jb 0x1001266a
mov eax, dword [esi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x10012660
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100126e9
mov eax, edx
push ecx
push eax
call fcn.10026a62
add esp, 8
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
add esi, 0x18
cmp esi, ebx
jne 0x10012631
mov esi, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x21c]
mov eax, 0x2aaaaaab
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x100126c3
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100126e9
push ecx
push esi
call fcn.10026a62
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026dd3
mov esp, ebp
pop ebp
ret
call fcn.1013a0b9
int3
Function at 0x10012950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x101c5068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0x100
push dword [eax]
lea eax, [ebp - 0x204]
push eax
call fcn.101430aa
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x100128a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x101d034c], eax
test eax, eax
je 0x10012a7c
call dword [sym.imp.KERNEL32.dll_FreeConsole]
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x10
push eax
push dword [0x101d034c]
mov dword [0x101d0348], 2
mov dword [ebp - 0x21c], 2
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x208], 0xbb8
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x10
push eax
push dword [0x101d034c]
mov dword [0x101d0348], 4
mov dword [ebp - 0x21c], 4
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0xbb8
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
push 0
push 0
push 0
push 0x10012b20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026dd3
mov esp, ebp
pop ebp
ret 8

Function at 0x10012a90
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10012b20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret
Function at 0x10014461
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0x90
mov eax, 0x1015f14d
call fcn.100271ca
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x98], eax
xor esi, esi
lea ecx, [ebp - 0x28]
push 0x10161558
mov dword [ebp - 4], esi
call fcn.1000ab70
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 1
call fcn.100215d3
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
mov edi, esi
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10014529
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
push 0x80
push 4
push esi
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1001452b
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0x98]
push eax
mov dword [ecx], eax
call fcn.10026de4
mov edi, eax
pop ecx
test edi, edi
je 0x1001452b
mov eax, dword [ebp - 0x98]
push dword [eax]
push esi
push edi
call fcn.10136bc0
add esp, 0xc
lea eax, [ebp - 0x9c]
push esi
push eax
mov eax, dword [ebp - 0x98]
push dword [eax]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
lea ecx, [ebp - 0x28]
call fcn.1000c5b0
lea ecx, [ebp + 8]
call fcn.1000c5b0
mov eax, esi
call fcn.10027185
ret
Function at 0x10014543
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xc4
mov eax, 0x1015f195
call fcn.100271ca
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc8], esi
mov edi, 0x10161558
lea ecx, [ebp - 0x28]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.1000ab70
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 1
call fcn.100215d3
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10014686
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push ebx
cmovae eax, dword [ebp + 0xc]
push 0x80
push 4
push ebx
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100145cd
push edi
mov ecx, esi
call fcn.1000ab70
jmp 0x100146a3
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xcc], eax
inc eax
push eax
mov dword [ebp - 0xc8], eax
call fcn.10026de4
mov edi, eax
pop ecx
test edi, edi
jne 0x100145f7
push 0x10161558
jmp 0x100145c1
push dword [ebp - 0xc8]
push 0
push edi
call fcn.10136bc0
add esp, 0xc
lea eax, [ebp - 0xd0]
push 0
push eax
push dword [ebp - 0xcc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xc4]
push edi
call fcn.10021f7a
push edi
call fcn.10026ded
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xc4]
call fcn.100217ce
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.100167a0
pop ecx
pop ecx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.1000ac20
cmp dword [ebp - 0x30], 0
jbe 0x1001467c
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10008800
lea ecx, [ebp - 0x40]
call fcn.1000c5b0
xor ebx, ebx
mov byte [ebp - 0xc8], bl
lea eax, [ebp - 0x28]
push dword [ebp - 0xc8]
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov dword [esi + 0x14], ebx
call fcn.1001471d
lea ecx, [ebp - 0x28]
call fcn.1000c5b0
lea ecx, [ebp + 0xc]
call fcn.1000c5b0
mov eax, esi
call fcn.10027185
ret

Function at 0x100146bb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push 0x80
push 2
push esi
inc edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100146ea
xor eax, eax
jmp 0x10014718
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10014714
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
je 0x10014716
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10016ee3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push str.337ff0efabed8556b9a9860eda2ec45a
mov dword [ebp - 4], esi
call fcn.10143360
mov edi, dword [ebp + 0xc]
mov edx, eax
mov ebx, dword [ebp + 8]
pop ecx
mov ecx, esi
test edi, edi
je 0x10016f1e
mov al, byte [esi + str.337ff0efabed8556b9a9860eda2ec45a]
xor byte [ecx + ebx], al
inc esi
xor eax, eax
cmp esi, edx
cmovge esi, eax
inc ecx
cmp ecx, edi
jb 0x10016f08
lea eax, [ebp - 4]
push eax
push edi
push ebx
call fcn.10001090
test eax, eax
je 0x10016f40
mov edx, dword [ebp - 4]
test edx, edx
je 0x10016f40
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x10016f4a
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100170af
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101c5068]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10136bc0
push 0x10162078
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.10012790
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.10026dd3
leave
ret
Function at 0x1001710d
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.10026e00
mov eax, dword [0x101c5068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x208
lea eax, [ebp - 0x61c]
push edi
xor esi, esi
push esi
push eax
call fcn.10136bc0
push str.C:log_
mov ebx, 0x104
lea eax, [ebp - 0x61c]
push ebx
push eax
call fcn.10144eb3
push 0x800
lea eax, [ebp - 0x1024]
push esi
push eax
call fcn.10136bc0
push 0x10162078
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.log
push eax
call fcn.1001391d
push edi
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.10136bc0
add esp, 0x40
lea eax, [ebp - 0x20c]
push edi
push esi
push eax
call fcn.10136bc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.10143239
pop ecx
test eax, eax
je 0x1001736c
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.10136dcd
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x414]
push eax
call ebx
test eax, eax
je 0x1001736c
lea eax, [ebp - 0x20c]
push eax
call fcn.10143239
lea ecx, [ebp - 0x20a]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0x824]
push 0x104
push eax
call fcn.10144eb3
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push str._s_s.txt
push eax
call fcn.1001391d
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1024]
push 0x3ff
push 0x400
push eax
call fcn.100091a0
push esi
call fcn.1013af6f
mov dword [ebp - 0x2034], eax
lea eax, [ebp - 0x2034]
push eax
mov dword [ebp - 0x2030], edx
call fcn.101451a1
add esp, 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test edi, edi
je 0x1001736c
lea ecx, [ebp - 0x1024]
push ecx
push eax
push dword [edi]
mov eax, dword [edi + 0x10]
push dword [edi + 4]
inc eax
push dword [edi + 8]
push dword [edi + 0xc]
push eax
mov eax, dword [edi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x2024]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.10016fcb
xor eax, eax
add esp, 0x28
mov word [ebp - 0x826], ax
lea eax, [ebp - 0x414]
push eax
call ebx
xor ebx, ebx
inc ebx
test eax, eax
lea eax, [ebp - 0x414]
push 0x10163880
push eax
cmovne esi, ebx
call fcn.10143939
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1001736c
test esi, esi
jne 0x10017312
push edi
push 2
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0xfeff
push ebx
push eax
call fcn.101445d3
add esp, 0x10
lea eax, [ebp - 0x2024]
push eax
call fcn.10143239
push edi
add eax, eax
push eax
lea eax, [ebp - 0x2024]
push ebx
push eax
call fcn.101445d3
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xd
push ebx
push eax
call fcn.101445d3
push edi
push 2
lea eax, [ebp - 0x2028]
mov dword [ebp - 0x2028], 0xa
push ebx
push eax
call fcn.101445d3
push edi
call fcn.10143a19
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026dd3
leave
ret
Function at 0x1001737b
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.10026e00
mov eax, dword [0x101c5068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
call fcn.1013af6f
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.101451a1
pop ecx
pop ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi + 0x10]
push edi
push eax
push dword [esi]
mov eax, dword [esi + 0x14]
inc ecx
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push ecx
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.10016fcb
add esp, 0x28
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
xor ecx, ecx
pop edi
inc ecx
test eax, eax
push 0x10163880
push ebx
cmovne edi, ecx
call fcn.10143939
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10017497
test edi, edi
jne 0x1001743a
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push 1
push eax
call fcn.101445d3
add esp, 0x10
lea eax, [ebp - 0x1004]
push eax
call fcn.10143239
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.101445d3
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.101445d3
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.101445d3
push esi
call fcn.10143a19
add esp, 0x38
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026dd3
leave
ret

Function at 0x10017821
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.10143239
mov dword [ebp - 4], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10026de4
push dword [ebp + 8]
mov esi, eax
push esi
call fcn.1014345c
mov eax, dword [ebp - 4]
xor edi, edi
add esp, 0x10
xor ebx, ebx
inc edi
test eax, eax
js 0x1001789b
push 0x5c
pop ecx
cmp word [esi + ebx*2], cx
jne 0x10017892
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10017888
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10017899
mov eax, dword [ebp - 4]
push 0x5c
pop ecx
mov word [esi + ebx*2], cx
inc ebx
cmp ebx, eax
jle 0x10017865
jmp 0x1001789b
xor edi, edi
push esi
call fcn.10026ded
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10017b7d
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor eax, eax
xor ecx, ecx
xor esi, esi
push edi
cmp dword [ebp + 0xc], eax
jle 0x10017c6f
mov edi, dword [ebp + 8]
mov dl, byte [esi + edi]
movzx ebx, dl
cmp dl, 0x3d
jne 0x10017baa
inc ecx
cmp ecx, 2
jg 0x10017c76
cmp dl, 0x7f
ja 0x10017c76
mov dl, byte [ebx + 0x10163a68]
cmp dl, 0x7f
je 0x10017c76
cmp dl, 0x40
jae 0x10017bcf
test ecx, ecx
jne 0x10017c76
inc eax
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x10017b95
test eax, eax
je 0x10017c6f
mov edi, dword [ebp + 0x14]
imul eax, eax, 6
add eax, 7
sar eax, 3
cmp dword [edi], eax
jge 0x10017bf7
mov dword [edi], eax
push 0xfffffffffffffff0
jmp 0x10017c78
mov edx, dword [ebp + 0x10]
xor eax, eax
xor ebx, ebx
mov dword [ebp + 0xc], eax
test esi, esi
jle 0x10017c6a
mov eax, dword [ebp + 8]
push 3
pop edi
movzx eax, byte [eax]
mov cl, byte [eax + 0x10163a68]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub edi, eax
movzx eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 0x3f
or ebx, eax
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 4
jne 0x10017c5b
xor eax, eax
mov dword [ebp + 0xc], eax
test edi, edi
jle 0x10017c46
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp edi, 1
jle 0x10017c53
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
cmp edi, 2
jle 0x10017c5b
mov byte [edx], bl
inc edx
mov eax, dword [ebp + 8]
dec esi
inc eax
mov dword [ebp + 8], eax
test esi, esi
jg 0x10017c0b
mov edi, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0xffffffffffffffee
pop eax
jmp 0x10017c71