joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push 0x104
lea eax, [ebp - 0x118]
mov dword [ebp - 0x134], 0
push 0
push eax
call fcn.1004cee0
add esp, 0xc
lea eax, [ebp - 0x118]
push 1
push esi
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
js 0x1000a78c
cmp byte [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
jne 0x1000a723
xor ecx, ecx
jmp 0x1000a739
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a730
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.100027a0
push 1
push 0x1007ab08
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0
call fcn.10001990
lea eax, [ebp - 0x130]
mov ecx, edi
push eax
call fcn.10002310
cmp dword [ebp - 0x11c], 0x10
jb 0x1000a7ab
push dword [ebp - 0x130]
call fcn.100498af
add esp, 4
jmp 0x1000a7ab
push 0
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], 0
push 0x1007aace
mov byte [edi], 0
call fcn.100027a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100498b4
mov esp, ebp
pop ebp
ret

Function at 0x1000a860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x104
lea eax, [ebp - 0x118]
mov dword [ebp - 0x134], 0
push 0
push eax
call fcn.1004cee0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1000a95c
cmp byte [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
jne 0x1000a8f0
xor ecx, ecx
jmp 0x1000a909
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a900
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.100027a0
push 1
push 0x1007ab08
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], 0
call fcn.10001990
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.10002310
cmp dword [ebp - 0x11c], 0x10
jb 0x1000a97b
push dword [ebp - 0x130]
call fcn.100498af
add esp, 4
jmp 0x1000a97b
push 0
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push 0x1007aace
mov byte [esi], 0
call fcn.100027a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100498b4
mov esp, ebp
pop ebp
ret
Function at 0x1000bd30
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1000bd6b
xor eax, eax
jmp 0x1000bef1
cmp eax, 1
jle 0x1000bd64
call fcn.1000bae0
test eax, eax
je 0x1000bd83
mov eax, 1
jmp 0x1000bef1
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10002420
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x36]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
add eax, ecx
mov byte [ebp - 0x36], 0x5c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x35]
mov byte [ebp - 0x35], 0x2f
call fcn.1000d340
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
movq qword [ebp - 0x34], xmm0
add esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push 0x1007ab08
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.100028a0
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x28]
call fcn.1000dc70
add esp, 4
mov byte [ebp - 4], 1
cmp dword [ebp - 0x3c], 0x10
jb 0x1000be3c
push dword [ebp - 0x50]
call fcn.100498af
add esp, 4
mov edi, dword [ebp - 0x34]
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x1000be52
push 0xffffffffffffffff
push 0
push edi
mov ecx, eax
call fcn.10002420
mov ebx, dword [ebp - 0x30]
lea esi, [edi + 0x18]
cmp esi, ebx
je 0x1000bec2
lea esp, [esp]
push 1
push 0x1007ab08
lea ecx, [ebp - 0x28]
call fcn.10001990
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.100018d0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
jne 0x1000beae
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x80
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x1000bebb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000bf0d
add esi, 0x18
cmp esi, ebx
jne 0x1000be60
mov esi, 1
test edi, edi
je 0x1000bede
push ebx
push edi
lea ecx, [ebp - 0x34]
call fcn.10003680
push edi
call fcn.100498af
add esp, 4
cmp dword [ebp - 0x14], 0x10
jb 0x1000beef
push dword [ebp - 0x28]
call fcn.100498af
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100498b4
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x1000bec7
Function at 0x1000bf20
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069010
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
push 0
push 0x1007aace
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100027a0
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.1000c090
test eax, eax
mov dword [ebp - 4], 0xffffffff
sete bl
cmp dword [ebp - 0x14], 0x10
jb 0x1000bf9f
push dword [ebp - 0x28]
call fcn.100498af
add esp, 4
test bl, bl
je 0x1000bfaa
xor eax, eax
jmp 0x1000c067
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push ecx
mov edx, esi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000c190
mov edi, dword [ebp - 0x18]
add esp, 4
mov ebx, dword [ebp - 0x1c]
test eax, eax
je 0x1000c022
mov esi, ebx
cmp ebx, edi
je 0x1000c005
mov ecx, esi
call fcn.1000bf20
test eax, eax
je 0x1000c022
add esi, 0x18
cmp esi, edi
jne 0x1000bff3
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x14], 0x10
jb 0x1000c010
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x2c], 1
test eax, eax
jne 0x1000c029
mov dword [ebp - 0x2c], 0
test ebx, ebx
je 0x1000c064
mov esi, ebx
cmp ebx, edi
je 0x1000c05b
cmp dword [esi + 0x14], 0x10
jb 0x1000c043
push dword [esi]
call fcn.100498af
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
add esi, 0x18
cmp esi, edi
jne 0x1000c033
push ebx
call fcn.100498af
add esp, 4
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100498b4
mov esp, ebp
pop ebp
ret
Function at 0x1000c090
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069048
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push ecx
push edx
mov edx, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.1000c5a0
mov edi, dword [ebp - 0x18]
add esp, 8
mov ebx, dword [ebp - 0x1c]
test eax, eax
je 0x1000c12a
mov esi, ebx
cmp ebx, edi
je 0x1000c123
cmp dword [esi + 0x14], 0x10
jb 0x1000c10f
mov eax, dword [esi]
jmp 0x1000c111
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x1000c12a
add esi, 0x18
cmp esi, edi
jne 0x1000c105
mov eax, 1
jmp 0x1000c12c
xor eax, eax
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x1000c174
mov esi, ebx
cmp ebx, edi
je 0x1000c168
lea esp, [esp]
cmp dword [esi + 0x14], 0x10
jb 0x1000c150
push dword [esi]
call fcn.100498af
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
add esi, 0x18
cmp esi, edi
jne 0x1000c140
push ebx
call fcn.100498af
mov eax, dword [ebp - 0x20]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100498b4
mov esp, ebp
pop ebp
ret
Function at 0x1000e190
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100693aa
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.100492ce
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x1000e236
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x1007d89c
push eax
lea ecx, [ebp - 0x24]
call fcn.10049fa0
push 0x100879fc
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.1004c432
push edi
push esi
call fcn.100490ac
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100498b4
mov esp, ebp
pop ebp
ret 4

Function at 0x1000e7d0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10069438
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x10089430]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.10002420
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.1000e700
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x1000e841
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.10049fa0
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x1000e86a
push dword [esp + 0xc]
call fcn.100498af
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000f1a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100694a0
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x10089430]
xor eax, esp
mov dword [esp + 0xd4], eax
mov eax, dword [0x10089430]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
dec dword [ebp + 0xc]
mov dword [esp + 8], 0
jne 0x1000f3b6
push 0xb0
lea eax, [esp + 0x28]
push 0
push eax
call fcn.1004cee0
add esp, 0xc
mov dword [esp + 0x24], 0x1007d9b0
mov dword [esp + 0x34], 0x1007d9b8
mov dword [esp + 0x8c], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push 0
lea eax, [esp + 0x40]
mov dword [esp + 0xec], 0
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], 1
call fcn.100106d0
mov dword [esp + 0xe8], 1
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x24], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x20], eax
lea ecx, [esp + 0x3c]
call fcn.10011360
mov dword [esp + 0x3c], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
push str.Set_Instatnce
push ecx
push 0x1007d960
push ecx
mov dword [esp + 0xf8], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ecx
push 0x1007d964
push ecx
push 0x11
push ecx
push 0x1007d94c
push ecx
push str.dllmain.cpp
push ecx
push str._Kw_
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ecx
lea eax, [esp + 0x7c]
push 0x1007d97c
push eax
call fcn.10012230
add esp, 0xc
mov ecx, eax
call fcn.1000f920
add esp, 4
push eax
call fcn.10012230
add esp, 0xc
push eax
call fcn.10012230
add esp, 0xc
push eax
call fcn.10012230
add esp, 0xc
mov ecx, eax
call fcn.1000f780
add esp, 4
push eax
call fcn.10012230
add esp, 0xc
mov ecx, eax
call fcn.1000f920
add esp, 4
push eax
call fcn.10012230
add esp, 0xc
push eax
call fcn.10012230
push eax
call fcn.100124f0
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
call fcn.100101a0
cmp dword [eax + 0x14], 0x10
jb 0x1000f34d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esp + 0x20], 0x10
jb 0x1000f367
push dword [esp + 0xc]
call fcn.100498af
add esp, 4
lea ecx, [esp + 0x8c]
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov dword [esp + 0xe8], 0xffffffff
call fcn.10010120
lea eax, [esp + 0x8c]
mov dword [esp + 0x8c], vtable.std::ios_base.0
push eax
call fcn.10049221
mov eax, dword [ebp + 8]
add esp, 4
mov dword [0x1008d938], eax
mov eax, 1
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0xd4]
xor ecx, esp
call fcn.100498b4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100147d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069c56
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x103
lea eax, [ebp - 0x21f]
mov byte [ebp - 0x220], 0
push 0
push eax
call fcn.1004cee0
add esp, 0xc
lea eax, [ebp - 0x220]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x103
lea eax, [ebp - 0x117]
mov byte [ebp - 0x118], 0
push 0
push eax
call fcn.1004cee0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x220]
push eax
push str._sKwTest_access__d
lea eax, [ebp - 0x118]
push 0x103
push eax
call fcn.10014ea0
add esp, 0x14
mov dword [ebp - 0x23c], 0xf
cmp byte [ebp - 0x118], 0
mov dword [ebp - 0x240], 0
mov byte [ebp - 0x250], 0
jne 0x10014898
xor ecx, ecx
jmp 0x100148aa
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100148a1
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x250]
call fcn.100027a0
lea ecx, [ebp - 0x250]
mov dword [ebp - 4], 0
call fcn.1000bd30
test eax, eax
mov dword [ebp - 4], 0xffffffff
sete bl
cmp dword [ebp - 0x23c], 0x10
jb 0x100148f2
push dword [ebp - 0x250]
call fcn.100498af
add esp, 4
test bl, bl
je 0x100148fa
xor al, al
jmp 0x10014977
cmp byte [ebp - 0x118], 0
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x238], 0
jne 0x10014922
xor ecx, ecx
jmp 0x10014939
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
jmp 0x10014930
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10014930
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x238]
call fcn.100027a0
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 1
call fcn.1000bf20
cmp dword [ebp - 0x224], 0x10
jb 0x10014975
push dword [ebp - 0x238]
call fcn.100498af
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100498b4
mov esp, ebp
pop ebp
ret

Function at 0x10014f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10014f45
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10014f84
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10014f80
lea ebx, [ebx]
cmp esi, edx
jae 0x10014f84
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10014f70
cmp esi, edx
jb 0x10014f89
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x100153b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ecx + 4]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x134], eax
cmp dword [ebx - 0xc], 0
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x13c], 0
jne 0x10015404
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
jmp 0x1001545f
push 0x12b
lea eax, [ebp - 0x12f]
mov byte [ebp - 0x130], 0
push 0
push eax
call fcn.1004cee0
add esp, 0xc
lea eax, [ebp - 0x130]
push ebx
push 0x12c
push eax
push edi
push dword [ebp - 0x138]
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, esi
test eax, eax
jne 0x10015453
test edi, edi
mov eax, 0x1007aace
cmovne eax, edi
jmp 0x10015459
lea eax, [ebp - 0x130]
push eax
call fcn.100028a0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100498b4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001a030
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x10089430]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov byte [ebp - 0x108], 0
push edi
push 0x103
mov dword [ebp - 0x314], eax
mov esi, edx
mov edi, dword [eax + 0x28]
lea eax, [ebp - 0x107]
push 0
push eax
call fcn.1004cee0
push esi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1004a4e7
push 0x1007ab08
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1004a6bb
push edi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.1004a6bb
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x310], ax
lea eax, [ebp - 0x30e]
push eax
call fcn.1004cee0
add esp, 0x3c
lea eax, [ebp - 0x310]
push 0x104
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x310]
push eax
xor esi, esi
call ebx
test eax, eax
je 0x1001a150
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebp + esi*2 - 0x310]
cmp eax, 0x5c
je 0x1001a115
cmp eax, 0x2f
jne 0x1001a142
cmp esi, 0x104
jae 0x1001a1dd
xor eax, eax
push eax
mov word [ebp + esi*2 - 0x310], ax
lea eax, [ebp - 0x310]
push eax
call edi
mov eax, 0x5c
mov word [ebp + esi*2 - 0x310], ax
lea eax, [ebp - 0x310]
inc esi
push eax
call ebx
cmp esi, eax
jne 0x1001a103
mov ecx, dword [ebp - 0x314]
lea eax, [ebp - 0x314]
push eax
mov esi, 0x23
mov dword [ebp - 0x314], 0
mov ebx, dword [ecx + 0x38]
call fcn.1001c250
test eax, eax
jne 0x1001a1ca
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001a1ca
push 0
lea eax, [ebp - 0x318]
mov dword [ebp - 0x318], 0
push eax
push ebx
push dword [ebp - 0x314]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
test eax, eax
push edi
cmovne esi, ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100498b4
mov esp, ebp
pop ebp
ret
call fcn.1004a250
int3

Function at 0x1001aac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.1004bc91
xor edx, edx
add esp, 0x10
cmp dword [ebp + 0xc], eax
mov ecx, str._read_write_error
cmove ecx, edx
mov eax, ecx
pop ebp
ret 8
Function at 0x1001d310
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1008a71c], 0
je 0x1001d4e5
push ebx
push esi
push edi
xor esi, esi
mov dword [0x1008a71c], 0
xor edi, edi
mov edi, edi
movzx eax, byte [edi + 0x1007cc95]
mov ecx, 0x1f
sub ecx, eax
mov edx, 1
movzx eax, byte [edi + 0x1007cc94]
add edi, 2
shl edx, cl
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or edx, eax
or esi, edx
cmp edi, 0xe
jb 0x1001d330
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x1001d373
xor eax, esi
test al, 1
je 0x1001d37d
shr eax, 1
xor eax, esi
jmp 0x1001d37f
shr eax, 1
test al, 1
je 0x1001d389
shr eax, 1
xor eax, esi
jmp 0x1001d38b
shr eax, 1
test al, 1
je 0x1001d395
shr eax, 1
xor eax, esi
jmp 0x1001d397
shr eax, 1
test al, 1
je 0x1001d3a1
shr eax, 1
xor eax, esi
jmp 0x1001d3a3
shr eax, 1
test al, 1
je 0x1001d3ad
shr eax, 1
xor eax, esi
jmp 0x1001d3af
shr eax, 1
test al, 1
je 0x1001d3b9
shr eax, 1
xor eax, esi
jmp 0x1001d3bb
shr eax, 1
test al, 1
je 0x1001d3c5
shr eax, 1
xor eax, esi
jmp 0x1001d3c7
shr eax, 1
mov dword [ecx*4 + 0x1008d980], eax
inc ecx
cmp ecx, 0x100
jl 0x1001d368
mov edi, 0x1008ed80
lea esp, [esp]
mov edx, dword [edi - 0x1400]
mov ecx, edx
and ecx, 0xff00
mov eax, edx
shl eax, 0x10
mov esi, edx
add ecx, eax
shr esi, 8
shl ecx, 8
mov eax, esi
and eax, 0xff00
add ecx, eax
mov eax, edx
shr eax, 0x18
add ecx, eax
movzx eax, dl
mov dword [edi - 0x400], ecx
mov ebx, dword [eax*4 + 0x1008d980]
xor ebx, esi
mov ecx, ebx
mov dword [edi - 0x1000], ebx
and ecx, 0xff00
mov eax, ebx
shl eax, 0x10
mov edx, ebx
add ecx, eax
shr edx, 8
shl ecx, 8
mov eax, edx
and eax, 0xff00
add ecx, eax
mov eax, ebx
shr eax, 0x18
add ecx, eax
movzx eax, bl
mov dword [edi], ecx
mov ebx, dword [eax*4 + 0x1008d980]
xor ebx, edx
mov ecx, ebx
mov dword [edi - 0xc00], ebx
and ecx, 0xff00
mov eax, ebx
shl eax, 0x10
mov esi, ebx
add ecx, eax
shr esi, 8
shl ecx, 8
mov eax, esi
and eax, 0xff00
add ecx, eax
mov eax, ebx
shr eax, 0x18
add ecx, eax
movzx eax, bl
mov dword [edi + 0x400], ecx
mov edx, dword [eax*4 + 0x1008d980]
xor edx, esi
mov ecx, edx
mov dword [edi - 0x800], edx
and ecx, 0xff00
mov eax, edx
shl eax, 0x10
add ecx, eax
mov eax, edx
shr eax, 8
shl ecx, 8
and eax, 0xff00
add ecx, eax
shr edx, 0x18
add ecx, edx
mov dword [edi + 0x800], ecx
add edi, 4
cmp edi, 0x1008f180
jl 0x1001d3e0
pop edi
pop esi
mov dword [0x1008a720], 0
pop ebx
ret
cmp dword [0x1008a720], 0
jne 0x1001d4e5
ret