joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100328c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.10064f50
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1058], 0x44
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1058]
push edi
mov edi, dword [ebp + 0xc]
push eax
movlpd qword [ebp - 0x1054], xmm0
movlpd qword [ebp - 0x104c], xmm0
movlpd qword [ebp - 0x1044], xmm0
movlpd qword [ebp - 0x103c], xmm0
movlpd qword [ebp - 0x1034], xmm0
movlpd qword [ebp - 0x102c], xmm0
movlpd qword [ebp - 0x1024], xmm0
movlpd qword [ebp - 0x101c], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x102c], 1
mov word [ebp - 0x1028], ax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1014], xmm0
test edi, edi
je 0x100329a5
push 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.10092e90
push edi
push esi
lea eax, [ebp - 0x1004]
push str.__s___s
push eax
call fcn.1000d670
add esp, 0x1c
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1004]
push eax
jmp 0x100329c0
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x100329e4
push dword [ebp - 0x1010]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1014]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10032a00
Capabilities:
Delete registry key
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 4
ja case.default.0x10032a0b
jmp dword [eax*4 + 0x10032acc]
call fcn.10032d10
test eax, eax
je 0x10032a31
mov dword [ebp + 8], 0x100d5654
pop ebp
jmp fcn.10032f50
call fcn.10032d10
test eax, eax
jne 0x10032a3e
mov dword [ebp + 8], str.RunTaskbarBeautify_TaskbarBeautifyExistReg_not_exist
pop ebp
jmp fcn.10015f50
push esi
push str.StartHookWindow
push str.WP_OpenShellMenu.CStartHookWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x10032a6f
mov eax, str.RunTaskbarBeautify_RT_FORCE_RUN_find
mov esi, str._reloadsettings
push eax
call fcn.10015f50
push esi
call fcn.10032f50
add esp, 8
pop esi
pop ebp
ret
mov eax, str.RunTaskbarBeautify_RT_FORCE_RUN_not_find
mov esi, 0x100d5654
push eax
call fcn.10015f50
push esi
call fcn.10032f50
add esp, 8
pop esi
pop ebp
ret
mov dword [ebp + 8], str._exit
pop ebp
jmp fcn.10032f50
push str.SOFTWARE360WallPaperOpenShell
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.StartHookWindow
push str.WP_OpenShellMenu.CStartHookWindow
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je case.default.0x10032a0b
mov dword [ebp + 8], str._reloadsettings
pop ebp
jmp fcn.10032f50
Function at 0x10032d10
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10092e90
add esp, 0xc
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
lea ecx, [ebp - 0x20d]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.StartButtonPath
call fcn.10031500
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10032df5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10032de2
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x20d]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x214], 4
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], 4
push eax
lea eax, [ebp - 0x214]
push eax
push str.TaskbarColor
call fcn.10031820
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10032df5
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x10032e10
Capabilities:
Check if file exists
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ce28b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], esi
call fcn.10092e90
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x1010875c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x240]
push str.taskbar
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10032ec6
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
call fcn.100093c0
mov ecx, eax
test ecx, ecx
je 0x10032f3a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.10019a90
test al, al
jne 0x10032f1e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10032f00
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000aeb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008920
int3
Function at 0x10032f50
Capabilities:
Create process on windows
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1260
call fcn.10064f50
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.10092e90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x1010875c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x1240]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x1240]
cmp ax, 6
je 0x10032fce
cmp ax, 9
je 0x10032fce
push str.ExplorerShell32.exe
jmp 0x10032fd3
push str.ExplorerShell64.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
xorps xmm0, xmm0
mov dword [ebp - 0x1260], 0x44
lea eax, [ebp - 0x1260]
movlpd qword [ebp - 0x125c], xmm0
push eax
movlpd qword [ebp - 0x1254], xmm0
movlpd qword [ebp - 0x124c], xmm0
movlpd qword [ebp - 0x1244], xmm0
movlpd qword [ebp - 0x123c], xmm0
movlpd qword [ebp - 0x1234], xmm0
movlpd qword [ebp - 0x122c], xmm0
movlpd qword [ebp - 0x1224], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor eax, eax
mov dword [ebp - 0x1234], 1
mov word [ebp - 0x1230], ax
xorps xmm0, xmm0
movups xmmword [ebp - 0x121c], xmm0
test esi, esi
je 0x1003309f
push 0x1000
push eax
lea eax, [ebp - 0x120c]
push eax
call fcn.10092e90
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x120c]
push str.__s___s
push eax
call fcn.1000d670
add esp, 0x1c
lea eax, [ebp - 0x121c]
push eax
lea eax, [ebp - 0x1260]
push eax
lea eax, [ebp - 0x120c]
jmp 0x100330b3
lea eax, [ebp - 0x121c]
push eax
lea eax, [ebp - 0x1260]
push eax
lea eax, [ebp - 0x20c]
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x100330e4
push dword [ebp - 0x1218]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x121c]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10064e61
mov esp, ebp
pop ebp
ret

Function at 0x100332b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x10102ddc
nop dword [eax]
nop dword [eax + eax]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10092e90
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [esi]
push edi
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
add esi, 8
cmp esi, 0x10102e1c
jl 0x100332e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10064e61
mov esp, ebp
pop ebp
ret 4
Function at 0x10033800
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100338cf
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10092e90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x1010875c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.cursors
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1003388c
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10033895
mov eax, dword [ebp + 0xc]
sub ecx, edx
sar ecx, 1
cmp eax, ecx
jbe 0x100338cf
lea ecx, [ebp - 0x20c]
push ecx
push eax
push esi
call fcn.100a5dc6
add esp, 0xc
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.10064e61
mov esp, ebp
pop ebp
ret 8
Function at 0x10037e50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
push 0x208
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x210], ebx
call fcn.10092e90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.UtilsWebView.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10037f2e
lea eax, [ebp - 0x20c]
push eax
call fcn.10058d60
add esp, 4
test eax, eax
je 0x10037f2e
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10037f2d
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetWebViewFactory
push edi
call ebx
test eax, eax
je 0x10037f0b
call eax
mov dword [esi + 0xa0], eax
push str.IWebViewToIWebViewEx
push edi
call ebx
push str.IsSupportedWebViewEngine
push edi
mov dword [esi + 0xa4], eax
call ebx
mov ebx, dword [ebp - 0x210]
mov dword [esi + 0xa8], eax
pop edi
cmp dword [esi + 0xa0], 0
jne 0x10037f5f
lea eax, [ebp - 0x20c]
push eax
push str.CWebWnd::Init_m_webViewHelper.InitDll_fail_dll_s
call fcn.10015f50
add esp, 8
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x10037fa1
push 0
push 2
call eax
test eax, eax
je 0x10037fa1
mov eax, dword [ebp + 8]
mov dword [esi + 0xac], eax
lea eax, [esi + 0xb0]
push ebx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10064e61
mov esp, ebp
pop ebp
ret 8
push str.CWebWnd::Init_IsSupportedWebViewEngine_false
call fcn.10015f50
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
call fcn.10064e61
mov esp, ebp
pop ebp
ret 8

Function at 0x10038980
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xa
push 0
push 0
push dword [ebp + 0xc]
push 0x100d61d4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 8
Function at 0x10038a80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
push eax
je 0x10038c2b
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
call ebx
test eax, eax
jne 0x10038b42
push dword [edi + 0xac]
call ebx
test eax, eax
je 0x10038b3b
push dword [edi + 4]
call ebx
test eax, eax
jne 0x10038b36
mov eax, dword [edi + 0xac]
lea esi, [edi + 0xb0]
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [edi + 0x20]
push eax
push 0x10102078
push 0x10102018
push 0x101091a0
call fcn.1000e6e0
movzx eax, ax
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x10038b95
call fcn.1003963b
mov dword [edi + 0x14], eax
test eax, eax
jne 0x10038b95
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
push 1
push 0
push str.cef_create
mov dword [edi + 0x68], 0
call fcn.1000fe30
mov ecx, eax
call fcn.10050810
push dword [edi + 4]
call ebx
mov ecx, edi
call fcn.10038480
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x9c]
test ecx, ecx
je 0x10038c40
lea edx, [ebp + 8]
mov dword [ebp + 8], 4
mov eax, dword [ecx]
push edx
lea edx, [ebp - 4]
push edx
push str.root_window
push ecx
call dword [eax + 0x2c]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10038c40
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push eax
call fcn.1003973d
cmp word [ebp + 8], 0
je 0x10038b16
lea eax, [edi + 8]
test eax, eax
je 0x10038c4e
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x1010201c
mov dword [edi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10102034]
lea ecx, [edi + 8]
mov dword [ecx + 8], eax
push 0x1010201c
mov dword [0x10102034], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push dword [0x101091a4]
test esi, esi
mov eax, section..data
push edi
push dword [ebp - 4]
cmovne eax, esi
mov edx, dword [eax + 4]
mov ecx, dword [eax + 0xc]
mov esi, dword [eax]
sub ecx, edx
mov eax, dword [eax + 8]
push ecx
sub eax, esi
push eax
mov eax, dword [ebp + 8]
push edx
push esi
push 0x56000000
push 0
movzx eax, ax
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
jmp 0x10038b16
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10038c40
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
push 0xc0000005
call fcn.1000eb10
int3
Function at 0x10042ab0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf210
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10102f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push dword [ebp + 8]
push 0x10000000
push eax
call fcn.100485d0
push dword [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.10058d60
add esp, 0x14
test eax, eax
je 0x10042bd1
mov esi, dword [ebp - 0x14]
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
call fcn.1003a002
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xd]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 0x10042020
push 0x1010973c
call fcn.1003a67b
add esp, 0x10
test eax, eax
je 0x10042c3d
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.1003a03c
mov edi, dword [0x10109738]
add esp, 4
mov byte [ebp - 4], bl
cmp dword [edi], ebx
jne 0x10042bba
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x10042c07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x10042bba
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x10042c07
cmp dword [edi + 4], 0
je 0x10042c07
cmp dword [edi + 0xc], 0
je 0x10042c07
mov ebx, 1
mov edx, dword [ebp - 0x14]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10042c29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x14]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10042c29
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 4
push eax
call fcn.1003a05d
add esp, 4
mov byte [ebp - 4], 2
test al, al
jne 0x10042c5a
call fcn.1003a693
sub esp, 8
lea eax, [ebp - 0x20]
mov ecx, esp
push eax
call fcn.100080b0
call fcn.1000c770
int3
Function at 0x100482e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10102f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x100484a8
test eax, eax
je 0x100484a8
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x100484a8
push ecx
push ebx
push eax
call fcn.10092e90
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x100484a8
cmp edi, 0xffffffff
je 0x100484a1
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1004ff20
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100484a1
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x10048437
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x100484a1
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x10048437
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x100483d0
cmp edi, esi
jae 0x10048437
nop
sub esi, edi
sbb ecx, eax
js 0x100483e5
jg 0x100483e0
cmp esi, 0x400000
jb 0x100483e5
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x10048437
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.1004ff70
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x1004842b
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x100483d0
jg 0x10048437
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x100483d0
lea eax, [ebp - 0x6c]
push eax
call fcn.1004fe10
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push 0x100dcd80
push 3
push edi
call fcn.1003efe6
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x10048450
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.100a8de4
add esp, 8
mov esi, 1
test ebx, ebx
je 0x1004848d
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x1004849b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10064e61
mov esp, ebp
pop ebp
ret
Function at 0x100485d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cfba0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10102f10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.100486b0
push 0
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.100487a0
add esp, 0x18
mov edx, dword [ebp - 0x14]
or esi, 0xffffffff
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004863e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 0x14], 0
je 0x1004866f
push 0
push dword [ebp - 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004866f
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x100d5654
call fcn.10007bd0
jmp 0x1004867d
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.1000c7c0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1004869c
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret