joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100392d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100a2fb9
call fcn.100023c8
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x420], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call fcn.100425a4
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x10039347
push 2
push esi
push ebx
call fcn.100425a4
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x10039347
call fcn.10010393
mov esi, eax
jmp 0x1003941a
push dword [ebp - 0x424]
push dword [ebp - 0x428]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1003936a
call fcn.10010393
jmp 0x1003940d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x10039360
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x428], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1003939a
mov esi, 0x8007000e
jmp 0x1003940f
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.1002c800
jmp 0x100393c0
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
je 0x10039393
push ebx
push dword [ebp - 0x420]
push ebx
push dword [ebp - 0x424]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10039360
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x420]
call fcn.10039199
mov esi, eax
test edi, edi
je 0x1003941a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x10039433
lea ecx, [ebp - 0x420]
call fcn.1003119c
lea ecx, [ebp - 0x430]
call fcn.1000f626
mov eax, esi
call fcn.100055af
ret 0x10
Function at 0x10039f53
Capabilities:
Terminate process

Disassembly:
push 0x24
mov eax, 0x100a306c
call fcn.100023c8
mov edi, dword [ebp + 8]
push 0
call fcn.1000240d
and dword [ebp - 4], 0
mov bl, byte [ebp + 0xc]
mov byte [ebp - 4], 1
test bl, bl
je 0x10039f93
test byte [0x10107fe8], 4
je 0x10039f93
push 0x666
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x10107fec]
test eax, eax
je 0x10039fb4
mov ecx, dword [eax + 0x24]
test ecx, ecx
sete al
test al, al
je 0x10039fae
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
test bl, bl
je 0x1003a002
test dword [edi], 0x80000000
je 0x1003a002
mov eax, dword [0x10107fe8]
test al, 1
jne 0x10039fdd
test al, 2
je 0x1003a002
mov esi, dword [0x10107fa4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, esi
jne 0x1003a002
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.1002fd81
lea ecx, [ebp - 0x28]
call fcn.1002b193
mov dword [ebp - 4], 4
call fcn.100068a7
call fcn.100055af
ret 8

Function at 0x1003b5ad
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x1003b5c0
push 0xd
pop eax
jmp 0x1003b604
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x1003b5d3
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x1003b5cb
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1003badc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x1003baee
push 0xd
pop eax
jmp 0x1003bb20
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003baf7
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x1003c084
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1003c1b4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x46c], 0xc
push 0x40
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x468], ebx
xorps xmm0, xmm0
mov dword [ebp - 0x464], ebx
push ebx
push eax
movups xmmword [ebp - 0x47c], xmm0
mov dword [ebp - 0x460], 0x44
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, 0x20a
mov edi, eax
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x41c]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.10031aa0
test eax, eax
je 0x1003c1b1
push ebx
xor eax, eax
mov dword [ebp - 0x468], ebx
inc eax
push ebx
push eax
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x46c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
je 0x1003c1b1
push esi
push edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.10029c5f
add esp, 0x10
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x460]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x41c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1003c1ae
push dword [ebp - 0x47c]
call edi
push dword [ebp - 0x478]
call edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret

Function at 0x1003c1c2
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x100a35f9
call fcn.10002f71
mov esi, ecx
or ebx, 0xffffffff
xor edi, edi
cmp dword [esi], ebx
je 0x1003c1fe
push 0x80004005
push 0x2e68367a
lea eax, [ebp - 0x20]
push eax
call fcn.10041233
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.1003caac
lea ecx, [ebp - 0x20]
call fcn.1002b193
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x10041738
push edi
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
cmove eax, ebx
mov dword [esi], eax
call fcn.10003491
ret 0xc
Function at 0x1003c235
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100a342b
call fcn.10001360
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x14
mov dword [ebp - 4], ebx
call fcn.10002483
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1003c274
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.1002a5e2
jmp 0x1003c276
mov eax, ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.1002b709
push esi
mov dword [ebp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x18]
cmp dword [esi + 0x18], 1
mov byte [ebp - 4], 2
jne 0x1003c2a3
cmp dword [esi + 0x1c], ebx
jne 0x1003c2a3
mov ecx, dword [esi + 0x24]
call fcn.1001b5a6
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0x1003be29
mov dword [ebp - 0x10], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1003c2d2
push 0x2e6b6832
call fcn.1003cf47
call fcn.100013a0
ret 0x10

Function at 0x1003c2da
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100a3460
call fcn.10001360
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
push 0x14
mov dword [ebp - 4], ebx
call fcn.10002483
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1003c31c
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.1002a940
jmp 0x1003c31e
mov eax, ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.1002b709
push esi
mov dword [ebp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esi + 0x18]
cmp dword [esi + 0x18], 1
mov byte [ebp - 4], 2
jne 0x1003c34b
cmp dword [esi + 0x1c], ebx
jne 0x1003c34b
mov ecx, dword [esi + 0x24]
call fcn.1001b5a6
push esi
mov byte [ebp - 4], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0x1003ca7c
mov dword [ebp - 0x10], ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthread]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x1003c37a
push 0x2e6b6831
call fcn.1003cf47
call fcn.100013a0
ret 0x14
Function at 0x1003d090
Capabilities:
Print debug messages

Disassembly:
push 0x81c
mov eax, 0x100a359c
call fcn.10002f71
mov esi, dword [ebp + 8]
push esi
call fcn.1000936b
mov edi, eax
mov ecx, 0x3e8
cmp edi, ecx
jle 0x1003d15f
lea eax, [edi - 0x3e9]
xor edx, edx
div ecx
inc eax
imul ecx, eax, 0xfffffc18
add edi, ecx
mov dword [ebp - 0x828], edi
mov edi, eax
and dword [ebp - 0x814], 0
lea eax, [ebp - 0x810]
mov dword [ebp - 0x820], eax
xor eax, eax
mov word [ebp - 0x810], ax
and dword [ebp - 0x810], eax
mov dword [ebp - 0x81c], 0x400
mov byte [ebp - 0x818], 0
mov word [ebp - 0x80c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x820]
push eax
push 0x3e8
push esi
call fcn.100275d3
lea ecx, [ebp - 0x820]
add esi, 0x7d0
call fcn.10009506
push dword [ebp - 0x820]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x820]
push eax
mov ecx, eax
call fcn.100073a8
sub edi, 1
jne 0x1003d0d2
mov edi, dword [ebp - 0x828]
test edi, edi
je 0x1003d16a
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.10003491
ret 4
Function at 0x1003fae5
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x20
mov eax, 0x100a3b3e
call fcn.10002f71
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
test edi, edi
je 0x1003fc20
test ebx, ebx
je 0x1003fc20
xor esi, esi
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], esi
push eax
push esi
push esi
push 0x8003
call fcn.100322de
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1003fc09
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003fb39
push esi
sub ecx, edx
push ecx
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1003fc09
push esi
xor edi, edi
inc edi
push edi
push 0x100c5478
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1003fc09
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003fb76
push esi
sub ecx, edx
push ecx
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1003fc09
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1003fc09
mov ebx, dword [ebp - 0x1c]
push esi
push 0x3c9
push ebx
push dword [ebp - 0x20]
call fcn.1000a297
movzx ecx, word [eax*2 + 0x100c2a10]
test cx, cx
je 0x1003fc09
mov edx, dword [ebp - 0x20]
movzx eax, cx
imul eax, eax, 0xc
cmp dword [eax + 0x100c31a8], edx
jne 0x1003fbe6
cmp dword [eax + 0x100c31ac], ebx
je 0x1003fbf4
movzx ecx, word [eax + 0x100c31b2]
test cx, cx
je 0x1003fc0d
jmp 0x1003fbd0
movzx eax, cx
mov ecx, dword [ebp - 0x2c]
imul eax, eax, 0xc
mov ax, word [eax + 0x100c31b0]
mov word [ecx], ax
jmp 0x1003fc0b
mov edi, esi
mov esi, edi
cmp dword [ebp - 0x24], 0
je 0x1003fc1c
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, esi
jmp 0x1003fc22
xor eax, eax
call fcn.10003491
ret 0xc
Function at 0x10048809
Capabilities:
Allocate thread local storage

Disassembly:
push 4
mov eax, 0x100a530c
call fcn.10001360
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [esi], 0x100b5e48
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
lea ecx, [esi + 0x14]
mov dword [ebp - 4], eax
call fcn.10046bde
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x101080b0], eax
mov eax, esi
call fcn.100013a0
ret

Function at 0x1004b486
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a56d4
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100b7bfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x80]
mov dword [ebp - 4], 2
call fcn.10026969
lea ecx, [esi + 0x68]
mov dword [ebp - 4], 5
call fcn.10026969
lea ecx, [esi + 0x58]
call fcn.10025721
lea ecx, [esi + 0x48]
call fcn.10025721
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 8
call fcn.10026969
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 0xb
call fcn.10026969
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0x10
call fcn.10026969
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004c4ad
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5d5e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100b7bfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0x50]
mov dword [ebp - 4], 1
call fcn.1006633e
lea ecx, [edi + 0x50]
call fcn.10009b3d
lea eax, [edi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x34]
mov dword [ebp - 4], 4
call fcn.10026969
lea ecx, [edi + 0x30]
mov dword [ebp - 4], 7
call fcn.10026969
lea ecx, [edi + 0x2c]
mov dword [ebp - 4], 0xa
call fcn.10026969
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0xd
call fcn.10026969
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0x13
call fcn.10026969
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004c59e
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5db5
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100b7bfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xc0]
call fcn.1002506a
lea ecx, [esi + 0x44]
call fcn.1002506a
and dword [ebp - 4], 0
lea ecx, [esi + 0x40]
call fcn.10006c2b
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 1
call fcn.10006c2b
lea ecx, [esi + 0x38]
mov dword [ebp - 4], 2
call fcn.10006c2b
lea ecx, [esi + 0x34]
call fcn.1002506a
lea ecx, [esi + 0x30]
call fcn.1002506a
lea ecx, [esi + 0x2c]
call fcn.1002506a
lea ecx, [esi + 0x28]
call fcn.1002506a
lea ecx, [esi + 0x24]
call fcn.1002506a
lea ecx, [esi + 0x20]
mov dword [ebp - 4], 3
call fcn.10006c2b
lea ecx, [esi + 0x1c]
mov dword [ebp - 4], 4
call fcn.10006c2b
lea ecx, [esi + 0x18]
call fcn.1002506a
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 9
call fcn.10026969
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004c66d
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5e06
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100b7bfc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 2
call fcn.10026969
lea ecx, [esi + 0x30]
call fcn.10026365
lea ecx, [esi + 0x1c]
call fcn.10026365
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 3
call fcn.10006c2b
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 8
call fcn.10026969
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1005810c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100a0e05
call fcn.10002f71
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x420]
push 0x200
call fcn.10001b31
xor eax, eax
mov word [ebp - 0x40c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.1002daaa
lea eax, [ebp - 0x420]
push eax
call fcn.10027c7b
mov edx, 0x104
cmp eax, edx
jbe 0x1005817e
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov byte [ebp - 0x418], 1
push edx
mov word [eax + 0x208], cx
lea ecx, [ebp - 0x420]
call fcn.1004161e
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x420]
setne bl
call fcn.100073a1
mov al, bl
call fcn.10003491
ret 4

Function at 0x10061301
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4

Function at 0x100646ac
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x18], 0x800000
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.10001550
mov esp, ebp
pop ebp
ret
Function at 0x1006e338
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor eax, eax
or ebx, 0xffffffff
push edi
mov edi, ecx
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea esi, [edi + 0x1c]
mov dword [ebp - 8], eax
push esi
mov byte [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
cmp dword [edi + 0x58], eax
je 0x1006e386
lea ecx, [edi + 0x6c]
cmp byte [ecx], al
je 0x1006e386
lea eax, [ebp - 0xc]
push eax
call fcn.1002b821
xor ebx, ebx
mov byte [ebp - 1], 1
test eax, eax
cmovg ebx, eax
xor eax, eax
cmp dword [ebp + 8], 0xffffffff
je 0x1006e39c
cmp ebx, 0xffffffff
je 0x1006e396
cmp dword [ebp + 8], ebx
jge 0x1006e39c
mov ebx, dword [ebp + 8]
mov byte [ebp - 1], al
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
jne 0x1006e3b7
mov ecx, dword [edi + 0x94]
call fcn.1001be38
mov bl, 1
jmp 0x1006e3e4
cmp byte [ebp - 1], 0
je 0x1006e3cc
test ebx, ebx
jne 0x1006e3cc
cmp byte [edi + 0x35], bl
je 0x1006e3cc
xor ecx, ecx
mov bl, cl
jmp 0x1006e3e4
mov ecx, dword [edi + 0x94]
lea eax, [ebp + 0xa]
push ebx
push eax
call fcn.1001be5a
xor ecx, ecx
cmp word [eax], cx
setne bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
lea eax, [ebp - 0xc]
mov byte [ebp - 0x14], 1
push eax
call fcn.1002b821
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
test bl, bl
je 0x1006e41c
push dword [ebp + 0x14]
mov ecx, edi
mov byte [edi + 0x35], 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1004efbd
jmp 0x1006e434
xor eax, eax
mov byte [edi + 0x35], al
cmp byte [ebp - 1], al
jne 0x1006e42a
xor al, al
jmp 0x1006e434
push dword [ebp + 0x10]
mov ecx, edi
call fcn.1004f101
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1007162e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push eax
push ebx
mov edi, ecx
call fcn.1007172d
mov esi, eax
test esi, esi
jne 0x1007171a
cmp dword [edi + 0x7c], eax
je 0x10071708
cmp dword [ebp + 0x14], 0xffffffff
je 0x1007167d
push dword [ebp + 0x14]
mov ecx, edi
call fcn.100718cb
jmp 0x10071702
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x100716fa
lea eax, [ebp - 0x254]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
or dword [ebp - 0x258], 0xffffffff
lea ecx, [ebp - 0x258]
push 0
push 0
push eax
call fcn.1002d274
cmp dword [ebp - 0x258], 0xffffffff
je 0x100716e0
cmp dword [ebp - 0x238], 0
ja 0x100716dc
cmp dword [ebp - 0x234], 0x7fffffff
ja 0x100716dc
push dword [ebp - 0x234]
mov ecx, edi
call fcn.100718cb
mov esi, eax
jmp 0x100716e3
push 8
jmp 0x100716e2
push 0x10
pop esi
cmp dword [ebp - 0x258], 0xffffffff
je 0x10071704
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x10071704
push ebx
mov ecx, edi
call fcn.1004ecaf
mov esi, eax
test esi, esi
jne 0x10071718
cmp byte [ebp + 0xc], 0
je 0x10071718
push ebx
mov ecx, edi
call fcn.100759b3
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001550
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1007172d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x220
mov eax, 0x100abaff
call fcn.10002f71
mov dword [ebp - 0x220], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
cmp byte [ebp + 0x10], bl
je 0x100717a2
push ebx
push ebx
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x218]
push eax
push 3
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
xor eax, eax
add esp, 0x24
cmp ax, word [ebp - 0x18]
jne 0x10071780
cmp ax, word [ebp - 0x218]
je 0x100717a2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100717a2
test al, 0x10
je 0x100717a2
mov ecx, dword [ebp - 0x220]
push edi
push esi
call fcn.1004eb13
jmp 0x100718c3
mov dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x228]
mov dword [ebp - 4], ebx
push eax
push 0x5c
push esi
call fcn.100274e0
test al, al
jne 0x100717e5
lea eax, [ebp - 0x228]
push eax
push 0x2f
push esi
call fcn.100274e0
test al, al
jne 0x100717e5
push esi
lea ecx, [ebp - 0x21c]
call fcn.10006bb7
mov esi, dword [ebp - 0x21c]
jmp 0x10071814
push esi
call fcn.1000936b
or ecx, 0xffffffff
sub ecx, dword [ebp - 0x228]
add eax, ecx
push eax
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.10027bc9
lea ecx, [ebp - 0x21c]
mov esi, dword [eax]
call fcn.10006c2b
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.10035d45
test al, al
jne 0x1007182c
push 0x40
jmp 0x100718ae
test edi, edi
je 0x100718af
mov ecx, edi
call fcn.1001b584
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.10019b63
cmp word [eax], bx
je 0x100718af
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x22c]
mov ecx, edi
push eax
call fcn.1001a5c9
mov eax, dword [eax]
mov dword [ebp - 0x220], eax
push dword [ebp - 0x21c]
mov ecx, esi
mov byte [ebp - 4], 2
push eax
call fcn.100636c3
test al, al
jne 0x1007189d
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 5
call fcn.10006c2b
lea eax, [ebp - 0x14]
mov byte [ebp - 4], bl
push eax
mov ecx, edi
call fcn.10019b63
cmp word [eax], bx
je 0x100718af
jmp 0x1007184d
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.10006c2b
push 4
pop ebx
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 6
call fcn.10006c2b
mov eax, ebx
call fcn.10003491
ret 0xc