joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001360
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x20210128
je 0x10001370
xor eax, eax
pop ebp
ret
push esi
push 0x4a0
call fcn.101427a2
push 0x4a0
mov esi, eax
push 0
push esi
call fcn.10143f10
add esp, 0x10
mov ecx, esi
pop esi
pop ebp
jmp fcn.10009380

Function at 0x10001ba0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001c30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x10001bd0
cmp eax, 2
jne 0x10001c2e
sub esp, 0xc
mov dword [esp + 0x20], 0
mov ecx, esp
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
push edi
mov dword [ecx], 0x101d1eb4
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.100100c0
lea ecx, [esp + 0x18]
call fcn.1000e3f0
mov edi, dword [esp + 0x18]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
test edi, edi
je 0x10001c30
cmp edi, 0x101d1eb4
je 0x10001c30
push edi
call fcn.10146720
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.10142783
add esp, 0x14
ret
Function at 0x10002620
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x44], eax
lea eax, [esp]
mov dword [esp], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
cmp edx, dword [esp + 0x2c]
ja 0x1000265d
mov eax, dword [esp + 8]
jb 0x10002663
cmp eax, ecx
jb 0x10002663
mov edx, dword [esp + 0x2c]
mov eax, ecx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.10142783
mov esp, ebp
pop ebp
ret
Function at 0x10003f20
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015eb28
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x101ed004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x10003f61
mov eax, 0xff
jmp 0x10004134
push 0x50
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.10143f10
add esp, 8
lea eax, [ebx + 0x68]
lea ecx, [ebp - 0x6c]
push eax
call fcn.100123b0
push 0x104
lea eax, [ebp - 0x27c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.10143f10
add esp, 0xc
lea eax, [ebp - 0x278]
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x27c], eax
push dword [ebx + 0x44]
push esi
call fcn.100088c0
mov byte [ebp - 4], 1
push 0x2e
push dword [ebp - 0x27c]
call fcn.1014406a
add esp, 8
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x60], 0xffffffff
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x280], eax
je 0x10003fe7
mov edx, dword [ebp - 0x6c]
lea ecx, [ebp - 0x6c]
call dword [edx + 0x2c]
push 0
push 0x8000000
push 3
push 0
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x60], eax
cmp eax, 0xffffffff
jne 0x10004033
push 0
push 0x8000000
push 3
push 0
push 0
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x60], eax
cmp eax, 0xffffffff
jne 0x10004033
mov esi, 0xff
jmp 0x100040f3
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 0x14]
xor ecx, ecx
add ecx, eax
lea eax, [ebp - 0x174]
push 0x100
adc edx, 0
mov dword [ebp - 0x3c], ecx
push 0
push eax
mov dword [ebp - 0x38], edx
call fcn.10143f10
add esp, 0xc
lea eax, [ebp - 0x174]
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x178], eax
push dword [ebp - 0x280]
push esi
call fcn.100088c0
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x178]
test eax, eax
je 0x10004098
push eax
call fcn.10146720
add esp, 4
push esi
call fcn.10147912
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x174]
mov eax, dword [ebp - 0x178]
add esp, 4
cmp eax, ecx
je 0x100040bd
push eax
call fcn.10146720
add esp, 4
push 0x100000
lea eax, [ebp - 0x74]
mov dword [ebp - 0x1c], 0
push eax
push dword [ebp - 0x284]
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.10014b00
lea ecx, [ebp - 0x6c]
mov esi, eax
call fcn.10012cc0
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
cmp eax, ecx
je 0x1000410c
push eax
call fcn.10146720
add esp, 4
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x6c], vtable.CArkWinIn.1.0
mov dword [ebp - 0x68], vtable.CArkWinIn.0
call fcn.10012cc0
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x10004132
push ecx
call fcn.10146720
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10142783
mov esp, ebp
pop ebp
ret 8
Function at 0x10008690
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x44], eax
lea eax, [esp]
mov dword [esp], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
cmp edx, dword [esp + 0x2c]
ja 0x100086cd
mov eax, dword [esp + 8]
jb 0x100086d3
cmp eax, ecx
jb 0x100086d3
mov edx, dword [esp + 0x2c]
mov eax, ecx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.10142783
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bf00
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
mov dword [esp + 0x14], esi
push edi
test eax, eax
je 0x1000bf1b
mov dword [eax], ebp
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
cmp dword [eax + 0xa4], 0
je 0x1000c005
cmp dword [esi + 0x54], 4
jne 0x1000bf5e
lea edi, [esi + 0x214]
mov edx, ebp
push edi
mov ecx, ebx
call fcn.10090910
lea eax, [edi + 0x114]
mov edx, ebp
push eax
mov ecx, ebx
call fcn.100dbb10
add esp, 8
jmp 0x1000c005
mov eax, dword [esi + 0x20c]
mov edi, dword [esi + 0x208]
mov dword [esp + 0x10], ebx
mov ebx, dword [esi + 0x200]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x204]
mov dword [esp + 0x20], ebp
test ebp, ebp
je 0x1000bfef
mov esi, dword [esp + 0x10]
mov ebp, eax
nop dword [eax]
mov dl, byte [esi]
lea esi, [esi + 1]
mov eax, edi
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
movzx eax, dl
xor eax, ebx
shr ebx, 8
movzx eax, al
shr ecx, 8
xor cl, dl
mov byte [esi - 1], cl
mov ecx, dword [esp + 0x14]
xor ebx, dword [ecx + eax*4]
movzx eax, bl
add eax, ebp
imul ebp, eax, 0x8088405
inc ebp
mov eax, ebp
shr eax, 0x18
xor eax, edi
shr edi, 8
movzx eax, al
xor edi, dword [ecx + eax*4]
sub dword [esp + 0x20], 1
jne 0x1000bf90
mov esi, dword [esp + 0x18]
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x200], ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 0x204], eax
mov dword [esi + 0x208], edi
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
push ebp
push ebx
call fcn.1000c020
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
Function at 0x1000f170
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x18
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp], eax
push ebx
push ebp
mov ebp, edx
push esi
push edi
test ecx, ecx
je 0x1000f2bf
test ebp, ebp
je 0x1000f2bf
test eax, eax
je 0x1000f2bf
push 0
push 0
mov edi, 0x101d1eb4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test ebx, ebx
jg 0x1000f1c2
mov cl, 1
mov esi, edi
jmp 0x1000f1ee
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0
call fcn.1014d427
add esp, 8
test eax, eax
jne 0x1000f1e8
xor cl, cl
jmp 0x1000f1ec
mov edi, eax
mov cl, 1
mov esi, edi
xor eax, eax
test cl, cl
cmovne eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1000f208
xor ebx, ebx
jmp 0x1000f295
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, ebp
call fcn.1000f0e0
push 0
push dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov ebx, eax
test ebx, ebx
jne 0x1000f28e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1000f28e
sub esp, 0xc
mov dword [esp + 0x2c], ebx
mov ecx, esp
xorps xmm0, xmm0
movq qword [esp + 0x24], xmm0
push ebp
mov dword [ecx], 0x101d1eb4
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.100100c0
lea ecx, [esp + 0x24]
call fcn.1000e3f0
mov ebp, dword [esp + 0x24]
add esp, 0xc
push ebx
push dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov ebx, eax
test ebp, ebp
je 0x1000f28e
cmp ebp, 0x101d1eb4
je 0x1000f28e
push ebp
call fcn.10146720
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test esi, esi
je 0x1000f2aa
cmp esi, 0x101d1eb4
je 0x1000f2aa
push edi
call fcn.10146720
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10142783
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10142783
add esp, 0x18
ret
Function at 0x10010e20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10010f1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 3
je 0x10010e66
cmp esi, 2
je 0x10010e66
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jl 0x10010f10
sub esp, 0xc
mov dword [esp + 0x20], 0
mov ecx, esp
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
push edi
mov dword [ecx], 0x101d1eb4
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.100100c0
lea ecx, [esp + 0x18]
call fcn.10010a90
mov edi, dword [esp + 0x18]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
je 0x10010ef1
test al, 0x10
jne 0x10010ef1
test edi, edi
je 0x10010edb
cmp edi, 0x101d1eb4
je 0x10010edb
push edi
call fcn.10146720
add esp, 4
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10142783
add esp, 0x14
ret
test edi, edi
je 0x10010f06
cmp edi, 0x101d1eb4
je 0x10010f06
push edi
call fcn.10146720
add esp, 4
cmp esi, 2
je 0x10010f20
cmp esi, 3
je 0x10010f20
cmp esi, 0x7b
je 0x10010f20
cmp esi, 0x35
je 0x10010f20
jmp 0x10010edb
test al, 0x10
je 0x10010edb
mov ecx, dword [esp + 0x18]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10142783
add esp, 0x14
ret
Function at 0x10011230
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, ecx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov eax, dword [ebx]
push edi
test eax, eax
je 0x1001125d
push eax
call fcn.10146720
add esp, 4
mov dword [ebx], 0
push esi
lea ecx, [esp + 0x14]
mov dword [ebx + 4], 0
mov dword [esp + 0x14], 0x101d1eb4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.100100c0
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
lea eax, [ebp + 0x11]
cmp eax, dword [esp + 0x18]
jle 0x100112c3
xor ecx, ecx
mov esi, edi
cmp edi, 0x101d1eb4
mov edx, 2
cmove esi, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push esi
call fcn.1014d427
add esp, 8
test eax, eax
je 0x100112e1
mov edi, eax
movups xmm0, xmmword [str.:Zone.Identifier]
xor eax, eax
movups xmmword [edi + ebp*2], xmm0
movups xmm0, xmmword [0x101d213c]
movups xmmword [edi + ebp*2 + 0x10], xmm0
mov word [edi + ebp*2 + 0x20], ax
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100113cc
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10011326
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100113cc
mov eax, dword [esp + 0x1c]
xor ecx, ecx
or ecx, ebp
or eax, 0
jl 0x100113cc
jg 0x10011342
cmp ecx, 0xe
jb 0x100113cc
test eax, eax
jg 0x100113cc
jl 0x10011354
cmp ecx, 0x19000
ja 0x100113cc
xor eax, eax
mov dword [ebx + 4], ecx
add ecx, 2
setb al
neg eax
or eax, ecx
push eax
push 1
call fcn.1014bd06
add esp, 8
mov dword [ebx], eax
mov dword [esp + 0x20], 0
mov ebp, 1
test eax, eax
je 0x10011395
push 0
lea ecx, [esp + 0x24]
push ecx
push dword [ebx + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x100113cc
test edi, edi
je 0x100113b5
cmp edi, 0x101d1eb4
je 0x100113b5
push edi
call fcn.10146720
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10142783
add esp, 0x18
ret 4
test edi, edi
je 0x100113e1
cmp edi, 0x101d1eb4
je 0x100113e1
push edi
call fcn.10146720
add esp, 4
mov eax, dword [ebx]
test eax, eax
je 0x100113f6
push eax
call fcn.10146720
add esp, 4
mov dword [ebx], 0
mov ecx, dword [esp + 0x24]
xor al, al
pop edi
pop esi
pop ebp
mov dword [ebx + 4], 0
pop ebx
xor ecx, esp
call fcn.10142783
add esp, 0x18
ret 4
Function at 0x100124f4
Capabilities:
Get file size

Disassembly:
sub esp, 0x10c
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x118]
cmp dword [esi + 0xc], 0xffffffff
je 0x1001250a
mov eax, dword [esi]
call dword [eax + 0x2c]
push 0
push 0x8000000
push 3
push 0
push 1
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x10012553
push 0
push 0x8000000
push 3
push 0
push 0
push SysReAllocStringLen
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x10012553
xor eax, eax
jmp 0x100125d7
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 8]
xor ecx, ecx
add ecx, eax
lea eax, [esp + 0x10]
push 0x100
adc edx, 0
mov dword [esi + 0x30], ecx
push 0
push eax
mov dword [esi + 0x34], edx
call fcn.10143f10
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
push dword [esp + 0x11c]
push edi
call fcn.100088c0
mov eax, dword [esi + 0x38]
mov edi, dword [esp + 0xc]
test eax, eax
je 0x100125b1
push eax
call fcn.10146720
add esp, 4
push edi
call fcn.10147912
mov dword [esi + 0x38], eax
lea ecx, [esp + 0x14]
mov eax, dword [esp + 0x10]
add esp, 4
cmp eax, ecx
je 0x100125d2
push eax
call fcn.10146720
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
call fcn.10142783
add esp, 0x10c
ret 8
Function at 0x100125f0
Capabilities:
Get disk information
Get file size

Disassembly:
sub esp, 0x10
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
mov edi, ecx
lea ebp, [edi + 0x44]
mov eax, dword [edi + 0x48]
cmp dword [eax + 0x24], ebx
mov dword [ebp], 0
setne bl
cmp dword [edi + 0xc], 0xffffffff
lea ebx, [ebx*4 + 1]
je 0x10012632
mov eax, dword [edi]
call dword [eax + 0x2c]
mov eax, dword [edi + 0x48]
push dword [eax + 0x68]
mov ecx, esi
push dword [esp + 0x2c]
push ebp
push ebx
call fcn.10012200
add esp, 0x10
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
jne 0x10012664
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10142783
add esp, 0x10
ret 8
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x10]
xor ecx, ecx
add ecx, eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x30], ecx
adc edx, 0
mov dword [edi + 0x34], edx
test eax, eax
je 0x10012691
push eax
call fcn.10146720
add esp, 4
push esi
call fcn.10147912
add esp, 4
mov dword [edi + 0x38], eax
test esi, esi
je 0x100126e0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 3
jle 0x100126e0
cmp word [esi + 2], 0x3a
jne 0x100126e0
cmp word [esi + 4], 0x5c
jne 0x100126e0
mov ax, word [esi]
mov word [esp + 0x14], ax
xor eax, eax
mov word [esp + 0x1a], ax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1a], 0x5c003a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [edi + 0x10], eax
mov ecx, dword [esp + 0x1c]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10142783
add esp, 0x10
ret 8
Function at 0x100127e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 4], eax
mov edx, dword [esp + 0xc]
mov dword [esp], edx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, ecx
test edx, edx
je 0x10012811
mov ebx, dword [esi + 0x1c]
sub ebx, dword [esi + 0x20]
jns 0x10012827
mov dword [esi + 0x44], 0xa0000047
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10142783
add esp, 8
ret 0xc
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x1001284b
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1001284b
push eax
call fcn.10146843
mov ecx, eax
add esp, 4
mov dword [esi + 0x14], ecx
test ecx, ecx
je 0x10012811
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp edi, ebx
ja 0x1001287a
test ecx, ecx
je 0x1001287a
mov eax, dword [esi + 0x20]
push edi
add eax, ecx
push eax
push edx
call fcn.10146160
add dword [esi + 0x20], edi
add esp, 0xc
add dword [esi + 0x28], edi
adc dword [esi + 0x2c], 0
mov dword [ebp], edi
jmp 0x100129bc
mov dword [ebp], 0
test ebx, ebx
jle 0x100128c4
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100128c4
mov eax, dword [esi + 0x20]
push ebx
add eax, ecx
push eax
push edx
call fcn.10146160
mov ecx, dword [esp + 0x1c]
mov eax, ebx
add ecx, ebx
cdq
add esp, 0xc
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
sub edi, ebx
add dword [ebp], ebx
add dword [esi + 0x28], eax
mov dword [esp + 0x10], ecx
adc dword [esi + 0x2c], edx
jmp 0x100128c8
mov ecx, dword [esp + 0x10]
mov ebx, dword [esi + 0x18]
cmp edi, ebx
jb 0x10012900
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push edi
push ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001296a
mov eax, dword [esp + 0x10]
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], 0
add dword [ebp], eax
jmp 0x100129bc
mov ecx, ebx
lea edx, [edi + 0x1000]
shr ecx, 1
cmp edx, ecx
ja 0x1001291a
mov eax, ebx
mov ebx, ecx
shr eax, 2
cmp edx, eax
cmovbe ebx, eax
push 0
push 0x1000
push dword [esi + 0x2c]
push dword [esi + 0x28]
call fcn.1015db60
mov ecx, eax
or ecx, edx
je 0x10012946
mov ecx, ebx
sub ecx, eax
cmp ebx, 0x1000
mov eax, ebx
cmova eax, ecx
cmp eax, edi
cmovae ebx, eax
push 0
lea eax, [esi + 0x1c]
mov dword [esi + 0x20], 0
mov dword [eax], 0
push eax
push ebx
push dword [esi + 0x14]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001298a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [esi + 0x44], eax
xor eax, eax
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10142783
add esp, 8
ret 0xc
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x100129bc
cmp edi, ebx
jae 0x1001299b
mov ebx, edi
test edi, edi
je 0x100129bc
mov eax, dword [esi + 0x14]
add eax, dword [esi + 0x20]
push ebx
push eax
push dword [esp + 0x18]
call fcn.10146160
add dword [esi + 0x20], ebx
add esp, 0xc
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
add dword [ebp], ebx
mov ecx, dword [esp + 0x14]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10142783
add esp, 8
ret 0xc
Function at 0x10012d92
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
jne 0x10012daf
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10142783
add esp, 8
ret 8
push ebx
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 8]
push edi
push 0
push ecx
push ebx
push eax
push dword [esi + 0xc]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
jne 0x10012de6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x44], eax
jmp 0x10012ded
add dword [esi + 0x28], ebx
adc dword [esi + 0x2c], 0
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.10142783
add esp, 8
ret 8
Function at 0x1001e390
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x5c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
mov esi, edx
mov dword [esp + 0x20], esi
mov ebx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], eax
cmp edi, 0xffffffff
jne 0x1001e3e6
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x3c]
mov eax, 1
cmp edi, eax
cmovl edi, eax
mov eax, 0x40
cmp edi, eax
cmovg edi, eax
mov eax, dword [esp + 0x24]
test ebx, ebx
jne 0x1001e40d
mov dword [eax], 0x100000
xor edx, edx
mov dword [eax + 4], ebx
mov eax, 0x100000
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10142783
add esp, 0x40
ret
lea ecx, [esi - 1]
mov ebx, 4
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov esi, ecx
or esi, 0x1fffe00
shr esi, 8
or esi, ecx
mov ecx, dword [esp + 0x20]
mov eax, ecx
shr esi, 1
mul ebx
mov dword [esp + 0x14], eax
mov eax, esi
shr eax, 1
cmp esi, 0x1000000
mov dword [esp + 0x10], edx
cmovbe eax, esi
mov esi, dword [esp + 0x14]
inc eax
mul ebx
mov ebx, eax
mov ebp, edx
mov edx, dword [esp + 0x10]
add ebx, esi
mov eax, dword [esp + 0x18]
adc ebp, edx
cmp eax, 5
jb 0x1001e475
add ebx, esi
adc ebp, edx
add ebx, 0x200000
mov esi, 1
adc ebp, 0
cmp edi, esi
jbe 0x1001e49a
cmp eax, 5
jb 0x1001e49a
add ebx, 0x600000
mov esi, 2
adc ebp, 0
xor edx, edx
mov eax, edi
div esi
xorps xmm0, xmm0
mov edx, eax
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x14], edx
cmp edx, 1
je 0x1001e4f7
xor edi, edi
mov esi, ecx
shld edi, esi, 2
shl esi, 2
test edi, edi
ja 0x1001e4e0
jb 0x1001e4cd
cmp esi, 0x100000
ja 0x1001e4d4
mov esi, 0x100000
jmp 0x1001e4e5
test edi, edi
jne 0x1001e4e0
cmp esi, 0x10000000
jb 0x1001e4e7
mov esi, 0x10000000
xor edi, edi
test edi, edi
ja 0x1001e4ff
jb 0x1001e4f1
cmp esi, ecx
ja 0x1001e4ff
mov esi, ecx
xor edi, edi
jmp 0x1001e4ff
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, esi
or eax, edi
push 0
push dword [esp + 0x18]
jne 0x1001e52b
mov eax, ecx
mov ecx, 3
mul ecx
shrd eax, edx, 1
shr edx, 1
add eax, ebx
adc edx, ebp
push edx
push eax
call fcn.1015dc20
mov ebp, eax
mov ebx, edx
jmp 0x1001e560
mov eax, edx
lea ecx, [edx + 2]
shr eax, 2
add ecx, eax
mov eax, edi
mul ecx
mov dword [esp + 0x18], eax
mov eax, esi
mul ecx
add dword [esp + 0x18], edx
add esi, ebx
mov dword [esp + 0x20], eax
adc edi, ebp
push edi
push esi
call fcn.1015dc20
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
add ebp, eax
adc ebx, edx
mov ecx, dword [esp + 0x24]
mov edx, ebx
mov eax, dword [esp + 0x20]
add eax, 0x200000
pop edi
mov dword [ecx], eax
mov eax, ebp
pop esi
mov dword [ecx + 4], 0
mov ecx, dword [esp + 0x44]
pop ebp
pop ebx
xor ecx, esp
call fcn.10142783
add esp, 0x40
ret