joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484f34
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48512f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 0x20e]
xor ecx, ecx
mov edx, 0xff
call fcn.00403aec
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x485111
xor esi, esi
push esi
mov esi, 0x485144
lea edi, [ebp - 0x20e]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
push esi
mov esi, 0x485144
lea edi, [ebp - 0x10f]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x10], 0xff
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x10f]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyA
mov ebx, eax
cmp ebx, 0x103
je 0x4850ff
test ebx, ebx
jne 0x4850f7
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x10f]
mov ecx, 0xff
call fcn.00405638
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x214]
mov edx, 0x48524c
call fcn.004056e0
mov eax, dword [ebp - 0x214]
call fcn.00405858
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20e]
push eax
push 0
push 0
push 0x485284
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp byte [ebp - 0x20d], 0x3a
jne 0x4850f6
cmp byte [ebp - 0x20c], 0x5c
jne 0x4850f6
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x20e]
mov ecx, 0xff
call fcn.00405638
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.004235a4
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
mov edx, edi
call fcn.004055c0
mov edx, dword [ebp - 0x224]
lea ecx, [ebp - 1]
mov eax, dword [0x63d9c8]
call fcn.00484d68
lea eax, [ebp - 0x228]
mov edx, edi
call fcn.004055c0
mov edx, dword [ebp - 0x228]
mov eax, dword [0x63d9d8]
call fcn.00424770
cmp byte [ebp - 1], 0
je 0x4850ff
inc esi
test ebx, ebx
je 0x484faa
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485136
lea eax, [ebp - 0x228]
mov edx, 6
call fcn.004053ec
ret
Function at 0x485438
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4855d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x6349ec]
cmp byte [eax], 0
jne 0x4855b8
cmp dword [ebp - 4], 0
je 0x485583
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0042316c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
push esi
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x485502
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4855e0
mov edx, 0x4855e4
mov eax, 0x80000002
call fcn.004238fc
mov eax, dword [ebp - 4]
call fcn.00403060
call fcn.00403024
mov eax, dword [0x6349e8]
mov edx, dword [ebp - 4]
call fcn.0040541c
jmp 0x4855b8
mov eax, esi
call fcn.004230a4
test al, al
jne 0x48554f
push 0x4855fc
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.004055c0
push dword [ebp - 0x1c]
push 0x485610
push 0x485620
push 0x48562c
push 0x485648
push 0x485658
lea eax, [ebp - 0x18]
mov edx, 7
call fcn.0040575c
mov eax, dword [ebp - 0x18]
call fcn.00405858
jmp 0x48558a
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4855e0
mov edx, 0x4855e4
mov eax, 0x80000002
call fcn.004238fc
mov eax, dword [ebp - 4]
call fcn.00403060
call fcn.00403024
mov eax, dword [0x6349e8]
mov edx, dword [ebp - 4]
call fcn.0040541c
jmp 0x4855b8
mov bl, 1
mov eax, 0x485680
push 0x10
push 0
push eax
mov eax, dword [0x63d9c8]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
test bl, bl
je 0x4855b8
push 1
push 0
push 0
push 0x485758
push 0
push 0
call sub.shell32.dll_ShellExecuteA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4855da
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004053ec
ret
Function at 0x489964
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x489999
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x634530]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x489979
pop edi
pop esi
pop ebx
ret

Function at 0x48a040
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x48a06e
mov eax, dword [esp + 4]
cmp eax, 4
je 0x48a06c
cmp eax, 5
je 0x48a06c
xor ebx, ebx
jmp 0x48a06e
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x406243
pop dword [ebp - 8]
mov eax, 0x406243
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xca4dec05
sub dword [ebp - 0x18], 0x7bfba6ba
mov dword [ebp - 0x14], 0xa41ac0a8
add dword [ebp - 0x14], 0x8e188b9d
mov dword [ebp - 0x10], 0xace02ca3
add dword [ebp - 0x10], 0x9f6c178b
mov dword [ebp - 0xc], 0x2adcec5c
add dword [ebp - 0xc], 0xd52313a4
lea eax, [ebp - 0x18]
push eax
mov eax, 0xe2f5ef55
add eax, 0x1d4a91af
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xa346f3aa
add dword [ebp - 0x18], 0xd12b75ac
mov dword [ebp - 0x14], 0xe9a45e78
sub dword [ebp - 0x14], 0xa837fd03
mov dword [ebp - 0x10], 0x7ac4073b
add dword [ebp - 0x10], 0xe8ab6531
mov dword [ebp - 0xc], 0xd15dabb6
sub dword [ebp - 0xc], 0xd15dabb6
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x839af688
add eax, 0x7ca58a78
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4c7
push 0
call eax
mov ecx, 0x1107bb2a
sub ecx, 0x11076610
mov edx, eax
mov ebx, 0xd4d6a3d7
sub ebx, 0xd48fbfd7
add ebx, dword [ebp - 8]
mov edi, 0xec46ce30
sub edi, 0x1b164df
mov esi, dword [ebx]
mov dword [ebp - 4], 0x9904ff15
xor esi, edi
xor dword [ebp - 4], 0x6813b83e
mov dword [edx], esi
xor dword [ebp - 4], eax
add edx, 0xc10fbd27
sub edx, 0xc10fbd23
add ebx, 0x5b68bd9e
add ebx, 0xa4974266
loop 0x406360
add eax, 0x61fc45f3
add eax, 0x9e050148
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb1e45f76
add ecx, 0x4e5ba08a
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x10003cb5
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
jmp 0x1002fc60
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
push edi
mov edi, ecx
push 0x104
push 0x100cfa78
movups xmmword [edi + 0x3c], xmm0
movups xmmword [edi + 0x4c], xmm0
mov byte [edi + 4], 0
mov dword [edi], 0
mov byte [edi + 0x38], 0
call esi
push str.mf.dll
push 0x100cfa78
push str._s_s
push 0xffffffffffffffff
push 0x104
push 0x100cfa78
call fcn.1000453e
push 0
push 0x100cfa78
call fcn.10001604
add esp, 0x20
mov dword [edi + 8], eax
push 0x104
push 0x100cfa78
call esi
push str.mfplat.dll
push 0x100cfa78
push str._s_s
push 0xffffffffffffffff
push 0x104
push 0x100cfa78
call fcn.1000453e
push 0
push 0x100cfa78
call fcn.10001604
xorps xmm0, xmm0
mov dword [edi + 0xc], eax
movups xmmword [edi + 0x10], xmm0
add esp, 0x20
movups xmmword [edi + 0x20], xmm0
movq qword [edi + 0x30], xmm0
cmp dword [edi + 8], 0
je 0x1002fda7
test eax, eax
je 0x1002fda7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MFStartup
push eax
call esi
push str.MFShutdown
push dword [edi + 0xc]
mov dword [edi + 0x10], eax
call esi
push str.MFCreateSystemTimeSource
push dword [edi + 0xc]
mov dword [edi + 0x14], eax
call esi
push str.MFCreateMemoryBuffer
push dword [edi + 0xc]
mov dword [edi + 0x18], eax
call esi
push str.MFCreateSample
push dword [edi + 0xc]
mov dword [edi + 0x1c], eax
call esi
push str.MFCreateFile
push dword [edi + 0xc]
mov dword [edi + 0x20], eax
call esi
push str.MFCreateMediaType
push dword [edi + 0xc]
mov dword [edi + 0x24], eax
call esi
push str.MFTEnum
push dword [edi + 0xc]
mov dword [edi + 0x28], eax
call esi
push str.MFCreateMPEG4MediaSink
push dword [edi + 8]
mov dword [edi + 0x2c], eax
call esi
push str.MFCreatePresentationClock
push dword [edi + 8]
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov eax, edi
pop edi
pop esi
ret

Function at 0x10004c41
Capabilities:
Query environment variable

Disassembly:
jmp 0x10083953
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10083967
xor edi, edi
jmp 0x1008399e
push ebx
push esi
call fcn.1008385f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100044a3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1008398e
push ebx
push esi
push edi
call fcn.1000226b
add esp, 0xc
push 0
call fcn.10002982
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x10004d9a
Capabilities:
Terminate process

Disassembly:
jmp 0x1006e0b1
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1006e0c2
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.1000248c
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x1000cab0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
je 0x1000cb77
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
push ebx
call esi
mov ecx, edi
mov edx, eax
mov dword [ebp + 8], edx
lea ebx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000cae0
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1000cb12
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push ebx
call esi
mov esi, eax
cmp word [ebx + esi*2 - 2], 0x5c
je 0x1000cb2c
mov eax, 0x5c
mov word [ebx + esi*2], ax
inc esi
mov ecx, edi
xor edx, edx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000cb36
sub ecx, dword [ebp + 8]
sar ecx, 1
je 0x1000cb77
lea esi, [ebx + esi*2]
nop dword [eax + eax]
mov ax, word [edi + edx*2]
lea esi, [esi + 2]
mov word [esi - 2], ax
inc edx
mov eax, edi
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000cb61
sub eax, ebx
sar eax, 1
cmp edx, eax
jb 0x1000cb50
mov ebx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e060
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100cb080]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], ecx
xor esi, esi
mov dword [ebp - 0x14], 0
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 0x24
mov dword [ebp - 0xc], 0x26
mov dword [ebp - 8], 0x2a
cmp dword [0x100cc4a8], ebx
jne 0x1000e107
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push 3
push 0x20
push 3
push 1
push 3
push 2
push ebx
push ebx
call edi
push edx
push eax
call edi
push edx
push eax
call edi
push edx
push eax
push 0x23
xor ecx, ecx
mov dword [0x100cc4a8], 0x11c
push 0x100cc4a8
mov dword [0x100cc4ac], 6
mov dword [0x100cc4b0], 1
mov word [0x100cc5bc], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ecx, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [section..data], eax
jmp 0x1000e10c
mov eax, dword [section..data]
test eax, eax
je 0x1000e126
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100041bf
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x1000e26c
push 0
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, eax
test edi, edi
je 0x1000e26c
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000e26c
push 0
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp edi, eax
jbe 0x1000e26c
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
nop dword [eax]
mov eax, dword [ebp + ebx*4 - 0x10]
cmp eax, 0x26
jne 0x1000e28d
push 0
push 0
push 0x100a0d64
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
xor esi, esi
test edi, edi
je 0x1000e269
lea ecx, [edi*2 + 2]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1000e269
push edi
push esi
push 0x100a0d64
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp edi, eax
jne 0x1000e269
push esi
push 0x100a0d64
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1000e207
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call edi
push 0x100a0c7c
push 0x26
call fcn.1000c920
mov esi, eax
add esp, 8
test esi, esi
je 0x1000e269
jmp 0x1000e224
cmp word [esi + edi*2 - 4], 0x5c
je 0x1000e21e
push 0x100a0d60
lea eax, [edi + 1]
push eax
push esi
call fcn.10002e82
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000e230
sub ecx, edx
sar ecx, 1
push ecx
push esi
push dword [ebp - 0x14]
call fcn.10002892
xor ecx, ecx
add esp, 0xc
test eax, eax
sete cl
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x1000e269
push esi
call edi
inc ebx
xor esi, esi
cmp ebx, 3
jl 0x1000e180
mov ebx, dword [ebp - 0x1c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x14]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100041bf
mov esp, ebp
pop ebp
ret
push 0x100a0c7c
push eax
jmp 0x1000e1f7
Function at 0x10017b50
Capabilities:
Copy file
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100cb080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0x11c]
test esi, esi
je 0x10017b78
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x214]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10017cb3
cmp dword [ebp - 0x210], 0
jl 0x10017cb3
jg 0x10017baf
cmp dword [ebp - 0x214], 0x7d000
jbe 0x10017cb3
push edi
mov ecx, ebx
call fcn.10001cd0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100022b1
push 0x103
lea edi, [ebx + 0x13c]
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.10001cc6
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call fcn.10004322
mov ecx, eax
add esp, 0x24
test ecx, ecx
je 0x10017c46
push str..old
push ecx
call fcn.100029f0
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.10004322
add esp, 0x10
test eax, eax
je 0x10017c46
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10017c46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CLogger::MoveLogFile_:_CopyFile_failed_Error__0x_x_
call fcn.10004e76
add esp, 8
test esi, esi
je 0x10017c51
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0x80
push 2
push 0
push 7
push 0x60004
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x10017c92
push 0
push 0
push 0
push 0
push 4
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x10017ca7
push eax
push edi
push str.CLogger::ReCreate_:_Failed_to_set_file_permission___s_._Error__0x_x_
jmp 0x10017c9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CLogger::ReCreate_:_Error_opening_log_file___s___Error__0x_x_
call fcn.10004e76
add esp, 0xc
pop edi
test esi, esi
je 0x10017cbe
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x10017cbe
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.100041bf
mov esp, ebp
pop ebp
ret

Function at 0x100181d0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100cf160], 0
jne 0x10018210
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x101
push eax
push 0x100cf160
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x10018210
push 0xffffffffffffffff
push 0x100aae54
push 0x101
push 0x100cf160
call fcn.100032ab
add esp, 0x10
mov eax, 0x100cf160
mov esp, ebp
pop ebp
ret
Function at 0x10021460
Capabilities:
Terminate thread

Disassembly:
jmp fcn.100427b0
push ebp
mov ebp, esp
pop ebp
jmp 0x100045d9

Function at 0x10023580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x18a8]
test ecx, ecx
je 0x100235e4
mov edi, dword [ebp + 8]
push edi
call fcn.10002496
mov bl, al
test bl, bl
je 0x100235e6
cmp byte [esi + 0x1ae4], 0
je 0x1002360b
mov ecx, dword [esi + 0x18d8]
mov dword [ebp + 8], 0
test ecx, ecx
je 0x100235d5
cmp ecx, 0xffffffff
je 0x100235d5
push 0
lea eax, [ebp + 8]
push eax
mov eax, dword [edi + 8]
push dword [eax]
push dword [edi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc dword [esi + 0x1ae8]
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor bl, bl
cmp dword [0x100c8418], 7
mov dword [0x100c82e8], 7
jg 0x1002360b
push str.encode_get_header_failed
push 0x100c82e0
call fcn.10001a0f
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 4
Function at 0x10034320
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100cb080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov bl, 1
call fcn.100022b1
add esp, 0xc
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
lea eax, [ebp - 0x20c]
je 0x100343a9
cmp byte [ebp + 0x14], 0
je 0x1003437a
push 0xffffffffffffffff
push esi
push 0x104
push eax
call fcn.10001cc6
add esp, 0x10
jmp 0x100343c4
push 0
push 0
push 0
push 0
push 0x104
push eax
push 0
push 0
push esi
call fcn.10004408
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0x100b1500
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x100343c4
push 0
push 0
push 0
push 0
push 0
push 0
push 0x104
push eax
push esi
call fcn.10004408
add esp, 0x24
lea eax, [ebp - 0x214]
push eax
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x100344f6
mov esi, dword [ebp - 0x214]
mov eax, esi
push edi
mov edi, dword [ebp - 0x210]
or eax, edi
jne 0x1003443a
xor bl, bl
mov dword [0x100c82e8], 7
cmp dword [0x100c8418], 7
jg 0x10034425
lea eax, [ebp - 0x20c]
push eax
push str.CCaptureCore::HasDiskAvailableSpace:_No_available_disk__S__space.
push 0x100c82e0
call fcn.10001a0f
add esp, 0xc
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100041bf
mov esp, ebp
pop ebp
ret 0x10
mov edx, edi
mov ecx, esi
call fcn.10001023
mulsd xmm0, qword [0x100b1b78]
mov edx, dword [ebp + 0x10]
movsd qword [ebp - 0x21c], xmm0
cmp edi, edx
ja 0x100344b9
mov ecx, dword [ebp + 0xc]
jb 0x10034463
cmp esi, ecx
jae 0x100344b9
xor bl, bl
mov dword [0x100c82e8], 7
cmp dword [0x100c8418], 7
jg 0x10034425
call fcn.10001023
mulsd xmm0, qword [0x100b1b78]
lea eax, [ebp - 0x20c]
sub esp, 0x10
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x21c]
movsd qword [esp], xmm0
push eax
push str.CCaptureCore::HasDiskAvailableSpace:_Free_disk__S__space__.2f__MB__is_less_than_required__.2f__MB_.
push 0x100c82e0
call fcn.10001a0f
add esp, 0x1c
jmp 0x10034425
cmp dword [0x100c8418], 6
mov dword [0x100c82e8], 6
jg 0x10034425
sub esp, 8
lea ecx, [ebp - 0x20c]
movsd qword [esp], xmm0
push ecx
push str.CCaptureCore::HasDiskAvailableSpace:_Free_disk__S__space__.2f__MB_.
push 0x100c82e0
call fcn.10001a0f
add esp, 0x14
jmp 0x10034425
xor bl, bl
mov dword [0x100c82e8], 7
cmp dword [0x100c8418], 7
jg 0x10034426
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str.CCaptureCore::HasDiskAvailableSpace:_GetDiskFreeSpaceEx__S__failed_with_err__X_
push 0x100c82e0
call fcn.10001a0f
mov ecx, dword [ebp - 4]
add esp, 0x10
mov al, bl
xor ecx, ebp
pop esi
pop ebx
call fcn.100041bf
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003ae80
Capabilities:
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009d340
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100cb080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0
mov dword [esi], vtable.FileWriter.0
cmp eax, 0xffffffff
je 0x1003af78
lea ecx, [ebp - 0x14]
xorps xmm0, xmm0
push ecx
push eax
mov bl, 1
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1003aeec
cmp dword [ebp - 0x10], 0
jl 0x1003aeec
jg 0x1003aeea
cmp dword [ebp - 0x14], 0
jbe 0x1003aeec
xor bl, bl
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1003af25
cmp dword [0x100c8418], 7
mov dword [0x100c82e8], 7
jg 0x1003af25
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FileWriter::FileWriter:_Cannot_close_handle___errno___d
push 0x100c82e0
call fcn.10001a0f
add esp, 0xc
mov dword [esi + 4], 0xffffffff
test bl, bl
je 0x1003af78
lea edi, [esi + 0xa]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1003af78
cmp dword [0x100c8418], 7
mov dword [0x100c82e8], 7
jg 0x1003af78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push edi
mov ecx, 0x100c82e0
call fcn.10003dc3
push eax
push str.FileWriter::FileWriter:_could_not_delete_empty_file__s__errno___d
push 0x100c82e0
call fcn.10001a0f
add esp, 0x10
test byte [ebp + 8], 1
je 0x1003af8c
push 0x110
push esi
call fcn.100017c6
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4