joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ef29
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, 0x4e6164
mov edi, 0x4e615c
xor ebx, ebx
mov dword [0x4e6160], 2
jmp 0x48f0b9
mov edx, dword [0x4adc38]
mov eax, dword [esi]
xor ecx, ecx
mov cl, byte [edx + eax + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e614c]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
and eax, 0x7fff
mov edx, dword [0x4adc3c]
mov word [edx + eax*2], bp
mov eax, dword [0x4e614c]
mov ecx, dword [edi]
mov dx, word [esi]
mov word [eax + ecx*2], dx
test ebp, ebp
je 0x48efb1
mov eax, dword [esi]
sub eax, ebp
cmp eax, 0x7efa
ja 0x48efb1
mov eax, ebp
call fcn.0048f31c
mov ebx, eax
mov eax, dword [0x4e6170]
cmp ebx, eax
jbe 0x48efb1
mov ebx, eax
cmp ebx, 3
jb 0x48f05b
mov edx, ebx
sub edx, 3
mov eax, dword [esi]
sub eax, dword [0x4e6168]
call fcn.00490f44
sub dword [0x4e6170], ebx
cmp ebx, dword [0x4e6178]
ja 0x48f02d
dec ebx
inc dword [esi]
mov ecx, dword [0x4adc38]
mov edx, dword [esi]
movzx ecx, byte [ecx + edx + 2]
mov edx, dword [edi]
shl edx, 5
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
mov ecx, dword [0x4e614c]
mov edx, dword [edi]
movzx ebp, word [ecx + edx*2]
mov edx, dword [esi]
and edx, 0x7fff
mov ecx, dword [0x4adc3c]
mov word [ecx + edx*2], bp
mov edx, dword [0x4e614c]
mov ecx, dword [edi]
mov bp, word [esi]
mov word [edx + ecx*2], bp
dec ebx
jne 0x48efdb
inc dword [esi]
jmp 0x48f075
add dword [esi], ebx
xor ebx, ebx
mov ecx, dword [esi]
mov edx, dword [0x4adc38]
movzx edx, byte [edx + ecx]
mov dword [edi], edx
mov ebp, dword [esi]
mov ecx, dword [0x4adc38]
shl edx, 5
movzx ecx, byte [ecx + ebp + 1]
xor ecx, edx
and ecx, 0x7fff
mov dword [edi], ecx
jmp 0x48f075
mov eax, dword [0x4adc38]
mov edx, dword [esi]
movzx edx, byte [eax + edx]
xor eax, eax
call fcn.00490f44
dec dword [0x4e6170]
inc dword [esi]
test eax, eax
je 0x48f0a8
mov edx, dword [esi]
sub edx, dword [0x4e6154]
cmp dword [0x4e6154], 0
jl 0x48f097
mov eax, dword [0x4adc38]
add eax, dword [0x4e6154]
jmp 0x48f099
xor eax, eax
xor ecx, ecx
call fcn.00490d68
mov edx, dword [esi]
mov dword [0x4e6154], edx
cmp dword [0x4e6170], 0x106
jae 0x48f0b9
call fcn.0048edf8
cmp dword [0x4e6170], 0
jne 0x48ef48
mov edx, dword [esi]
sub edx, dword [0x4e6154]
cmp dword [0x4e6154], 0
jl 0x48f0e4
mov eax, dword [0x4adc38]
add eax, dword [0x4e6154]
jmp 0x48f0e6
xor eax, eax
mov ecx, 1
call fcn.00490d68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48f0f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov ebx, eax
mov esi, 0x4e615c
cmp ebx, 1
jl 0x48f10f
cmp ebx, 9
jle 0x48f119
mov eax, 0x4adc90
call fcn.00492ec4
xor edx, edx
mov dword [0x4e6158], edx
cmp dword [0x4e6150], 0
jne 0x48f13e
mov dword [0x4e6158], 1
mov dword [0x4e6150], 0x10000
cmp dword [0x4adc38], 0
jne 0x48f17b
push 2
push 0x8000
call fcn.00496290
add esp, 8
mov edi, eax
mov dword [0x4adc38], edi
test edi, edi
jne 0x48f17b
mov eax, 0x4b1b14
call fcn.0042d5a0
mov edx, 0x4adc90
mov eax, 4
call fcn.00492d64
cmp dword [0x4adc3c], 0
jne 0x48f1de
push 2
push 0x8000
call fcn.00496290
add esp, 8
mov dword [0x4adc3c], eax
push 2
push 0x8000
call fcn.00496290
add esp, 8
mov dword [0x4e614c], eax
cmp dword [0x4adc3c], 0
je 0x48f1be
cmp dword [0x4e614c], 0
jne 0x48f1de
mov eax, 0x1ff
call fcn.004125d0
push eax
call fcn.00486954
pop ecx
mov edx, 0x4adc90
mov eax, 4
call fcn.00492d64
mov eax, dword [0x4e614c]
mov word [eax + 0xfffe], 0
push 0xfffe
push 0
push eax
call fcn.00497b00
movzx edx, word [ebx*8 + 0x4adc42]
mov dword [0x4e6178], edx
add esp, 0xc
movzx ecx, word [ebx*8 + 0x4adc40]
mov dword [0x4e617c], ecx
cmp ebx, 2
movzx eax, word [ebx*8 + 0x4adc44]
mov dword [0x4e6180], eax
movzx edx, word [ebx*8 + 0x4adc46]
mov dword [0x4e6174], edx
jg 0x48f23f
or word [ebp], 4
jmp 0x48f249
cmp ebx, 8
jl 0x48f249
or word [ebp], 2
xor ecx, ecx
xor eax, eax
mov dword [0x4e6164], ecx
mov ebx, 0x8000
add ebx, ebx
mov dword [0x4e6154], eax
mov eax, dword [0x4adc38]
mov edx, ebx
call dword [0x4ae150]
mov dword [0x4e6170], eax
mov eax, dword [0x4e6170]
test eax, eax
je 0x48f27f
cmp eax, 0xffffffff
jne 0x48f293
mov dword [0x4e616c], 1
xor edx, edx
mov dword [0x4e6170], edx
jmp 0x48f2d1
xor ecx, ecx
mov dword [0x4e616c], ecx
cmp dword [0x4e6170], 0x106
jae 0x48f2ac
call fcn.0048edf8
xor eax, eax
xor ebx, ebx
mov dword [esi], eax
mov edx, dword [0x4adc38]
mov eax, dword [esi]
shl eax, 5
xor ecx, ecx
mov cl, byte [edx + ebx]
inc ebx
xor eax, ecx
and eax, 0x7fff
cmp ebx, 2
mov dword [esi], eax
jb 0x48f2b2
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4974dc
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x498cf8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x498d14
call fcn.0049a454
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x498d30
test bl, 1
je 0x498d30
call fcn.0049e520
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x498f14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0049a010
test byte [ebp + 0xd], 0xc0
jne 0x498f38
mov eax, dword [0x4aec58]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x498f45
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x498f72
je 0x498f84
sub ecx, 0x100
je 0x498f92
sub ecx, 0x100
je 0x498f99
sub ecx, 0x100
je 0x498f8b
jmp 0x498fa0
sub ecx, 0x600
je 0x498f99
sub ecx, 0x100
je 0x498f84
jmp 0x498fa0
mov edi, 1
jmp 0x498fa5
mov edi, 2
jmp 0x498fa5
mov edi, 4
jmp 0x498fa5
mov edi, 5
jmp 0x498fa5
mov edi, 3
test byte [ebp + 0xd], 1
je 0x498fcc
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4ae6d0]
test al, 0x80
je 0x498fc5
mov ebx, 0x80
jmp 0x498fde
mov ebx, 1
jmp 0x498fde
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x498fde
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x498ff0
je 0x498ff9
dec eax
je 0x499002
jmp 0x49900b
mov dword [ebp - 4], CreateStatusWindowA
jmp 0x49901a
mov dword [ebp - 4], 0x40000000
jmp 0x49901a
mov dword [ebp - 4], 0xc0000000
jmp 0x49901a
push 1
call fcn.0049a3e8
pop ecx
mov ebx, eax
jmp 0x499106
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x499036
sub eax, 0x10
je 0x49903d
sub eax, 0x10
je 0x499046
sub eax, 0x10
je 0x49904f
jmp 0x49904f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x499056
mov dword [ebp - 8], 1
jmp 0x499056
mov dword [ebp - 8], 2
jmp 0x499056
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4990bf
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4990b4
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x4990b4
add ebx, 0xffffffb2
push ebx
call fcn.0049a3e8
pop ecx
mov ebx, eax
jmp 0x499106
mov edi, esi
push edi
call fcn.00498e78
pop ecx
test eax, eax
je 0x4990d3
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4990df
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0049a110
add esp, 8
mov ebx, eax
inc eax
jne 0x499106
push 4
call fcn.0049a3e8
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0049a044
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x499610
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x49962c
call fcn.0049a454
jmp 0x49969b
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
jne 0x499648
call fcn.0049a454
jmp 0x49969b
cmp dword [0x4ea088], 1
je 0x499699
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.0049e3f4
pop ecx
cmp al, 0x41
jl 0x499699
cmp al, 0x5a
jg 0x499699
cmp byte [ebp - 0x107], 0x3a
jne 0x499699
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_SetEnvironmentVariableA
dec eax
je 0x499699
call fcn.0049a454
jmp 0x49969b
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49e4b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x49e51a
call fcn.0049e468
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00497cb0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00497cb0
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x49e598
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4afbb0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x49e672
cmp dword [0x4afbac], 0
jne 0x49e672
cmp dword [0x4afdd8], 0
je 0x49e62c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0049e39c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49e612
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0049e39c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49e612
lea ebx, [ebp - 0x84]
jmp 0x49e613
inc ebx
call fcn.0049e554
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x49e6ad
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4afbb4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00497cb0
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4afbb7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x49e6ad
cmp dword [0x4afbac], 0
je 0x49e68c
cmp dword [0x4afbac], 0xffffffff
je 0x49e6ad
push esi
call dword [0x4afbac]
pop ecx
mov eax, dword [0x4afbb0]
test eax, eax
je 0x49e6ad
cmp dword [0x4afbb0], 0xffffffff
je 0x49e6ad
cmp byte [eax], 0
je 0x49e6ad
push esi
push eax
call fcn.0049e4b8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49fe38
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x49fe5e
test esi, esi
je 0x49fe5e
call fcn.0049e520
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x49fed0
call fcn.0049fb50
mov ebx, eax
test eax, eax
jne 0x49fe79
call fcn.0049e520
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x49fed0
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x49fd94
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x49fec4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x49febd
push 0x59
call fcn.0049a3e8
pop ecx
jmp 0x49fed0
call fcn.0049a454
jmp 0x49fed0
mov dword [ebx + 8], eax
test edi, edi
je 0x49fed0
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x10009080
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a088
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10040014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x100091b6
push 0xc
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
push 0x10039144
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
call fcn.100050b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
call fcn.1000fcf0
mov ecx, eax
call fcn.1000fdb0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x1000913e
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10009134
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100091c8
push edx
push ecx
call fcn.10017942
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
test ebx, ebx
jne 0x1000916f
mov dword [edi + 0x18], 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x14], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1001b6a9
int3
Function at 0x1000ee20
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a841
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x10040014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0
cmp dword [esi + 0x14], 8
jb 0x1000ee77
mov edx, dword [esi]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1000ee8e
mov eax, edx
cmp word [eax], 0x25
je 0x1000eec4
add eax, 2
sub ecx, 1
jne 0x1000ee80
push esi
mov ecx, edi
call fcn.10004eb0
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100174a0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test eax, eax
je 0x1000ee8e
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x1000ee8e
push esi
lea ecx, [ebp - 0x2c]
call fcn.10004eb0
mov dword [ebp - 4], 1
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1000eeeb
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x38], eax
test eax, eax
jne 0x1000ef63
push esi
mov ecx, edi
call fcn.10004eb0
mov dword [ebp - 0x34], 1
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x1000ef4a
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000ef40
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000f022
push edx
push ecx
call fcn.10017942
add esp, 8
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
jmp 0x1000eea4
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10017f2e
add esp, 4
mov dword [ebp - 0x30], eax
cmp dword [esi + 0x14], 8
jb 0x1000ef8a
mov esi, dword [esi]
mov ecx, dword [ebp - 0x38]
inc ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x30]
test eax, eax
je 0x1000efc9
cmp eax, dword [ebp - 0x38]
ja 0x1000efc9
xor ecx, ecx
mov word [esi + eax*2], cx
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000efb0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.100050b0
push esi
call fcn.10017950
movups xmm0, xmmword [ebp - 0x2c]
mov dword [edi + 0x10], 0
add esp, 4
mov dword [edi + 0x14], 0
xor eax, eax
movups xmmword [edi], xmm0
mov word [ebp - 0x2c], ax
movq xmm0, qword [ebp - 0x1c]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x34], 1
mov byte [ebp - 4], al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
jmp 0x1000eea4
call fcn.1001b6a9
int3
Function at 0x10011350
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x10040014]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x100113d2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x100113d2
test ecx, ecx
je 0x100113ce
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x10011390
xor eax, eax
jmp 0x100113d7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x100113e1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100174a0
add esp, 0xc
ret 0xc

Function at 0x100117a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002af58
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10040014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100117d6
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10011880
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.10011a90
test al, al
je 0x1001182f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1001186c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10011862
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001189d
push edx
push ecx
call fcn.10017942
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100174a0
mov esp, ebp
pop ebp
ret
call fcn.1001b6a9
int3
Function at 0x10012ab0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x10040014]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x10012b15
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10012af0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10012b15
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100174a0
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.100174a0
add esp, 8
ret 4

Function at 0x10013990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b450
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10040014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
test esi, esi
je 0x10013acf
cmp byte [esi + 0x54], 0
je 0x10013acf
add esi, 0x1c
xor bl, bl
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x3c], bl
test esi, esi
je 0x10013a10
mov eax, dword [esi]
test eax, eax
je 0x10013a0d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10013a04
cmp eax, 0x80
je 0x10013a04
xor bl, bl
jmp 0x10013a0a
mov byte [esi + 4], 1
mov bl, 1
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 0x3c], bl
push ecx
mov edx, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.1000f610
add esp, 4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x10013a47
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10013a95
push 2
push 0
push 0
push edi
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.1000b670
mov dword [ebp - 4], 2
test esi, esi
je 0x10013ac1
test bl, bl
je 0x10013ac1
mov eax, dword [esi]
test eax, eax
je 0x10013abd
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100174a0
mov esp, ebp
pop ebp
ret 4