joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe94d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe94d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xe94d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe94d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xe94d94
push eax
push esi
call fcn.00e9720b
add esp, 8
pop esi
ret 0x10

Function at 0xe94da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe94e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xe94e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xead320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e96dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xe94dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xe94e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe94ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xe94eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xead320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e96dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xe94eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xe94e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xe95000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xe95131
push esi
call fcn.00e98145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00e87080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xe95131
push 0
push ebp
call fcn.00e873a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00e87260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xe9508b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00e872f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xe95121
push 0xead918
push edi
call fcn.00e963f0
push eax
push ebx
push esi
call fcn.00e94f60
push 0xead8f8
push edi
call fcn.00e963f0
push eax
push ebx
push esi
call fcn.00e94f60
push 0xead8d8
push edi
call fcn.00e963f0
push eax
push ebx
push esi
call fcn.00e94f60
push 0xead8c0
push edi
call fcn.00e963f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00e94f60
push 0xead8a0
push edi
call fcn.00e963f0
push eax
push ebx
push esi
call fcn.00e94f60
push 0xead888
push edi
call fcn.00e963f0
push eax
push ebx
push esi
call fcn.00e94f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xe961b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e96140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e96140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e96140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e96140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe96bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe96c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xea887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe96c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe96c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1000411f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x1000415c
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [edi], edx
mov dword [edi + 4], edx
cmp dword [esi + 0x18], edx
jbe 0x10004159
push ebx
mov ebx, edx
mov ecx, dword [esi + 0x14]
lea ebx, [ebx + 0x10]
mov eax, dword [ecx + ebx - 8]
add dword [edi], eax
mov eax, dword [ecx + ebx - 4]
adc dword [edi + 4], eax
inc edx
cmp edx, dword [esi + 0x18]
jb 0x1000413f
pop ebx
pop edi
jmp 0x10004190
lea eax, [ebp - 4]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000417e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000417e
xor al, al
jmp 0x10004192
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10004586
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x10], 0
je 0x10004649
mov eax, dword [esi + 0x18]
xor edi, edi
test eax, eax
je 0x100045b6
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0x14]
cmp edx, dword [ecx]
je 0x100045b6
inc edi
add ecx, 0x10
cmp edi, eax
jb 0x100045aa
cmp edi, eax
jb 0x100045c1
xor al, al
jmp 0x10004662
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov ebx, edi
mov dword [ebp + 8], edx
mov edx, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
shl ebx, 4
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x10004640
mov eax, dword [esi + 0x14]
mov eax, dword [ebx + eax]
mov dword [esi + 8], eax
mov byte [esi + 0x10], 0
cmp edx, edi
jbe 0x100045fb
mov ecx, esi
call fcn.100042be
mov ecx, dword [ebp - 4]
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, esi
call fcn.10004586
mov byte [esi + 0x10], 1
test al, al
je 0x100045ba
mov ecx, dword [ebp + 8]
add ebx, 0x10
add ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
inc edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
cmp edx, dword [esi + 0x18]
jb 0x100045dc
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov al, 1
jmp 0x10004662
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100046d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov bl, 1
push edi
mov edi, dword [ebp + 0xc]
add dword [esi + 0x20], edi
adc dword [esi + 0x24], 0
cmp byte [esi + 5], 0
je 0x100046f9
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
jmp 0x10004710
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
mov ecx, dword [esi + 0xc]
push edi
push dword [ebp + 8]
push dword [ecx + 4]
call fcn.100073ee
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 0xc

Function at 0x100067dd
Capabilities:
Hash data using crc32b

Disassembly:
xor ecx, ecx
mov eax, ecx
push 8
shl eax, 0x18
pop edx
test eax, eax
jns 0x100067f4
add eax, eax
xor eax, 0x4c11db7
jmp 0x100067f6
add eax, eax
dec edx
test edx, edx
jg 0x100067e7
mov dword [ecx*4 + 0x10055858], eax
inc ecx
cmp ecx, 0x100
jl 0x100067df
ret
Function at 0x10007433
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov word [esi], ax
lea eax, [ebp + 0xc]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Pathswinrar.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp + 0x10]
test eax, eax
jne 0x10007485
lea eax, [edi + edi]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp - 4]
push eax
push 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1002148a
push edi
push dword [ebp + 8]
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.1002621f
push esi
call fcn.1001ff84
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000750c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and dword [ecx + 0x102c], 0
and dword [ecx + 0x1028], 0
pop ebp
jmp fcn.1001efc6
Function at 0x1000d3e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov esi, dword [esi]
and esi, 7
cmp eax, 5
jae 0x1000d408
xor eax, eax
jmp 0x1000d56a
add dword [ebp + 0x10], 5
lea ecx, [eax - 4]
mov edx, dword [ebp + 8]
push ebx
or ebx, 0xffffffff
add ecx, edx
mov dword [ebp - 8], ecx
push 3
pop eax
add edx, edi
mov dword [ebp - 4], edx
cmp edx, ecx
jae 0x1000d43a
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x1000d434
inc edx
cmp edx, ecx
jb 0x1000d427
push 3
mov dword [ebp - 4], edx
pop eax
mov edi, edx
sub edi, dword [ebp + 8]
cmp edx, ecx
jae 0x1000d54e
mov ecx, edi
sub ecx, ebx
cmp ecx, eax
jbe 0x1000d471
xor esi, esi
mov al, byte [edx + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test al, al
je 0x1000d4b0
cmp al, 0xff
je 0x1000d4b0
and esi, 3
xor eax, eax
add esi, esi
or esi, 1
inc eax
jmp 0x1000d541
dec ecx
shl esi, cl
and esi, 7
je 0x1000d451
movzx eax, byte [esi + 0x10048a80]
mov ecx, edx
sub ecx, eax
cmp byte [esi + 0x10048a78], 0
mov al, byte [ecx + 4]
je 0x1000d498
test al, al
je 0x1000d498
cmp al, 0xff
jne 0x1000d451
mov ecx, dword [ebp - 8]
mov ebx, edi
mov edx, dword [ebp + 8]
push 3
pop eax
and esi, eax
add esi, esi
or esi, 1
inc edi
jmp 0x1000d41e
movzx ebx, al
movzx eax, byte [edx + 3]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [edx + 1]
mov edx, dword [ebp + 0x10]
shl ebx, 8
or ebx, eax
cmp dword [ebp + 0x18], 0
je 0x1000d4dd
add ebx, edi
add ebx, edx
jmp 0x1000d4e1
sub ebx, edi
sub ebx, edx
mov dword [ebp + 0xc], ebx
test esi, esi
je 0x1000d517
movzx eax, byte [esi + 0x10048a80]
shl eax, 3
push 0x18
pop ecx
sub ecx, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
test al, al
je 0x1000d506
cmp al, 0xff
jne 0x1000d517
xor ebx, ebx
push 0x20
pop ecx
sub ecx, dword [ebp - 0xc]
inc ebx
shl ebx, cl
dec ebx
xor ebx, dword [ebp + 0xc]
jmp 0x1000d4d1
mov edx, dword [ebp - 4]
mov eax, ebx
shr eax, 0x18
and al, 1
dec al
not al
mov byte [edx + 1], bl
mov byte [edx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [edx + 3], al
mov eax, ebx
mov ebx, dword [ebp - 0x10]
shr eax, 8
push 5
mov byte [edx + 2], al
pop eax
mov ecx, dword [ebp - 8]
add edi, eax
mov edx, dword [ebp + 8]
jmp 0x1000d41b
mov edx, edi
sub edx, ebx
pop ebx
lea ecx, [edx - 1]
shl esi, cl
and esi, 7
cmp eax, edx
mov eax, dword [ebp + 0x14]
sbb ecx, ecx
not ecx
and ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1000fbd9
Capabilities:
Encode data using add xor sub operations

Disassembly:
push ebx
push esi
xor edx, edx
push edi
push 8
mov edi, edx
xor esi, esi
pop ebx
mov ecx, edi
xor eax, eax
and ecx, 1
add ecx, 0xffffffff
not ecx
adc eax, 0xffffffff
and ecx, 0xd7870f42
shrd edi, esi, 1
not eax
and eax, 0xc96c5795
shr esi, 1
xor edi, ecx
xor esi, eax
sub ebx, 1
jne 0x1000fbe5
mov dword [edx*8 + 0x10055d78], edi
mov dword [edx*8 + 0x10055d7c], esi
inc edx
cmp edx, 0x100
jb 0x1000fbde
pop edi
pop esi
pop ebx
ret
Function at 0x1000fc41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x1000fc79
movzx eax, byte [edi]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor ecx, dword [eax*8 + 0x10055d78]
xor edx, dword [eax*8 + 0x10055d7c]
inc edi
sub esi, 1
jne 0x1000fc56
pop edi
mov eax, ecx
pop esi
pop ebp
ret 0x10

Function at 0x10012da5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10012ddd
movzx edx, word [ecx + 0x8524]
push edi
mov edi, dword [ebp + 8]
movsx eax, byte [edi]
xor eax, edx
shr dx, 8
movzx eax, al
xor dx, word [ecx + eax*2 + 8]
inc edi
movzx edx, dx
mov word [ecx + 0x8524], dx
sub esi, 1
jne 0x10012dbb
pop edi
mov ax, word [ecx + 0x8524]
pop esi
pop ebp
ret 8

Function at 0x10017ec2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor edx, edx
mov ebx, ecx
test esi, esi
je 0x10017ef4
push edi
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov ecx, edx
shr ecx, 8
xor ecx, eax
shl edx, 8
movzx eax, cl
xor edx, dword [ebx + eax*4 + 0x1a90]
inc edi
sub esi, 1
jne 0x10017ed6
pop edi
pop esi
movzx eax, dx
pop ebx
pop ebp
ret 8

Function at 0x1001c148
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov byte [ecx + 0x1070], 0
pop ebp
jmp fcn.1001efc6

Function at 0x1001e8c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1001e8fb
test dl, 7
je 0x1001e8fb
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10056718]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x1001e8db
cmp esi, 8
jb 0x1001e98b
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x10056718]
xor ecx, dword [eax*4 + 0x10056b18]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10056f18]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x10057718]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x10057b18]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10057f18]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x10057318]
movzx eax, bl
xor ecx, dword [eax*4 + 0x10058318]
mov ebx, ecx
sub edi, 1
jne 0x1001e90a
pop edi
test esi, esi
je 0x1001e9a7
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10056718]
inc edx
sub esi, 1
jne 0x1001e98f
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
Function at 0x1001efc6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.1002f740
mov eax, dword [0x10054e34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0x1054], eax
and dword [edi + 0x1020], 0
cmp byte [edi + 0x1d], 0
jne 0x1001f003
test bl, 4
jne 0x1001f003
xor cl, cl
jmp 0x1001f005
mov cl, 1
mov eax, ebx
shr eax, 1
push esi
and al, 1
movzx esi, al
neg esi
sbb esi, esi
and esi, 0xc0000000
add esi, 0x80000000
test bl, 1
je 0x1001f02a
or esi, 0x40000000
shr ebx, 3
not ebx
and ebx, 1
test cl, cl
je 0x1001f039
or ebx, 2
xor eax, eax
lea ecx, [ebp - 0x104c]
cmp byte [edi + 0x15], al
setne al
dec eax
and eax, 0x8000000
mov dword [ebp - 0x1058], eax
call fcn.10015aed
cmp byte [edi + 0x1c], 0
je 0x1001f064
or esi, 0x100
push 0
push dword [ebp - 0x1058]
push 3
push 0
push ebx
push esi
push dword [ebp - 0x1054]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1050], eax
cmp eax, 0xffffffff
jne 0x1001f108
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x105c], eax
lea eax, [ebp - 0x1004]
push 0x800
push eax
push dword [ebp - 0x1054]
call fcn.1002252e
test al, al
je 0x1001f0ef
push 0
push dword [ebp - 0x1058]
lea eax, [ebp - 0x1004]
push 3
push 0
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1050], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1001f0e2
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x1050]
cmp eax, 0xffffffff
jne 0x1001f108
jmp 0x1001f0f5
mov eax, dword [ebp - 0x1050]
cmp dword [ebp - 0x105c], 2
jne 0x1001f108
mov dword [edi + 0x1020], 1
cmp byte [edi + 0x1c], 0
pop esi
je 0x1001f134
cmp eax, 0xffffffff
je 0x1001f134
or dword [ebp - 0x1060], 0xffffffff
lea ecx, [ebp - 0x1060]
or dword [ebp - 0x105c], 0xffffffff
push 0
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
xor eax, eax
mov byte [edi + 0x12], al
mov dword [edi + 0xc], eax
mov byte [edi + 0x10], al
mov eax, dword [ebp - 0x1050]
cmp eax, 0xffffffff
setne bl
cmp eax, 0xffffffff
je 0x1001f167
push 0x800
push dword [ebp - 0x1054]
lea ecx, [edi + 0x1e]
mov dword [edi + 4], eax
push ecx
call fcn.100261b9
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.1002f614
mov esp, ebp
pop ebp
ret 8
Function at 0x1001f3ab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
push ebx
mov ebx, ecx
jne 0x1001f3c1
mov al, 1
jmp 0x1001f535
cmp dword [ebx + 0xc], 1
jne 0x1001f3d2
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebx + 4], eax
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebx + 0xc], 0
mov byte [ebp - 8], 0
je 0x1001f429
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x1001f450
mov eax, dword [ebp + 0xc]
sub eax, esi
cmp eax, 0x4000
jb 0x1001f3fa
mov eax, 0x4000
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
add al, 1
mov dword [ebp - 8], eax
je 0x1001f450
add esi, 0x4000
cmp esi, dword [ebp + 0xc]
jb 0x1001f3e9
jmp 0x1001f448
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
dec eax
neg eax
sbb al, al
inc al
mov dword [ebp - 8], eax
test al, al
jne 0x1001f52c
cmp byte [ebx + 0x14], 0
je 0x1001f52c
cmp dword [ebx + 0xc], 0
jne 0x1001f52c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
mov edi, eax
call dword [edx + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebx + 0x1e]
push eax
mov dword [ebp - 0x14], edx
call fcn.1001fee8
push edi
mov dword [ebp - 0xc], eax
mov esi, edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
cmp esi, edi
jb 0x1001f4dd
ja 0x1001f49e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jbe 0x1001f4dd
mov edx, dword [ebp - 0x10]
mov ecx, edx
sub ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
mov eax, esi
sbb eax, edi
cmp eax, edi
jg 0x1001f4dd
jl 0x1001f4b8
cmp ecx, 0xffffffff
ja 0x1001f4dd
mov ecx, dword [ebp + 0xc]
mov eax, edi
add ecx, edx
adc eax, esi
mov dword [ebp - 0x14], eax
js 0x1001f4dd
jg 0x1001f4cd
cmp ecx, 0xffffffff
jbe 0x1001f4dd
lea esi, [ebx + 0x1e]
mov ecx, 0x100587e8
push esi
call fcn.1001ec8f
jmp 0x1001f4e0
lea esi, [ebx + 0x1e]
push edi
push esi
mov ecx, 0x100587e8
call fcn.1001eca0
test al, al
je 0x1001f51d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x1001f3d4
test eax, eax
je 0x1001f3d4
mov esi, dword [ebx]
mov ecx, ebx
push edi
call dword [esi + 0x14]
sub eax, dword [ebp - 4]
mov ecx, ebx
sbb edx, edi
push edx
push eax
call dword [esi + 0x10]
jmp 0x1001f3d4
lea eax, [ebx + 0x1e]
mov ecx, 0x100587e8
push eax
push edi
call fcn.1001ec8c
mov al, byte [ebp - 8]
pop edi
mov byte [ebx + 8], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8