joyce8/EMBER2024-capa huggingface dataset:
Function at 0x116cbec0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x116cbf64
mov edi, dword [esp + 0x218]
test edi, edi
je 0x116cbf5d
mov ebx, dword [esp + 0x21c]
test ebx, ebx
je 0x116cbf5d
lea ecx, [esp + 0xc]
test ecx, ecx
je 0x116cbf5d
mov eax, dword [esp + 0x220]
mov esi, 0x7a
test eax, eax
je 0x116cbf3a
lea edx, [esp + 0xc]
push eax
push edx
push 0x117b01ec
push ebx
push edi
call fcn.116e1000
add esp, 0x14
xor esi, esi
jmp 0x116cbf6c
lea eax, [esp + 0xc]
push eax
call fcn.116e0997
add esp, 4
cmp ebx, eax
jbe 0x116cbf6c
lea ecx, [esp + 0xc]
push ecx
push edi
call fcn.116e0f2f
add esp, 8
xor esi, esi
jmp 0x116cbf6c
mov esi, 0x57
jmp 0x116cbf6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
mov dword [0x117e0da4], esi
je 0x116cbf7d
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebx
sete al
add esp, 0x208
ret

Function at 0x116cbf90
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x117907a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
mov eax, dword [0x11794eec]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21e]
mov word [esp + 0x21c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], bx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push 0x104
push ecx
mov dword [esp + 0x434], 1
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x116cc089
lea edx, [esp + 0x21c]
test edx, edx
je 0x116cc082
lea eax, [esp + 0x14]
test eax, eax
je 0x116cc082
mov eax, dword [esp + 0x438]
mov esi, 0x7a
cmp eax, ebx
je 0x116cc053
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x117b01ec
lea edx, [esp + 0x228]
push 0x104
push edx
call fcn.116e1000
add esp, 0x14
xor esi, esi
mov eax, esi
jmp 0x116cc08f
lea eax, [esp + 0x14]
push eax
call fcn.116e0997
add esp, 4
cmp eax, 0x104
jae 0x116cc07e
lea ecx, [esp + 0x14]
lea edx, [esp + 0x21c]
push ecx
push edx
call fcn.116e0f2f
add esp, 8
xor esi, esi
mov eax, esi
jmp 0x116cc08f
mov eax, 0x57
jmp 0x116cc08f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x117e0da4], eax
je 0x116cc0a1
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x116cc0b2
lea eax, [esp + 0x21c]
lea ecx, [esp + 0xc]
push eax
call fcn.116a6a10
mov esi, dword [esp + 0x434]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.116a5d90
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x42c], bl
call fcn.116a6790
mov ecx, dword [esp + 0x424]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x424
ret
Function at 0x116d19c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x116d19e1
push 0x57
mov dword [0x117e0da4], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x116d1a12
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x116d1a12
test al, 0x10
jne 0x116d1a12
test al, 1
je 0x116d19dc
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret

Function at 0x116d1a80
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x116d1aa1
push 0x57
mov dword [0x117e0da4], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
jne 0x116d1ad2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x116d1ad2
test al, 0x10
jne 0x116d1ad2
test al, 1
je 0x116d1a9c
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
pop edi
pop esi
ret
pop edi
mov eax, 1
pop esi
ret
Function at 0x116d3b90
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x116d3bac
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.116e15e0
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.116e1720
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x116d3c30
cmp byte [esp + 0x10], 0x5c
jne 0x116d3c30
cmp byte [esp + 0x11], 0x5c
jne 0x116d3c30
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.116e1720
add esp, 8
test eax, eax
je 0x116d3cae
inc eax
push 0x5c
push eax
call fcn.116e1720
add esp, 8
mov esi, eax
test esi, esi
je 0x116d3cae
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x116d3c72
test bl, 1
je 0x116d3c61
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x116d3ce4
cmp ebx, 0xffffffff
je 0x116d3c7b
test edi, edi
jne 0x116d3c8a
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x116d3ce4
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.116e1720
mov esi, eax
add esp, 8
test esi, esi
jne 0x116d3c34
test ebp, ebp
je 0x116d3ce4
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x116d3cd9
test al, 0x10
jne 0x116d3ce4
test al, 1
je 0x116d3ccc
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x116d3ce4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x116d3d00
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
test ebx, ebx
jne 0x116d3d1c
xor eax, eax
pop ebx
add esp, 0x410
ret
push ebp
push esi
push edi
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.116e0f54
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.116e1860
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.116e0997
add esp, 0x18
cmp eax, 2
jbe 0x116d3da1
cmp word [esp + 0x10], di
jne 0x116d3da1
cmp word [esp + 0x12], di
jne 0x116d3da1
lea eax, [esp + 0x14]
push edi
push eax
call fcn.116e1860
add esp, 8
test eax, eax
je 0x116d3e29
add eax, 2
push edi
push eax
call fcn.116e1860
add esp, 8
mov esi, eax
test esi, esi
je 0x116d3e29
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x116d3de9
test bl, 1
je 0x116d3dd8
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x116d3e5f
cmp ebx, 0xffffffff
je 0x116d3df2
test edi, edi
jne 0x116d3e01
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x116d3e5f
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.116e1860
mov esi, eax
add esp, 8
test esi, esi
jne 0x116d3da9
test ebp, ebp
je 0x116d3e5f
mov ebx, dword [esp + 0x424]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x116d3e54
test al, 0x10
jne 0x116d3e5f
test al, 1
je 0x116d3e47
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x116d3e5f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x116d4860
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x26c]
push ebp
mov ebp, dword [esp + 0x26c]
push esi
mov esi, dword [esp + 0x26c]
mov eax, 0x1f3
push ebx
sub eax, ebp
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x116d48a9
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x25c
ret
push edi
mov edi, 1
mov eax, dword [ebx]
test al, 0x10
mov dword [esp + 0x14], eax
je 0x116d4a19
cmp word [ebx + 0x2c], 0x2e
lea ecx, [ebx + 0x2c]
jne 0x116d48e5
mov ax, word [ebx + 0x2e]
test ax, ax
je 0x116d49e9
cmp ax, 0x2e
jne 0x116d48e5
cmp word [ebx + 0x30], 0
je 0x116d49e9
push ecx
call fcn.116e0997
mov ecx, dword [esp + 0x1c]
mov ebx, eax
add esp, 4
lea eax, [ebx + 1]
cmp ecx, eax
jb 0x116d49e2
mov ecx, dword [esp + 0x278]
mov word [esi + ebp*2 - 2], 0
lea eax, [ecx + 0x2c]
push eax
push esi
call fcn.116e0f05
mov al, byte [esp + 0x284]
add esp, 8
test al, 0x10
je 0x116d493e
mov edx, dword [esp + 0x284]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
push esi
call dword [esp + 0x290]
mov edi, eax
test edi, edi
je 0x116d49a5
test byte [esp + 0x27c], 0x40
jne 0x116d49a5
lea ecx, [ebx + ebp]
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], 0
lea edx, [ebx + ebp + 1]
lea eax, [esi + ecx*2]
mov ecx, 0x93
mov word [eax - 2], 0x5c
mov word [eax], 0x2a
xor eax, eax
mov word [esi + edx*2], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x284]
mov ecx, dword [esp + 0x280]
push eax
mov eax, dword [esp + 0x280]
push ecx
lea ecx, [esp + 0x24]
push eax
push ecx
push edx
push esi
call fcn.116d4860
add esp, 0x18
mov edi, eax
test byte [esp + 0x27c], 0x20
je 0x116d49d5
test edi, edi
je 0x116d49d5
mov edx, dword [esp + 0x284]
mov eax, dword [esp + 0x14]
push edx
add ebx, ebp
push eax
push 0
push esi
mov word [esi + ebx*2 - 2], 0
call dword [esp + 0x290]
mov edi, eax
mov word [esi + ebp*2 - 2], 0x2a
mov word [esi + ebp*2], 0
mov ebx, dword [esp + 0x278]
test edi, edi
je 0x116d4a01
mov eax, dword [esp + 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x116d48af
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x25c
ret
mov ecx, dword [esp + 0x284]
lea edx, [ebx + 0x2c]
push ecx
push eax
push edx
push esi
mov word [esi + ebp*2 - 4], 0
call dword [esp + 0x290]
mov word [esi + ebp*2 - 4], 0x5c
mov edi, eax
mov word [esi + ebp*2 - 2], 0x2a
jmp 0x116d49e9
Function at 0x116d5b20
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x116d5b3f
push 0x57
mov dword [0x117e0da4], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
push 0
push 0x116d5a70
push 0x20
push esi
call fcn.116d4760
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test esi, esi
jne 0x116d5b85
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x117e0da4], eax
je 0x116d5b85
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
ret
Function at 0x116da4a0
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11790eb8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x116da4d2
call fcn.116c9660
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x116da4e3
mov ecx, 0x80000000
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x116da538
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x116da51e
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x116da664
cmp dword [esp + 0x18], ebx
jne 0x116da538
cmp dword [esp + 0x14], ebx
je 0x116da664
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x116da549
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.116a5d90
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x116da58f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x116da58f
call fcn.116f3b50
test eax, eax
je 0x116da58f
push 0x117b5260
lea ecx, [esp + 0x14]
call fcn.116a6a10
push ebx
lea ecx, [esp + 0x14]
call fcn.116a7440
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x116da63e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x116da5cb
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x116da63e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x116da619
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x116da61c
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x116da614
mov dword [esi + 0x10], ebx
jmp 0x116da61c
mov dword [esi + 0x10], ecx
jmp 0x116da61c
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.116a6790
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.116a6790
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x116dab30
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
mov dword [esi], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
lea ecx, [esi + 0xc]
lea edi, [esi + 0x14]
cmp eax, 0xffffffff
mov dword [esi + 8], ebx
mov dword [ecx], ebx
mov dword [esi + 0x10], ebx
mov dword [edi], ebx
mov dword [esi + 4], eax
mov dword [esi + 0x18], ebx
je 0x116dabd0
cmp eax, ebx
je 0x116dabd0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
push 1
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x116daba2
cmp dword [edi], ebx
je 0x116dabaf
mov ecx, dword [esi + 4]
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 4]
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x116dabd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x116dabe0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push 0x80000000
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x116dac72
cmp eax, ebx
je 0x116dac72
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x116dac7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x116dae20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x116daf77
xor edx, edx
cmp eax, edx
je 0x116daf77
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x116dae5a
cmp eax, ecx
jb 0x116dae5a
xor ecx, ecx
jmp 0x116dae5f
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x116dae79
jg 0x116daf77
cmp eax, dword [esi + 8]
ja 0x116daf77
cmp ecx, edx
jne 0x116dae93
cmp eax, dword [esi + 0x42c]
ja 0x116dae93
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x116daed8
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x116daeb3
cmp edi, edx
jb 0x116daeb3
xor edx, edx
jmp 0x116daeb8
mov edx, 1
cmp ecx, ebx
ja 0x116daed8
cmp dword [esp + 0x14], edx
jg 0x116daed8
jl 0x116daec8
cmp eax, edi
ja 0x116daed8
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.116daf90
test eax, eax
je 0x116daf77
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x116daf26
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x7fffffff
push ecx
call edi
cmp eax, 0xffffffff
je 0x116daf67
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x116daf67
jmp 0x116daf36
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x116daf67
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x116daf67
cmp dword [edi], ebp
jne 0x116daf67
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x116dfb90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push 0x117b01ec
push ecx
call fcn.116e0f91
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push SysStringLen
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x116dfc6a
mov edi, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x116dfc50
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
lea ecx, [eax + eax]
push ecx
call fcn.116e0478
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x116dfc50
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ebx
push edi
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x116dfc80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push 0x117b01ec
push ecx
call fcn.116e0f91
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push SysStringLen
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x116dfd19
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8