joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e2477
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, 0x10026ed8
test edi, edi
je 0x100e24da
mov eax, dword [0x10026edc]
mov edx, dword [0x10026ee0]
push 4
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push 0x2000100a
push 0x400
mov dword [ebp - 4], 1
mov dword [edi + 4], edx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100e24da
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [esi], ecx
je 0x100e24cf
inc eax
add esi, 0xc
cmp eax, 0x74
jb 0x100e24c0
jmp 0x100e24da
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [edi], eax
mov dword [edi + 4], ecx
pop edi
pop esi
leave
ret

Function at 0x100e4592
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x1018b72e
call fcn.10188e66
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x40], ebx
je 0x100e46aa
cmp byte [edi + 0x45], bl
je 0x100e46aa
mov eax, dword [edi]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x101d880c]
mov ecx, edi
call esi
cmp eax, 0xffffffff
jne 0x100e45d3
xor al, al
jmp 0x100e46ac
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.10082946
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x14]
mov ebx, dword [edi + 0x40]
mov esi, ecx
cmp edx, 0x10
jae 0x100e4601
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
add eax, esi
mov dword [ebp - 0x2c], eax
cmp edx, 0x10
jae 0x100e4611
lea ecx, [ebp - 0x28]
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x2c]
lea eax, [edi + 0x48]
push ecx
push eax
mov ecx, esi
call dword [0x101d880c]
mov ecx, ebx
call esi
xor ebx, ebx
sub eax, ebx
je 0x100e4651
sub eax, 1
je 0x100e4654
dec eax
sub eax, 1
jne 0x100e4641
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10043c5c
mov al, bl
jmp 0x100e46ac
mov byte [edi + 0x45], bl
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov eax, ecx
cmp edx, 0x10
jae 0x100e4664
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x100e468d
cmp edx, 0x10
jae 0x100e4673
lea ecx, [ebp - 0x28]
push dword [edi + 0x50]
push esi
push 1
push ecx
call dword [sym.imp.msvcrt.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x100e4641
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [edi + 0x45], bl
je 0x100e463f
test esi, esi
jne 0x100e45f4
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.10081f2b
jmp 0x100e45ee
mov al, 1
call fcn.10188e03
ret
Function at 0x100eec37
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100eecae
push 0x10029080
lea eax, [ebp - 0x210]
push 0x105
push eax
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x100eecae
push eax
push 0x80
push 3
push eax
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x100eecae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x100eecb0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101885f0
leave
ret

Function at 0x100efc2f
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x100efdb8
test ebx, ebx
je 0x100efdb8
lea eax, [edi + 3]
cmp eax, edi
jb 0x100efdb1
push 3
xor edx, edx
pop ecx
div ecx
push 4
pop ecx
mul ecx
test edx, edx
ja 0x100efdb1
jb 0x100efc79
cmp eax, 0xffffffff
ja 0x100efdb1
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x100efdb1
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
test esi, esi
jne 0x100efca2
mov eax, 0x8007000e
jmp 0x100efdbd
push 3
pop ecx
cmp edi, ecx
jl 0x100efd23
mov eax, edi
xor edx, edx
div ecx
imul ecx, eax, 0xfffffffd
add edi, ecx
mov dword [ebp - 8], edi
mov edi, eax
movzx edx, byte [ebx]
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
add ebx, 3
shl edx, 8
add edx, ecx
shl edx, 8
add edx, eax
mov eax, edx
shr eax, 0x12
mov ax, word [eax*2 + 0x10029458]
mov word [esi], ax
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov ax, word [eax*2 + 0x10029458]
mov word [esi + 2], ax
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
mov ax, word [eax*2 + 0x10029458]
mov word [esi + 4], ax
mov ax, word [edx*2 + 0x10029458]
mov word [esi + 6], ax
add esi, 8
sub edi, 1
jne 0x100efcb9
mov edi, dword [ebp - 8]
cmp edi, 2
jne 0x100efd6c
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
mov eax, ecx
shr eax, 0xa
push 0x3d
mov ax, word [eax*2 + 0x10029458]
mov word [esi], ax
mov eax, ecx
shr eax, 4
and eax, 0x3f
and ecx, 0xf
mov ax, word [eax*2 + 0x10029458]
mov word [esi + 2], ax
mov ax, word [ecx*8 + 0x10029458]
mov word [esi + 4], ax
pop eax
jmp 0x100efd9c
cmp edi, 1
jne 0x100efda8
movzx ecx, byte [ebx]
mov eax, ecx
and ecx, 3
shr eax, 2
shl ecx, 5
push 0x3d
mov ax, word [eax*2 + 0x10029458]
mov word [esi], ax
mov ax, word [ecx + 0x10029458]
mov word [esi + 2], ax
pop eax
mov word [esi + 4], ax
mov word [esi + 6], ax
xor eax, eax
mov word [esi + 8], ax
jmp 0x100efdad
xor eax, eax
mov word [esi], ax
xor eax, eax
jmp 0x100efdbd
mov eax, 0x80070216
jmp 0x100efdbd
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10101031
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x10101153
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10101153
xor edi, edi
cmp dword [esi + 8], edi
jne 0x10101061
xor eax, eax
inc eax
jmp 0x1010115d
push edi
xor edx, edx
call fcn.10109e4c
mov ebx, eax
test ebx, ebx
jne 0x10101076
push 0x66
jmp 0x10101155
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x128], edi
jne 0x10101146
mov edx, ebx
mov ecx, esi
call fcn.1010129c
test eax, eax
je 0x10101141
mov edx, ebx
mov ecx, esi
call fcn.10101406
test eax, eax
je 0x10101141
mov eax, dword [ebx + 0x28]
mov dword [ebp - 4], 1
mov ecx, dword [eax + 4]
lea edi, [eax + 0x14]
test ecx, ecx
je 0x10101146
dec ecx
cmp dword [edi + 0x10], 0
mov dword [ebp - 8], ecx
je 0x1010112f
cmp dword [edi + 0x24], 0
je 0x101010f6
push dword [edi + 0x1c]
mov edx, ebx
mov ecx, edi
push dword [ebx + 0x2c]
push esi
call fcn.100ff122
cmp eax, 0x80004001
je 0x1010112c
xor ecx, ecx
test eax, eax
setns cl
mov dword [ebp - 4], ecx
test eax, eax
js 0x1010113c
jmp 0x1010112c
test byte [edi + 0x3c], 0x20
je 0x10101101
mov eax, dword [edi + 0x54]
jmp 0x1010110e
push 5
pop edx
mov ecx, edi
call fcn.10138916
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1010112f
push dword [edi + 0x1c]
mov ecx, eax
push dword [ebx + 0x2c]
push esi
push ebx
call dword [0x101d880c]
call dword [ebp - 0xc]
test eax, eax
je 0x10101138
mov ecx, dword [ebp - 8]
add edi, 0x78
test ecx, ecx
jne 0x101010bf
jmp 0x1010113c
and dword [ebp - 4], 0
mov esi, dword [ebp - 4]
jmp 0x10101149
mov dword [ebp - 4], edi
jmp 0x1010113c
xor esi, esi
inc esi
push ebx
call fcn.10109de0
mov eax, esi
jmp 0x1010115d
push 0x65
push esi
call fcn.1010116a
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10104b71
Capabilities:
Create directory
Delete file
Get common file path
Move file
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
xor esi, esi
cmp dword [ebx], 0xffffffff
jne 0x10104b8c
xor eax, eax
inc eax
jmp 0x10104c91
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
call fcn.101049f2
mov dword [ebp - 8], eax
test eax, eax
je 0x10104c8f
push edi
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x10104c7a
push esi
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], esi
push esi
push 0x8100000
push 2
push esi
push esi
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x10104c48
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10104c22
push edi
push esi
push 0x1002a838
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10104c7a
push 1
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x10104c7a
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x10104c7a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 2
jb 0x10104bc6
jmp 0x10104c7a
cmp dword [ebp - 4], esi
je 0x10104c61
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10104c64
push esi
lea eax, [ebp - 4]
push eax
push 0x1000
push edi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10104c2d
jmp 0x10104c64
xor esi, esi
inc esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x10104c7a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x10104c8e
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1010a002
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
inc ebx
test edi, edi
je 0x1010a1b4
cmp dword [ebp + 8], ebx
je 0x1010a02a
cmp dword [ebp + 8], 2
jne 0x1010a1b4
mov edx, dword [edi]
xor ecx, ecx
push 0x104c
call fcn.10109e4c
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0x1010a1bc
mov ecx, esi
call fcn.1010481d
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 8]
call fcn.101463eb
mov dword [ebp - 4], eax
test eax, eax
je 0x1010a074
push dword [ebp - 8]
mov ecx, dword [esi + 0x10]
mov edx, eax
call fcn.1014658a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, esi
call fcn.1010a1cb
mov ecx, dword [esi + 0x10]
call fcn.10109c37
cmp dword [ebp + 8], 2
jne 0x1010a092
mov edx, edi
mov ecx, esi
call fcn.101188fb
mov ecx, esi
call fcn.101092d1
test eax, eax
je 0x1010a0bb
mov ecx, esi
call fcn.101093c2
test eax, eax
je 0x1010a0bb
mov eax, dword [esi + 0x24]
cmp dword [eax + 0x134], 0
je 0x1010a0bb
mov edx, esi
call fcn.10118870
cmp dword [esi + 0x38], 0
je 0x1010a0c5
or dword [esi + 0x48], 0xc
mov eax, dword [esi + 0x28]
lea edi, [eax + 0x14]
mov eax, dword [eax + 4]
test eax, eax
je 0x1010a184
mov esi, dword [ebp + 0xc]
dec eax
cmp dword [edi + 0x10], 0
mov dword [ebp - 4], eax
je 0x1010a172
cmp dword [edi + 0x24], 0
je 0x1010a108
mov edx, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.100ff1ff
cmp eax, 0x80004001
je 0x1010a16f
xor ebx, ebx
test eax, eax
setns bl
jmp 0x1010a16f
cmp byte [edi + 0x3c], 0
jge 0x1010a113
mov eax, dword [edi + 0x5c]
jmp 0x1010a11d
push 7
pop edx
mov ecx, edi
call fcn.10138916
mov dword [ebp - 8], eax
test eax, eax
je 0x1010a139
push esi
push dword [ebp + 8]
mov ecx, eax
call dword [0x101d880c]
call dword [ebp - 8]
neg eax
sbb eax, eax
and ebx, eax
test byte [edi + 0x3d], 4
je 0x1010a144
mov eax, dword [edi + 0x68]
jmp 0x1010a14e
push 0xa
pop edx
mov ecx, edi
call fcn.10138916
mov dword [ebp - 8], eax
test eax, eax
je 0x1010a16f
push fcn.1010a8e0
push esi
push dword [ebp + 8]
mov ecx, eax
call dword [0x101d880c]
call dword [ebp - 8]
neg eax
sbb eax, eax
and ebx, eax
mov eax, dword [ebp - 4]
add edi, 0x78
test eax, eax
jne 0x1010a0d9
mov esi, dword [ebp - 0xc]
test ebx, ebx
je 0x1010a1aa
test dword [esi + 0x48], 0x100
je 0x1010a1aa
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
and eax, 0x100000
push eax
push ecx
push dword [esi + 0x34]
mov ecx, dword [esi + 0x10]
call fcn.10135554
mov ebx, eax
push esi
call fcn.10109de0
mov eax, ebx
jmp 0x1010a1be
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1010a385
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov dword [ebp - 0xc], edx
mov ecx, dword [esi + 0x4fc]
mov eax, dword [esi + 0x4f8]
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x1010a3b2
mov dword [esi + 0x4d4], eax
jmp 0x1010a3be
cmp dword [esi + 0x4d4], eax
jne 0x1010a4c9
mov ebx, dword [esi + 0x28]
mov eax, dword [ebx + 4]
test eax, eax
je 0x1010a51d
add ebx, 0x14
dec eax
cmp dword [ebx + 0x10], 0
mov dword [ebp - 8], eax
je 0x1010a512
cmp dword [ebx + 0x24], 0
jne 0x1010a40b
test byte [ebx + 0x3c], 4
je 0x1010a3ee
mov edx, dword [ebx + 0x48]
jmp 0x1010a400
push 2
pop edx
mov ecx, ebx
call fcn.10138916
mov ecx, dword [ebp - 4]
mov edx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], edx
test edx, edx
je 0x1010a512
mov edi, dword [ebx + 0x14]
test edi, edi
jne 0x1010a46c
test ecx, ecx
jne 0x1010a512
push 0x3c
push 8
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1010a4c9
mov dword [ebx + 0x14], edi
mov dword [edi], 0x3c
mov ecx, dword [esi + 0x28]
mov ecx, dword [ecx]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 0x10]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x4d8]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x4d4]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 4]
mov dword [edi + 0x2c], eax
cmp dword [ebx + 0x24], 0
mov eax, dword [edi + 0x30]
mov ecx, dword [esi + 0x58]
mov dword [ebp - 0x10], eax
push edi
je 0x1010a4d0
xor edx, edx
test ecx, ecx
mov ecx, ebx
setne dl
inc edx
call fcn.100ff0c1
cmp eax, 0x80004001
jne 0x1010a4bf
push edi
push 0
push dword [esi + 0x44]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [ebx + 0x14], 0
mov ecx, dword [ebp - 4]
jmp 0x1010a50f
test eax, eax
jns 0x1010a4e9
cmp dword [ebp - 4], 0
je 0x1010a4aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 0xc]
setne al
inc eax
push eax
call dword [0x101d880c]
call dword [ebp - 0xc]
test eax, eax
je 0x1010a4c3
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1010a506
mov eax, dword [edi + 0x30]
cmp dword [ebp - 0x10], eax
jne 0x1010a4c9
imul eax, eax, 0x34
add ecx, eax
add dword [esi + 0x4fc], eax
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x30]
add dword [esi + 0x4f8], eax
mov eax, dword [ebp - 8]
add ebx, 0x78
test eax, eax
jne 0x1010a3cf
xor eax, eax
inc eax
jmp 0x1010a4cb

Function at 0x1010a69f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
push esi
push edi
mov edi, dword [ebx + 0x28]
mov eax, dword [edi + 4]
test eax, eax
je 0x1010a78a
add edi, 0x14
Function at 0x1011041e
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [esi], ecx
push edi
mov edi, ecx
test ebx, ebx
je 0x101105ef
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x101105ef
cmp dword [eax + 4], ecx
je 0x101105ef
lea ecx, [ebp - 0xc]
push ecx
push dword [eax + 0x14]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x101104ec
invalid
push eax
mov eax, 0x80070057

Function at 0x101126e1
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, edx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x218], eax
mov dword [ebx], esi
mov dword [eax], esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
mov dword [ecx], esi
push esi
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], edx
mov dword [edx], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10112750
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10112818
movzx eax, ax
or eax, 0x80070000
jmp 0x10112818
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
push 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov edi, eax
test edi, edi
je 0x101127cb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
jne 0x1011277f
mov eax, 0x8007000e
jmp 0x10112817
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
push 2
call dword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
test eax, eax
jne 0x1011279a
push esi
jmp 0x101127c5
lea eax, [ebp - 0x214]
mov dword [ebp - 0x210], edi
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], edi
push eax
push 0x1001d750
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
push esi
test eax, eax
jne 0x101127df
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10112817
movzx eax, ax
or eax, 0x80070000
jmp 0x10112817
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x218]
movzx eax, word [ecx + 0xa]
mov dword [ebx], eax
movzx eax, word [ecx + 8]
mov dword [edx], eax
movzx eax, word [ecx + 0xe]
mov edx, dword [ebp - 0x21c]
mov dword [edx], eax
movzx eax, word [ecx + 0xc]
mov ecx, dword [ebp - 0x220]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.101885f0
leave
ret 8
Function at 0x10119940
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
and dword [ebp - 8], 0
mov edi, ecx
push 0x10
mov ecx, dword [esi + 0x34]
add ecx, dword [esi + 0x2c]
add ecx, dword [esi + 0x1c]
add ecx, dword [esi + 0x14]
mov eax, dword [esi + 4]
add ecx, dword [esi + 0xc]
add eax, 0x3c
pop ebx
add eax, ecx
mov dword [ebp - 0x14], 0x49464944
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], bx
push eax
push edi
mov word [ebp - 0xe], dx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, esi
mov ecx, edi
call fcn.10119b87
mov ecx, dword [ebp - 4]
add eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101885f0
leave
ret 4

Function at 0x101199be
Capabilities:
Get file size
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov dword [ebp - 0x18], eax
push edi
mov edi, ecx
test edx, edx
je 0x10119a4f
cmp word [edx], ax
je 0x10119a4f
push eax
push eax
push 3
push eax
push 1
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10119a4f
push ebx
push 0x10
pop ebx
xor eax, eax
mov dword [ebp - 0x14], 0x52415644
push eax
push esi
mov word [ebp - 0x10], bx
mov word [ebp - 0xe], ax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and dword [ebp - 8], 0
push 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
test eax, eax
je 0x10119a43
mov edx, esi
mov ecx, edi
call fcn.10119af2
add dword [ebp - 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
jmp 0x10119a51
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.101885f0
leave
ret

Function at 0x10119a65
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
push edi
mov edi, ecx
test esi, esi
je 0x10119ad9
mov eax, dword [ebp + 8]
test eax, eax
je 0x10119ad9
push 0x10
pop edx
push ebx
mov dword [ebp - 0xc], eax
xor ecx, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x52415644
push eax
push edx
lea eax, [ebp - 0x14]
mov word [ebp - 0x10], dx
push eax
push edi
mov word [ebp - 0xe], cx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10119ad9
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10119ad9
mov eax, dword [ebp - 0x18]
add eax, dword [ebp + 8]
jmp 0x10119adb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101885f0
leave
ret 4
Function at 0x10119af2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
xor esi, esi
jmp 0x10119b4c
cmp dword [ebp - 0x808], 0
je 0x10119b7d
push 0
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 0x808]
lea eax, [ebp - 0x804]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10119b6c
mov eax, dword [ebp - 0x80c]
cmp eax, dword [ebp - 0x808]
jne 0x10119b6c
add esi, eax
push 0
lea eax, [ebp - 0x808]
push eax
push 0x800
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10119b12
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101885f0
leave
ret
mov eax, esi
jmp 0x10119b6e

Function at 0x1011a354
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebx], esi
lea edx, [ecx + 2]
mov dword [ebx + 4], esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1011a370
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 0xa]
push ecx
push 0x40
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x1011a44a
mov eax, dword [ebp - 4]
mov ecx, edi
push dword [ebp + 8]
shr eax, 1
mov edx, eax
mov dword [ebp - 4], eax
call fcn.1004503e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1011a3b5
sub ecx, edx
push 0x2e
sar ecx, 1
pop eax
jmp 0x1011a3cf
cmp word [edi + ecx*2], ax
je 0x1011a3ef
dec ecx
test ecx, ecx
jg 0x1011a3c9
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1011a3d9
sub ecx, edx
sar ecx, 1
push 0x2e
pop eax
mov word [edi + ecx*2], ax
mov edx, dword [ebp - 4]
inc ecx
sub edx, ecx
push 0x1002d078
lea ecx, [edi + ecx*2]
call fcn.1004503e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1011a443
mov edx, dword [ebp - 8]
mov ecx, edi
call fcn.1011a4c2
mov ecx, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x1011a443
cmp dword [ecx], 0x6c666e66
mov dword [ebx + 4], ecx
jne 0x1011a443
mov eax, dword [ecx + 8]
cmp dword [ecx + eax], 0x63657266
jne 0x1011a443
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
mov esi, dword [ecx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4