joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016eed0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, ecx
lea esi, [ebp + 8]
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push 0x1e2
push str..._.._base_win_registry.cc
push str.StartWatching
push eax
call fcn.1014e3e0
mov ecx, edi
add esp, 0x10
mov edi, dword [edi + 8]
test edi, edi
jne 0x1016efa0
push 0x38
mov esi, ecx
call fcn.1020d865
add esp, 4
mov edi, eax
lea ecx, [eax + 8]
xorps xmm0, xmm0
movups xmmword [eax + 8], xmm0
movups xmmword [eax + 0x18], xmm0
movups xmmword [eax + 0x28], xmm0
mov dword [eax], 0x1025933c
mov dword [eax + 4], 0
call fcn.1016e7c0
mov dword [edi + 0x34], 0
mov ebx, dword [esi + 8]
mov dword [esi + 8], edi
test ebx, ebx
je 0x1016ef9b
mov dword [ebx], 0x1025933c
lea ecx, [ebx + 0x34]
call fcn.10145de0
lea ecx, [ebx + 8]
call fcn.1016e7f0
mov eax, dword [ebx + 4]
add eax, 1
cmp eax, 2
jb 0x1016ef8b
call fcn.1014e410
push dword [ebx + 4]
call fcn.1016f280
add esp, 4
mov dword [ebx + 4], 0
push ebx
call fcn.10205096
add esp, 4
mov ecx, esi
mov edi, dword [esi + 8]
jmp 0x1016ef9d
mov ecx, esi
lea esi, [ebp + 8]
mov dword [ebp - 0x28], esp
sub esp, 8
mov ebx, esp
mov eax, dword [esi]
mov dword [ebx + 4], eax
mov dword [esi], 0
mov ecx, dword [ecx]
mov dword [ebx], ecx
mov esi, dword [edi + 4]
lea eax, [esi + 1]
cmp eax, 1
ja 0x1016f031
mov dword [ebp - 0x24], ecx
sub esp, 0x10
movaps xmm0, xmmword [0x102650b0]
movups xmmword [esp], xmm0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov esi, eax
cmp dword [edi + 4], eax
je 0x1016f02e
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [edi + 4]
add ecx, 1
cmp ecx, 2
jb 0x1016f00e
mov dword [ebp - 0x2c], eax
call fcn.1014e410
push dword [edi + 4]
call fcn.1016f280
mov eax, dword [ebp - 0x2c]
add esp, 4
mov dword [edi + 4], 0
mov ecx, esi
add ecx, 1
cmp ecx, 2
jb 0x1016f024
mov dword [edi + 4], esi
mov esi, eax
call fcn.1014e410
mov eax, esi
push eax
call dword [sym.imp.kernel32.dll_SetLastError]
mov esi, dword [edi + 4]
mov ecx, dword [ebp - 0x24]
add ebx, 4
lea eax, [esi + 1]
cmp eax, 2
jae 0x1016f070
mov dword [ebp - 0x24], 0
lea esi, [ebp + 8]
mov edi, dword [ebp - 0x28]
mov ecx, ebx
call fcn.10145de0
mov esp, edi
mov ecx, esi
call fcn.10145de0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 1
push esi
push 0xf
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x1016f0a6
mov eax, dword [edi + 4]
add eax, 1
cmp eax, 2
jb 0x1016f03c
call fcn.1014e410
push dword [edi + 4]
call fcn.1016f280
add esp, 4
mov dword [edi + 4], 0
jmp 0x1016f03c
lea ecx, [edi + 0x34]
push ebx
call fcn.10145d70
lea esi, [edi + 8]
push 0x5e
push str..._.._base_win_registry.cc
push str.StartWatching
lea eax, [ebp - 0x20]
push eax
call fcn.1014e3e0
add esp, 0x10
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
push 1
push edi
push dword [edi + 4]
call fcn.1016e8d0
mov dword [ebp - 0x24], eax
jmp 0x1016f043
Function at 0x10170090
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x15c], eax
lea eax, [esp + 0x44]
push 0x118
push 0
push eax
call fcn.10208980
add esp, 0xc
mov dword [esp + 0x40], 0x11c
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x54]
push dword [esp + 0x54]
call dword [sym.imp.kernel32.dll_GetProductInfo]
push 0x54
call fcn.1020d865
add esp, 4
mov esi, eax
mov edi, dword [esp + 0xc]
mov eax, dword [0x102b5ff4]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10170145
lea edx, [esp + 0x40]
mov ecx, esi
push edi
call fcn.101704a0
add esp, 4
mov ecx, dword [esp + 0x15c]
xor ecx, ebp
call fcn.10205d16
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
push 0x102b5ff4
call fcn.1020d865
add esp, 4
cmp dword [0x102b5ff4], 0xffffffff
jne 0x1017011f
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x102b5ff0], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x102b5fe0], xmm1
movups xmmword [0x102b5fd0], xmm0
push 0x102b5ff4
call fcn.1020d865
add esp, 4
jmp 0x1017011f
Function at 0x10170270
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x15c], eax
push str.ntdll.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x101703b3
push str.RtlGetVersion
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x101703b3
mov esi, eax
lea eax, [esp + 0x44]
push 0x118
push 0
push eax
call fcn.10208980
add esp, 0xc
mov dword [esp + 0x40], 0x11c
lea eax, [esp + 0x40]
push eax
call esi
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x54]
push dword [esp + 0x54]
call dword [sym.imp.kernel32.dll_GetProductInfo]
push 0x54
call fcn.1020d865
add esp, 4
mov esi, eax
mov edi, dword [esp + 0xc]
mov eax, dword [0x102b5ff4]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1017034a
lea edx, [esp + 0x40]
mov ecx, esi
push edi
call fcn.101704a0
add esp, 4
mov ecx, dword [esp + 0x15c]
xor ecx, ebp
call fcn.10205d16
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
push 0x102b5ff4
call fcn.1020d865
add esp, 4
cmp dword [0x102b5ff4], 0xffffffff
jne 0x10170324
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x102b5ff0], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x102b5fe0], xmm1
movups xmmword [0x102b5fd0], xmm0
push 0x102b5ff4
call fcn.1020d865
add esp, 4
jmp 0x10170324
int3

Function at 0x101703c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x102b5ff4]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1017043b
movzx eax, word [0x102b5fd0]
cmp eax, 0xc
ja case.0x10170400.1
xor esi, esi
jmp dword [eax*4 + 0x102652b0]
mov esi, 3
jmp case.0x10170400.0
mov esi, 5
jmp case.0x10170400.0
mov esi, 2
jmp case.0x10170400.0
mov esi, 1
jmp case.0x10170400.0
mov esi, 4
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.10205d16
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x102b5ff4
call fcn.1020d865
add esp, 4
cmp dword [0x102b5ff4], 0xffffffff
jne 0x101703f2
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x20]
mov dword [0x102b5ff0], eax
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
movups xmmword [0x102b5fe0], xmm1
movups xmmword [0x102b5fd0], xmm0
push 0x102b5ff4
call fcn.1020d865
add esp, 4
jmp 0x101703f2
Function at 0x10171ba0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx]
lea eax, [ebx + 1]
cmp eax, 2
jae 0x10171bc4
xor ebx, ebx
jmp 0x10171c80
mov esi, ecx
cmp dword [ecx + 4], 1
jne 0x10171c94
mov dword [esi], 0
call fcn.1014e410
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
call fcn.1014e410
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push 0
push 0
push 5
push ecx
push eax
mov dword [ebp - 0x1c], ebx
push ebx
push eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x10171c6b
mov ebx, dword [ebp - 0x14]
cmp dword [esi], ebx
je 0x10171c64
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jb 0x10171c4a
mov dword [ebp - 0x18], eax
call fcn.1014e410
push dword [esi]
call fcn.1016f280
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x10171c5d
mov dword [esi], ebx
mov ebx, eax
call fcn.1014e410
mov eax, ebx
push eax
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [esi + 4], 0
test edi, edi
setne bl
call fcn.1014e410
push dword [ebp - 0x1c]
call fcn.1016f280
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
int3

Function at 0x10171ca0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x38], eax
xor eax, eax
cmp dword [esi + 4], 0
setne al
mov ebx, ecx
sar ebx, 0x1f
add eax, eax
add eax, 4
push dword [ebp + 0xc]
push ecx
push ebx
mov dword [esp + 0x18], eax
push eax
push dword [esi]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x10171d1d
call fcn.101be560
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x10171d1d
call fcn.101be560
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
test edi, edi
je 0x10171d68
mov esi, dword [ebp + 0x14]
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x1c], xmm0
movdqa xmmword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
push 0x1c
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
mov ecx, dword [esp + 0x1c]
sub ecx, edi
add ecx, dword [esp + 0x14]
test eax, eax
cmove ecx, eax
mov dword [esi], ecx
mov bl, 1
mov ecx, dword [esp + 0x38]
xor ecx, ebp
call fcn.10205d16
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor ebx, ebx
jmp 0x10171d51
Function at 0x10174640
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [0x102b6080], 0x10259364
mov dword [0x102b6084], 0
mov dword [0x102b6088], 0
mov byte [0x102b608c], 0
mov dword [0x102b60ac], 0
mov dword [0x102b60b0], 0
mov dword [0x102b60b4], 0
mov dword [0x102b60bc], 0
mov dword [0x102b60c0], 0
xorps xmm0, xmm0
movups xmmword [0x102b6090], xmm0
movups xmmword [0x102b6099], xmm0
mov dword [0x102b60b8], 0x102b60bc
movups xmmword [0x102b60c4], xmm0
movups xmmword [0x102b60d4], xmm0
mov dword [0x102b60e8], 0
mov dword [0x102b60e4], 0
mov dword [0x102b60ec], 0x3f800000
movups xmmword [0x102b60f0], xmm0
mov dword [0x102b6100], 0
mov dword [0x102b6104], 0x3f800000
movups xmmword [0x102b6108], xmm0
mov dword [0x102b6118], 0x3f800000
movups xmmword [0x102b611c], xmm0
mov dword [0x102b612c], 0x3f800000
movups xmmword [0x102b6130], xmm0
mov dword [0x102b6140], 0x3f800000
mov dword [0x102b6164], 0
mov dword [0x102b6160], 0
movups xmmword [0x102b6148], xmm0
mov dword [0x102b6158], 0
mov dword [0x102b6168], 1
mov ecx, 0x102b616c
call fcn.101bed80
mov dword [0x102b6204], 0
mov dword [0x102b6208], 0
mov dword [0x102b620c], 0
mov ecx, 0x102b6210
push 0
call fcn.101620c0
mov ecx, 0x102b6218
push 0
call fcn.101620c0
mov ecx, 0x102b6220
push 0
call fcn.101620c0
xorps xmm0, xmm0
movups xmmword [0x102b6228], xmm0
mov dword [0x102b6238], 0x3f800000
movups xmmword [0x102b623c], xmm0
movups xmmword [0x102b6249], xmm0
movups xmmword [0x102b625c], xmm0
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [0x102b6158], eax
mov esi, eax
xor ecx, 0x84222325
mov edx, 0x1b3
mov eax, ecx
mul edx
sar esi, 0x1f
xor esi, 0xcbf29ce4
shl ecx, 8
add ecx, edx
imul edx, esi, 0x1b3
add edx, ecx
mov dword [0x102b6150], eax
mov dword [0x102b6154], edx
mov ecx, dword [0x102b6168]
mov eax, dword [0x102b6170]
shr eax, 6
test cl, 2
jne 0x10174839
test cl, 8
jne 0x10174842
test cl, 0x10
jne 0x10174854
test eax, eax
mov ecx, 0xfa0
jmp 0x1017485b
test eax, eax
mov ecx, 0x3e8
jmp 0x10174849
test eax, eax
mov ecx, 0x100
cmovne ecx, eax
push ecx
call fcn.101bfb50
jmp 0x10174864
test eax, eax
mov ecx, 0x7a1200
cmovne ecx, eax
push ecx
call fcn.101bfd40
add esp, 4
mov ecx, dword [0x102b6094]
mov dword [0x102b6094], eax
test ecx, ecx
je 0x1017487c
mov eax, dword [ecx]
push 1
call dword [eax]
call fcn.10173210
mov ecx, eax
push 0
push str.TraceLog
push 0x102b6080
call fcn.101732a0
pop esi
pop ebp
ret
Function at 0x1018d826
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, 0x9f
jle 0x1018d850
lea eax, [esi - 0xf3]
cmp eax, 4
jb 0x1018d890
lea eax, [esi - 0xa0]
cmp eax, 2
jb 0x1018d890
jmp 0x1018d866
lea eax, [esi - 0x7f]
cmp eax, 2
jb 0x1018d890
cmp esi, 0x10
je 0x1018d890
cmp esi, 0x1b
jne 0x1018d866
mov bl, 1
jmp 0x1018d890
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov bl, 1
test ax, ax
js 0x1018d890
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1018d890
push 2
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
sete bl
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x1019abf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x1019ac42
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x1019ac2c
call fcn.1014e410
push dword [esi]
call fcn.1016f280
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1019ac3b
mov dword [esi], ebx
call fcn.1014e410
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
lea ecx, [esi + 0x10]
call fcn.101e3c30
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
mov al, byte [ebp + 0xc]
mov byte [esi + 0x19], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x1019ac80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.1019afa0
mov dword [esi], 0
test eax, eax
je 0x1019ace4
mov ebx, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [esi]
add ecx, 1
cmp ecx, 2
jb 0x1019acca
mov dword [ebp - 0x10], eax
call fcn.1014e410
push dword [esi]
call fcn.1016f280
mov eax, dword [ebp - 0x10]
add esp, 4
mov dword [esi], 0
lea ecx, [ebx + 1]
cmp ecx, 2
jb 0x1019acdd
mov dword [esi], ebx
mov ebx, eax
call fcn.1014e410
mov eax, ebx
push eax
call dword [sym.imp.kernel32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.1014be30
lea ecx, [esi + 0x10]
call fcn.101e3c30
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1019b090
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x6c], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea edi, [esp + 0x10]
push 0x9c
push str..._.._base_files_file_win.cc
push str.GetLength
push edi
call fcn.1014e3e0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.10160300
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0
call fcn.1002a3d0
test al, al
je 0x1019b118
lea ecx, [esp + 0x10]
push 0
push 0
push esi
push str.File::GetLength
call fcn.101e3c40
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xffffffff
lea eax, [esp + 8]
push eax
push dword [esi]
call dword [sym.imp.kernel32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb esi, esi
mov edi, dword [esp + 0xc]
or edi, esi
or esi, dword [esp + 8]
lea ecx, [esp + 0x10]
call fcn.1002a710
lea ecx, [esp + 0x20]
call fcn.10160360
mov ecx, dword [esp + 0x6c]
xor ecx, ebp
call fcn.10205d16
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x1019b220
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
lea esi, [esp + 0x10]
push 0x15a
push str..._.._base_files_file_win.cc
push str.DoInitialize
push esi
call fcn.1014e3e0
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push esi
call fcn.10160300
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov ecx, 1
cmove ecx, eax
test bl, 4
mov edx, 4
cmovne ecx, edx
test bl, 8
mov esi, 2
cmove esi, ecx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x1019b3e2
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov ecx, ebx
and ecx, 0x40
shl ecx, 0x18
test bl, bl
cmovns edx, ecx
mov ecx, ebx
rol ecx, 0x1a
mov esi, ebx
shl esi, 0xb
and esi, 0x20000000
mov edi, ebx
shr edi, 4
and edi, 0x10000
and ecx, 0x80000100
or ecx, esi
or ecx, edi
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
mov esi, ebx
and esi, 0x400
mov eax, ebx
mov dword [esp + 0xc], esi
mov ebx, esi
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, eax
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, eax
shl edi, 8
mov ebx, edi
and ebx, 0x2000000
or ebx, esi
and edi, 0x8000000
or edi, ebx
mov esi, dword [ebp + 8]
xor edx, 3
cmp byte [esi + 0xb], 0
jns 0x1019b368
mov esi, dword [esi]
mov ebx, dword [esp + 8]
mov eax, dword [esp + 4]
push 0
push edi
push eax
push 0
push edx
push ecx
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp dword [ebx], eax
je 0x1019b3c6
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebx]
add eax, 1
cmp eax, 2
jb 0x1019b3ac
call fcn.1014e410
push dword [ebx]
call fcn.1016f280
add esp, 4
mov dword [ebx], 0
mov eax, edi
add eax, 1
cmp eax, 2
jb 0x1019b3bd
mov dword [ebx], edi
call fcn.1014e410
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
mov edi, dword [ebx]
add edi, 1
cmp edi, 2
jae 0x1019b3f3
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.1019b170
add esp, 4
mov dword [ebx + 0x14], eax
jmp 0x1019b424
push 0x57
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [edi + 0x14], 0xffffffff
jmp 0x1019b424
mov eax, dword [esp + 0xc]
shr eax, 0xa
mov dword [ebx + 0x14], 0
mov byte [ebx + 0x19], al
mov eax, dword [ebp + 0xc]
test al, 4
jne 0x1019b415
test al, 0xa
je 0x1019b424
mov byte [ebx + 0x18], 1
jmp 0x1019b424
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
setne byte [ebx + 0x18]
lea ecx, [esp + 0x20]
call fcn.10160360
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.10205d16
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1019b450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x1019b49c
mov esi, ecx
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x1019b486
call fcn.1014e410
push dword [esi]
call fcn.1016f280
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x1019b495
mov dword [esi], ebx
call fcn.1014e410
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1019b4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 0xc]
xor eax, eax
test ecx, ecx
jle 0x1019b5e4
mov edx, dword [ebp + 8]
test edx, edx
je 0x1019b5e4
mov esi, ecx
and esi, 3
mov eax, ecx
shr eax, 2
je 0x1019b56a
mov dword [ebp - 0x10], esi
mov ebx, ecx
mov esi, edx
mov edi, eax
test cl, 4
je 0x1019b50d
movzx edi, word [edx]
add edi, ecx
movzx esi, word [edx + 2]
shl esi, 0xb
xor esi, edi
shl edi, 0x10
xor edi, esi
lea esi, [edx + 4]
mov ebx, edi
shr ebx, 0xb
add ebx, edi
lea edi, [eax - 1]
cmp eax, 1
je 0x1019b560
add edi, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, word [esi]
add eax, ebx
movzx ebx, word [esi + 2]
shl ebx, 0xb
xor ebx, eax
shl eax, 0x10
xor eax, ebx
mov ebx, eax
shr ebx, 0xb
add ebx, eax
movzx eax, word [esi + 4]
add eax, ebx
movzx ebx, word [esi + 6]
shl ebx, 0xb
xor ebx, eax
shl eax, 0x10
xor eax, ebx
mov ebx, eax
shr ebx, 0xb
add ebx, eax
add edi, 0xfffffffe
add esi, 8
cmp edi, 2
jg 0x1019b520
and ecx, 0xfffffffc
add edx, ecx
mov ecx, ebx
mov esi, dword [ebp - 0x10]
cmp esi, 1
je 0x1019b593
cmp esi, 2
je 0x1019b5a5
cmp esi, 3
jne 0x1019b5b8
movzx eax, word [edx]
add ecx, eax
movsx eax, byte [edx + 2]
shl eax, 0x12
xor eax, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 0xb
jmp 0x1019b5b6
movsx eax, byte [edx]
add ecx, eax
mov eax, ecx
shl eax, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
jmp 0x1019b5b6
movzx eax, word [edx]
add ecx, eax
mov eax, ecx
shl eax, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
lea eax, [ecx*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret