joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11d72070
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fac860
push eax
mov eax, dword [0x121256a8]
mov dword fs:[0], esp
sub esp, 0x38
push ebx
xor ebx, ebx
push esi
push edi
cmp eax, ebx
mov edi, ecx
je 0x11d720a4
cmp dword [edi + 0xb68], ebx
je 0x11d72184
push 0x12119948
lea ecx, [esp + 0x10]
mov dword [0x121256a8], 1
mov dword [0x121256ac], ebx
call fcn.11e7eae0
mov ecx, 0x12130390
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x14], 0x11fcabec
call fcn.11e141d0
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, ebx
mov byte [esp + 0x4c], 1
je 0x11d720f4
mov eax, dword [esi + 0xa4]
mov dword [0x121256ac], eax
jmp 0x11d72153
push 1
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x11fcb36c
call fcn.11e7eae0
lea ecx, [esp + 0x28]
mov byte [esp + 0x58], 1
call fcn.11dfcbd0
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c], 3
push ecx
lea ecx, [esp + 0x20]
call fcn.11dfd270
mov eax, dword [esp + 0xc]
cmp dword [eax - 8], ebx
je 0x11d72145
push 0x121256ac
push 0x12083d60
push eax
call fcn.11e68128
add esp, 0xc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 1
call fcn.11dfcc90
cmp esi, ebx
mov byte [esp + 0x4c], bl
je 0x11d72166
push 0x121303a0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push ebx
mov ecx, edi
call fcn.11d9b070
mov dword [0x121256b0], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0xffffffff
call fcn.11e7f280
mov eax, dword [esp + 0x54]
cmp eax, ebx
je 0x11d72230
cmp eax, 0xffffffff
je 0x11d72230
lea edx, [esp + 0x54]
mov dword [esp + 0x54], ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x54]
cmp ecx, ebx
jbe 0x11d721c7
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 4
cmp eax, ebx
jne 0x11d721e5
cmp ecx, ebx
jne 0x11d721e5
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 4
mov ecx, dword [0x121256ac]
shr eax, 0xa
cmp eax, ecx
jbe 0x11d7220c
cmp ecx, ebx
jbe 0x11d7220c
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 4
mov ecx, dword [0x121256b0]
cmp eax, ecx
jae 0x11d72230
cmp ecx, ebx
jbe 0x11d72230
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret 4
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x44
ret 4
Function at 0x11d82720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11fae288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0
call fcn.11e84ba0
mov eax, dword [esp + 0x30]
mov byte [esp + 0x28], 1
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x11d82792
mov ecx, dword [0x12133f80]
test ecx, ecx
je 0x11d82784
push eax
push 0x4008
push str._CSDConfig::UpdateSafeDiskMenuItemPolicy__Line:_d__Policy__s_
push str.SDiskPolicy
push 4
call fcn.11ca5810
mov eax, dword [esp + 0x44]
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.11d6f710
add esp, 8
lea edx, [esi + 0xa38]
push 1
push edx
lea ecx, [esp + 0xc]
call fcn.11e8c590
add esi, 0xa58
push 0xffffffffffffffff
push 0
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.11e84c10
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.11e84f30
lea ecx, [esp + 4]
mov byte [esp + 0x28], 1
call fcn.11e8c5f0
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.11e84bb0
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.11e7f280
mov ecx, dword [esp + 0x20]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x11d84350
Capabilities:
Delete file
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fae5a8
push eax
mov eax, dword [0x12125c80]
mov dword fs:[0], esp
sub esp, 0xc
test eax, eax
push ebx
push ebp
push esi
push edi
jne 0x11d844d4
mov dword [0x12125c80], 1
call fcn.11e936c0
test eax, eax
jne 0x11d843a2
call fcn.11e93650
test eax, eax
jne 0x11d843a2
call fcn.11e93570
test eax, eax
je 0x11d844b2
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov cx, word [0x12048894]
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
mov eax, dword [0x12048890]
mov dword [esp + 0x14], eax
mov word [esp + 0x18], cx
xor edi, edi
lea eax, [esp + 0x14]
mov esi, 1
mov ecx, edi
lea edx, [edi + 0x41]
push eax
mov word [esp + 0x18], dx
shl esi, cl
call ebp
test ebx, esi
je 0x11d843e8
cmp eax, 3
je 0x11d843f3
inc edi
cmp edi, 0x1a
jb 0x11d843c7
jmp 0x11d844d4
mov ecx, dword [0x11fd6250]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x14]
push str.B52E7173_63FB_4dc8_ACB2_47E298DAF3A2
push edx
lea eax, [esp + 0x18]
push 0x12025c58
push eax
mov dword [esp + 0x34], 0
call fcn.11e82200
mov ecx, dword [esp + 0x20]
add esp, 0x10
push 0
push 0x80
push 1
push 0
push 0
push bind
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [0x12133f80]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
setne al
test ecx, ecx
mov dword [0x12090ae0], eax
je 0x11d8447c
mov edx, dword [esp + 0x10]
push esi
push eax
push edx
push 0x4310
push str._CSDConfig::CheckCreateFileInRootDir__Line:_d_Create__s__bRet__d__hFile__08x_
push str.SafeDisk
push 4
call fcn.11ca5810
mov eax, dword [0x12090ae0]
add esp, 0x1c
test eax, eax
je 0x11d84494
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x11d8449f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x12125c7c], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.11e7f280
jmp 0x11d844d4
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d844d4
push 0x42ee
push str._CSDConfig::CheckCreateFileInRootDir__Line:_d_OS_is_not_2008win82012___
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x10
mov ecx, dword [esp + 0x2c]
mov edx, dword [0x12125c7c]
pop edi
pop esi
mov dword [ecx], edx
mov ecx, dword [esp + 0x14]
mov eax, dword [0x12090ae0]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x11d858f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11fae81f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x30], 0
push 0x12119948
lea ecx, [esp + 0xc]
mov dword [esp + 0x40], 2
call fcn.11e7eae0
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 3
call fcn.11e84ba0
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 4
call fcn.11e84ba0
mov ecx, dword [esp + 0x48]
push 0
lea eax, [esp + 0x24]
push 0x12023db8
mov bl, 5
push eax
push ecx
mov byte [esp + 0x4c], bl
call fcn.11d6f8c0
mov eax, dword [esp + 0x5c]
push 0
lea edx, [esp + 0x24]
push 0x12023db8
push edx
push eax
call fcn.11d6f8c0
add esp, 0x20
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.11d857d0
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.11d857d0
mov eax, dword [esp + 0x24]
xor esi, esi
test eax, eax
jle 0x11d859ee
push 0x12119948
lea ecx, [esp + 0x10]
call fcn.11e7eae0
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xc]
mov byte [esp + 0x3c], 6
mov ecx, dword [eax + esi*4]
push ecx
push 0x120a17bc
push edx
call fcn.11e82200
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
call fcn.11e7ff30
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], bl
call fcn.11e7f280
mov eax, dword [esp + 0x24]
inc esi
cmp esi, eax
jl 0x11d8599d
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jle 0x11d85a49
push 0x12119948
lea ecx, [esp + 0x10]
call fcn.11e7eae0
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
mov byte [esp + 0x3c], 7
mov edx, dword [ecx + esi*4]
push edx
push 0x120a17bc
push eax
call fcn.11e82200
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call fcn.11e7ff30
lea ecx, [esp + 0xc]
mov byte [esp + 0x3c], bl
call fcn.11e7f280
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jl 0x11d859f8
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d85a7a
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push edx
push eax
push ecx
push 0x4586
push str._CSDConfig::GetVirtualPath__Line:_d__Path__s__PathCommon__s__Ret__s_
push str.PathCvrt
push 4
call fcn.11ca5810
add esp, 0x1c
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 4
call fcn.11e84bb0
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 3
call fcn.11e84bb0
mov esi, dword [esp + 0x44]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.11e7e880
mov ebx, 1
mov dword [esp + 0x30], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 2
call fcn.11e7f280
lea ecx, [esp + 0x48]
mov byte [esp + 0x3c], bl
call fcn.11e7f280
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3c], 0
call fcn.11e7f280
mov ecx, dword [esp + 0x34]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 0xc
Function at 0x11d8a5c0
Capabilities:
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x11faf048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
lea eax, [esp + 0x24]
push 3
push eax
mov ecx, ebx
mov edi, 1
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.11e819c0
mov eax, dword [eax]
push 0
lea ecx, [esp + 0x10]
push 0
push ecx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
lea ecx, [esp + 0x24]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.11e7f280
test esi, esi
je 0x11d8a6b7
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov ecx, 0x1a
mov eax, esi
mov edx, edi
call fcn.11e69490
push 0
push 0x30
push edx
push eax
call fcn.11e69450
mov ecx, dword [esp + 0x10]
add eax, esi
adc edx, edi
add eax, 0x2800
adc edx, 0
cmp edx, ecx
mov ecx, dword [esp + 0xc]
jb 0x11d8a6cd
ja 0x11d8a676
cmp eax, ecx
jbe 0x11d8a6cd
mov edx, dword [0x12133f80]
test edx, edx
je 0x11d8a6a1
mov edx, dword [ebx]
push eax
mov eax, dword [0x12126854]
push ecx
push edi
push esi
push edx
push eax
push str.__s__CSafeDoc::OnVirtualAlloc__s__Disk_Full__dwSize__d___Free__d___Need__d__n
push str.excel
push 4
call fcn.11ca5810
add esp, 0x24
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x11d99f10
Capabilities:
Identify system language via api

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esi, eax
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d99f3e
mov eax, esi
and eax, 0xffff
push eax
push str._CSDConfig::GetSysLanguageIdentify__langidUsertem_0x_08x_
push str.SDConfig
push 4
call fcn.11ca5810
add esp, 0x10
mov edx, esi
xor ecx, ecx
and edx, 0xffff
mov eax, 0x120906c8
cmp edx, dword [eax]
je 0x11d99f73
add eax, 8
inc ecx
cmp eax, 0x12090700
jb 0x11d99f4d
push edx
mov edx, dword [esp + 0xc]
push 0x120a3b10
push edx
call fcn.11e82200
add esp, 0xc
pop esi
ret 4
mov ecx, dword [ecx*8 + 0x120906cc]
push ecx
mov ecx, dword [esp + 0xc]
call fcn.11e7f500
pop esi
ret 4

Function at 0x11d9b560
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x11fb0cfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push esi
mov ecx, 0x1212b458
call fcn.11ec4a10
push eax
lea ecx, [esp + 8]
call fcn.11e7eae0
mov eax, dword [esp + 4]
push str.ScreenClippingHost.exe
push eax
mov dword [esp + 0x220], 0
call fcn.11e67d22
add esp, 8
test eax, eax
jne 0x11d9b5cf
lea ecx, [esp + 4]
mov dword [esp + 0x218], 0xffffffff
call fcn.11e7f280
mov eax, 1
jmp 0x11d9b6b6
mov esi, dword [esp + 0x220]
test esi, esi
jne 0x11d9b5f5
lea ecx, [esp + 4]
mov dword [esp + 0x218], 0xffffffff
call fcn.11e7f280
xor eax, eax
jmp 0x11d9b6b6
mov ecx, 0x1212b458
call fcn.11df40d0
test eax, eax
jne 0x11d9b634
mov ecx, dword [esp + 4]
push str.ShellExperienceHost.exe
push ecx
call fcn.11e67d22
add esp, 8
test eax, eax
je 0x11d9b634
lea ecx, [esp + 4]
mov dword [esp + 0x218], 0xffffffff
call fcn.11e7f280
xor eax, eax
jmp 0x11d9b6b6
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x103
push edx
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x12133f80]
pop edi
test eax, eax
je 0x11d9b68b
lea eax, [esp + 8]
mov ecx, 0x1212b458
push eax
push esi
call fcn.11ec4a10
push eax
push str.CSDConfig::IsScreenSketchWindow___s__hWnd_0x_08X__wszWindowText__s_
push str.ScreenSketch
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x18
lea ecx, [esp + 8]
push ecx
call fcn.11dca190
xor edx, edx
add esp, 4
cmp edx, eax
lea ecx, [esp + 4]
sbb esi, esi
mov dword [esp + 0x218], 0xffffffff
neg esi
call fcn.11e7f280
mov eax, esi
mov ecx, dword [esp + 0x210]
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x11d9dd10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fb1168
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x121260e4]
test ecx, ecx
je 0x11d9dd4f
mov edx, eax
sub edx, ecx
cmp edx, 0xea60
jae 0x11d9dd4f
cmp eax, ecx
jae 0x11d9dde7
mov dword [0x121260e4], eax
call esi
mov ecx, 0x12130390
mov dword [0x121260e4], eax
mov dword [esp + 8], 0x11fcabec
call fcn.11e141d0
mov esi, eax
mov dword [esp + 0xc], esi
test esi, esi
mov dword [esp + 0x40], 0
je 0x11d9dd8c
mov eax, dword [esi + 0x484]
mov dword [0x121260e0], eax
jmp 0x11d9ddd0
push 1
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push 0x11fcccc4
call fcn.11e7eae0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4c], 0
call fcn.11dfcbd0
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 2
call fcn.11dfd310
mov dword [0x121260e0], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], 0
call fcn.11dfcc90
test esi, esi
mov dword [esp + 0x40], 0xffffffff
je 0x11d9dde7
push 0x121303a0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d9de0b
mov ecx, dword [0x121260e0]
push ecx
push str.CSDConfig::GetWarningTypeDisableMask_s_dwMask__d_
push str.SDConfig
push 4
call fcn.11ca5810
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov eax, dword [0x121260e0]
mov dword fs:[0], ecx
pop esi
add esp, 0x40
ret
Function at 0x11da9530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11fb2483
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x32]
mov word [esp + 0x30], bx
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24c]
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push eax
push ecx
call fcn.11dbcbf0
add esp, 0xc
lea edx, [esp + 0x30]
lea eax, [esp + 0xc]
mov ecx, 0x1212b5c0
push edx
push eax
call fcn.11d7ce00
mov eax, dword [0x12133f80]
mov dword [esp + 0x240], ebx
cmp eax, ebx
je 0x11da95d0
mov ecx, dword [esp + 0x24c]
mov edx, dword [esp + 0xc]
push ecx
push edx
mov ecx, 0x1212b458
call fcn.11ec4a10
push eax
push str.__s__CSDConfig::SetPrepareSaveFile__s__bIsEncrypt__d_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x18
lea eax, [esi + 0x10f4]
push 1
push eax
lea ecx, [esp + 0x2c]
call fcn.11e8c590
mov eax, dword [esi + 0x1118]
xor edi, edi
cmp eax, ebx
mov byte [esp + 0x240], 1
jle 0x11da9626
push ebp
xor ebp, ebp
mov ecx, dword [esi + 0x1114]
mov eax, ebp
add eax, ecx
mov ecx, dword [esp + 0x10]
push ecx
mov edx, dword [eax]
push edx
call fcn.11e67d22
add esp, 8
cmp eax, ebx
je 0x11da9625
mov eax, dword [esi + 0x1118]
inc edi
add ebp, 0x14
cmp edi, eax
jl 0x11da95f9
pop ebp
mov eax, dword [esi + 0x1118]
cmp edi, eax
jne 0x11da9716
mov eax, dword [0x11fd6250]
mov dword [esp + 0x10], eax
mov byte [esp + 0x240], 2
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ebx
call fcn.11e923e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x240], 3
call fcn.11e923e0
mov byte [esp + 0x240], 4
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x240], 5
push ecx
lea ecx, [esp + 0x14]
call fcn.11e7f410
mov eax, dword [esp + 0x250]
mov edx, dword [esp + 0x24c]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edx
call fcn.11e92570
mov ecx, dword [esp + 0x254]
push ecx
lea ecx, [esp + 0x20]
call fcn.11e92570
mov edi, dword [esi + 0x1118]
add esi, 0x1114
push 0xffffffffffffffff
mov ecx, esi
lea edx, [edi + 1]
mov dword [esp + 0x24], ebx
push edx
call fcn.11db9500
mov edx, dword [esi]
lea ecx, [edi + edi*4]
lea eax, [esp + 0x10]
push eax
lea ecx, [edx + ecx*4]
call fcn.11db94c0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x240], 7
call fcn.11e92540
lea ecx, [esp + 0x18]
mov byte [esp + 0x240], 6
call fcn.11e92540
lea ecx, [esp + 0x10]
mov byte [esp + 0x240], 1
call fcn.11e7f280
jmp 0x11da9765
mov eax, dword [esi + 0x1114]
mov ecx, dword [esp + 0x24c]
mov edx, dword [esp + 0x250]
lea edi, [edi + edi*4]
shl edi, 2
push edx
mov dword [edi + eax + 4], ecx
mov eax, dword [esi + 0x1114]
lea ecx, [edi + eax + 8]
call fcn.11e92570
mov ecx, dword [esp + 0x254]
mov edx, dword [esi + 0x1114]
push ecx
lea ecx, [edi + edx + 0xc]
call fcn.11e92570
mov eax, dword [esi + 0x1114]
mov dword [edi + eax + 0x10], ebx
lea ecx, [esp + 0x24]
mov byte [esp + 0x240], bl
call fcn.11e8c5f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x240], 0xffffffff
call fcn.11e7f280
mov ecx, dword [esp + 0x238]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x238
ret 0x10
Function at 0x11daa7c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x11fb2719
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x264
mov eax, dword [0x11fd6250]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x270], ebx
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x288]
mov dword [esp + 0x27c], 1
cmp esi, ebx
je 0x11daa9cc
push esi
call fcn.11e67d05
add esp, 4
test eax, eax
je 0x11daa9cc
mov ecx, dword [0x11fd6250]
mov dword [esp + 0x18], ecx
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x280], 2
call fcn.11e7eae0
push 0x5c
lea ecx, [esp + 0x18]
mov byte [esp + 0x280], 3
call fcn.11e80430
cmp eax, 0xffffffff
je 0x11daa9aa
inc eax
lea edx, [esp + 0x10]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.11e819c0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x280], 4
call fcn.11e7f410
lea ecx, [esp + 0x10]
mov byte [esp + 0x27c], 3
call fcn.11e7f280
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push 0x12023d48
lea ecx, [esp + 0x14]
push eax
push ecx
xor ebp, ebp
call fcn.11e7f9f0
mov eax, dword [eax]
lea edx, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x284], 5
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0x27c], 3
call fcn.11e7f280
cmp esi, 0xffffffff
je 0x11daa9aa
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp word [esp + 0x4c], 0x2e
jne 0x11daa8f8
lea eax, [esp + 0x20]
push eax
jmp 0x11daa99f
test byte [esp + 0x20], 0x10
jne 0x11daa99a
lea ecx, [esp + 0x4c]
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
call fcn.11e7f9f0
mov eax, dword [0x12133f80]
mov byte [esp + 0x27c], 6
test eax, eax
je 0x11daa941
mov ecx, dword [esp + 0x10]
push ecx
push str.CSDConfig::GetNewExistFile_001___s_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x10
mov eax, dword [esp + 0x30]
cmp ebp, eax
jb 0x11daa951
jne 0x11daa989
cmp ebx, dword [esp + 0x2c]
jae 0x11daa989
mov eax, dword [0x12133f80]
test eax, eax
je 0x11daa973
mov edx, dword [esp + 0x10]
push edx
push str.CSDConfig::GetNewExistFile_match___s_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
call fcn.11e7f410
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
lea ecx, [esp + 0x10]
mov byte [esp + 0x27c], 3
call fcn.11e7f280
lea ecx, [esp + 0x20]
push ecx
push esi
call edi
test eax, eax
jne 0x11daa8e6
lea ecx, [esp + 0x14]
mov byte [esp + 0x27c], 2
call fcn.11e7f280
lea ecx, [esp + 0x18]
mov byte [esp + 0x27c], 1
call fcn.11e7f280
mov esi, dword [esp + 0x284]
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.11e7e880
mov dword [esp + 0x270], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x27c], 0
call fcn.11e7f280
mov ecx, dword [esp + 0x274]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x270
ret 8
Function at 0x11dabdf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11fb28c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
lea ecx, [esp + 8]
call fcn.11e923e0
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x18], 0
test edi, edi
je 0x11dabe4a
mov ecx, edi
call fcn.11e92ce0
mov esi, eax
test esi, esi
je 0x11dabe4a
mov ecx, edi
call fcn.11e925e0
cmp eax, 0x78
jbe 0x11dabe4a
lea eax, [esp + 8]
push eax
push esi
call fcn.11ee62c0
add esp, 8
lea ecx, [esp + 0xc]
call fcn.11e26080
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 1
call fcn.11e2ab60
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.11e260b0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.11e92540
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14

Function at 0x11dac4f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11fb29c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
lea ecx, [esp + 8]
call fcn.11e923e0
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x18], 0
test edi, edi
je 0x11dac54a
mov ecx, edi
call fcn.11e92ce0
mov esi, eax
test esi, esi
je 0x11dac54a
mov ecx, edi
call fcn.11e925e0
cmp eax, 0x78
jbe 0x11dac54a
lea eax, [esp + 8]
push eax
push esi
call fcn.11ee62c0
add esp, 8
lea ecx, [esp + 0xc]
call fcn.11e26080
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x30], 1
call fcn.11e2ac20
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x18], 0
call fcn.11e260b0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.11e92540
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x18
Function at 0x11db97f0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x208
push ebx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 4], eax
mov eax, dword [0x1212b4f4]
push 0xffffffffffffffff
mov dword [esi + 8], eax
call fcn.11cc8f00
add esp, 4
mov dword [esi + 0xc], eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esi + 0x428]
push eax
push ecx
call fcn.11e674bf
add esp, 0xc
mov ecx, 0x1212b458
lea ebx, [esi + 0x14]
push 0x207
call fcn.11ec4b70
push eax
push ebx
call fcn.11e674bf
push 0x120abd48
push ebx
call fcn.11e68668
add esp, 0x14
test eax, eax
je 0x11db98a0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], 0
lea edx, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x104
push edx
push ebx
stosw word es:[edi], ax
call fcn.11dbbfd0
add esp, 0xc
test eax, eax
pop edi
jbe 0x11db98a0
lea eax, [esp + 8]
push 0x207
push eax
push ebx
call fcn.11e674bf
add esp, 0xc
push ebx
call fcn.11e94640
add esp, 4
mov dword [esi + 0x424], eax
mov eax, 1
pop esi
pop ebx
add esp, 0x208
ret