joyce8/EMBER2024-capa huggingface dataset:
Function at 0x113a6770
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1150d468
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x113a67a2
call fcn.113fb9a0
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x113a67b3
mov ecx, SysReAllocStringLen
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x113a6808
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x113a67ee
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x113a6934
cmp dword [esp + 0x18], ebx
jne 0x113a6808
cmp dword [esp + 0x14], ebx
je 0x113a6934
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x113a6819
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.114e9d1c
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x113a685f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x113a685f
call fcn.11393920
test eax, eax
je 0x113a685f
push 0x1156a2f8
lea ecx, [esp + 0x14]
call fcn.114ea146
push ebx
lea ecx, [esp + 0x14]
call fcn.114ea3dc
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x113a690e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x113a689b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x113a690e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x113a68e9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x113a68ec
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x113a68e4
mov dword [esi + 0x10], ebx
jmp 0x113a68ec
mov dword [esi + 0x10], ecx
jmp 0x113a68ec
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.114e9faf
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.114e9faf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x113a8d10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push 0x115674b0
push ecx
call fcn.11364437
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x113a8dea
mov edi, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x113a8dd0
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
lea ecx, [eax + eax]
push ecx
call fcn.114ef26e
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x113a8dd0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ebx
push edi
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x113a8e00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push 0x115674b0
push ecx
call fcn.11364437
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x113a8e99
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8
Function at 0x113a90c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x113a915a
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x113a9144
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.114ef26e
mov esi, eax
add esp, 4
test esi, esi
je 0x113a9144
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x113a92f0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1150d77b
push eax
mov dword fs:[0], esp
sub esp, 0x65c
mov ecx, 0x115a41e8
push ebx
push ebp
push esi
push edi
push str.PATH
push 0x115a41ec
call fcn.113a90c0
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x113a9341
push ebp
call fcn.11363fc6
add esp, 4
test eax, eax
jne 0x113a9384
push ebp
call fcn.114ef297
add esp, 4
push 0x11582520
call fcn.11363fc6
inc eax
lea esi, [eax + eax]
push esi
call fcn.114ef26e
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x113a94c8
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x11582520
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call fcn.11363fa1
add esp, 8
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x264]
push eax
push str.oadbg_
push str._s_s_
push ecx
call fcn.11364437
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x476]
mov word [esp + 0x474], bx
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x264]
stosw word es:[edi], ax
push edx
push ebp
lea eax, [esp + 0x46c]
push str._s_s
push eax
call fcn.11364437
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x113a94bf
mov esi, dword [esp + 0x680]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x40]
push 0x1156a5c8
push eax
call edi
test eax, eax
je 0x113a94a8
lea ecx, [esp + 0x40]
push 0x1156a5c4
push ecx
call edi
test eax, eax
je 0x113a94a8
test byte [esp + 0x14], 0x10
jne 0x113a94a8
lea edx, [esp + 0x40]
lea ecx, [esp + 0x10]
push edx
call fcn.114ea023
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x67c], 0
call fcn.114e7e0f
lea ecx, [esp + 0x10]
mov dword [esp + 0x674], 0xffffffff
call fcn.114e9faf
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x113a9444
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call fcn.114ef297
add esp, 4
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x668
ret 8
Function at 0x113aab40
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov eax, dword [0x115a466c]
push ebx
mov ebx, dword [esp + 0x10]
push esi
test eax, eax
push edi
jne 0x113aab62
mov eax, dword [0x115a4dfc]
test eax, eax
jne 0x113aab62
mov eax, dword [0x115a540c]
test eax, eax
je 0x113aab66
test ebx, ebx
je 0x113aaba0
mov eax, dword [0x11582704]
or esi, 0xffffffff
cmp eax, esi
jne 0x113aaba0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, esi
mov dword [0x11582704], eax
je 0x113aaba0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x113aaba0
mov eax, dword [0x11582704]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x11582704], esi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push ebx
push esi
push edi
call fcn.113b2ad0
add esp, 0xc
test eax, eax
je 0x113aabe3
mov ecx, dword [esp + 0x1c]
push ecx
push ebx
push esi
push edi
call fcn.113c2b60
add esp, 0x10
test eax, eax
je 0x113aabe3
push ebx
push esi
push edi
call fcn.113d1e80
add esp, 0xc
test eax, eax
je 0x113aabe3
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x113b30d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x3ec
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
push esi
xor ebp, ebp
push edi
mov dword [0x115a4660], ebp
call ebx
mov dword [0x115a4668], eax
mov ecx, 0xf7
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
mov esi, dword [esp + 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp esi, ebp
stosb byte es:[edi], al
je 0x113b320c
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.113ba1a0
mov esi, dword [esp + 0x408]
mov ebx, dword [esp + 0x414]
mov ebp, dword [esp + 0x410]
mov edi, dword [esp + 0x40c]
add esp, 4
mov dword [esp + 0x10], eax
test esi, esi
jne 0x113b3175
test edi, edi
jne 0x113b3175
test ebp, ebp
jne 0x113b3175
test ebx, ebx
jne 0x113b3175
mov ecx, dword [esp + 0x414]
test ecx, ecx
jne 0x113b3175
mov ecx, dword [esp + 0x418]
test ecx, ecx
je 0x113b3201
cmp eax, 3
jne 0x113b3201
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x1c]
push ecx
push 0x30
push edx
call fcn.113da700
add esp, 0xc
test eax, eax
je 0x113b31fd
mov eax, dword [esp + 0x40]
test esi, esi
je 0x113b31a5
mov ecx, eax
and ecx, 1
mov dword [esi], ecx
test edi, edi
je 0x113b31b0
mov edx, eax
and edx, 2
mov dword [edi], edx
test ebp, ebp
je 0x113b31bc
mov ecx, eax
and ecx, 4
mov dword [ebp], ecx
test ebx, ebx
je 0x113b31db
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [ebx], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ecx
mov ecx, dword [esp + 0x414]
test ecx, ecx
je 0x113b31ed
mov edx, eax
and edx, 8
mov dword [ecx], edx
mov ecx, dword [esp + 0x418]
test ecx, ecx
je 0x113b31fd
and eax, 0x10
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3ec
ret
mov esi, dword [esp + 0x400]
lea eax, [esp + 0x10]
push 1
push eax
mov dword [esp + 0x18], ebp
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call ebp
push 0
push 0
push 0
push esi
mov dword [esp + 0x28], eax
call ebp
cmp esi, 0xffffffff
je 0x113b329d
lea ecx, [esp + 0x1c]
test ecx, ecx
je 0x113b329d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x113b32b8
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push edx
push 0x34
push eax
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x113b3296
mov dword [0x115a4660], 0xd
mov dword [0x115a4664], 0x29f7
call ebx
mov dword [0x115a4668], eax
jmp 0x113b32ba
mov edi, 1
jmp 0x113b32ba
mov dword [0x115a4660], 1
mov dword [0x115a4664], 0x29ea
call ebx
mov dword [0x115a4668], eax
xor edi, edi
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push esi
call ebp
test edi, edi
jne 0x113b311e
mov dword [0x115a4660], 0xf
mov dword [0x115a4664], 0x1b63
call ebx
pop edi
pop esi
mov dword [0x115a4668], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x3ec
ret
Function at 0x113b3f90
Capabilities:
Timestomp file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1150d9b8
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
xor edi, edi
mov dword [0x115a4660], edi
call ebp
mov esi, dword [esp + 0x44]
mov dword [0x115a4668], eax
cmp esi, edi
je 0x113b40c3
push esi
call fcn.11363fc6
add esp, 4
test eax, eax
je 0x113b40c3
mov ebx, dword [esp + 0x48]
cmp ebx, edi
je 0x113b40c3
push esi
lea ecx, [esp + 0x2c]
call fcn.113da5c0
push edi
push edi
push 3
push edi
push 1
push 0xc0000000
push esi
mov dword [esp + 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
jne 0x113b4045
mov dword [0x115a4660], 3
mov dword [0x115a4664], 0x1cfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x28]
mov dword [0x115a4668], eax
mov dword [esp + 0x3c], ebp
call fcn.113da660
jmp 0x113b40de
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
push esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x4c]
push eax
push ebx
push esi
call fcn.113b4100
add esp, 0xc
lea ecx, [esp + 0x10]
mov edi, eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], ebp
call fcn.113da660
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
mov dword [0x115a4660], 1
mov dword [0x115a4664], 0x1ce7
call ebp
mov dword [0x115a4668], eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x113b4670
Capabilities:
Get file size
Write file on windows

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x64]
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.113b3db0
push eax
call fcn.113b2390
mov ebp, eax
add esp, 0x10
test ebp, ebp
jne 0x113b46d5
mov dword [0x115a4660], 0xc
mov dword [0x115a4664], 0x1da7
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [0x115a4668], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
mov ebx, dword [esp + 0x6c]
mov eax, dword [ebx + 0x70]
mov edi, dword [ebx + 0x6c]
add eax, edi
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0x74]
lea ecx, [eax + edx*2]
mov edx, dword [ebp]
lea eax, [ecx + ecx + 0x7a]
mov ecx, ebp
push eax
mov dword [esp + 0x68], eax
call dword [edx + 8]
mov edi, eax
push edi
mov dword [esp + 0x14], edi
call fcn.114ef26e
mov esi, eax
add esp, 4
test esi, esi
jne 0x113b4739
mov dword [0x115a4660], 0x21
mov dword [0x115a4664], 0x1db1
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov dword [0x115a4668], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x6c]
lea edi, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x68]
push ecx
push esi
push eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebx
push ecx
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebp
call dword [edx + 0x10]
test eax, eax
je 0x113b4821
mov edi, dword [esp + 0x68]
mov ebp, dword [esp + 0x60]
mov ebx, dword [edi + 0x378]
mov eax, dword [edi + 0x37c]
test ebx, ebx
mov dword [esp + 0x64], eax
jne 0x113b47ba
test eax, eax
jne 0x113b47ba
lea edx, [esp + 0x64]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [esp + 0x64]
push 0
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x18]
push 0
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x113b4837
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
push edx
push esi
mov dword [edi + 0x378], ebx
mov dword [edi + 0x37c], eax
mov dword [edi + 0x380], ecx
call fcn.113da750
add esp, 8
mov dword [edi + 0x384], eax
mov dword [esp + 0x14], 1
jmp 0x113b4856
mov dword [0x115a4660], 0x11
mov dword [0x115a4664], 0x1dbd
jmp 0x113b484b
mov dword [0x115a4660], 0xe
mov dword [0x115a4664], 0x1dcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4668], eax
push esi
call fcn.114ef297
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x113c4300
Capabilities:
Timestomp file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1150dc78
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
xor edi, edi
mov dword [0x115a4df0], edi
call ebp
mov esi, dword [esp + 0x44]
mov dword [0x115a4df8], eax
cmp esi, edi
je 0x113c4433
push esi
call fcn.11363fc6
add esp, 4
test eax, eax
je 0x113c4433
mov ebx, dword [esp + 0x48]
cmp ebx, edi
je 0x113c4433
push esi
lea ecx, [esp + 0x2c]
call fcn.113da5c0
push edi
push edi
push 3
push edi
push 1
push 0xc0000000
push esi
mov dword [esp + 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
jne 0x113c43b5
mov dword [0x115a4df0], 3
mov dword [0x115a4df4], 0x1c7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x28]
mov dword [0x115a4df8], eax
mov dword [esp + 0x3c], ebp
call fcn.113da660
jmp 0x113c444e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
push esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov eax, dword [esp + 0x4c]
push eax
push ebx
push esi
call fcn.113c5b20
add esp, 0xc
lea ecx, [esp + 0x10]
mov edi, eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], ebp
call fcn.113da660
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x1c6c
call ebp
mov dword [0x115a4df8], eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x113c5660
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
push esi
lea esi, [eax + 0xfff]
mov eax, dword [ecx + 0x24]
xor ebx, ebx
shr esi, 0xc
shl esi, 0xc
cmp esi, eax
push edi
mov dword [esp + 0x1c], esi
jbe 0x113c5886
mov ebp, dword [esp + 0x24]
lea edx, [esp + 0x10]
push edx
push ebp
sub esi, eax
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0x10], ebx
jne 0x113c5867
or ecx, 0xffffffff
sub ecx, esi
cmp ecx, eax
jb 0x113c5867
mov edi, dword [esp + 0x28]
add eax, esi
push ebx
push eax
push edi
call fcn.113db440
add esp, 0xc
test eax, eax
je 0x113c5815
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ebx
push ebp
call esi
push ebx
push ebx
push ebx
push edi
call esi
push 0x10000
call fcn.114ef26e
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x113c583e
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x30], ebx
mov ebp, dword [edx + 0x24]
mov ecx, 0x4000
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
test ebp, ebp
mov edi, 0x10000
jbe 0x113c5720
cmp ebp, edi
ja 0x113c5720
mov edi, ebp
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x14]
push 0
push eax
push edi
push esi
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x113c5795
mov eax, dword [esp + 0x14]
test eax, eax
je 0x113c57e8
lea edx, [esp + 0x18]
push 0
push edx
mov ebx, eax
push eax
mov eax, dword [esp + 0x34]
push esi
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x113c57ab
cmp dword [esp + 0x18], ebx
jb 0x113c57c1
test ebp, ebp
jbe 0x113c5706
sub ebp, edi
jne 0x113c5706
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x113c5706
mov dword [0x115a4df0], 0xd
mov dword [0x115a4df4], 0x1e53
jmp 0x113c57d5
mov dword [0x115a4df0], 0xe
mov dword [0x115a4df4], 0x1e64
jmp 0x113c57d5
mov dword [0x115a4df0], 0xe
mov dword [0x115a4df4], 0x1e6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
mov dword [esp + 0x30], 1
push esi
call fcn.114ef297
mov eax, dword [esp + 0x34]
add esp, 4
test eax, eax
jne 0x113c5890
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword [edx + 0x24], ecx
pop ebx
add esp, 0x10
ret
mov dword [0x115a4df0], 0x25
mov dword [0x115a4df4], 0x1e32
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [0x115a4df8], eax
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret
mov dword [0x115a4df0], 0x21
mov dword [0x115a4df4], 0x1e3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [0x115a4df8], eax
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret
mov dword [0x115a4df0], 0x10009
mov dword [0x115a4df4], 0x1e2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret