joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401750
Capabilities:
Encode data using xor

Disassembly:
push 0x406fe8
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + edx], dl
mov dword [0xa48d1313], eax
dec edx
pushfd
bound edi, qword [eax]
out 0x36, eax
salc
or byte [eax], ah
add byte [eax], al
add dword [eax], eax
add byte [eax], al
jb 0x4017ed
dec ecx
and byte fs:[edx + esi*2 + 0x6d], ah
jb 0x4017f6
jae 0x4017f8
je 0x401795
je 0x40180b
jb 0x401802
imul esp, dword [edx + 0x75], 0x74
add bh, bh
int3
bound esi, qword [ebp + 0x74]
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
add byte [edx + 0x6e4b825], dl
xchg ebp, eax
fisttp word [ebp - 0x6e]
sub dh, byte [edx + edx*8 - 0xe]
or byte [edi], bh
outsb dx, byte [esi]
jl 0x401798
ret
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
ljmp 0x56
add byte [eax], al
add dl, ch
push esi
add byte [eax], al
in eax, 0x56
add byte [eax], al
add byte [0x726f4600], al
add eax, 0x726f4600
insd dword es:[edi], dx
xor dword [eax], eax
or eax, 0x4d001001
popal
add dword [eax], edx
add byte [ebp + 0x61], cl
outsb dx, byte [esi]
jne 0x401874
insb byte es:[edi], dx
and byte [edx + edx*2 + 0x4d], al
and byte [edx + 0x65], dl
jae 0x401882
je 0x40181f
sbb dword [ecx], eax
add byte [edx], al
and al, byte [ecx]
and edx, dword [esi + 0x6c000056]
je 0x40182e
add byte [esi + 0x56], cl
add byte [ecx], al
add byte [edi], al
add byte [eax], dl
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 5], ch
add byte [eax], al
jbe 0x401847
add byte [eax], al
adc byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
push 0xde000003
add eax, 0x20200000
add byte [eax], al
add byte [eax], al
add byte [eax], al
test al, 8
add byte [eax], al
inc esi
or dword [eax], eax
add byte [eax], ah
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x11fffff4], ch
add dh, ch
adc dword [eax], eax
add byte [eax], dh
xor byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x69fffff2], ch
push cs
add byte [eax], al
xchg esi, eax
push ds
add byte [eax], al
xor byte [eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
test al, 0x1c
add byte [eax], al
sub eax, 0x20200000
add byte [eax], al
add byte [eax], al
add byte [eax], al
test al, 0xc
add byte [eax], al
out 0x49, al
add byte [eax], al
sub byte [eax], al
add byte [eax], al
adc byte [eax], al
add byte [eax], al
and byte [eax], al
add byte [eax], al
add dword [eax], eax
or byte [eax], al
add byte [eax], al
add byte [eax], al
inc eax
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
invalid
Function at 0x100fa0b
Capabilities:
Listen for remote procedure calls

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
jne 0x100fa2f
mov eax, 0x80070057
push eax
mov esi, eax
push 0x56
jmp 0x100faf8
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.01011735
mov esi, eax
cmp esi, ebx
jge 0x100fa49
push esi
push 0x5a
jmp 0x100faf8
mov eax, dword [ebp + 0xc]
push ebx
push dword [ebp - 4]
mov dword [0x10496b4], eax
mov eax, dword [ebp + 0x10]
push 0x14
push dword [0x1049004]
mov dword [0x10496b8], eax
mov eax, dword [ebp + 0x14]
mov dword [0x10496b0], edi
mov dword [0x10496bc], eax
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
cmp eax, ebx
je 0x100fa90
jle 0x100fa89
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x6d
jmp 0x100faf8
push ebx
push ebx
push dword [section..data]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf]
cmp eax, ebx
je 0x100fab5
jle 0x100faae
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x72
jmp 0x100faf8
push ebx
push ebx
push 0xa
push ebx
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
cmp eax, ebx
je 0x100fad7
jle 0x100fad0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x75
jmp 0x100faf8
push 1
push 0x14
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
cmp eax, ebx
je 0x100fb07
jle 0x100faf3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x7a
push 0x10014e8
push 0x10014bc
call fcn.0101167d
cmp dword [ebp - 4], ebx
je 0x100fb1d
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100ff67
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x101007f
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x101007f
mov edi, 0x10496c4
push edi
call fcn.010127c9
mov esi, eax
test esi, esi
jge 0x100ffa2
push esi
push 0x4d
jmp 0x1010087
push dword [ebp + 8]
lea eax, [ebp - 4]
push 0x10017fc
push eax
mov dword [0x10496e8], 1
mov dword [0x10496c0], ebx
call fcn.0101160d
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x100ffd4
push esi
push 0x5a
jmp 0x1010087
push dword [ebp - 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10496ec], eax
test eax, eax
jne 0x101000e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100fffe
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jne 0x1010009
mov esi, 0x80004005
push esi
push 0x5f
jmp 0x1010087
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1010025
mov esi, 0xc1420126
push esi
push 0x63
jmp 0x1010087
push 0x10496f0
push dword [ebp + 8]
push edi
push dword [0x10496c0]
call fcn.01013db5
mov esi, eax
test esi, esi
jge 0x1010044
push esi
push 0x6e
jmp 0x1010087
push edi
push dword [0x10496f0]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0100fa0b
mov esi, eax
test esi, esi
jge 0x1010062
push esi
push 0x75
jmp 0x1010087
push 0x10017dc
push 0x20000
mov dword [0x10496f4], 1
call fcn.01011628
pop ecx
pop ecx
jmp 0x1010096
mov esi, 0x80070057
push esi
push 0x45
push 0x1001758
push 0x100173c
call fcn.0101167d
cmp dword [ebp - 4], 0
je 0x10100ae
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1010787
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1047bb0
call fcn.01010c14
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x104a184
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1010542
cmp eax, esi
jne 0x1010535
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1010545
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101051c
xor esi, esi
inc esi
mov eax, dword [0x104a180]
cmp eax, esi
jne 0x1010558
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1010587
mov eax, dword [0x104a180]
test eax, eax
jne 0x1010581
mov dword [0x104a180], esi
push 0x10012b0
push 0x10012a4
call fcn.0101047e
pop ecx
pop ecx
test eax, eax
je 0x1010587
jmp 0x10106ab
mov dword [0x1049718], esi
mov eax, dword [0x104a180]
cmp eax, esi
jne 0x10105ab
push 0x10012a0
push 0x1001294
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x104a180], 2
cmp dword [ebp - 0x20], ebx
jne 0x10105b8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x104a18c], ebx
je 0x10105d9
push 0x104a18c
call fcn.01010b89
pop ecx
test eax, eax
je 0x10105d9
push ebx
push 2
push ebx
call dword [0x104a18c]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10106ab
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1010643
cmp cx, bx
je 0x10105fe
cmp dword [ebp - 0x1c], ebx
jne 0x1010643
movzx ecx, word [eax]
cmp cx, bx
je 0x1010613
cmp cx, 0x20
ja 0x1010613
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x10105fe
test byte [ebp - 0x40], 1
je 0x101061f
movzx ecx, word [ebp - 0x3c]
jmp 0x1010622
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1049714], eax
cmp dword [0x1049708], ebx
jne 0x1010688
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1010654
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x10105e8
cmp dword [0x1049718], ebx
jne 0x1010696
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1049714]
jmp 0x10106b7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01010c59
ret
call fcn.01010e07
jmp 0x10104df
Function at 0x1012d1d
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
xor edi, edi
mov esi, 0x10c
test edi, edi
je 0x1012d53
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, esi
push esi
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1012db2
push 9
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, 0x80000005
je 0x1012d8a
test eax, eax
jl 0x1012dd1
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jl 0x1012dde
test eax, eax
jl 0x1012d43
mov esi, dword [edi]
inc esi
inc esi
push esi
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 8], eax
test eax, eax
jne 0x1012def
mov eax, 0x8007000e
push eax
push 0x366
jmp 0x1012dbd
mov eax, 0x8007000e
push eax
push 0x34d
mov dword [ebp - 4], eax
push 0x1001f58
push 0x1001fec
call fcn.0101167d
jmp 0x1012e0f
or eax, 0x10000000
push eax
push 0x35a
jmp 0x1012dbd
or ecx, 0x10000000
push ecx
mov dword [ebp - 4], ecx
push 0x35b
jmp 0x1012dc0
push esi
push 0
push eax
call sub.msvcrt.dll_memset
push dword [edi]
mov esi, dword [ebp + 8]
lea eax, [edi + 4]
push eax
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0xc]
add esp, 0x18
mov dword [eax], esi
test edi, edi
je 0x1012e1f
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1012e2e
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1012e93
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1012e6e
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jne 0x1012e79
mov ebx, 0x80004005
push ebx
push 0x5f7
push 0x1001f58
push 0x100201c
call fcn.0101167d
jmp 0x1012f28
cmp dword [ebp - 8], ebx
je 0x1012ea7
mov eax, 0x8007007a
push eax
mov ebx, eax
push 0x602
jmp 0x1012e7f
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1012edd
mov eax, 0x8007000e
push eax
mov ebx, eax
push 0x606
push 0x1001f58
push 0x100201c
call fcn.0101167d
jmp 0x1012f14
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
jbe 0x1012f0d
push 0
lea ecx, [ebp - 4]
push ecx
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1012f31
add esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x1012ee9
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor edi, edi
test edi, edi
je 0x1012f28
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1012f45
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jne 0x1012f50
mov ebx, 0x80004005
push ebx
push 0x618
jmp 0x1012ecc
Function at 0x1013559
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push 0x1c
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x101359d
mov eax, 0x8007000e
push eax
push 0xb0
push 0x1002350
push 0x1002320
mov dword [ebp - 4], eax
call fcn.0101167d
jmp 0x1013748
push edi
push 7
pop ecx
xor eax, eax
mov edi, ebx
push 0x1002308
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
jne 0x10135f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10135cc
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
test eax, eax
jne 0x10135da
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xb7
push 0x1002350
push 0x1002320
call fcn.0101167d
jmp 0x1013747
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10022fc
push eax
call esi
xor edi, edi
mov dword [ebx + 4], eax
cmp eax, edi
jne 0x101363d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1013622
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x1013630
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xbe
jmp 0x101372e
push 0x10022dc
push dword [ebx]
call esi
mov dword [ebx + 8], eax
cmp eax, edi
jne 0x101367c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1013661
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x101366f
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xc5
jmp 0x101372e
push 0x10022c8
push dword [ebx]
call esi
mov dword [ebx + 0xc], eax
cmp eax, edi
jne 0x10136b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x10136a0
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x10136ae
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xcc
jmp 0x101372e
push 0x10022b4
push dword [ebx]
call esi
mov dword [ebx + 0x10], eax
cmp eax, edi
jne 0x10136f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x10136dc
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x10136ea
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xd3
jmp 0x101372e
push 0x10022a0
push dword [ebx]
call esi
mov dword [ebx + 0x14], eax
cmp eax, edi
jne 0x101373f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1013718
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x1013726
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0xda
push 0x1002350
push 0x1002320
call fcn.0101167d
jmp 0x1013746
mov eax, dword [ebp + 8]
mov dword [eax], ebx
xor ebx, ebx
pop esi
pop edi
push ebx
call fcn.010134fe
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
Function at 0x1013db5
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1049010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x14], 0
and dword [ebp - 0x18], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
push 8
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x1013e19
mov edi, 0x8007000e
push edi
push 0x291
push 0x1002350
push 0x10024fc
call fcn.0101167d
jmp 0x1013ee4
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
push 0x10024ec
mov dword [esi + 0x10], eax
push 0x10024d8
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 4], 0x1012972
mov dword [esi + 8], 0x101214b
call fcn.01013b77
mov edi, eax
test edi, edi
jge 0x1013e53
push edi
push 0x29f
jmp 0x1013e05
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.RPCRT4.dll_UuidFromStringW]
test eax, eax
je 0x1013e7a
jle 0x1013e70
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x2a7
jmp 0x1013e05
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call fcn.0101375b
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x1013e99
push edi
push 0x2aa
jmp 0x1013e05
mov ecx, dword [ebp - 0x18]
push eax
push eax
push esi
push 0x101380f
push eax
push eax
mov dword [esi + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x1013edd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1013ec7
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jne 0x1013ed2
mov edi, 0x80004005
push edi
push 0x2bc
jmp 0x1013e05
xor esi, esi
and dword [ebp - 0x18], esi
mov dword [ebx], eax
push dword [ebp - 0x18]
call fcn.010134fe
test esi, esi
je 0x1013f00
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010796
leave
ret 0x10
Function at 0x10141b2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
xor esi, esi
push 0x30
lea eax, [ebp - 0x4c]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x50], esi
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
add esp, 0xc
cmp edi, esi
jne 0x10141f3
mov esi, 0x80004005
jmp 0x10142c2
push 0x3e8
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, esi
je 0x101423f
cmp eax, 0x80
je 0x101423f
cmp eax, 0x102
je 0x1014235
cmp eax, 0xffffffff
jne 0x10141e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jg 0x1014229
mov esi, eax
jmp 0x10142c2
and eax, 0xffff
or eax, 0x80070000
jmp 0x1014222
mov esi, 0x800705b4
jmp 0x10142c2
lea eax, [ebp - 0x50]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x10142a3
cmp dword [ebp - 0x2c], esi
je 0x1014287
cmp dword [ebp - 0x24], esi
je 0x1014287
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10142a3
mov eax, 0xfeff
cmp word [ebp - 4], ax
je 0x10142b9
mov esi, 0xc1440129
jmp 0x10142b9
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
push 2
push 0x1002530
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10142b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x10142b7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x10142cf
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp esi, ebx
je 0x10143d3
cmp dword [ebp + 0xc], ebx
je 0x10143d3
push 0x3e8
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x1014341
cmp eax, 0x80
je 0x1014341
cmp eax, 0x102
je 0x101433a
cmp eax, 0xffffffff
je 0x1014320
mov esi, 0x80004005
jmp 0x1014378
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x101432e
mov esi, eax
jmp 0x1014378
and eax, 0xffff
or eax, 0x80070000
jmp 0x101432a
mov esi, 0x800705b4
jmp 0x1014378
push edi
push 2
push ebx
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x101438c
call edi
test eax, eax
je 0x101438c
call edi
cmp eax, ebx
jg 0x1014380
mov esi, eax
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
and eax, 0xffff
or eax, 0x80070000
jmp 0x1014369
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1014392
lea ecx, [ebp - 8]
push ecx
push 2
sub eax, edx
pop ecx
sar eax, 1
mul ecx
push edx
push eax
call fcn.01011101
mov esi, eax
cmp esi, ebx
jl 0x101436b
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101436b
jmp 0x1014363
mov esi, 0x80070057
jmp 0x1014378
Function at 0x10153f7
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x1015456
cmp word [esi], bx
je 0x1015456
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push 0x6200000
push 3
push ebx
push 7
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1015441
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
test ebx, ebx
jne 0x1015452
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1015452
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x1015460
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1015b6e
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 4], esi
je 0x1015c49
cmp dword [ebp + 0xc], esi
je 0x1015c49
push ebx
push edi
mov edi, dword [ebp + 0x10]
push 8
pop ebx
cmp edi, esi
jne 0x1015ba5
mov edi, 0x10026ac
mov dword [ebp + 0xc], ebx
jmp 0x1015bb6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
lea eax, [esi + 0xa]
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1015be8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1015be1
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
test eax, eax
jl 0x1015c2e
mov dword [ebx], esi
test esi, esi
je 0x1015bff
shr esi, 1
push edi
inc esi
push esi
lea eax, [ebx + 4]
push eax
call fcn.01011320
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x1015c2e
and dword [ebp - 0xc], 0
push 0x28
push dword [ebp + 0xc]
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jge 0x1015c2e
or eax, 0x10000000
mov dword [ebp - 4], eax
test ebx, ebx
je 0x1015c42
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop ebx
jmp 0x1015c4e
mov eax, 0x80070057
pop esi
leave
ret 0xc