joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11dd7be0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11fb5e08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.11e84ba0
xor esi, esi
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], esi
call fcn.11e84c10
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.11d6f710
mov eax, dword [esp + 0x18]
add esp, 8
cmp eax, esi
jne 0x11dd7c58
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.11e84bb0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov edi, dword [esp + 0x34]
push edi
call fcn.11dbbda0
mov ebx, eax
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jle 0x11dd7c8e
mov edx, dword [esp + 0xc]
mov eax, dword [edx + esi*4]
push eax
push ebx
push edi
call fcn.11d68a90
add esp, 0xc
test eax, eax
jne 0x11dd7cc0
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x11dd7c6f
mov ecx, dword [esp + 0x30]
xor eax, eax
test ecx, ecx
sete al
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.11e84bb0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.11e84bb0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x11ddca60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fb6408
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x11ddcb8a
cmp word [edi], 0
je 0x11ddcb8a
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push 0
call fcn.11e84c10
mov ecx, dword [esp + 0x28]
push 0xffffffffffffffff
push 0
call fcn.11e84c10
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov dword [ebp], 0
mov dword [ebx], 0
cmp word [edi], 0
je 0x11ddcb42
push edi
lea ecx, [esp + 0x24]
call fcn.11e7eae0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], 0
push eax
mov esi, dword [eax - 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x11ddcb27
test al, 0x10
je 0x11ddcb0a
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x20]
push edx
mov eax, dword [ecx + 4]
push eax
call fcn.11e851b0
mov ecx, dword [ebx]
lea eax, [esi + 1]
add ecx, eax
mov dword [ebx], ecx
jmp 0x11ddcb27
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x20]
push edx
mov eax, dword [ecx + 4]
push eax
call fcn.11e851b0
mov ecx, dword [ebp]
lea eax, [esi + 1]
add ecx, eax
mov dword [ebp], ecx
lea ecx, [esp + 0x20]
lea edi, [edi + esi*2 + 2]
mov dword [esp + 0x18], 0xffffffff
call fcn.11e7f280
cmp word [edi], 0
jne 0x11ddcac4
mov edx, dword [ebp]
inc edx
mov dword [ebp], edx
mov ecx, dword [ebx]
inc ecx
mov dword [ebx], ecx
mov eax, dword [0x12133f80]
test eax, eax
mov ebx, ecx
je 0x11ddcbac
mov ecx, dword [ebp]
push ebx
push ecx
push 0x2ca6
push str._GetFileGroupInfo__Line:_d_FileSize__d__DirSize__d_
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x18
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x12133f80]
test eax, eax
je 0x11ddcbac
push 0x2c7e
push str._GetFileGroupInfo__Line:_d_SrcFile_Pointer_is_null.
push str.SafeDisk
push 4
call fcn.11ca5810
add esp, 0x10
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret
Function at 0x11de17d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x11fb69a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x24]
call fcn.11e84ba0
xor esi, esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x80], esi
call fcn.11e8af10
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x88], 1
call fcn.11e59e90
mov edx, dword [esp + 0x94]
mov ebx, dword [esp + 0x90]
add esp, 8
xor ebp, ebp
cmp eax, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x8c], edx
mov dword [esp + 0x88], esi
jle 0x11de18c2
jmp 0x11de184b
xor esi, esi
cmp dword [esp + 0x8c], 0x44
jb 0x11de18c2
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x36]
mov word [esp + 0x34], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x34]
mov eax, dword [eax + ebp*4]
push eax
push ecx
call fcn.11e6749a
mov edx, dword [esp + 0x1c]
mov ecx, 0x11
lea esi, [esp + 0x3c]
mov edi, ebx
mov eax, dword [edx + ebp*4]
mov edx, dword [esp + 0x94]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x90]
add esp, 8
inc edi
add ebx, 0x44
sub edx, 0x44
inc ebp
cmp ebp, eax
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edx
jl 0x11de1849
lea ecx, [esp + 0x14]
mov byte [esp + 0x80], 0
call fcn.11e8af20
lea ecx, [esp + 0x24]
mov dword [esp + 0x80], 0xffffffff
call fcn.11e84bb0
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x74
ret 8
Function at 0x11de48b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11fb6c20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.11e923e0
mov ecx, 0x1212b458
mov dword [esp + 0x24], 0
call fcn.11ec4670
mov edx, dword [esp + 0x30]
cmp edx, 8
jbe 0x11de49ca
mov edi, dword [esp + 0x2c]
mov esi, dword [edi + 4]
lea ecx, [edi + 4]
sub edx, esi
sub edx, 8
js 0x11de49ca
cmp dword [edi], eax
je 0x11de4931
cmp edx, 8
jb 0x11de49ca
mov ecx, dword [ecx]
mov esi, 0xfffffff8
lea edi, [edi + ecx + 8]
mov ebp, dword [edi + 4]
lea ecx, [edi + 4]
sub esi, ebp
add edx, esi
jns 0x11de4908
jmp 0x11de49ca
mov ecx, dword [edi + 4]
cmp ecx, 0x18
jbe 0x11de49ca
mov eax, dword [0x12133f80]
test eax, eax
je 0x11de495b
push ecx
push str.CSDGlobalShare::SetRoleMatchInfo_had_found_data_size__d_
push str.FilePolicy
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x10
mov edx, dword [edi + 4]
lea eax, [edi + 8]
push edx
push eax
lea ecx, [esp + 0x14]
call fcn.11e92940
mov eax, dword [0x12133f80]
test eax, eax
je 0x11de49ca
lea ecx, [esp + 0xc]
call fcn.11e92ce0
mov edi, dword [edi + 4]
mov esi, eax
add edi, esi
lea eax, [esi + 0x18]
cmp eax, edi
jae 0x11de49ca
mov ecx, dword [0x12133f80]
test ecx, ecx
je 0x11de49b6
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
push str.CSDGlobalShare::SetRoleMatchInfo_Type__d__UserID__d__RoleID__d__Path__s_
push str.FilePolicy
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x1c
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
lea eax, [edx + ecx*2]
lea esi, [esi + eax + 0x1b]
lea eax, [esi + 0x18]
cmp eax, edi
jb 0x11de498c
push 1
push 0x1212caf0
lea ecx, [esp + 0x18]
call fcn.11e8c590
mov ecx, 0x1212caa8
mov byte [esp + 0x24], 1
call fcn.11e928f0
lea ecx, [esp + 0xc]
push ecx
mov ecx, 0x1212caa8
call fcn.11e92990
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.11e8c5f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.11e92540
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x11de4ab0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push esi
mov esi, dword [esp + 0x418]
test esi, esi
je 0x11de4bdd
mov ecx, 0x1212b458
call fcn.11df4850
test eax, eax
je 0x11de4bdd
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x210]
push 0x103
push ecx
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, 0x1212b458
call fcn.11df5090
test eax, eax
pop edi
je 0x11de4b84
lea edx, [esp + 4]
push str.Microsoft_Visual_Basic_for_Applications
push edx
call fcn.11e68668
add esp, 8
test eax, eax
jne 0x11de4b6b
lea eax, [esp + 4]
push str.Microsoft_Visual_Basic
push eax
call fcn.11e68668
add esp, 8
test eax, eax
je 0x11de4b84
lea ecx, [esp + 0x20c]
push 0x11fd3134
push ecx
call fcn.11e67d22
add esp, 8
test eax, eax
je 0x11de4bd7
mov ecx, 0x1212b458
call fcn.11df4810
test eax, eax
je 0x11de4bdd
lea edx, [esp + 4]
push str.Microsoft_Visual_Basic
push edx
call fcn.11e68668
add esp, 8
test eax, eax
jne 0x11de4bbe
lea eax, [esp + 4]
push str.Microsoft_Visual_Basic_for_Applications
push eax
call fcn.11e68668
add esp, 8
test eax, eax
je 0x11de4bdd
lea ecx, [esp + 0x20c]
push str.wndclass_desked_gsk
push ecx
call fcn.11e67d22
add esp, 8
test eax, eax
jne 0x11de4bdd
mov dword [0x1212cc20], esi
pop esi
add esp, 0x410
ret
Function at 0x11de51f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fb6c58
push eax
mov dword fs:[0], esp
mov eax, dword [0x1212c7e8]
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x12047ae8
push 0x68
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x11de5397
mov ecx, dword [0x1212c7e8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x11de5397
mov edx, dword [0x1212c7e8]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, 2
jb 0x11de5397
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x11de5397
push esi
call fcn.11e67ea5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x11de5397
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add ebp, 2
shr esi, 1
and ecx, 3
dec esi
push esi
push ebp
rep stosb byte es:[edi], al
push ebx
call fcn.11e674bf
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.11e84ba0
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], edi
call fcn.11e84c10
push edi
lea eax, [esp + 0x14]
push 0x12047adc
push eax
push ebx
call fcn.11d6f8c0
push ebx
call fcn.11e67fdf
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x48]
add esp, 0x14
cmp eax, edi
jle 0x11de5336
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 4]
xor esi, esi
test eax, eax
jle 0x11de532b
mov ecx, dword [ebx]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + esi*4]
mov ecx, dword [edx + edi*4]
push eax
push ecx
call fcn.11e89110
add esp, 8
test eax, eax
jne 0x11de5317
mov eax, dword [ebx + 4]
inc esi
cmp esi, eax
jl 0x11de52f3
jmp 0x11de532b
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 4]
lea eax, [eax + edi*4 + 4]
push eax
push ecx
mov ecx, ebp
call fcn.11e851b0
mov eax, dword [esp + 0x14]
add edi, 2
cmp edi, eax
jl 0x11de52ea
mov eax, dword [ebp + 4]
xor esi, esi
test eax, eax
jle 0x11de536c
mov eax, dword [0x12133f80]
test eax, eax
je 0x11de5364
mov ecx, dword [ebp]
mov edx, dword [ecx + esi*4]
push edx
push esi
push str.CSDGlobalShare::LoadMacroWindowText___d___s_
push str.IPG13839
push 0xffffffffffffffff
call fcn.11ca5810
add esp, 0x14
mov eax, dword [ebp + 4]
inc esi
cmp esi, eax
jl 0x11de533f
lea ecx, [esp + 0x10]
mov esi, 1
mov dword [esp + 0x28], 0xffffffff
call fcn.11e84bb0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x11de5bf0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fb6df0
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [esp + 0x50]
xor ebx, ebx
cmp esi, ebx
je 0x11de5d21
push esi
call fcn.11e67d05
add esp, 4
test eax, eax
jbe 0x11de5d21
push ebx
push 0x80
push 3
push ebx
push 1
push bind
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x11de5d21
mov eax, dword [0x11fd624c]
push ebp
push edi
xor ebp, ebp
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], ebx
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x11de5cc6
cmp dword [esp + 0x38], ebx
jbe 0x11de5cc6
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [esp + 0x38]
lea edx, [esp + 0x10]
push ebx
push edx
push ebp
push ebp
lea ecx, [esp + 0x68]
mov dword [esp + 0x20], ebx
call fcn.11e7ab90
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x11de5cb4
xor ebp, ebp
push ebp
lea ecx, [esp + 0x5c]
call fcn.11e7ac60
cmp ebp, dword [esp + 0x10]
je 0x11de5cc6
xor ebp, ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, ebx
jbe 0x11de5cfb
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x10]
push eax
call fcn.11e7e980
mov ecx, dword [esp + 0x5c]
push eax
mov byte [esp + 0x54], 1
call fcn.11e7f410
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], bl
call fcn.11e7f280
lea ecx, [esp + 0x58]
mov dword [esp + 0x50], 0xffffffff
call fcn.11e79f00
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret
mov ecx, dword [esp + 0x40]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x11de5e30
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x11fb6e0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
xor edi, edi
cmp esi, edi
mov dword [esp + 0x10], edi
je 0x11de605a
mov ebp, dword [esp + 0x234]
cmp ebp, edi
je 0x11de605a
mov ebx, dword [esp + 0x238]
cmp ebx, edi
je 0x11de605a
mov ecx, 0x1212b458
call fcn.11df4810
test eax, eax
je 0x11de605a
call fcn.11dd84e0
test eax, eax
jne 0x11de5ed5
call fcn.11dd8580
test eax, eax
jne 0x11de5ed5
push edi
push edi
mov ecx, 0x1212b5c0
call fcn.11d744b0
test eax, eax
jne 0x11de5ed5
push edi
mov ecx, 0x1212b5c0
call fcn.11d87b70
test eax, eax
je 0x11de605a
cmp dword [0x1212c758], edi
je 0x11de605a
mov ecx, 0x1212b5c0
call fcn.11da9350
test eax, eax
je 0x11de605a
mov word [esp + 0x18], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x12133f80]
test eax, eax
je 0x11de5f30
lea ecx, [esp + 0x18]
push ebx
push ecx
push esi
push str.IsForbidOpenFileDlg_hWnd_0x_08x__wndText__s__dwNum__lu_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x18
lea edx, [esp + 0x18]
push 0x1203ea7c
push edx
call fcn.11e67e01
add esp, 8
test eax, eax
je 0x11de5f8c
lea eax, [esp + 0x18]
push 0x120bb6e4
push eax
call fcn.11e67e01
add esp, 8
test eax, eax
je 0x11de5f8c
lea ecx, [esp + 0x18]
push 0x120bb6d8
push ecx
call fcn.11e67e01
add esp, 8
test eax, eax
je 0x11de5f8c
lea edx, [esp + 0x18]
push 0x120bb6c8
push edx
call fcn.11e67e01
add esp, 8
test eax, eax
jne 0x11de605a
mov eax, dword [esp + 0x238]
xor ebx, ebx
test eax, eax
jbe 0x11de605a
mov edi, ebp
mov eax, dword [edi]
push eax
call fcn.11dbbe80
mov esi, eax
mov eax, dword [0x12133f80]
add esp, 4
test eax, eax
je 0x11de5fcd
mov ecx, dword [edi]
push ecx
push esi
push str.IsForbidOpenFileDlg_dwAttrib_0x_08x__lpFileName__s_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x14
cmp esi, 0xffffffff
je 0x11de5fed
mov edx, esi
and edx, 0x10
cmp dl, 0x10
je 0x11de5fed
mov eax, dword [edi]
mov ecx, 0x1212aa70
push eax
call fcn.11ca4360
test eax, eax
je 0x11de5ffe
mov eax, dword [esp + 0x238]
inc ebx
add edi, 4
cmp ebx, eax
jb 0x11de5f9f
jmp 0x11de605a
push 0x12119948
lea ecx, [esp + 0x18]
call fcn.11e7eae0
mov ecx, dword [0x1212c7e8]
push 0
push 0x18
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x234], 0
call fcn.11e833d0
push 1
push 0
mov edx, dword [esp + 0x1c]
mov ecx, 0x1212b158
push edx
call fcn.11dc00d0
lea ecx, [esp + 0x14]
mov dword [esp + 0x228], 0xffffffff
mov dword [esp + 0x10], 1
call fcn.11e7f280
mov eax, dword [0x12133f80]
test eax, eax
je 0x11de6080
mov esi, dword [esp + 0x10]
push esi
push str.IsForbidOpenFileDlg_bForbid__d_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x10
mov eax, esi
jmp 0x11de6084
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret 0xc
Function at 0x11def280
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x768
push ebx
mov ebx, dword [esp + 0x770]
push esi
push edi
test ebx, ebx
je 0x11def3c9
cmp word [ebx], 0
je 0x11def3c9
mov esi, dword [esp + 0x77c]
test esi, esi
je 0x11def3c9
mov ecx, 0x1d7
xor eax, eax
lea edi, [esp + 0x18]
push eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0x760
call fcn.11e69e9f
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.11e69d3f
add esp, 8
test eax, eax
je 0x11def317
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ecx
mov ecx, dword [eax + 8]
push edx
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x10]
push edx
mov edx, dword [eax + 0x14]
inc ecx
add edx, 0x76c
push ecx
push edx
push str._02d__02d__02d__02d:_02d:_02d
lea eax, [esp + 0x38]
push 0x1f
push eax
call fcn.11e69362
add esp, 0x24
mov ecx, dword [0x12126434]
mov dword [esp + 0x304], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x12126854]
mov dword [esp + 0x308], eax
push 0x103
lea eax, [esp + 0x100]
push edx
push eax
call fcn.11e674bf
mov ecx, 0x10a
lea edi, [esp + 0x318]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x78c]
add esp, 0xc
test esi, esi
je 0x11def374
mov ecx, 0x10
lea edi, [esp + 0x734]
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 2
push 0
push 1
push 0x10000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x11def3c9
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push 0
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x768
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x768
ret
Function at 0x11df32e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x11fb7e7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], 0x11fd3398
lea esi, [edi + 0x4c]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 8
call fcn.11e7f280
lea ecx, [esi + 0x2c]
mov byte [esp + 0x18], 7
call fcn.11e7f280
lea ecx, [esi + 0x28]
mov byte [esp + 0x18], 6
call fcn.11e7f280
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 5
call fcn.11e7f280
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 4
call fcn.11e7f280
lea ecx, [esi + 0x1c]
mov byte [esp + 0x18], 3
call fcn.11e7f280
lea ecx, [esi + 0x18]
mov byte [esp + 0x18], 2
call fcn.11e7f280
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 0
call fcn.11e7f280
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.11ec4580
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x11df36b0
Capabilities:
Get file version info

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x218
push ebx
xor ebx, ebx
push ebp
push esi
cmp edx, ebx
push edi
je 0x11df37e1
mov ebp, dword [esp + 0x230]
cmp ebp, ebx
je 0x11df37e1
mov ecx, dword [esp + 0x234]
cmp ecx, 0x10
jb 0x11df37e1
mov esi, ecx
xor eax, eax
mov edi, ebp
mov word [esp + 0x20], bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
push 0x103
and ecx, 3
push edx
rep stosb byte es:[edi], al
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2a]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x28]
push eax
call fcn.11e674bf
add esp, 0xc
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, ebx
mov dword [esp + 0x10], eax
je 0x11df37e1
push eax
call fcn.11e679bc
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x11df37e1
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push esi
and ecx, 3
mov dword [esp + 0x18], ebx
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ebx
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x11df37c9
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0x12022ca0
push esi
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x11df37c9
call fcn.11f67bc0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
push ebp
push ecx
push edx
push 1
call fcn.11f680d0
mov edi, eax
call fcn.11f67c30
cmp edi, 0xffffffff
je 0x11df37c9
mov dword [esp + 0x14], 1
push esi
call fcn.11e679b1
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x218
ret
Function at 0x11dfc670
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x1212e104]
test eax, eax
je 0x11dfc67f
mov eax, 1
ret
push esi
mov esi, 0x1212e10c
push esi
mov dword [0x1212e104], 1
call fcn.11e67d05
add esp, 4
test eax, eax
jne 0x11dfc6a1
mov esi, str.TAppAccess.dll
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x1212e108], eax
je 0x11dfc721
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TAppAccessStart
push eax
call esi
mov dword [0x1212e0ec], eax
mov eax, dword [0x1212e108]
push str.TAppAccessStop
push eax
call esi
mov ecx, dword [0x1212e108]
push str.NotifyRegChange
push ecx
mov dword [0x1212e0f0], eax
call esi
mov edx, dword [0x1212e108]
push str.SetHttpSvrStart
push edx
mov dword [0x1212e0f4], eax
call esi
mov dword [0x1212e0f8], eax
mov eax, dword [0x1212e108]
push str.SetSVNSvrStart
push eax
call esi
mov ecx, dword [0x1212e108]
push str.GetSVNSvrStart
push ecx
mov dword [0x1212e0fc], eax
call esi
mov dword [0x1212e100], eax
mov eax, dword [0x1212e0ec]
pop esi
test eax, eax
je 0x11dfc75e
mov eax, dword [0x1212e0f0]
test eax, eax
je 0x11dfc75e
mov eax, dword [0x1212e0f4]
test eax, eax
je 0x11dfc75e
mov eax, dword [0x1212e0f8]
test eax, eax
je 0x11dfc75e
mov eax, dword [0x1212e0fc]
test eax, eax
je 0x11dfc75e
mov eax, dword [0x1212e100]
test eax, eax
je 0x11dfc75e
mov eax, 1
ret
xor eax, eax
ret