joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2a20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5698e6
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x5a6124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x224], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0xc8]
call eax
mov dword [ebp - 0x248], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x244], 0
push eax
push 0x11
movups xmmword [ebp - 0x240], xmm0
push 0
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x238], 0x51
mov dword [ebp - 0x23c], 0x56e1a4
mov dword [ebp - 0x21c], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebp - 0x244]
test eax, eax
lea eax, [ebp - 0x248]
cmovns ecx, dword [ebp - 0x21c]
push eax
mov dword [ebp - 0x244], ecx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x4e2b8f
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4e2b8f
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.00407b50
mov eax, dword [ebp - 0x220]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x24c], esp
mov esi, esp
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x228], esi
call fcn.00407010
add eax, 0x10
add esp, 4
mov dword [esi], eax
mov byte [ebp - 4], 1
call fcn.004e2980
mov byte [ebp - 4], 0
lea ecx, [eax + 4]
call fcn.00454d60
push ecx
push esp
call fcn.004e2980
lea ecx, [eax + 4]
call fcn.00454bf0
mov ecx, dword [ebp - 0x224]
mov ecx, dword [ecx + 0x140]
call fcn.00432680
mov edx, dword [ebp - 0x220]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4e2b8f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4e2ba0
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00502bf3
mov esp, ebp
pop ebp
ret 4
Function at 0x4e5c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569dc6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5a6124]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4e5cdc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4e5cdc
call fcn.004a9570
mov esi, eax
jmp 0x4e5dcc
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4e5cff
call fcn.004a9570
jmp 0x4e5dbf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4e5d1d
call fcn.004a9570
jmp 0x4e5dbf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4e5d3e
mov esi, 0x8007000e
jmp 0x4e5dc1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004e4b20
jmp 0x4e5d68
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x4e5d7f
mov esi, 0x8007000e
jmp 0x4e5dc1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4e5d9f
call fcn.004a9570
jmp 0x4e5dbf
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004e5ad0
mov esi, eax
test edi, edi
je 0x4e5dcc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4e5df0
lea ecx, [ebp - 0x418]
call fcn.004e5080
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00502bf3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4e7190
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4e71a9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4e71b5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4e71b0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x54655a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054615f

Function at 0x546565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005462e0

Function at 0x54f7fe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054efd8

Function at 0x54f809
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054f213

Function at 0x54fc75
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0054f9fc
Function at 0x1008c4e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1008d4a
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor esi, esi
cmp edi, esi
jne 0x1008c8c
call ebx
test eax, eax
jne 0x1008d47
and edi, 0xffff7fff
cmp edi, 2
jne 0x1008cd7
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x1008caf
call ebx
cmp eax, 6
je 0x1008cd7
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1008cb5
push esi
sub eax, edx
lea ecx, [ebp - 0x10]
push ecx
sar eax, 1
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1008d47
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
push esi
push eax
call edi
mov ebx, eax
cmp ebx, esi
je 0x1008d47
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1008d47
push esi
push esi
push ebx
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
push dword [ebp - 0xc]
call edi
cmp eax, esi
je 0x1008d36
push esi
lea ecx, [ebp - 0x10]
push ecx
dec eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100917e
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x101fea8
call fcn.01009be4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1022718
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1008f93
cmp eax, esi
jne 0x1008f86
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1008f96
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1008f6d
xor esi, esi
inc esi
mov eax, dword [0x1022714]
cmp eax, esi
jne 0x1008fa9
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1008fe4
mov eax, dword [0x1022714]
test eax, eax
jne 0x1008fde
mov dword [0x1022714], esi
push 0x1001338
push 0x100132c
call fcn.01008eea
pop ecx
pop ecx
test eax, eax
je 0x1008fe4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10090ae
mov dword [0x10223bc], esi
mov eax, dword [0x1022714]
cmp eax, esi
jne 0x1009008
push 0x1001328
push 0x1001320
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1022714], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1009015
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1022720], ebx
je 0x1009036
push 0x1022720
call fcn.01009b59
pop ecx
test eax, eax
je 0x1009036
push ebx
push 2
push ebx
call dword [0x1022720]
push dword [0x10223a4]
push dword [0x10223a8]
push dword [0x10223a0]
call fcn.0100893c
add esp, 0xc
mov dword [0x10223b8], eax
cmp dword [0x10223ac], ebx
jne 0x1009094
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10223bc], ebx
jne 0x10090a2
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10223b8]
call fcn.01009c29
ret
call fcn.01009d31
jmp 0x1008f4b
Function at 0x100c1c7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100c1f6
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.01009259
add esp, 0x14
jmp 0x100c2d4
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100c2d4
test al, 0x40
jne 0x100c2d4
test al, 2
je 0x100c218
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100c2d4
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x100c1d8
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x100c2c4
cmp eax, 0xffffffff
je 0x100c2c4
test byte [esi + 0xc], 0x82
jne 0x100c299
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x100c284
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x100c284
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100c289
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100c299
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100c2b7
mov eax, dword [esi + 0xc]
test al, 8
je 0x100c2b7
test eax, 0x400
jne 0x100c2b7
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x100c2d7
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100daf7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x100db26
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.01009259
add esp, 0x14
jmp 0x100dc10
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x100dc10
test al, 0x40
jne 0x100dc10
test al, 2
je 0x100db48
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x100dc10
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x100db08
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x100dc00
cmp eax, 1
je 0x100dc00
cmp eax, 0xffffffff
je 0x100dc00
test byte [esi + 0xc], 0x82
jne 0x100dbd2
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x100dbbd
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x100dbbd
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x100dbc2
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x100dbd2
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x100dbf0
mov eax, dword [esi + 0xc]
test al, 8
je 0x100dbf0
test eax, 0x400
jne 0x100dbf0
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add dword [esi + 4], 0xfffffffe
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x100dc15
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
mov eax, 0xffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100fb01
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100fb1c
test al, 0x50
jne 0x100fb1c
inc esi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100fbcc
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x105
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x100fc34
push edi
push edi
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov esi, eax
cmp esi, edi
je 0x100fc34
test byte [ebp - 0x214], 8
jne 0x100fc34
push 0x32
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01009199
leave
ret 4

Function at 0x100fc4b
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, 0x80
cmp ebx, esi
je 0x100fc8a
test ebx, 0xffffff78
je 0x100fc8a
push dword [ebp + 8]
and dword [ebp + 0xc], 0
push ebx
push 0x1002d08
push 4
call fcn.01011862
add esp, 0x10
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100fd18
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100fccf
and dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.01011603
cmp esi, 2
je 0x100fcbd
push esi
push edi
push 0x1002ca8
push 3
jmp 0x100fd08
push edi
push 0x1002c48
push 2
call fcn.01011862
add esp, 0xc
jmp 0x100fd10
and eax, 0x3120
or eax, ebx
or eax, esi
cmp eax, esi
je 0x100fce1
and eax, 0xffffff7f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x100fd17
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.01011603
push esi
push edi
push 0x1002be8
push 4
call fcn.01011862
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1011095
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push 1
push eax
mov dword [ebp - 8], 0x1003ad0
call fcn.01012229
mov esi, eax
test esi, esi
je 0x10110cd
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0101252a
mov esi, eax
cmp dword [ebp - 4], 0
je 0x10110e5
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop esi
leave
ret 8

Function at 0x101122a
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jne 0x1011255
and dword [0x102272c], esi
jmp 0x1011372
cmp word [edi], 0x5c
jne 0x10112c6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1011260
push 2
sub eax, edx
pop ecx
sar eax, 1
mov dword [ebp - 0x210], eax
mul ecx
lea ecx, [ebp - 0x210]
push ecx
push edx
push eax
call fcn.01010ddf
mov esi, eax
test esi, esi
jl 0x1011372
lea eax, [ebp - 0x210]
push eax
push 2
push dword [ebp - 0x210]
call fcn.01010e11
mov esi, eax
test esi, esi
jl 0x1011372
push edi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0100960e
add esp, 0xc
jmp 0x1011337
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x10112e7
mov esi, 0xc000000d
jmp 0x1011372
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10112f0
push 2
sub eax, edx
pop ecx
sar eax, 1
mov dword [ebp - 0x210], eax
mul ecx
lea ecx, [ebp - 0x210]
push ecx
push edx
push eax
call fcn.01010ddf
mov esi, eax
test esi, esi
jl 0x1011372
lea eax, [ebp - 0x210]
push eax
push 2
push dword [ebp - 0x210]
call fcn.01010e11
mov esi, eax
test esi, esi
jl 0x1011372
push dword [ebp - 0x210]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x102272c], eax
test eax, eax
jne 0x101135c
mov esi, 0xc0000017
jmp 0x1011372
push dword [ebp - 0x210]
lea ecx, [ebp - 0x20c]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
setge al
pop edi
xor ecx, ebp
pop esi
call fcn.01009199
leave
ret 4
Function at 0x101162b
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
jne 0x10116a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x101168d
cmp esi, 3
je 0x101168d
push esi
push ebx
call fcn.01011603
push esi
push ebx
push 0x1004178
push 4
call fcn.01011862
add esp, 0x10
jmp 0x10117a8
push ebx
push 0x10040e8
push 2
call fcn.01011862
add esp, 0xc
jmp 0x10117a8
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10116d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.01011603
push dword [ebp - 4]
push ebx
push 0x1004080
push 4
call fcn.01011862
add esp, 0x10
jmp 0x101179c
cmp dword [ebp - 0xc], esi
je 0x1011700
push 0x57
pop eax
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.01011603
push ebx
push 0x1004050
push 4
call fcn.01011862
add esp, 0xc
jmp 0x101179c
push esi
push dword [ebp - 0x10]
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp edi, esi
jne 0x101173a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.01011603
push dword [ebp - 4]
push ebx
push 0x1003ff0
push 4
call fcn.01011862
add esp, 0x10
jmp 0x1011791
push dword [ebp - 0x10]
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, esi
jne 0x1011776
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
mov dword [ebp - 4], eax
call fcn.01011603
push dword [ebp - 4]
push ebx
push 0x1003f98
push 4
call fcn.01011862
add esp, 0x10
jmp 0x101178c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
cmp dword [ebp - 8], esi
jne 0x10117af
cmp edi, esi
je 0x101179c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x101190c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x2c
push 0x101ff08
call fcn.01009be4
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
xor edi, edi
inc edi
or dword [ebp + 8], edi
mov dword [ebp - 0x3c], 0x10
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push 3
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_LdrFindResource_U]
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffffe
pop esi
mov dword [ebp - 4], esi
jmp 0x1011976
cmp dword [ebp - 0x1c], ebx
jl 0x1011a00
mov dword [ebp - 4], edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_LdrAccessResource]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], esi
jmp 0x10119b4
cmp dword [ebp - 0x1c], ebx
jl 0x1011a00
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x5c
jb 0x10119ed
push 0x10041f4
mov eax, dword [ebp - 0x20]
add eax, 6
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10119ed
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], esi
jmp 0x1011a00
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
call fcn.01009c29
ret 4