joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11990d5
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x12896e5
call fcn.01160118
mov eax, 0x101c
call fcn.011602e0
mov eax, dword [0x12cf8c8]
push ebx
push esi
mov esi, dword [ebp + 8]
push dword [esi]
mov dword [ebp - 0x10], eax
push 0x800
lea eax, [ebp - 0x1010]
push eax
push 0x100355c
xor ebx, ebx
push ebx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, ebx
je 0x119925e
cmp word [ebp - 0x1010], bx
push edi
lea edi, [ebp - 0x1010]
je 0x119925d
push edi
lea ecx, [ebp - 0x1024]
call fcn.01039819
mov dword [ebp - 4], ebx
cmp word [edi], 0x5f
je 0x1199239
push dword [esi]
push ebx
push 0x10149a4
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push dword [esi]
mov ecx, dword [ebp - 0x1018]
push 0x1014880
push edi
lea eax, [ebp - 0x1028]
push eax
call fcn.011968a0
mov byte [ebp - 4], 1
push dword [esi]
mov ecx, dword [ebp - 0x1018]
push 0x1014894
push edi
lea eax, [ebp - 0x1020]
push eax
call fcn.011968a0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1020]
cmp dword [eax - 8], 5
jl 0x119921c
push edi
lea ecx, [ebp - 0x1014]
call fcn.01039819
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1014]
call fcn.0105253b
lea ecx, [ebp - 0x1014]
call fcn.0107533f
lea ecx, [ebp - 0x101c]
call fcn.01196150
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x101c]
call fcn.01044bd5
mov ecx, dword [ebp - 0x1018]
lea eax, [ebp - 0x101c]
push eax
call fcn.01199063
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x101c]
call fcn.0119617d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1014]
call fcn.0103290a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1020]
call fcn.0103290a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1028]
call fcn.0103290a
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea edi, [edi + eax*2 + 2]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1024]
call fcn.0103290a
cmp word [edi], bx
jne 0x1199135
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe1a
leave
ret 4
Function at 0x11998f1
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
je 0x119990b
mov eax, 0x800003ea
jmp 0x1199a38
push ebx
push dword [ebp + 0xc]
lea ebx, [esi + 0x3c]
mov ecx, ebx
call fcn.01044f8b
push dword [ebp + 0x18]
lea ecx, [esi + 0x44]
call fcn.01044f8b
push dword [ebp + 0x1c]
lea ecx, [esi + 0x48]
call fcn.01044f8b
push dword [ebp + 0x14]
lea ecx, [esi + 0x40]
call fcn.01044f8b
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov al, byte [ebp + 0x20]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x30], edi
mov byte [esi + 0x38], al
mov al, byte [ebp + 0x24]
mov edi, 0x100685a
push edi
lea ecx, [esi + 0x68]
mov byte [esi + 0x3a], al
mov byte [esi + 0x39], 0
mov dword [esi + 0x64], 1
call fcn.010b8b4e
push edi
lea ecx, [esi + 0x6c]
call fcn.010b8b4e
push edi
lea ecx, [esi + 0x70]
call fcn.010b8b4e
mov ecx, dword [ebx]
xor eax, eax
cmp dword [ecx - 8], eax
je 0x1199a32
cmp dword [ebp + 0x14], eax
je 0x1199a32
mov edi, dword [ebp + 0x10]
cmp edi, eax
je 0x1199a32
cmp word [edi], ax
je 0x1199a32
mov ecx, ebx
call fcn.0107bf40
push edi
lea ecx, [esi + 0x4c]
call fcn.011961a5
lea edi, [esi + 0x74]
mov ecx, edi
call fcn.011976fe
push dword [ebp + 0x2c]
lea eax, [esi + 0x34]
push dword [ebp + 0x28]
push eax
push edi
push ebx
call fcn.0119988c
cmp eax, 0x80070006
jne 0x11999ee
push dword [ebx]
push 0xc
push 0x80004005
mov ecx, esi
call fcn.01198269
jmp 0x1199a37
xor edi, edi
cmp dword [esi + 0x78], edi
mov ecx, esi
jne 0x1199a02
push dword [ebx]
push 0xc
push 0x80004005
jmp 0x11999e7
call fcn.01196393
lea eax, [ebp + 0xc]
push eax
push edi
push esi
push 0x11994c3
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
mov dword [esi + 8], eax
jne 0x1199a2e
push edi
push 0x1c
push 0x8000ffff
jmp 0x11999e5
xor eax, eax
jmp 0x1199a37
mov eax, 0x80004005
pop ebx
pop edi
pop esi
pop ebp
ret 0x28
Function at 0x119b020
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1289ab4
call fcn.01160118
sub esp, 0x10
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x14]
call fcn.01044f5e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [esi + 0x7c]
push 0x32
push 0x32
lea ecx, [ebp - 0x14]
call fcn.01032987
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x119b05e
xor esi, esi
inc esi
jmp 0x119b0cb
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.010329f4
lea ecx, [ebp - 0x14]
call fcn.0107bf40
push ebx
push ebx
push 3
push ebx
push 7
push SysReAllocString
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
cmp ecx, ebx
jne 0x119b09f
mov esi, 0x80004005
jmp 0x119b0c0
mov cl, byte [ebp + 8]
push ebx
mov byte [ebp - 0xd], cl
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push ebx
push 1
lea ecx, [ebp - 0xd]
push ecx
push 0x2d4804
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor esi, esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x18]
call fcn.01082628
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0104508a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x119e1d5
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x1289ff0
call fcn.01160118
sub esp, 0x2c4
mov eax, dword [0x12cf8c8]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
lea ecx, [ebp - 0x2cc]
mov dword [ebp - 0x10], eax
call fcn.0116f618
mov dword [ebp - 4], esi
xor eax, eax
mov ecx, 0xad
lea edi, [ebp - 0x2c4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2d0]
push eax
push 0x20000000
lea ecx, [ebp - 0x2cc]
mov dword [ebp - 0x2d0], esi
call fcn.012068a5
push eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHParseDisplayName]
test eax, eax
lea eax, [ebp - 0x2c4]
jl 0x119e25d
push 0x109
push 0x2b4
push eax
push esi
lea ecx, [ebp - 0x2cc]
call fcn.01121ce0
push eax
jmp 0x119e26a
push 0x101
push 0x2b4
push eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp eax, esi
je 0x119e28e
push dword [ebp - 0x2c4]
call dword [sym.imp.USER32.dll_CopyIcon]
push dword [ebp - 0x2c4]
mov esi, eax
call dword [sym.imp.USER32.dll_DestroyIcon]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2cc]
call fcn.0116f6a9
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe1a
leave
ret 4

Function at 0x119e319
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x128a00a
call fcn.01160118
sub esp, 0x2c8
mov eax, dword [0x12cf8c8]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edi
xor esi, esi
push esi
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x2c8], eax
call fcn.0116f618
mov dword [ebp - 4], esi
xor eax, eax
mov ecx, 0xad
lea edi, [ebp - 0x2c4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2d4]
push eax
push 0x20000000
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0x2d4], esi
call fcn.012068a5
push eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHParseDisplayName]
test eax, eax
lea eax, [ebp - 0x2c4]
jl 0x119e3aa
push 0x208
push 0x2b4
push eax
push esi
lea ecx, [ebp - 0x2d0]
call fcn.01121ce0
push eax
jmp 0x119e3b7
push 0x200
push 0x2b4
push eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop edi
cmp eax, esi
pop esi
pop ebx
je 0x119e3d6
mov ecx, dword [ebp - 0x2c8]
lea eax, [ebp - 0x2b8]
push eax
call fcn.01044f8b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
call fcn.0116f6a9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor eax, eax
call fcn.0115fe1a
leave
ret 8
Function at 0x119e9ce
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x128a0ac
call fcn.01160118
sub esp, 0x24c
mov eax, dword [0x12cf8c8]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov esi, ecx
call fcn.0119e5e3
xor ebx, ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x228], ebx
mov byte [ebp - 4], 1
mov eax, dword [edi]
push ebx
push ebx
mov edi, 0x20006
push edi
push ebx
push ebx
push eax
push SysReAllocString
lea ecx, [ebp - 0x22c]
call fcn.01061330
cmp eax, ebx
je 0x119ea34
mov byte [ebp - 0x21d], bl
jmp 0x119ebba
push ebx
push ebx
push edi
push ebx
push ebx
push dword [0x12d01bc]
lea ecx, [ebp - 0x228]
push dword [ebp - 0x22c]
call fcn.01061330
cmp eax, ebx
jne 0x119ea29
push dword [0x12d01b4]
lea ecx, [ebp - 0x228]
push dword [esi + 0x40]
call fcn.01061385
mov edi, dword [esi + 0x34]
push ebx
push ebx
push 0x146
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
sub eax, edi
mov dword [ebp - 0x230], eax
xor eax, eax
push 9
pop ecx
lea edi, [ebp - 0x258]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [ebp - 0x21a]
mov word [ebp - 0x21c], bx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x250], eax
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x258], 0x27
mov dword [ebp - 0x24c], 0x104
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 2
xor edi, edi
cmp dword [ebp - 0x230], ebx
jle 0x119eb4d
lea eax, [edi + 1]
push eax
push dword [0x12d01b8]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x224]
push eax
call fcn.01032a27
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
lea ecx, [esi + 4]
mov dword [ebp - 0x254], edi
call fcn.0111e6d0
test eax, eax
je 0x119eb34
push dword [ebp - 0x224]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x228]
call fcn.01044b10
mov word [ebp - 0x21c], bx
lea ecx, [ebp - 0x224]
call fcn.010478ab
mov edi, dword [ebp - 0x234]
cmp edi, dword [ebp - 0x230]
jl 0x119eadd
mov edi, dword [ebp - 0x230]
jmp 0x119eb88
push edi
push dword [0x12d01b8]
lea eax, [ebp - 0x224]
push eax
call fcn.01032a27
add esp, 0xc
push dword [ebp - 0x224]
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x224]
call fcn.010478ab
inc edi
cmp edi, dword [esi + 0x40]
jle 0x119eb55
lea ecx, [ebp - 0x228]
call fcn.01044a59
lea ecx, [ebp - 0x22c]
call fcn.01044a59
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.0103290a
mov byte [ebp - 0x21d], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x228]
call fcn.01044a59
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.01044a59
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x21d]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe1a
leave
ret 4
Function at 0x119f3a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x119f3b8
cmp dword [ebp + 8], 0
jne 0x119f3bf
mov eax, 0x80004003
jmp 0x119f408
mov eax, dword [0x12d28f8]
push esi
mov esi, dword [eax + 0x24]
push 0x1014e00
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x119f402
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x119f402
mov ecx, dword [edi]
lea edx, [ebp + 0xa]
push edx
add eax, 2
push eax
push edi
call dword [ecx + 0x104]
test eax, eax
jne 0x119f402
cmp word [ebp + 0xa], ax
jne 0x119f407
mov eax, 0xc947006d
pop esi
pop edi
pop ebp
ret 8

Function at 0x11a5717
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x128b01c
call fcn.01160118
push ecx
push esi
mov esi, ecx
and dword [esi + 0x14], 0
push edi
lea edi, [esi + 4]
mov ecx, edi
mov dword [ebp - 0x10], esi
call fcn.010842f2
and dword [ebp - 4], 0
push dword [ebp + 8]
lea ecx, [esi + 0x18]
mov dword [esi], 0x1015150
mov dword [edi], 0x101512c
call fcn.01257a53
mov byte [ebp - 4], 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x1c]
call fcn.01257a53
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
lea ecx, [esi + 0x20]
call fcn.01257a53
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x28], eax
and dword [esi + 0x2c], 0
mov byte [ebp - 4], 4
fld qword [ebp + 0x1c]
fstp qword [esi + 0x30]
lea ecx, [esi + 0x40]
fldz
fstp qword [esi + 0x38]
call fcn.011a1b1e
mov byte [ebp - 4], 5
lea ecx, [esi + 0x4c]
call fcn.011a1b1e
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x11ae031
Capabilities:
Get common file path

Disassembly:
mov eax, 0x128ba6e
call fcn.01160118
sub esp, 0x444
mov eax, dword [0x12cf8c8]
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x10], eax
jne 0x11ae05e
mov eax, 0x80004003
jmp 0x11ae167
mov eax, dword [0x12ce0a0]
push esi
mov dword [ebp - 0x450], eax
mov dword [ebp - 4], ebx
push 0xf0ca
lea ecx, [ebp - 0x450]
call fcn.01032a7e
push 0x51
push dword [ebp - 0x450]
lea ecx, [ebp - 0x444]
push ebx
call fcn.01074a96
cmp byte [ebp + 0xc], bl
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x448], ebx
je 0x11ae0cc
lea eax, [ebp - 0x448]
push eax
push ebx
push ebx
push 0x12
call esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jl 0x11ae0cc
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x440], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x444]
call fcn.01073dd6
cmp eax, 1
jne 0x11ae0ec
lea eax, [ebp - 0x21c]
push eax
jmp 0x11ae0f1
push 0x100355c
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp dword [ebp - 0x448], ebx
mov dword [edi], eax
je 0x11ae141
mov dword [ebp - 0x44c], ebx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x11ae12e
mov eax, dword [ebp - 0x44c]
push dword [ebp - 0x448]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x44c]
cmp eax, ebx
je 0x11ae141
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [edi], ebx
jne 0x11ae14c
mov ebx, 0x8007000e
jmp 0x11ae155
call esi
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.0103290a
mov eax, ebx
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe1a
leave
ret 8
Function at 0x11ae33d
Capabilities:
Create thread

Disassembly:
mov eax, 0x128bb45
call fcn.01160118
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp dword [esi + 0x24], ebx
mov dword [ebp - 0x1c], ebx
jne 0x11ae35d
cmp dword [esi + 0x1c], ebx
jg 0x11ae367
mov eax, 0x80004005
jmp 0x11ae4c1
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
mov ecx, dword [0x12d28f8]
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
push edx
call dword [eax + 0x24]
mov edi, eax
cmp edi, ebx
jge 0x11ae3b2
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x11ae39a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11ae3ab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x11ae4c0
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jne 0x11ae3e4
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x11ae3c9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11ae3da
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004003
jmp 0x11ae4c0
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
call dword [ecx + 0x54]
mov edi, eax
cmp edi, ebx
jl 0x11ae38a
cmp dword [ebp - 0x10], ebx
je 0x11ae3b9
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x11ae409
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0x70]
mov edi, eax
cmp edi, ebx
jl 0x11ae43d
push dword [ebp - 0x18]
lea edi, [esi + 0x68]
mov ecx, edi
call fcn.01044f8b
mov ecx, edi
call fcn.0107bf40
mov edi, eax
cmp edi, ebx
jge 0x11ae44e
mov byte [ebp - 4], bl
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x11ae39a
cmp byte [ebp + 8], bl
jne 0x11ae494
lea eax, [esi + 0x28]
push eax
push ebx
push esi
push fcn.011addb2
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x24], eax
jne 0x11ae49e
mov byte [ebp - 4], bl
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11ae48d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x11ae4c0
push esi
call fcn.011addb2
mov esi, eax
jmp 0x11ae4a1
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 4], bl
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x11ae4be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x11b0041
Capabilities:
Create thread

Disassembly:
mov eax, 0x128be0f
call fcn.01160118
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 4]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x24], edi
call fcn.011afb4a
mov dword [ebp - 4], edi
lea eax, [esi + 0x34]
push eax
mov dword [esi], 0x1015600
mov dword [ebx], 0x10155f4
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 1
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov byte [ebp - 4], 2
mov dword [esi + 0x58], edi
mov byte [ebp - 4], 3
push edi
push edi
push 1
push edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 0x2c], eax
je 0x11b0106
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 0x28], eax
je 0x11b0106
push edi
push edi
push esi
push 0x11aff5a
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x30], eax
je 0x11b0106
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x20]
push eax
push edi
mov ecx, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.011aff86
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x11b1ff6
Capabilities:
Create thread
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi + 0x38], ecx
je 0x11b2010
mov eax, 0x80004005
jmp 0x11b21c1
cmp dword [esi + 0x2c], ecx
push ebx
push edi
mov dword [ebp - 4], ecx
jle 0x11b213a
xor ebx, ebx
mov eax, dword [esi + 0x28]
push ecx
push 0x42000000
push 3
push ecx
push 7
lea edi, [ebx + eax]
mov eax, dword [edi + 0x102c]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [edi + 0x1018]
call fcn.01082659
mov eax, dword [esi + 0x28]
lea ecx, [ebx + eax + 0x1018]
cmp dword [ecx], 0xffffffff
jne 0x11b2062
push 0
call fcn.01082659
mov eax, dword [esi + 0x28]
lea ecx, [ebx + eax]
cmp dword [ecx + 0x1018], 0
je 0x11b211c
xor eax, eax
lea edi, [ecx + 0x1004]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [esi + 0x28]
xor eax, eax
mov ecx, 0x400
add edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x28]
push 0
add eax, ebx
mov ecx, dword [eax + 0x1018]
lea edx, [eax + 0x1004]
push edx
lea edx, [eax + 0x1000]
push edx
push 0x1b
push 1
push 0x1000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
test eax, eax
mov eax, dword [esi + 0x28]
je 0x11b2112
push 0
add eax, ebx
mov ecx, dword [eax + 0x1018]
push eax
push dword [esi + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
mov dword [esi + 0x38], eax
je 0x11b2198
mov eax, dword [esi + 0x28]
push dword [ebx + eax + 0x102c]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x11b210f
cmp eax, 3
jbe 0x11b2102
cmp eax, 5
jbe 0x11b210f
mov eax, dword [esi + 0x28]
mov byte [ebx + eax + 0x101c], 0
jmp 0x11b2123
mov eax, dword [esi + 0x28]
mov byte [ebx + eax + 0x101c], 1
jmp 0x11b2123
mov byte [ecx + 0x101c], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add ebx, 0x1034
xor ecx, ecx
cmp eax, dword [esi + 0x2c]
jl 0x11b2020
cmp dword [esi + 0x38], ecx
jne 0x11b2147
or dword [esi + 0x38], 0xffffffff
xor eax, eax
jmp 0x11b21bf
cmp dword [esi + 0x34], ecx
jne 0x11b21a8
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ecx
push ecx
push 1
push ecx
call edi
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 0x3c], eax
je 0x11b2198
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x40], eax
je 0x11b2198
push ebx
push ebx
push 1
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x44], eax
je 0x11b2198
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x11b1fc6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x34], eax
jne 0x11b219f
mov eax, 0x80004003
jmp 0x11b21bf
push 0xfffffffffffffff1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop edi
pop ebx
pop esi
leave
ret 0x10
Function at 0x11b7c41
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
shr esi, 2
and edx, 3
test esi, esi
push edi
lea edi, [ecx + esi*4]
jle 0x11b7c79
cmp ecx, edi
jae 0x11b7c79
xor ebx, ebx
mov esi, dword [ecx]
add eax, esi
xor eax, ebx
add ecx, 4
xor eax, esi
add ebx, 4
cmp ecx, edi
jb 0x11b7c67
test edx, edx
jle 0x11b7ca2
dec edx
mov edi, ecx
js 0x11b7ca2
sub ecx, dword [ebp + 0xc]
lea esi, [edx + 1]
mov ebx, ecx
mov ecx, edx
shl ecx, 3
movzx edx, byte [edi]
shl edx, cl
sub ecx, 8
add eax, edx
xor eax, edx
xor eax, ebx
inc edi
inc ebx
dec esi
jne 0x11b7c8f
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x11b96db
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp esi, edi
jne 0x11b96f6
mov eax, 0x80004003
jmp 0x11b976d
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, edi
je 0x11b976b
add eax, 3
and eax, 0xfffffffc
call fcn.011602e0
cmp esp, edi
mov dword [ebp + 0xc], esp
je 0x11b976b
push esp
push ebx
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x11b976b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x1007ab8
push dword [ebp + 0xc]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x11b976b
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 8]
mov edx, edi
mov cl, 0x20
mov dword [esi], eax
mov dword [esi + 4], edi
call fcn.01160540
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebx + 0xc]
or dword [esi], eax
or dword [esi + 4], edi
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 8