joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10f7b93
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x208
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [edi], ebx
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10f7bcd
mov dword [ebp - 4], 0x8007000e
jmp 0x10f7cc4
push esi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x104
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x10f7ca7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.010f6a76
cmp eax, ebx
jge 0x10f7c59
mov ecx, dword [0x111124c]
cmp ecx, 0x111124c
je 0x10f7c44
test byte [ecx + 0x1c], 1
je 0x10f7c44
cmp byte [ecx + 0x19], 3
jb 0x10f7c44
push eax
push dword [ebp + 8]
push 0x1012aec
push 0x3e
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010196ed
mov ecx, dword [0x111124c]
cmp esi, ebx
jle 0x10f7c54
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 4], esi
jmp 0x10f7cca
mov eax, dword [ebp - 0xc]
shr eax, 0xb
test al, 1
je 0x10f7d19
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x10f7c94
test byte [eax + 0x1c], 1
je 0x10f7c94
cmp byte [eax + 0x19], 4
jb 0x10f7c94
push dword [ebp + 8]
push 0x1012aec
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019680
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.010f6cc2
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x10f7cc4
mov esi, dword [ebp - 8]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10f7caf
sub eax, edx
sar eax, 1
je 0x10f7cc4
mov dword [edi], esi
mov dword [ebp - 8], ebx
mov ecx, dword [0x111124c]
cmp dword [ebp - 8], ebx
je 0x10f7cde
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [0x111124c]
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
jge 0x10f7d12
cmp ecx, 0x111124c
je 0x10f7d12
test byte [ecx + 0x1c], 1
je 0x10f7d12
cmp byte [ecx + 0x19], 3
jb 0x10f7d12
push dword [ebp - 4]
push dword [ebp + 8]
push 0x1012aec
push 0x42
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010196ed
mov eax, dword [ebp - 4]
leave
ret 8
cmp esi, 0x3ed
je 0x10f7d2f
cmp esi, 1
je 0x10f7d2f
cmp esi, 0x57
jne 0x10f7c3e
mov ecx, dword [0x111124c]
cmp ecx, 0x111124c
je 0x10f7cca
test byte [ecx + 0x1c], 1
je 0x10f7cca
cmp byte [ecx + 0x19], 5
jb 0x10f7cca
push dword [ebp + 8]
push 0x1012aec
push 0x41
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01019680
jmp 0x10f7cc4
Function at 0x10f9b33
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x10f9b64
test byte [eax + 0x1c], 1
je 0x10f9b64
cmp byte [eax + 0x19], 4
jb 0x10f9b64
push 0x1012d98
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov edi, dword [ebp + 0x14]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push ecx
push ecx
push eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
call esi
mov ebx, eax
test ebx, ebx
jne 0x10f9bab
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x10f9b9f
mov dword [ebp + 8], eax
jmp 0x10f9c44
and eax, 0xffff
or eax, 0x80070000
jmp 0x10f9b97
push 2
push ebx
lea eax, [ebp - 8]
push eax
call fcn.0101aed5
mov dword [ebp + 8], eax
test eax, eax
jl 0x10f9c36
mov edi, dword [edi]
push ebx
mov ebx, dword [ebp - 8]
push ebx
push edi
call esi
test eax, eax
jne 0x10f9be5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10f9be0
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 8], eax
jmp 0x10f9c39
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0107cc67
mov dword [ebp + 8], eax
test eax, eax
jl 0x10f9c39
test ebx, ebx
je 0x10f9c03
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor ebx, ebx
mov esi, dword [ebp + 0x14]
push esi
push dword [ebp - 4]
call fcn.0107cfe1
mov dword [ebp + 8], eax
test eax, eax
jl 0x10f9c39
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push 0
lea ecx, [esi + 4]
push ecx
push eax
call fcn.0107c871
mov dword [ebp + 8], eax
test eax, eax
jl 0x10f9c39
mov al, byte [ebp + 0x10]
mov byte [esi + 8], al
jmp 0x10f9c39
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10f9c44
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x10f9c5a
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
and dword [ebp - 4], 0
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x10f9c84
test byte [eax + 0x1c], 1
je 0x10f9c84
cmp byte [eax + 0x19], 4
jb 0x10f9c84
push 0x1012d98
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
mov eax, dword [ebp + 8]
leave
ret 0x10
Function at 0x10fe872
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [0x111124c]
mov esi, 0x111124c
cmp eax, esi
je 0x10fe8ac
test byte [eax + 0x1c], 0x20
je 0x10fe8ac
cmp byte [eax + 0x19], 4
jb 0x10fe8ac
push 0x1013c38
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
mov eax, dword [0x111124c]
xor ecx, ecx
push ebx
xor ebx, ebx
cmp byte [ebp + 8], cl
mov dword [ebp - 4], ebx
setne cl
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ecx
cmp eax, esi
je 0x10fe8e9
test byte [eax + 0x1c], 0x20
je 0x10fe8e9
cmp byte [eax + 0x19], 4
jb 0x10fe8e9
push ecx
push 0x1013c38
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189f6
push edi
lea eax, [ebp - 8]
push eax
mov edi, 0xf003f
push edi
push ebx
mov esi, 0x100177c
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x10fe958
jle 0x10fe916
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x10fea3c
test byte [eax + 0x1c], 0x20
je 0x10fea3c
cmp byte [eax + 0x19], 2
jb 0x10fea3c
push dword [ebp - 4]
push esi
push 0x1013c38
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010196ed
jmp 0x10fea37
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
mov edi, 0x1013d00
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x10fe9c4
jle 0x10fe984
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x10fea3c
test byte [eax + 0x1c], 0x20
je 0x10fea3c
cmp byte [eax + 0x19], 2
jb 0x10fea3c
push dword [ebp - 4]
push edi
push esi
push 0x1013c38
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019a40
jmp 0x10fea37
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
mov ebx, 0x1013ce8
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, eax
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x10fea35
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x10fea1c
test byte [eax + 0x1c], 0x20
je 0x10fea1c
cmp byte [eax + 0x19], 2
jb 0x10fea1c
push 0
push ebx
push edi
push esi
push 0x1013c38
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01082de9
mov eax, dword [0x111124c]
mov ecx, dword [ebp + 8]
test ecx, ecx
jg 0x10fea27
mov dword [ebp - 4], ecx
xor ebx, ebx
jmp 0x10fea3c
and ecx, 0xffff
or ecx, 0x80070000
jmp 0x10fea20
xor ebx, ebx
mov eax, dword [0x111124c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
cmp dword [ebp - 8], ebx
je 0x10fea52
push dword [ebp - 8]
call esi
mov eax, dword [0x111124c]
cmp dword [ebp - 0xc], ebx
pop ebx
je 0x10fea62
push dword [ebp - 0xc]
call esi
mov eax, dword [0x111124c]
pop esi
cmp eax, 0x111124c
je 0x10fea88
test byte [eax + 0x1c], 0x20
je 0x10fea88
cmp byte [eax + 0x19], 4
jb 0x10fea88
push 0x1013c38
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x10ffd4d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x111127c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
and dword [0x1113210], 0
and dword [0x1113214], 0
push ebx
push esi
mov eax, dword [0x111124c]
push 4
pop ebx
cmp eax, 0x111124c
je 0x10ffda5
test byte [eax + 0x1c], 0x20
je 0x10ffda5
cmp byte [eax + 0x19], bl
jb 0x10ffda5
push 0x1013f24
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x210]
push eax
push 0x1013f74
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
jbe 0x10ffddd
mov esi, 0x8007000e
jmp 0x10ffeea
mov ecx, 0x1013f6c
lea eax, [ebp - 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10ffe0c
test dx, dx
je 0x10ffe08
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10ffe0c
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x10ffde8
xor eax, eax
jmp 0x10ffe11
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10ffe8c
mov ecx, 0x1013f60
lea eax, [ebp - 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10ffe44
test dx, dx
je 0x10ffe40
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10ffe44
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x10ffe20
xor eax, eax
jmp 0x10ffe49
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10ffe51
push 9
jmp 0x10ffe8b
mov ecx, 0x1013f54
lea eax, [ebp - 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10ffe80
test dx, dx
je 0x10ffe7c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10ffe80
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x10ffe5c
xor eax, eax
jmp 0x10ffe85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10ffe92
push 6
pop eax
mov word [0x1111fcc], ax
call fcn.01104d37
test eax, eax
jne 0x10ffedd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10ffeaf
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x10fff13
test byte [eax + 0x1c], 0x20
je 0x10ffeef
cmp byte [eax + 0x19], 2
jb 0x10ffeef
push 0x1013f24
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
jmp 0x10ffeea
or dword [0x1113210], 1
mov esi, dword [ebp - 0x214]
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x10fff13
test byte [eax + 0x1c], 0x20
je 0x10fff13
cmp byte [eax + 0x19], bl
jb 0x10fff13
push 0x1013f24
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010189d0
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0106f5f8
leave
ret
Function at 0x1100e1f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x111127c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x58], ecx
xor edi, edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], edi
call fcn.010be9e0
push ebx
lea ecx, [ebp - 0x48]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 0x5c], edi
call fcn.010be9f9
cmp eax, edi
jge 0x1100e6d
push edi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea eax, [ebp - 0x48]
push eax
call fcn.010c7466
push dword [0x1111ffc]
lea ecx, [ebp - 0x48]
call fcn.010bea52
cmp eax, edi
jge 0x1100e93
push edi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_RaiseException]
push edi
push 0x2000080
push 3
push edi
push 1
push 0x80000000
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x54], eax
mov ebx, 0x80070000
cmp eax, 0xffffffff
je 0x1100f33
cmp eax, edi
je 0x1100f33
push edi
lea ecx, [ebp - 0x5c]
push ecx
push 8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1100ef2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1100ee1
and eax, 0xffff
or eax, ebx
push dword [ebp - 0x40]
mov dword [ebp - 0x64], 0x316
push 0x10145c8
jmp 0x1100f53
cmp dword [ebp - 0x5c], 8
je 0x1100eff
mov dword [ebp - 0x4c], 0x80004005
mov eax, dword [0x111124c]
cmp eax, 0x111124c
je 0x1100f82
test byte [eax + 0x1c], 8
je 0x1100f82
cmp byte [eax + 0x19], 5
jb 0x1100f82
push dword [esi + 4]
push dword [esi]
push dword [ebp - 0x50]
push 0x1014010
push 0x34
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01019e9a
jmp 0x1100f7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1100f44
and eax, 0xffff
or eax, ebx
push dword [ebp - 0x40]
mov dword [ebp - 0x64], 0x313
push 0x1014594
mov dword [ebp - 0x4c], eax
mov eax, dword [0x1112000]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x68], 0x1014250
call sym.wbengine.exe_public:_void___cdecl_CTraceFailureHelper::TraceMessage_unsigned_short_int_const__
add esp, 0xc
mov eax, dword [0x111124c]
cmp dword [ebp - 0x4c], edi
jge 0x1100fb2
cmp eax, 0x111124c
je 0x1100fb2
test byte [eax + 0x1c], 8
je 0x1100fb2
cmp byte [eax + 0x19], 2
jb 0x1100fb2
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0x1014010
push 0x35
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010196ed
cmp dword [ebp - 0x54], 0xffffffff
je 0x1100fe1
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1100fe1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1100fd6
and eax, 0xffff
or eax, ebx
push edi
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea ecx, [ebp - 0x48]
call fcn.010be803
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0106f5f8
leave
ret 8
Function at 0x1102b19
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10a4
call fcn.0106f610
mov eax, dword [0x111127c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x108c], 0
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1088]
push esi
mov dword [ebp - 0x1090], eax
lea eax, [ebp - 0x10a4]
push eax
mov esi, ecx
mov dword [ebp - 0x1094], 0x800
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebx + 0x10]
or eax, dword [ebx + 0x14]
je 0x1102b83
push dword [ebx + 0x10]
lea eax, [ebp - 0x24]
push 0x1014d40
push 0x10
push eax
call fcn.01025c69
add esp, 0x10
jmp 0x1102b89
xor eax, eax
mov word [ebp - 0x24], ax
push edi
push dword [ebx + 0x18]
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0xc]
movzx eax, word [ebp - 0x1096]
push dword [ebx + 4]
push dword [esi]
push eax
movzx eax, word [ebp - 0x1098]
push eax
movzx eax, word [ebp - 0x109a]
push eax
movzx eax, word [ebp - 0x109c]
push eax
movzx eax, word [ebp - 0x109e]
push eax
movzx eax, word [ebp - 0x10a2]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [esi + 0x24]
lea eax, [ebp - 0x1088]
push 0x1014cc8
push 0x788
push eax
call fcn.01025c69
add esp, 0x40
cmp eax, 0x8007007a
jne 0x1102c83
push 0x10182
call fcn.010c82e6
pop ecx
push eax
lea eax, [ebp - 0x108c]
push eax
call fcn.01102aef
push dword [ebx + 0x18]
mov eax, dword [ebp - 0x108c]
mov dword [ebp - 0x1090], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0xc]
movzx eax, word [ebp - 0x1096]
push dword [ebx + 4]
mov edi, 0x80c1
push dword [esi]
mov dword [ebp - 0x1094], edi
push eax
movzx eax, word [ebp - 0x1098]
push eax
movzx eax, word [ebp - 0x109a]
push eax
movzx eax, word [ebp - 0x109c]
push eax
movzx eax, word [ebp - 0x109e]
push eax
movzx eax, word [ebp - 0x10a2]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [esi + 0x24]
push 0x1014cc8
push edi
push dword [ebp - 0x108c]
call fcn.01025c69
add esp, 0x40
mov esi, dword [ebx + 0x20]
push 4
pop ecx
mov edi, 0x100cbcc
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
pop edi
je 0x1102cfa
mov ebx, dword [ebx + 0x20]
movzx eax, byte [ebx + 0xf]
push eax
movzx eax, byte [ebx + 0xe]
push eax
movzx eax, byte [ebx + 0xd]
push eax
movzx eax, byte [ebx + 0xc]
push eax
movzx eax, byte [ebx + 0xb]
push eax
movzx eax, byte [ebx + 0xa]
push eax
movzx eax, byte [ebx + 9]
push eax
movzx eax, byte [ebx + 8]
push eax
movzx eax, word [ebx + 6]
push eax
movzx eax, word [ebx + 4]
push eax
push dword [ebx]
lea eax, [ebp - 0x88]
push 0x1014c50
push 0x32
push eax
call fcn.01025c69
add esp, 0x38
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x1094]
push dword [ebp - 0x1090]
call fcn.01040bdd
push 0x1014c48
push dword [ebp - 0x1094]
push dword [ebp - 0x1090]
call fcn.01040bdd
push dword [ebp - 0x1090]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x108c], 0
pop esi
pop ebx
je 0x1102d32
push dword [ebp - 0x108c]
call fcn.01102a7b
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0106f5f8
leave
ret 4
Function at 0x11051c0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x111127c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jae 0x11053a0
test eax, eax
jne 0x110520d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x11053a3
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x11053a0
lea ecx, [ebp - 0x210]
cmp eax, ecx
je 0x11053a0
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x210]
cmp ax, 0x41
jb 0x1105240
cmp ax, 0x5a
jbe 0x1105249
lea ecx, [eax - 0x61]
cmp cx, 0x19
ja 0x110526d
cmp word [ebp - 0x20e], 0x3a
jne 0x110526d
cmp word [ebp - 0x20c], 0x5c
jne 0x11053a0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
push 0x5c
pop edi
cmp ax, di
jne 0x11052af
cmp word [ebp - 0x20e], di
jne 0x11052af
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
test eax, eax
je 0x11053a0
add eax, 2
push edi
push eax
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
test eax, eax
je 0x11053a0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x11052d9
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffef5
add eax, 0x10b
jmp 0x11053a3
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x210]
cmp esi, eax
jne 0x11052ed
mov esi, eax
jmp 0x11052f0
add esi, 0xfffffffe
cmp esi, dword [ebp - 0x214]
je 0x11053a0
cmp word [esi], di
jne 0x11053a0
cmp esi, dword [ebp - 0x214]
jbe 0x11053a0
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x210]
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x11053a0
movzx ebx, word [edi + 2]
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [edi + 2], bx
cmp eax, 0xffffffff
jne 0x1105368
mov esi, edi
cmp edi, dword [ebp - 0x214]
ja 0x1105311
cmp esi, dword [ebp - 0x214]
jbe 0x11053a0
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
jmp 0x1105389
test al, 0x10
jne 0x1105356
mov eax, 0x10b
jmp 0x11053a3
cmp word [esi + 2], bx
je 0x110539c
push 0x5c
pop eax
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x1105373
jmp 0x1105202
xor eax, eax
jmp 0x11053a3
push 0x7b
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0106f5f8
leave
ret 4
Function at 0x1f1213c
Capabilities:
Encode data using xor

Disassembly:
pushal
pop word [esp + 0x19]
lea esp, [esp + 2]
jmp 0x1f11583
mov ecx, ebx
push ecx
jmp 0x1e9ae35
lea esp, [esp + 4]
call 0x1eb3551
not ecx
jmp 0x1f115e1
jmp 0x1f1141b
jmp 0x1eb457d
jmp 0x1f114f4
xchg cl, ch
jmp 0x1f114a6
cmp ebx, edi
pushfd
lea esp, [esp + 4]
je 0x1e9b2d6
jne 0x1f113c1
sub byte [ecx + 0x3b], ah
adc byte [esi], ch
cmp ah, byte [edx]
jb 0x1e9afe8
idiv byte [edx]
adc eax, 0x8b553784
in al, dx
and esp, 0xfffffff8
sub esp, 0x19c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
jmp 0x1e9afe2
jmp 0x1e9ae8d
mov bh, pe_nt_image_headers32
add dword [eax], edx
call fcn.01ea87fd
jnp 0x1e9affa
xor dh, ch
hlt
movsb byte es:[edi], byte [esi]
or byte [edx], dh
nop
mov esp, 0x38d94e03
sbb eax, esi
sub al, 0x7e
xlatb
mov ch, 0x96
push ecx
cmp al, 0x44
mov esp, dword [edx - 0x1f]
clc
mov dword [reloc.KERNEL32.dll_GetTimeZoneInformation], eax
invalid
jmp 0x1e9b2df
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor edi, edi
sub esp, 2
lea esp, [esp + 2]
jmp 0x1e9afa6
mov eax, dword [0x1ea3ec0]
jmp 0x1f113db
add edx, dword [ebx + reloc.KERNEL32.dll_GetTimeZoneInformation]
int1
invalid
leave
ret 8
cmp eax, edi
jne 0x1e9ae4f
je 0x1f11411
out dx, eax
ja 0x1f113cf
xor byte [ecx - 0x33], 0xf7
push 0xae6899fe
add eax, 0x8dcea7b4
lea esp, [esp + 8]
jmp 0x1f113d7
push dword [0x1ea3f58]
call fcn.01f11431
inc edi
invalid
push 0x4c0
clc
push 8
jmp 0x1f113fb
mov dword [esp + 0x10], edi
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x1f11445
lea esp, [esp + 0x18]
cmp dword [eax], edi
jbe 0x1e9ae2c
cdq
clc
dec dword [edi]
xchg dword [edx + ebx*4 - 0x389c0008], edx
ja 0x1e9aeeb
arpl di, ax
push edi
xor al, cl
dec eax
cli
js 0x1f1144e
mov dword [eax - 0x45], edi
aad 0x66
mov esi, edx
bswap esi
mov esi, dword [esp]
call fcn.01f113f5
cmp dword [eax + edi + 8], esi
call 0x1f1147b
inc esp
push dword [esp]
mov byte [esp + 2], cl
jmp 0x1f114bc
lea esp, [esp + 4]
jne 0x1e9ae16
dec si
xor esi, esi
jmp 0x1f11471
mov ecx, dword [eax + edi + 0xc]
cmc
jmp 0x1f114cf
lea esp, [esp + 8]
jbe 0x1e9ae16
and dword [esp + 0x14], esi
jmp 0x1e9af90
add ecx, dword [esp + 0x14]
mov ah, bl
lea eax, [ebp + ebp]
mov eax, ecx
mov eax, 0x6157273b
jmp 0x1f11619
cmp ebx, dword [eax + edi + 4]
push bx
push dx
push word [esp + 1]
mov dword [esp], eax
lea esp, [esp + 2]
jmp 0x1f11496
lea esp, [esp + 0x1c]
inc dword [esp + 0x10]
neg cx
jmp 0x1f115a9
mov ecx, dword [esp + 0x10]
jmp 0x1f115d7
add edi, 0xc
cmp ecx, dword [eax]
call int.01f115c1
mov ecx, dword [eax + 0x7c]
mov edi, dword [esp]
mov di, word [esp]
cmc
jmp 0x1f1165c
mov eax, dword [ebp + 0xc]
call 0x1eb354c
pushal
mov dword [esp + 0xf], ecx
call fcn.01f115bf
cmp ecx, esi
jmp 0x1f1172a
add edi, ebx
mov dword [esp + 0x2c], ecx
sub esp, 0x10
add esp, 0
jmp 0x1f1162b
mov edi, dword [eax + 0x78]
neg esi
xor esi, esi
sub esp, 0
jmp 0x1f11641
lea esp, [esp + 0x10]
je 0x1e9b2d6
cmp edi, ebx
call fcn.01f116a3
lea esp, [esp + 4]
call dword [eax + 0x98]
jmp 0x1e9afd9