joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71ce1340
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2f4], ecx
xor ecx, ecx
mov dword [ebp - 0x2f0], edx
mov edx, 4
mov dword [ebp - 0x2f8], eax
mov eax, esi
mul edx
push edi
push 0x71d12f5c
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.71cf5a85
mov edi, eax
add esp, 8
test edi, edi
je 0x71ce14e5
push ebx
lea ebx, [esi*4]
push ebx
push 0
push edi
call fcn.71cf7720
mov eax, dword [ebp - 0x2f0]
xor ecx, ecx
mov edx, 4
push 0x71d12f5c
mov dword [eax], edi
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.71cf5a85
mov esi, eax
add esp, 0x14
test esi, esi
je 0x71ce14e4
push ebx
push 0
push esi
call fcn.71cf7720
mov edi, dword [ebp - 0x2f8]
add esp, 0xc
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x71d7a8cc]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2f4]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x1c
mov ecx, esi
movq qword [ebp - 0xc], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [0x71d122ac]
call esi
test eax, eax
je 0x71ce14e4
xor ebx, ebx
nop dword [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x71ce14b5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x18]
cmp ecx, eax
je 0x71ce14b5
push ecx
push 0
push 0xa
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x71ce14b5
test esi, esi
je 0x71ce14b5
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x71ce14ae
mov edi, dword [edi]
lea eax, [ebp - 0x2ec]
push eax
push esi
mov dword [ebp - 0x2ec], 0x10001
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x71ce14a1
mov eax, dword [ebp - 0x234]
mov dword [edi + ebx], eax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
mov dword [ebx + eax], esi
xor esi, esi
add ebx, 4
push esi
mov edi, esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
test edi, edi
je 0x71ce14b5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x71d7a8d0]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x2f4]
mov ecx, esi
mov dword [ebp - 0x20], 0x1c
call dword [0x71d122ac]
call esi
mov edi, dword [ebp - 0x2f8]
test eax, eax
jne 0x71ce1430
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71ce1630
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ec
mov eax, dword [0x71d5a008]
xor eax, esp
mov dword [esp + 0x2e8], eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [esp + 0x14], edx
mov dword [esp + 4], ecx
movlpd qword [esp + 8], xmm0
push esi
push edi
test ebx, ebx
je 0x71ce1747
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, dword [ebp + 0xc]
and ecx, dword [ebp + 0x10]
or edx, ecx
je 0x71ce169f
mov eax, dword [esp + 0xc]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
add esi, 1
adc edi, 0
test edi, edi
jb 0x71ce1671
ja 0x71ce16af
cmp esi, ebx
jb 0x71ce1671
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, dword [ebp + 0xc]
and ecx, dword [ebp + 0x10]
or edx, ecx
je 0x71ce1722
mov eax, dword [esp + 0xc]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x10001
push eax
mov eax, dword [esp + 0x10]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x71ce1722
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xd8]
mov dword [ecx + esi*4], eax
add esi, 1
adc edi, 0
test edi, edi
jb 0x71ce16c8
ja 0x71ce174f
cmp esi, ebx
jb 0x71ce16c8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x2f4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71ce1c40
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x71d57a40
push 0x71cf6ba0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x71d5a008]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x30], eax
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea ecx, [ebp - 0x48]
call fcn.71ce1950
test eax, eax
js 0x71ce1d39
mov esi, 3
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x28], esi
push dword [ebp - 0x24]
lea eax, [ebp - 0x38]
push eax
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x3c]
call fcn.71ce1500
add esp, 8
test al, al
jne 0x71ce1d0b
test esi, esi
je 0x71ce1d0b
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x48]
mov edx, dword [ebp - 0x3c]
mov ecx, edi
call fcn.71ce1630
add esp, 0xc
dec esi
jmp 0x71ce1cd2
test edi, edi
je 0x71ce1d39
xor esi, esi
mov dword [ebp - 0x2c], esi
cmp esi, dword [ebp - 0x48]
jae 0x71ce1d39
mov edi, dword [edi + esi*4]
cmp edi, 0xffffffff
je 0x71ce1d33
test edi, edi
je 0x71ce1d33
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
mov edi, dword [ebp - 0x40]
jmp 0x71ce1d11
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x71ce1d5a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x71ce1d6f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x40]
call fcn.71cf5a25
push dword [ebp - 0x3c]
call fcn.71cf5a25
add esp, 8
mov eax, dword [ebp - 0x38]
or eax, dword [ebp - 0x34]
je 0x71ce1da0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x71ce6c60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, [ebp - 0x20c]
mov dword [ebp - 0x418], edx
push 0x104
mov eax, esi
mov ebx, ecx
push eax
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jne 0x71ce6cbc
push 0x10000
call fcn.71cfbe20
mov esi, eax
add esp, 4
test esi, esi
je 0x71ce6d25
push 0x8000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x71ce6d2d
cmp byte [ebp + 8], 0
je 0x71ce6cf6
push 0x104
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x71ce6cf6
lea eax, [ebp - 0x20c]
cmp esi, eax
je 0x71ce6cf0
push esi
call fcn.71cfbe30
add esp, 4
lea esi, [ebp - 0x414]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x71ce6d2d
mov edx, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x71ce6d07
sub edx, ecx
mov ecx, dword [ebp - 0x418]
sar edx, 1
push edx
push esi
call fcn.71ce7500
jmp 0x71ce6d35
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x20c]
cmp esi, eax
je 0x71ce6d52
lea eax, [ebp - 0x414]
cmp esi, eax
je 0x71ce6d52
push esi
call fcn.71cfbe30
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71ce7280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov edx, ecx
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x21c], edx
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x71ce73f0
test eax, eax
je 0x71ce73f0
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x71ce72c1
mov ecx, dword [edi]
push ebx
push esi
xor esi, esi
mov dword [edi + 0x10], 0
mov word [ecx], si
xor ecx, ecx
mov word [ebp - 0x20c], cx
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x208
push ecx
push esi
push esi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x71ce73ab
mov eax, dword [ebp - 0x210]
add eax, 2
push 0x71d12f5c
push eax
mov dword [ebp - 0x214], eax
call fcn.71cf5a85
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x71ce7393
lea eax, [ebp - 0x214]
push eax
push ebx
push 0
push 0
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x71ce7377
mov eax, dword [ebp - 0x214]
shr eax, 1
je 0x71ce736e
lea edx, [eax - 1]
lea edx, [ebx + edx*2]
nop
cmp word [edx], 0
jne 0x71ce736e
sub edx, 2
sub eax, 1
jne 0x71ce7360
push eax
push ebx
mov ecx, edi
call fcn.71ce7500
push ebx
call fcn.71cf5a25
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov esi, 8
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x71ce73dd
mov eax, dword [ebp - 0x210]
shr eax, 1
je 0x71ce73ce
lea ecx, [ebp + eax*2 - 0x20e]
cmp word [ecx], 0
jne 0x71ce73ce
sub ecx, 2
sub eax, 1
jne 0x71ce73c0
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.71ce7500
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x57
xor ecx, ebp
pop edi
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71ceb400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebx], 0
cmp word [esi], 0x2a
jne 0x71ceb483
push 5
lea eax, [esi + 2]
push str.FILE:
push eax
call fcn.71cfc103
add esp, 0xc
test eax, eax
jne 0x71ceb483
push 0x10
push eax
lea eax, [esi + 0xc]
push eax
call fcn.71cfde7a
add esp, 0xc
cmp eax, 0xffffffff
je 0x71ceb483
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 8], 0x10002
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
call fcn.71ceb250
or ecx, 0xffffffff
add esp, 4
test eax, eax
cmove ecx, dword [ebp - 0x40]
mov dword [ebx], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
cmp word [esi], 0x2a
lea eax, [esi + 2]
jne 0x71ceb4cc
push 4
push str.RAW:
push eax
call fcn.71cfc103
add esp, 0xc
test eax, eax
jne 0x71ceb4cc
lea edi, [esi + 0xa]
test edi, edi
je 0x71ceb4cc
push ecx
mov edx, ebx
mov ecx, edi
call fcn.71cebd40
add esp, 4
cmp eax, 0xb
je 0x71ceb4ca
cmp eax, 0x78
je 0x71ceb4ca
cmp eax, 0x13
je 0x71ceb4ca
cmp eax, 0x49a
jne 0x71ceb51f
mov esi, edi
mov eax, dword [0x71d7a964]
xor edi, edi
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x48], eax
test eax, eax
je 0x71ceb4f0
push edi
mov ecx, eax
call dword [0x71d122ac]
call dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x71ceb506
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, dword [0x71d7a964]
test esi, esi
je 0x71ceb51d
push dword [ebp - 0x44]
mov ecx, esi
call dword [0x71d122ac]
call esi
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret

Function at 0x71ceb530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10008
call fcn.71d0fed0
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x71d7a964]
push edi
xor edi, edi
mov dword [ebp - 0x10008], ecx
lea ebx, [edi + 1]
test esi, esi
je 0x71ceb56c
push edi
mov ecx, esi
call dword [0x71d122ac]
call esi
mov ebx, eax
lea eax, [ebp - 0x10004]
push eax
push 0x8000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x71ceb58c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x71ceb5b7
lea edx, [ebp - 0x10004]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x71ceb595
mov ecx, dword [ebp - 0x10008]
lea eax, [ebp - 0x10004]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.71ce7500
mov esi, dword [0x71d7a964]
test esi, esi
je 0x71ceb5cc
push ebx
mov ecx, esi
call dword [0x71d122ac]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cebef0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
mov edi, edx
mov dword [ebp - 0x210], edi
test ebx, ebx
je 0x71cec038
cmp word [ebx], 0
je 0x71cec038
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x71cec01f
cmp esi, 0x104
jae 0x71cebf69
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.71ce7500
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.71cfbe20
mov edi, eax
add esp, 4
test edi, edi
je 0x71cec007
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x71cebfe3
cmp eax, esi
jae 0x71cebfc2
mov ecx, dword [ebp - 0x210]
push esi
push edi
call fcn.71ce7500
push edi
call fcn.71cfbe30
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
push edi
mov esi, 0x7a
call fcn.71cfbe30
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.71cfbe30
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov esi, 8
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x57
pop edi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cecc80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
xor esi, esi
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x71cecd38
push dword [ebp - 0x10]
push esi
push dword [ebp + 8]
push dword [ebp - 8]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x71cecd51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x71cecd11
mov eax, dword [edi + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x71cecd51
pop edi
pop esi
mov eax, 0x80004004
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
cmp eax, 0xea
jne 0x71cecd51
push 0
push ebx
push dword [ebp - 0x10]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x71cecd51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x71cecd51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x71cecd4f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x71cecd5d
test ebx, ebx
je 0x71cecd5d
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
mov dword [ebx], ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cecd70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [0x71d78674]
mov dword [ebp - 0x10], eax
mov eax, dword fs:[0x2c]
push edi
mov dword [ebp - 8], edx
mov edi, ecx
mov esi, dword [eax + esi*4]
mov eax, dword [0x71d7ab94]
cmp eax, dword [esi + 4]
jle 0x71cecdec
push 0x71d7ab94
call fcn.71cf5946
add esp, 4
cmp dword [0x71d7ab94], 0xffffffff
jne 0x71cecdec
push str.CancelIoEx
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x71d7ab94
mov dword [0x71d7ab98], eax
call fcn.71cf58fc
add esp, 4
mov eax, dword [0x71d7ab9c]
cmp eax, dword [esi + 4]
jle 0x71cece38
push 0x71d7ab9c
call fcn.71cf5946
add esp, 4
cmp dword [0x71d7ab9c], 0xffffffff
jne 0x71cece38
push str.CancelIo
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x71d7ab9c
mov dword [0x71d7aba0], eax
call fcn.71cf58fc
add esp, 4
push dword [edi + 0xc]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x71cecf1d
push ebx
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x71cecf32
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x71cecee4
mov eax, dword [edi + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0xc]
push 0xffffffffffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push esi
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x71cecee4
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x71cecede
mov esi, dword [0x71d7ab98]
mov eax, dword [edi + 8]
test esi, esi
je 0x71cecec9
push ebx
push eax
mov ecx, esi
call dword [0x71d122ac]
call esi
test eax, eax
je 0x71cecede
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x71cecee4
mov esi, dword [0x71d7aba0]
mov ecx, esi
push eax
call dword [0x71d122ac]
call esi
test eax, eax
jne 0x71cecee4
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x71cecefb
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x71cecf32
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
je 0x71cecf1d
push 0
push dword [ebp - 0x10]
push ebx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x71cecf32
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x71cecf32
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cedd50
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
cwde
invalid
loop 0x71cedd4d
push ss
std
lodsb al, byte [esi]
outsd dx, dword [esi]
push ds
mov ah, ah
jmp 0x71cf0303
jbe 0x71cf0359
xor dl, byte [eax]
add byte [eax], al

Function at 0x71cee7d0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov ebx, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x71cee8b8
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x71cee8b8
push edi
call fcn.71cf5a1c
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20c]
push esi
push edi
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x71cee8af
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0
push eax
push 0x71d1ac1c
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x71cee8af
mov ecx, dword [ebp - 0x214]
push esi
movzx eax, word [ecx + 0xa]
mov word [ebx], ax
movzx eax, word [ecx + 8]
mov word [ebx + 2], ax
movzx eax, word [ecx + 0xe]
mov word [ebx + 4], ax
movzx eax, word [ecx + 0xc]
mov word [ebx + 6], ax
call fcn.71cf5a25
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
push esi
call fcn.71cf5a25
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x71cee8ca
movzx eax, ax
or eax, 0x80070000
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
Function at 0x71cef1e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x71d5a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov word [ebp - 0x20c], dx
mov esi, ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x210]
push edx
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x214], 0
push edx
lea edx, [ebp - 0x214]
mov dword [ebp - 0x210], 0x208
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x71cef34c
mov eax, dword [ebp - 0x210]
mov ecx, 0x103
shr eax, 1
cmp eax, 0x104
cmovne ecx, eax
add ecx, ecx
cmp ecx, 0x208
jae 0x71cef373
xor eax, eax
mov edx, 0x104
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push ecx
push eax
push ecx
mov ecx, esi
call fcn.71ccc380
mov ecx, eax
test ecx, ecx
js 0x71cef361
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x71cef361
test esi, esi
je 0x71cef335
xor eax, eax
cmp ax, word [esi]
je 0x71cef335
xor ecx, ecx
cmp ax, word [ebx]
je 0x71cef361
mov edx, 0x104
mov eax, esi
nop dword [eax]
cmp word [eax], cx
je 0x71cef2cd
add eax, 2
sub edx, 1
jne 0x71cef2c0
xor eax, eax
mov ecx, 0x80070057
test edx, edx
push edi
cmovne ecx, eax
mov edi, edx
mov eax, 0x104
sub eax, edx
neg edi
sbb edi, edi
and edi, eax
test edx, edx
je 0x71cef322
movzx eax, word [esi + edi*2 - 2]
cmp eax, 0x5c
je 0x71cef313
cmp eax, 0x2f
je 0x71cef313
push 0x71d1ac1c
mov edx, 0x104
mov ecx, esi
call fcn.71ccc310
mov ecx, eax
test ecx, ecx
js 0x71cef322
push ebx
mov edx, 0x104
mov ecx, esi
call fcn.71ccc310
mov ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
mov ecx, 0x80070057
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
test ecx, ecx
jle 0x71cef361
movzx ecx, cx
or ecx, 0x80070000
mov eax, ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.71cf548b
mov esp, ebp
pop ebp
ret
call fcn.71cf5bb0
int3