joyce8/EMBER2024-capa huggingface dataset:
Function at 0x113c78b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x113c78dc
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x21c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
xor eax, eax
pop esi
ret
mov ecx, dword [0x11582d84]
mov eax, esi
mov dword [eax], ecx
mov edx, dword [0x11582d88]
mov dword [eax + 4], edx
mov ecx, dword [0x11582d8c]
mov dword [eax + 8], ecx
mov edx, dword [0x11582d90]
mov word [esi + 0x30], 0x40
mov dword [eax + 0xc], edx
mov eax, dword [0x115a4e08]
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x113c7920
mov dword [esi + 0x20], 0x40001
jmp 0x113c7927
mov dword [esi + 0x20], 0x40002
mov word [esi + 0x32], 1
mov eax, dword [0x11582704]
push edi
mov edi, dword [0x115a4e28]
cmp eax, 0xffffffff
je 0x113c794b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x113c794b
mov edi, eax
mov dword [esi + 0x2c], edi
pop edi
mov eax, 1
pop esi
ret

Function at 0x113c7a00
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push 0xffffffffffffffff
push 0x110
mov ecx, ebp
call fcn.113904e0
mov ecx, ebp
call fcn.11390c10
mov ebx, eax
mov ecx, 0x44
mov esi, 0x115a4e00
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x11582704]
cmp eax, 0xffffffff
je 0x113c7a45
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x113c7a45
mov dword [ebx + 0x28], eax
add ebx, 0x48
push ebx
call fcn.113da690
mov esi, dword [esp + 0x1c]
mov eax, dword [0x115a4e04]
add esp, 4
mov dword [esi + 0x18], eax
mov cl, byte [0x115a4e0c]
mov byte [esi + 0x16], cl
mov edx, dword [0x115a4e08]
mov dword [esi + 0x1c], edx
mov al, byte [0x115a4e10]
mov byte [esi + 0x17], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x14]
mov dword [esi + 0x30], eax
mov cx, ax
mov eax, dword [esp + 0x24]
test eax, eax
mov word [ebx + 0x3c], cx
je 0x113c7ae7
push 0xffffffffffffffff
mov ecx, ebp
call fcn.113904d0
mov edi, dword [esp + 0x20]
push eax
mov ecx, edi
call fcn.113904e0
mov ecx, edi
call fcn.113904d0
mov ecx, ebp
mov esi, eax
call fcn.11390c10
mov dword [esp + 0x20], esi
mov ecx, edi
mov esi, eax
call fcn.11390c10
mov edx, dword [esp + 0x20]
mov edi, eax
mov ecx, edx
add ebx, 0x10
mov eax, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.113da6b0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x113c7bb0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
cmp edx, 0xffffffff
je 0x113c7c0f
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x113c7c0f
mov eax, dword [esp + 0xc]
test eax, eax
je 0x113c7c0f
push esi
lea esi, [esp + 8]
push 0
push esi
push eax
push ecx
push edx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop esi
jne 0x113c7c09
mov dword [0x115a4df0], 0xe
mov dword [0x115a4df4], 0x223c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
xor eax, eax
ret
mov eax, 1
ret
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x2235
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
xor eax, eax
ret
Function at 0x113cd280
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1150df38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [0x115a4df0], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x80]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x115a4df8], eax
lea eax, [esp + 0x10]
push 1
push eax
push esi
push ebx
mov dword [esp + 0x20], esi
call edi
push esi
push esi
push 0x40
push ebx
mov dword [esp + 0x2c], eax
call edi
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x80]
mov dword [esp + 0x14], esi
call fcn.11390300
mov edx, dword [esp + 0x84]
xor ecx, ecx
push 0xffffffffffffffff
mov dword [esp + 0x7c], esi
mov cx, word [edx + 0x3e]
push ecx
lea ecx, [esp + 0x88]
call fcn.113904e0
lea ecx, [esp + 0x80]
call fcn.113904d0
lea ecx, [esp + 0x80]
mov esi, eax
call fcn.11390c10
cmp ebx, 0xffffffff
mov ebp, eax
je 0x113cd412
test ebp, ebp
je 0x113cd412
test esi, esi
je 0x113cd412
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x113cd3ab
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
mov dword [esp + 0x1c], 0
rep stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x113cd42b
mov dword [0x115a4df0], 0xd
mov dword [0x115a4df4], 0x222a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
lea ecx, [esp + 0x80]
mov dword [esp + 0x78], 0xffffffff
call fcn.11390430
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
jne 0x113cd4e2
mov dword [0x115a4df0], 0xf
mov dword [0x115a4df4], 0x2e55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x221d
jmp 0x113cd3a0
lea ecx, [esp + 0x80]
call fcn.113904d0
push eax
lea ecx, [esp + 0x84]
call fcn.11390c10
mov ecx, dword [esp + 0x88]
push eax
push ecx
call fcn.113ce990
add esp, 0xc
test eax, eax
je 0x113cd3ab
lea ecx, [esp + 0x80]
call fcn.11390bf0
mov edx, 0x50
cmp word [eax + 4], dx
jne 0x113cd3ab
mov ecx, 0x14
mov esi, eax
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
cmp word [esp + 0x24], dx
jne 0x113cd3ab
cmp word [esp + 0x30], 0x38
jne 0x113cd3ab
mov esi, dword [esp + 0x20]
mov dword [esp + 0x20], 0
push esi
push edx
lea edx, [esp + 0x28]
push edx
call fcn.113da700
add esp, 0xc
mov dword [esp + 0x20], esi
test eax, eax
je 0x113cd3ab
mov edi, dword [esp + 0x88]
mov ecx, 0x14
lea esi, [esp + 0x20]
mov dword [esp + 0x14], 1
rep movsd dword es:[edi], dword [esi]
jmp 0x113cd3ab
mov ecx, dword [esp + 0x60]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x113cd500
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1150df58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [0x115a4df0], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x64]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x115a4df8], eax
lea eax, [esp + 0x10]
push 1
push eax
push esi
push ebx
mov dword [esp + 0x20], esi
call edi
push esi
push esi
push 0x90
push ebx
mov dword [esp + 0x28], eax
call edi
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x14], esi
call fcn.11390300
mov edx, dword [esp + 0x6c]
xor ecx, ecx
push 0xffffffffffffffff
mov dword [esp + 0x60], esi
mov cx, word [edx + 0x10]
push ecx
lea ecx, [esp + 0x6c]
call fcn.113904e0
lea ecx, [esp + 0x64]
call fcn.113904d0
lea ecx, [esp + 0x64]
mov esi, eax
call fcn.11390c10
cmp ebx, 0xffffffff
mov ebp, eax
je 0x113cd680
test ebp, ebp
je 0x113cd680
test esi, esi
je 0x113cd680
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x113cd61c
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
mov dword [esp + 0x70], 0
rep stosb byte es:[edi], al
lea eax, [esp + 0x70]
push eax
push esi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x113cd699
mov dword [0x115a4df0], 0xd
mov dword [0x115a4df4], 0x222a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x5c], 0xffffffff
call fcn.11390430
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
jne 0x113cd735
mov dword [0x115a4df0], 0xf
mov dword [0x115a4df4], 0x2e89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
xor eax, eax
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
add esp, 0x50
ret
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x221d
jmp 0x113cd611
lea ecx, [esp + 0x64]
call fcn.113904d0
push eax
lea ecx, [esp + 0x68]
call fcn.11390c10
mov ecx, dword [esp + 0x6c]
push eax
push ecx
call fcn.113ce990
add esp, 0xc
test eax, eax
je 0x113cd61c
lea ecx, [esp + 0x64]
call fcn.11390bf0
mov edx, 0x38
cmp word [eax + 4], dx
jne 0x113cd61c
mov ecx, 0xe
mov esi, eax
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
cmp word [esp + 0x20], dx
jne 0x113cd61c
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0
push esi
push edx
lea edx, [esp + 0x24]
push edx
call fcn.113da700
add esp, 0xc
mov dword [esp + 0x1c], esi
test eax, eax
je 0x113cd61c
mov edi, dword [esp + 0x70]
mov ecx, 0xe
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], 1
rep movsd dword es:[edi], dword [esi]
jmp 0x113cd61c
mov ecx, dword [esp + 0x44]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x50
ret
Function at 0x113cd750
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1150df78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
mov dword [0x115a4df0], ebp
call edi
mov esi, dword [esp + 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x115a4df8], eax
lea eax, [esp + 0x14]
push 1
push eax
push ebp
push esi
mov dword [esp + 0x24], ebp
call ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], ebp
call fcn.11390300
push ebp
push ebp
push 0xc8
push esi
mov dword [esp + 0x34], ebp
call ebx
mov edx, dword [esp + 0x34]
xor ecx, ecx
push 0xffffffffffffffff
mov cx, word [edx + 0x12]
push ecx
lea ecx, [esp + 0x18]
call fcn.113904e0
lea ecx, [esp + 0x10]
call fcn.113904d0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.11390c10
cmp esi, 0xffffffff
mov ebp, eax
je 0x113cd856
test ebp, ebp
je 0x113cd856
test ebx, ebx
je 0x113cd856
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x113cd90f
mov ecx, ebx
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
mov dword [esp + 0x38], 0
rep stosb byte es:[edi], al
lea eax, [esp + 0x38]
push eax
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x113cd876
mov dword [0x115a4df0], 0xd
mov dword [0x115a4df4], 0x222a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
jmp 0x113cd90f
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x221d
call edi
mov dword [0x115a4df8], eax
jmp 0x113cd90f
lea ecx, [esp + 0x10]
call fcn.113904d0
push eax
lea ecx, [esp + 0x14]
call fcn.11390c10
mov ecx, dword [esp + 0x34]
push eax
push ecx
call fcn.113ce990
add esp, 0xc
test eax, eax
je 0x113cd90f
lea ecx, [esp + 0x10]
call fcn.11390bf0
mov edi, eax
cmp word [edi], 1
jne 0x113cd90f
xor edx, edx
xor ecx, ecx
mov dx, word [edi + 0xe]
mov cx, word [edi + 0xc]
imul edx, ecx
mov eax, dword [edi + 4]
add edx, 0x10
cmp eax, edx
jne 0x113cd90f
mov ebx, dword [edi + 8]
mov dword [edi + 8], 0
push ebx
push eax
push edi
call fcn.113da700
add esp, 0xc
mov dword [edi + 8], ebx
test eax, eax
je 0x113cd90f
mov edi, dword [esp + 0x38]
lea edx, [esp + 0x10]
push edx
mov ecx, edi
call fcn.11390460
mov ecx, edi
call fcn.11390bf0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x2c], 1
mov dword [ecx], eax
add eax, 0x10
mov dword [edx], eax
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push 0
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
jne 0x113cd96f
mov dword [0x115a4df0], 0xf
mov dword [0x115a4df4], 0x2ebe
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp]
mov dword [0x115a4df8], eax
mov dword [esp + 0x14], 0xffffffff
call fcn.11390430
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp]
mov dword [esp + 0x14], 0xffffffff
call fcn.11390430
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x113cf640
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [0x115a4df0], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x115a4df8], eax
lea eax, [esp + 0x10]
push 1
push eax
push edi
push ebp
mov dword [esp + 0x20], edi
call esi
push edi
push edi
push edi
push ebp
mov dword [esp + 0x24], eax
call esi
mov ebx, dword [esp + 0x20]
mov edx, dword [0x11582d84]
mov ecx, ebx
mov dword [esp + 0x1c], edi
mov dword [ecx], edx
mov eax, dword [0x11582d88]
mov dword [ecx + 4], eax
mov edx, dword [0x11582d8c]
mov dword [ecx + 8], edx
mov eax, dword [0x11582d90]
mov word [ebx + 0x30], 0x40
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x113cf6bf
mov dword [ebx + 0x20], 0x40001
jmp 0x113cf6c6
mov dword [ebx + 0x20], 0x40002
push 0x40
push ebx
mov word [ebx + 0x3e], 0x50
mov dword [ebx + 0x34], edi
call fcn.113da750
add esp, 8
mov ecx, 4
mov edi, 0x11582d84
mov esi, ebx
xor edx, edx
mov dword [ebx + 0x34], eax
repe cmpsd dword [esi], dword es:[edi]
mov dword [esp + 0x20], eax
jne 0x113cf7ab
cmp word [ebx + 0x30], 0x40
jne 0x113cf7ab
mov ecx, dword [ebx + 0x20]
cmp ecx, 0x40001
je 0x113cf719
cmp ecx, 0x40002
jne 0x113cf7ab
cmp word [ebx + 0x3e], 0x50
jne 0x113cf7ab
push eax
xor esi, esi
push 0x40
push ebx
mov dword [ebx + 0x34], esi
call fcn.113da700
mov ecx, dword [esp + 0x2c]
add esp, 0xc
cmp eax, esi
mov dword [ebx + 0x34], ecx
je 0x113cf7ab
cmp ebp, 0xffffffff
je 0x113cf782
cmp ebx, esi
je 0x113cf782
lea edx, [esp + 0x20]
push esi
push edx
push 0x40
push ebx
push ebp
mov dword [esp + 0x34], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x113cf7a3
mov dword [0x115a4df0], 0xe
mov dword [0x115a4df4], 0x223c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
jmp 0x113cf7ab
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x2235
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
jmp 0x113cf7ab
mov dword [esp + 0x1c], 1
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
jne 0x113cf7ef
mov dword [0x115a4df0], 0x10
mov dword [0x115a4df4], 0x32e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
xor eax, eax
add esp, 8
ret
mov eax, 1
add esp, 8
ret
Function at 0x113cfaf0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1150dfd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [0x115a4df0], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x115a4df8], eax
lea eax, [esp + 0x10]
push 1
push eax
push ebp
push ebx
mov dword [esp + 0x20], ebp
call esi
push ebp
push ebp
push 0xc8
push ebx
mov dword [esp + 0x28], eax
call esi
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], ebp
call fcn.113904d0
mov esi, dword [esp + 0x38]
push eax
push esi
mov dword [esi + 4], eax
mov dword [esi + 8], ebp
call fcn.113da750
add esp, 8
cmp word [esi], 1
mov edi, eax
mov dword [esi + 8], edi
jne 0x113cfc66
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 0xe]
mov dx, word [esi + 0xc]
imul ecx, edx
mov eax, dword [esi + 4]
add ecx, 0x10
cmp eax, ecx
jne 0x113cfc66
push edi
push eax
push esi
mov dword [esi + 8], ebp
call fcn.113da700
add esp, 0xc
cmp eax, ebp
mov dword [esi + 8], edi
je 0x113cfc66
lea ecx, [esp + 0x2c]
call fcn.11390300
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x2c]
push eax
mov dword [esp + 0x28], ebp
call fcn.11390850
lea ecx, [esp + 0x2c]
call fcn.113904d0
push eax
lea ecx, [esp + 0x30]
call fcn.11390c10
mov ecx, dword [esp + 0x34]
push eax
push ecx
call fcn.113ce860
add esp, 0xc
cmp eax, ebp
je 0x113cfcd4
lea ecx, [esp + 0x2c]
call fcn.113904d0
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.11390c10
or edi, 0xffffffff
cmp ebx, edi
je 0x113cfcb4
cmp eax, ebp
je 0x113cfcb4
cmp esi, ebp
je 0x113cfcb4
lea edx, [esp + 0x34]
push ebp
push edx
push esi
push eax
push ebx
mov dword [esp + 0x48], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x113cfcca
mov dword [0x115a4df0], 0xe
mov dword [0x115a4df4], 0x223c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
mov dword [esp + 0x24], edi
lea ecx, [esp + 0x2c]
call fcn.11390430
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push ebp
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x14]
pop edi
pop esi
cmp eax, ebp
pop ebp
pop ebx
jne 0x113cfce1
mov dword [0x115a4df0], 0x10
mov dword [0x115a4df4], 0x336a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x2235
jmp 0x113cfc4e
mov dword [esp + 0x14], 1
jmp 0x113cfc59
mov dword [esp + 0x24], 0xffffffff
jmp 0x113cfc5d
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x113cff10
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1150e018
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [0x115a4df0], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x115a4df8], eax
lea eax, [esp + 0x10]
push 1
push eax
push ebp
push esi
mov dword [esp + 0x20], ebp
call edi
mov ecx, dword [esp + 0x30]
push ebp
push ebp
mov dword [esp + 0x1c], eax
mov edx, dword [ecx + 0x10]
push edx
push esi
call edi
lea ecx, [esp + 0x28]
xor ebx, ebx
call fcn.11390300
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x28]
push eax
mov dword [esp + 0x24], ebp
call fcn.11390850
lea ecx, [esp + 0x28]
call fcn.113904d0
push eax
lea ecx, [esp + 0x2c]
call fcn.11390c10
mov ecx, dword [esp + 0x30]
push eax
push ecx
call fcn.113ce860
add esp, 0xc
cmp eax, ebp
je 0x113d0044
lea ecx, [esp + 0x28]
call fcn.113904d0
lea ecx, [esp + 0x28]
mov dword [esp + 0x34], eax
call fcn.11390c10
cmp esi, 0xffffffff
je 0x113d000e
cmp eax, ebp
je 0x113d000e
mov ecx, dword [esp + 0x34]
cmp ecx, ebp
je 0x113d000e
lea edx, [esp + 0x34]
push ebp
push edx
push ecx
push eax
push esi
mov dword [esp + 0x48], ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x113d002f
mov dword [0x115a4df0], 0xe
mov dword [0x115a4df4], 0x223c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
jmp 0x113d0044
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x2235
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
jmp 0x113d0044
lea ecx, [esp + 0x28]
call fcn.113904d0
mov ecx, dword [esp + 0x30]
mov ebx, 1
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.11390430
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ebp
push edx
push eax
push esi
call edi
pop edi
pop esi
cmp ebx, ebp
pop ebp
pop ebx
jne 0x113d009b
mov dword [0x115a4df0], 0x10
mov dword [0x115a4df4], 0x33c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 8]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x113d19b0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1150e060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.11390300
xor edi, edi
push 1
push 0x115a4d50
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], edi
call fcn.1135fab2
mov ecx, 0x115a4d48
mov byte [esp + 0x34], 1
call fcn.113904d0
test eax, eax
jbe 0x113d1a0c
push 0x115a4d48
lea ecx, [esp + 0x14]
call fcn.11390850
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 0
call fcn.1135faee
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x14]
push 1
push eax
push edi
push esi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
sub ebp, ebx
mov dword [esp + 0x1c], eax
push ebp
mov dword [esp + 0x1c], edi
call fcn.114ef26e
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x113d1b34
lea ecx, [esp + 0x10]
call fcn.113904d0
cmp eax, ebp
mov dword [esp + 0x44], eax
jbe 0x113d1a6b
mov dword [esp + 0x44], ebp
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x44]
test eax, eax
jbe 0x113d1aaa
lea ecx, [esp + 0x10]
call fcn.11390bf0
mov ecx, dword [esp + 0x44]
mov esi, eax
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, 0xffffffff
je 0x113d1b00
test ebp, ebp
je 0x113d1b00
lea edx, [esp + 0x3c]
push 0
push edx
push ebp
push ebx
push esi
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x113d1b21
mov dword [0x115a4df0], 0xe
mov dword [0x115a4df4], 0x223c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
jmp 0x113d1b29
mov dword [0x115a4df0], 1
mov dword [0x115a4df4], 0x2235
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a4df8], eax
jmp 0x113d1b29
mov dword [esp + 0x18], 1
push ebx
call fcn.114ef297
add esp, 4
xor edi, edi
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push edi
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0xffffffff
call fcn.11390430
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x113d2fe0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov dword [0x115a5400], ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a5408], eax
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
mov esi, dword [esp + 0x3c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp esi, ebp
stosb byte es:[edi], al
je 0x113d3024
mov ecx, 8
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
jmp 0x113d308d
mov esi, dword [esp + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x10]
push 1
push eax
push ebp
push esi
mov dword [esp + 0x20], ebp
call edi
push ebp
push ebp
push ebp
push esi
mov ebx, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x113d307e
lea ecx, [esp + 0x3c]
push 0
push ecx
lea edx, [esp + 0x1c]
push 0x20
push edx
push esi
mov dword [esp + 0x50], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x113d307e
cmp dword [esp + 0x3c], 0x20
jne 0x113d307e
mov ebp, 1
lea eax, [esp + 0x10]
push 0
push eax
push ebx
push esi
call edi
test ebp, ebp
je 0x113d30c1
lea ecx, [esp + 0x14]
push ecx
call fcn.113d2b90
add esp, 4
test eax, eax
je 0x113d30e0
mov ecx, dword [esp + 0x40]
mov eax, 1
test ecx, ecx
je 0x113d30e2
mov bl, byte [esp + 0x1b]
xor edx, edx
cmp bl, 0xe
pop edi
setne dl
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
add esp, 0x24
ret
mov dword [0x115a5400], 0xf
mov dword [0x115a5404], 0x2f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x115a5408], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret