joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4059c6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x4059e7
mov ecx, dword [0x42e7fc]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x42f058]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x42dfc0
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405bad
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405bad
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405bba
inc ebx
cmp cl, 0xfc
jbe 0x405ba0
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0xc], eax
or eax, edx
push 2
mov dword [ebp - 8], eax
pop eax
mov dword [ebp - 0x14], ecx
or ecx, edx
add ebx, eax
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0x10], ecx
jne 0x405b4b
cmp dword [0x42f0a4], 0
mov dword [ebp + 0xc], eax
je 0x405a79
mov dword [ebp + 0xc], 4
dec dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
push dword [ebp + eax*4 - 0x14]
push dword [0x42f024]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405ab0
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jne 0x405ab9
and byte [edi], 0
cmp dword [ebp + 0xc], 0
jne 0x405a79
cmp byte [edi], 0
jne 0x405b32
mov eax, dword [ebp - 0x14]
cmp eax, 0x2b
jne 0x405add
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405898
jmp 0x405b2d
cmp eax, 0x26
jne 0x405b09
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405898
cmp byte [edi], 0
jne 0x405b32
push str.C:Program_Files
push edi
call fcn.004059a4
jmp 0x405b2d
cmp eax, 0x25
jne 0x405b1c
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405b2d
cmp eax, 0x24
jne 0x405b2d
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
je 0x405b43
cmp dword [ebp - 0xc], 0x1a
jne 0x405b43
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405bd3
jmp 0x405b91
cmp byte [ebp + 0xf], 0xfd
jne 0x405b7f
cmp esi, 0x1b
jne 0x405b64
push dword [0x42f024]
push edi
call fcn.00405902
jmp 0x405b75
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.004059a4
add esi, 0xffffffeb
cmp esi, 6
jae 0x405b91
jmp 0x405b43
cmp byte [ebp + 0xf], 0xff
jne 0x405b91
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.004059c6
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x42dfc0
jmp 0x405bad
jne 0x405baa
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405bad
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405a12
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405bcf
push eax
push dword [ebp + 8]
call fcn.004059a4
leave
ret 8
Function at 0x405d07
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42ca1c], 0
push esi
jne 0x405d3e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d18
mov dword [ecx*4 + 0x42ca18], eax
inc ecx
cmp ecx, 0x100
jl 0x405d13
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d6f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42ca18]
xor eax, esi
inc ecx
dec edx
jne 0x405d51
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x5561517a
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x1d792ff8
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x11c91890
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x12117d1c]
test eax, eax
jne 0x11c918de
mov dword [0x12117d1c], 1
call fcn.11e93380
test eax, eax
push 0x104
push 0x12117d20
je 0x11c918d8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x11c918de
push 0x12019658
push 0x12117d20
call fcn.11e67470
add esp, 8
mov eax, 0x12117d20
ret
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, 0x12117d20
ret
Function at 0x11c9f2b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11f9e298
push eax
mov eax, dword [0x12133f80]
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
xor ebp, ebp
push esi
push edi
mov edi, dword [esp + 0x38]
cmp eax, ebp
mov esi, ecx
je 0x11c9f2fc
push edi
mov ecx, 0x1212b458
call fcn.11ec4a10
push eax
push str.__s__CCurrentFileMgr::OnDocClose_lpwszFileName__s_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x14
push 2
lea ecx, [esp + 0x20]
call fcn.11e15fa0
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], ebp
call fcn.11e16080
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x30], 1
cmp eax, ebp
je 0x11c9f357
cmp dword [eax], 0x10
jb 0x11c9f357
mov eax, dword [eax + 8]
push 1
lea ecx, [esp + 0x3c]
push eax
push ecx
mov ecx, esi
call fcn.11ca4680
mov edx, dword [esp + 0x38]
mov ecx, esi
push edx
mov byte [esp + 0x34], 2
call fcn.11ca2af0
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 1
call fcn.11e7f280
push ebx
push ebp
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x50]
push ebp
push eax
mov ecx, 0x1212b5c0
call fcn.11c9f420
mov ecx, dword [eax]
push edi
push ecx
mov byte [esp + 0x3c], 3
call fcn.11e67d22
add esp, 8
cmp eax, ebp
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 1
sete bl
call fcn.11e7f280
test bl, bl
pop ebx
je 0x11c9f3ec
push 1
push 0x1212c678
lea ecx, [esp + 0x18]
call fcn.11e8c590
push 0x12119948
mov ecx, 0x1212c698
mov byte [esp + 0x34], 4
call fcn.11e7f500
mov dword [0x1212c69c], ebp
mov dword [0x1212c6a0], ebp
mov dword [0x1212c6a4], ebp
mov dword [0x1212c6a8], ebp
mov dword [0x1212c6ac], ebp
mov dword [0x1212c6b0], ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.11e8c5f0
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.11e16090
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.11e15fd0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x11ca3040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11f9e7a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x18]
call fcn.11e84ba0
lea eax, [esi + 4]
xor edi, edi
push 1
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], edi
call fcn.11e8c590
mov eax, dword [0x12133f80]
mov byte [esp + 0x30], 1
cmp eax, edi
je 0x11ca30af
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x38]
push eax
push ecx
mov ecx, 0x1212b458
call fcn.11ec4a10
push eax
push str.__s__CCurrentFileMgr::IsOpenedDiffDocCur___m_arrOpenedEncryptDoc.GetSize__lu__m_arrOpenedDecryptDoc.GetSize__lu_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x18
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x28]
lea edx, [eax + ecx]
cmp edx, 1
jle 0x11ca30fe
cmp ecx, edi
jle 0x11ca30fa
cmp eax, edi
jle 0x11ca3130
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.11e8c5f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.11e84bb0
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
cmp eax, edi
jle 0x11ca3130
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 0
call fcn.11e8c5f0
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.11e84bb0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
push ebx
add esi, 0x34
push ebp
push esi
lea ecx, [esp + 0x24]
call fcn.11e84f30
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 0
call fcn.11e8c5f0
mov eax, dword [esp + 0x24]
xor ebp, ebp
cmp eax, edi
jle 0x11ca31c7
mov eax, dword [esp + 0x20]
push 0
push 0
push 0
mov esi, dword [eax + edi*4]
push 0
push 0
lea ecx, [esp + 0x24]
push 0
push ecx
mov ecx, 0x1212b5c0
call fcn.11c9f420
mov edx, dword [eax]
push esi
push edx
mov byte [esp + 0x40], 2
call fcn.11e67d22
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
sete bl
mov byte [esp + 0x38], 0
call fcn.11e7f280
test bl, bl
jne 0x11ca31b7
mov eax, dword [esp + 0x20]
mov ecx, 0x1212aa70
mov eax, dword [eax + edi*4]
push eax
call fcn.11ca4360
test eax, eax
je 0x11ca31c2
mov eax, dword [esp + 0x24]
inc edi
cmp edi, eax
jl 0x11ca3157
jmp 0x11ca31c7
mov ebp, 1
mov eax, dword [0x12133f80]
test eax, eax
je 0x11ca31f0
push ebp
mov ecx, 0x1212b458
call fcn.11ec4a10
push eax
push str.__s__CCurrentFileMgr::IsOpenedDiffDocCur___bDiff__d_
push str.CurrentFileMgr
push 1
call fcn.11ca5810
add esp, 0x14
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.11e84bb0
mov ecx, dword [esp + 0x30]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x11cab7c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11f9ed88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push 2
lea ecx, [esp + 0x10]
call fcn.11e15fa0
mov eax, dword [esp + 0x28]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 7
push bind
push eax
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x11cab82f
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], eax
call fcn.11e15fd0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push 0
push 0
push esi
call fcn.11ee27a0
add esp, 0x10
test eax, eax
je 0x11cab89c
mov eax, dword [esp + 8]
mov ebx, 1
test eax, eax
jbe 0x11cab88f
push edi
mov edi, dword [esp + 0x30]
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.11e925f0
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x30]
push edx
push eax
mov ecx, edi
mov dword [esp + 0x38], 0
call fcn.11e92d00
push eax
push esi
call fcn.11ee27a0
add esp, 0x10
pop edi
jmp 0x11cab89c
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.11cabda0
add esp, 4
mov edx, dword [esp + 0x30]
push 0
push edx
push esi
call fcn.11ee08c0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.11e15fd0
mov ecx, dword [esp + 0x18]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x11caca90
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x11f9ef70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 1
push 0
push ecx
mov dword [esi], 0x64
mov ecx, esp
mov dword [esp + 0x10], esp
push str.networksharefolder_s19hexbin_file_featureworks_similarity
call fcn.11e7eae0
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0xffffffff
call fcn.11dfcbd0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], 1
cmp eax, 0xf0000001
jne 0x11cacaf5
lea ecx, [esp + 8]
call fcn.11dfd310
mov dword [esi], eax
cmp dword [esi], 0x64
jbe 0x11cacb00
mov dword [esi], 0x64
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.11dfcc90
mov ecx, dword [esp + 0x30]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x38
ret
Function at 0x11caea70
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x11f9f180
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 1
push 0x12119c40
lea ecx, [esp + 0x18]
xor esi, esi
xor ebx, ebx
call fcn.11e8c590
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x24], esi
mov edi, 0x12119c70
mov eax, dword [edi - 8]
test eax, eax
je 0x11caeac2
push edi
push ebp
call fcn.11e67d22
add esp, 8
test eax, eax
je 0x11caead3
add edi, 0x418
inc esi
cmp edi, 0x12124030
jb 0x11caeaad
jmp 0x11caeb0c
mov eax, esi
mov ecx, dword [esp + 0x34]
shl eax, 6
add eax, esi
lea edi, [esi + eax*2]
mov eax, dword [esp + 0x30]
shl edi, 3
dec ecx
lea edx, [edi + 0x12119e78]
push ecx
push edx
push eax
call fcn.11e674bf
mov eax, dword [edi + 0x12119c6c]
add esp, 0xc
inc eax
mov ebx, 1
mov dword [edi + 0x12119c6c], eax
or edi, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], edi
call fcn.11e8c5f0
test ebx, ebx
je 0x11caeb80
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
jne 0x11caeb80
push 1
push 0x12119c40
lea ecx, [esp + 0x18]
call fcn.11e8c590
mov edx, esi
mov dword [esp + 0x24], 1
shl edx, 6
add edx, esi
lea ecx, [esp + 0x10]
lea eax, [esi + edx*2]
xor esi, esi
mov dword [eax*8 + 0x12119c68], 0
mov dword [esp + 0x24], edi
call fcn.11e8c5f0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x11caec30
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11f9f1b8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, dword [esp + 0x20]
cmp esi, 0x28
ja 0x11caecfc
push ebx
push edi
push 1
push 0x12119c40
lea ecx, [esp + 0x14]
call fcn.11e8c590
mov eax, esi
mov ecx, 0x82
shl eax, 6
add eax, esi
mov dword [esp + 0x20], 0
push 0x103
lea esi, [esi + eax*2]
xor eax, eax
shl esi, 3
lea edx, [esi + 0x12119c70]
lea ebx, [esi + 0x12119e78]
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 0x82
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x30]
push ecx
push edx
call fcn.11e674bf
mov edx, dword [esp + 0x3c]
push 0x103
push edx
push ebx
call fcn.11e674bf
mov dword [esi + 0x12119c68], 1
add esp, 0x18
mov dword [esi + 0x12119c6c], 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.11e8c5f0
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x11cb2910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x11f9f4c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, ecx
push edi
lea ecx, [esp + 0x2c]
call fcn.11e7e980
mov eax, dword [eax]
mov ecx, esi
push eax
mov dword [esp + 0x20], 0
call fcn.11cb22b0
lea ecx, [esp + 0x28]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.11e7f280
test esi, esi
je 0x11cb29b2
push 2
push 0x12118e98
lea ecx, [esp + 0x10]
call fcn.11c923e0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push edi
mov dword [esp + 0x28], 1
call dword [esp + 0x30]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.11c92410
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push edx
push eax
push edi
call dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10

Function at 0x11cb2bf0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11f9f538
push eax
mov dword fs:[0], esp
sub esp, 0xc
call fcn.11cb2370
test eax, eax
je 0x11cb2c73
push esi
push 0x20
push 0x12118e98
lea ecx, [esp + 0xc]
call fcn.11c923e0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
mov dword [esp + 0x30], 0
call dword [esp + 0x38]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.11c92410
mov eax, esi
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x1c
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
call dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x1c

Function at 0x11cb2cb0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11f9f558
push eax
mov dword fs:[0], esp
sub esp, 0xc
call fcn.11cb2290
test eax, eax
je 0x11cb2d33
push esi
push 2
push 0x12118e98
lea ecx, [esp + 0xc]
call fcn.11c923e0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
mov dword [esp + 0x30], 0
call dword [esp + 0x38]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.11c92410
mov eax, esi
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x1c
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
call dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x1c
Function at 0x11cb6c10
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x138
mov ecx, 0x10
xor eax, eax
push ebx
push ebp
mov ebx, dword [esp + 0x144]
push esi
mov esi, dword [esp + 0x14c]
push edi
mov ebp, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x14]
push 0x40
push eax
push esi
push ebx
call ebp
test eax, eax
jne 0x11cb6c5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x138
ret
cmp word [esp + 0x10], 0x5a4d
je 0x11cb6c74
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x138
ret
mov edx, dword [esp + 0x4c]
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x54]
push 0xf8
add edx, esi
push ecx
push edx
push ebx
call ebp
test eax, eax
jne 0x11cb6cad
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x138
ret
cmp dword [esp + 0x50], 0x4550
je 0x11cb6cc4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x138
ret
mov eax, dword [esp + 0x66]
pop edi
not eax
shr eax, 0xd
pop esi
pop ebp
and eax, 1
pop ebx
add esp, 0x138
ret

Function at 0x11cb6ce0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x148
mov ecx, 0x10
xor eax, eax
push ebx
push ebp
mov ebx, dword [esp + 0x154]
push esi
mov esi, dword [esp + 0x15c]
push edi
mov ebp, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push eax
lea eax, [esp + 0x14]
push 0x40
push eax
push esi
push ebx
call ebp
test eax, eax
jne 0x11cb6d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x148
ret
cmp word [esp + 0x10], 0x5a4d
je 0x11cb6d44
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x148
ret
mov edx, dword [esp + 0x4c]
mov ecx, 0x42
xor eax, eax
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x54]
push pe_nt_image_headers32
add edx, esi
push ecx
push edx
push ebx
call ebp
test eax, eax
jne 0x11cb6d7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x148
ret
cmp dword [esp + 0x50], 0x4550
je 0x11cb6d94
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x148
ret
mov eax, dword [esp + 0x66]
pop edi
not eax
shr eax, 0xd
pop esi
pop ebp
and eax, 1
pop ebx
add esp, 0x148
ret
Function at 0x11cb6db0
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x148
xor eax, eax
mov ecx, 0x10
push ebx
push ebp
mov ebx, dword [esp + 0x158]
push esi
mov esi, dword [esp + 0x160]
mov ebp, dword [esp + 0x158]
push edi
lea edi, [esp + 0x10]
push eax
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push 0x40
push eax
push esi
push ebx
push ebp
call fcn.11e14e50
add esp, 0x1c
test eax, eax
je 0x11cb6e07
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x148
ret
cmp word [esp + 0x10], 0x5a4d
je 0x11cb6e1d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x148
ret
xor eax, eax
mov ecx, 0x42
lea edi, [esp + 0x50]
push eax
rep stosd dword es:[edi], eax
push eax
mov eax, dword [esp + 0x54]
cdq
add eax, ebx
lea ecx, [esp + 0x58]
push pe_nt_image_headers32
push ecx
adc edx, esi
push edx
push eax
push ebp
call fcn.11e14e50
add esp, 0x1c
test eax, eax
je 0x11cb6e61
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x148
ret
cmp dword [esp + 0x50], 0x4550
je 0x11cb6e78
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x148
ret
mov eax, dword [esp + 0x66]
pop edi
not eax
shr eax, 0xd
pop esi
pop ebp
and eax, 1
pop ebx
add esp, 0x148
ret
Function at 0x11cba930
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11f9fbcb
push eax
mov eax, dword [0x12133f80]
mov dword fs:[0], esp
sub esp, 0x664
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x11cba971
mov eax, dword [0x12126854]
push eax
push str.__s__CMiniTSafeDoc::CleanADSCache___n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x10
cmp dword [0x121244fc], ebp
je 0x11cba991
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
add esp, 0x670
ret
call fcn.11dc2dd0
push eax
lea ecx, [esp + 8]
call fcn.11e7eae0
mov eax, dword [esp + 4]
mov dword [esp + 0x670], ebp
cmp dword [eax - 8], ebp
jne 0x11cba9dc
lea ecx, [esp + 4]
mov dword [esp + 0x670], 0xffffffff
call fcn.11e7f280
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x664]
mov dword fs:[0], ecx
add esp, 0x670
ret
push ebx
push edi
push 0x1203c7f8
lea ecx, [esp + 0x10]
call fcn.11e82a90
push 0x12022ca0
lea ecx, [esp + 0x10]
call fcn.11e7fed0
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], bp
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
push 0x104
lea edx, [esp + 0x21c]
push ecx
push edx
stosw word es:[edi], ax
call fcn.11e674bf
lea eax, [esp + 0x224]
push str..adstest.sdd
push eax
call fcn.11e67470
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x438]
mov dword [esp + 0x434], ebp
rep stosd dword es:[edi], eax
add esp, 0x14
lea ecx, [esp + 0x420]
lea edx, [esp + 0x218]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x11cbab12
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bp
rep stosd dword es:[edi], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
stosw word es:[edi], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x14]
push 0x104
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.11e674bf
lea edx, [esp + 0x45c]
lea eax, [esp + 0x20]
push edx
push eax
call fcn.11e67470
add esp, 0x14
lea ecx, [esp + 0x14]
push ecx
call esi
cmp dword [0x12133f80], ebp
je 0x11cbaaf7
mov eax, dword [0x12126854]
lea edx, [esp + 0x14]
push edx
push eax
push str.__s__CMiniTSafeDoc::CleanADSCache__s__DeleteFileW_n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x14
lea eax, [esp + 0x424]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x11cbaa93
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x678], 0xffffffff
call fcn.11e7f280
mov ecx, dword [esp + 0x670]
pop edi
pop ebx
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x670
ret