joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1217d210
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217d247
jmp 0x1217d276
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217d276
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 8], 0
je 0x1217d286
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1217d2a0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1219be08]
mov dword [ebp - 0x10], eax
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov al, byte [0x1219be4f]
mov byte [ebp - 0x118], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217d308
mov ecx, dword [ebp + 8]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217d308
jmp 0x1217d363
cmp dword [ebp + 0xc], 0
je 0x1217d325
mov edx, dword [ebp + 0xc]
push edx
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217d325
jmp 0x1217d363
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1217d363
push 0x104
mov ecx, dword [ebp + 0x14]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 4], 0
je 0x1217d373
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217d383
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.1218af21
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1217d3a0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
push eax
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217d3d7
jmp 0x1217d406
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217d406
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 8], 0
je 0x1217d416
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1217d430
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217d46b
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217d46b
jmp 0x1217d478
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217d488
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x1217d4a0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217d4d0
jmp 0x1217d4ff
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217d4ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 8], 0
je 0x1217d50f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1217d520
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217d55b
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217d55b
jmp 0x1217d578
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217d588
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1217d6c0
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217d6fb
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217d6fb
jmp 0x1217d70c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217d71c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x1217d730
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217d772
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217d772
jmp 0x1217d7a4
cmp dword [ebp + 0xc], 0
je 0x1217d78f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217d78f
jmp 0x1217d7a4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_CreateDirectoryExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x1217d7b4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217d7c4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1217d7e0
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217d81b
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217d81b
jmp 0x1217d828
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217d838
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x1217d9e0
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217da22
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217da22
jmp 0x1217da6a
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217da3b
jmp 0x1217da6a
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_QueryDosDeviceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1217da6a
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.12171010
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x1217da7a
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217da8a
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1217daa0
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217dadb
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217dadb
jmp 0x1217daec
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217dafc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x1217db80
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217dbbb
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217dbbb
jmp 0x1217dbd3
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217dbe3
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1217dc80
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217dcbb
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217dcbb
jmp 0x1217dcc8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217dcd8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x1217e3f0
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217e432
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217e432
jmp 0x1217e464
cmp dword [ebp + 0xc], 0
je 0x1217e44f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217e44f
jmp 0x1217e464
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_CopyFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x1217e474
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217e484
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1217e610
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217e652
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217e652
jmp 0x1217e684
cmp dword [ebp + 0xc], 0
je 0x1217e66f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217e66f
jmp 0x1217e684
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_MoveFileExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x1217e694
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217e6a4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1217e6c0
Capabilities:
Create pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217e6fb
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217e6fb
jmp 0x1217e724
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_CreateNamedPipeA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217e734
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x20

Function at 0x1217e7f0
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217e82b
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217e82b
jmp 0x1217e850
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_CallNamedPipeA]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1217e860
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1217e980
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217e9cc
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217e9cc
jmp 0x1217ea63
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1217e9e5
jmp 0x1217ea63
mov edx, dword [ebp + 0x24]
push edx
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217e9fe
jmp 0x1217ea63
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x1217ea45
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 8], 0
je 0x1217ea63
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp + 8], 0
je 0x1217ea73
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0x10], 0
je 0x1217ea83
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217ea93
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x20

Function at 0x1217eab0
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
je 0x1217eaeb
mov eax, dword [ebp + 0xc]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217eaeb
jmp 0x1217eafc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1217eb0c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1217eb90
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217ebd2
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217ebd2
jmp 0x1217ec00
cmp dword [ebp + 0xc], 0
je 0x1217ebef
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217ebef
jmp 0x1217ec00
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x1217ec10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x1217ec20
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8

Function at 0x1217ecd0
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217ed12
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217ed12
jmp 0x1217ed40
cmp dword [ebp + 0xc], 0
je 0x1217ed2f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1217ed2f
jmp 0x1217ed40
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenBackupEventLogA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x1217ed50
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x1217ed60
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x1217edb0
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
mov eax, dword [ebp + 0x24]
cmp dword [eax], 0
je 0x1217edef
mov ecx, dword [ebp + 0x24]
mov edx, dword [ecx]
push edx
call fcn.12171010
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217edef
jmp 0x1217ee1f
mov eax, dword [ebp + 0x28]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov ax, word [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov ax, word [ebp + 0x10]
push eax
mov cx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x1217ee2f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x24
Function at 0x1217f5f0
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 8
call dword [sym.imp.kernel32.dll_SetLastError]
cmp dword [ebp + 8], 0
je 0x1217f639
mov eax, dword [ebp + 8]
push eax
call fcn.12171010
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1217f639
jmp 0x1217f6b6
cmp dword [ebp + 0xc], 0
je 0x1217f656
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.12171010
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1217f656
jmp 0x1217f6b6
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
push eax
push 0
call fcn.12171010
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1217f671
jmp 0x1217f6b6
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1217f6b6
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
push edx
push 0
push 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
cmp dword [ebp - 0x10], 0
je 0x1217f6c6
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 0xc], 0
je 0x1217f6d6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.kernel32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0x1217f6e6
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x1c