joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011348a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov eax, ecx
mov esi, ebx
mov dword [ebp - 4], eax
neg esi
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
test ebx, ebx
je 0x101134c0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x101134c0
mov esi, 0x80070002
test esi, esi
js 0x10113543
push edi
push 0x1003b6db
push 0x50
call fcn.1016721c
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x101134f2
xor ecx, ecx
mov eax, dword [ecx + 0x10199528]
add ecx, 0xc
and dword [eax + edi], 0
cmp ecx, 0xf0
jb 0x101134db
jmp 0x101134f4
xor edi, edi
test edi, edi
jne 0x101134fd
mov esi, 0x8007000e
test esi, esi
js 0x1011352d
mov edx, dword [ebp - 4]
mov ecx, 0x10029f3c
push edi
call fcn.101132e5
mov esi, eax
test esi, esi
js 0x1011352d
mov edx, dword [ebp - 4]
mov ecx, 0x10029f90
push edi
call fcn.101132e5
mov esi, eax
test esi, esi
js 0x1011352d
mov dword [ebx], edi
xor edi, edi
test edi, edi
je 0x10113542
push 1
mov ecx, edi
call fcn.101132a9
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1011354b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 8], edx
mov edi, 0x104
push edi
mov edx, ebx
mov dword [ebp - 0xc], eax
call fcn.10115806
mov esi, eax
test esi, esi
js 0x101135fd
push 0x10018f30
mov edx, edi
mov ecx, ebx
call fcn.1003f209
mov esi, eax
test esi, esi
js 0x101135fd
and dword [ebp - 4], 0
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x10113595
sub ecx, edx
sar ecx, 1
sub edi, ecx
mov ecx, ebx
add edi, edi
mov dword [ebp - 4], edi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x101135b3
sub ecx, edx
lea eax, [ebp - 4]
push eax
sar ecx, 1
lea eax, [ebx + ecx*2]
push eax
lea eax, [ebp - 0x10]
push eax
push 2
push dword [ebp - 8]
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x101135f2
jg 0x101135e7
mov esi, eax
jmp 0x101135fd
movzx esi, ax
or esi, 0x80070000
jmp 0x101135fd
cmp dword [ebp - 0x10], 1
je 0x101135fd
mov esi, 0x8000ffff
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10115806
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 8], ecx
push edi
mov edi, dword [ebp + 8]
mov ecx, ebx
mov edx, edi
call fcn.101157b7
mov esi, eax
test esi, esi
js 0x1011589b
and dword [ebp - 4], 0
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x10115831
sub ecx, edx
sar ecx, 1
sub edi, ecx
mov ecx, ebx
add edi, edi
mov dword [ebp - 4], edi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1011584f
sub ecx, edx
lea eax, [ebp - 4]
push eax
sar ecx, 1
lea eax, [ebx + ecx*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 2
push 0x10018d7c
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10115890
jg 0x10115885
mov esi, eax
jmp 0x1011589b
movzx esi, ax
or esi, 0x80070000
jmp 0x1011589b
cmp dword [ebp - 0xc], 1
je 0x1011589b
mov esi, 0x8000ffff
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10116229
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x101163bb
test ebx, ebx
je 0x101163bb
lea eax, [edi + 3]
or ecx, 0xffffffff
mov edx, eax
cmp eax, edi
jae 0x10116261
mov edx, ecx
mov eax, 0x80070216
jmp 0x101163c0
mov eax, edx
xor edx, edx
push 3
pop esi
div esi
push 4
pop edx
mul edx
test edx, edx
ja 0x10116257
jb 0x10116279
cmp eax, ecx
ja 0x10116257
lea edx, [eax + 2]
cmp edx, eax
jb 0x10116257
mov ecx, edx
push ecx
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
test esi, esi
jne 0x101162a0
mov eax, 0x8007000e
jmp 0x101163c0
push 3
pop ecx
cmp edi, ecx
jl 0x10116324
mov eax, edi
xor edx, edx
div ecx
imul ecx, eax, 0xfffffffd
mov dword [ebp - 4], eax
add edi, ecx
mov dword [ebp - 8], edi
mov edi, eax
movzx edx, byte [ebx]
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
add ebx, 3
shl edx, 8
add edx, ecx
shl edx, 8
add edx, eax
mov eax, edx
shr eax, 0x12
mov ax, word [eax*2 + 0x1002a960]
mov word [esi], ax
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov ax, word [eax*2 + 0x1002a960]
mov word [esi + 2], ax
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
mov ax, word [eax*2 + 0x1002a960]
mov word [esi + 4], ax
mov ax, word [edx*2 + 0x1002a960]
mov word [esi + 6], ax
add esi, 8
sub edi, 1
jne 0x101162ba
mov edi, dword [ebp - 8]
cmp edi, 2
jne 0x10116376
movzx ecx, byte [ebx]
mov eax, 0x100
imul ecx, eax
movzx eax, byte [ebx + 1]
push 0x3d
add cx, ax
movzx ecx, cx
mov eax, ecx
shr eax, 0xa
mov ax, word [eax*2 + 0x1002a960]
mov word [esi], ax
mov eax, ecx
shr eax, 4
and eax, 0x3f
and ecx, 0xf
mov ax, word [eax*2 + 0x1002a960]
mov word [esi + 2], ax
mov ax, word [ecx*8 + 0x1002a960]
mov word [esi + 4], ax
pop eax
jmp 0x101163a6
cmp edi, 1
jne 0x101163b2
movzx ecx, byte [ebx]
mov eax, ecx
and ecx, 3
shr eax, 2
shl ecx, 5
push 0x3d
mov ax, word [eax*2 + 0x1002a960]
mov word [esi], ax
mov ax, word [ecx + 0x1002a960]
mov word [esi + 2], ax
pop eax
mov word [esi + 4], ax
mov word [esi + 6], ax
xor eax, eax
mov word [esi + 8], ax
jmp 0x101163b7
xor eax, eax
mov word [esi], ax
xor eax, eax
jmp 0x101163c0
mov eax, 0x80070057
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10120e3a
Capabilities:
Get file size

Disassembly:
push 0x14
mov eax, 0x10178eed
call fcn.101673a2
mov ebx, ecx
cmp dword [ebx + 0x14], 8
jb 0x10120e52
mov eax, dword [ebx]
jmp 0x10120e54
mov eax, ebx
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], edi
cmp esi, 0xffffffff
je 0x10120f71
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10120e9e
push ecx
mov edx, 0xa2
jmp 0x10120f77
cmp dword [ebp - 0x10], 0
ja 0x10120f7f
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10120f69
cmp eax, 0xffffffff
je 0x10120f69
sub esp, 0xc
lea ecx, [ebp - 0x18]
push 1
push eax
call fcn.1003f3c5
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x18]
test esi, esi
jne 0x10120ef3
push ecx
mov edx, 0xbe
jmp 0x10120f77
cmp edi, 2
jbe 0x10120f1c
cmp byte [esi], 0xff
jne 0x10120f1c
cmp byte [esi + 1], 0xfe
jne 0x10120f1c
shr edi, 1
cmp edi, 1
jbe 0x10120f4c
lea eax, [edi - 1]
push eax
lea eax, [esi + 2]
push eax
lea ecx, [ebx + 0x1c]
call fcn.100451ec
jmp 0x10120f4c
cmp edi, 3
jbe 0x10120f41
cmp byte [esi], 0xef
jne 0x10120f41
cmp byte [esi + 1], 0xbb
jne 0x10120f41
cmp byte [esi + 2], 0xbf
jne 0x10120f41
lea eax, [edi - 3]
push eax
lea eax, [esi + 3]
push eax
push 0xfde9
jmp 0x10120f45
push edi
push esi
push 3
mov ecx, ebx
call fcn.10120dc5
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea ecx, [ebp - 0x1c]
call fcn.1003f382
lea ecx, [ebp - 0x20]
call fcn.1003f382
call fcn.10167370
ret
push ecx
mov edx, 0xb3
jmp 0x10120f77
push ecx
mov edx, 0x9a
mov ecx, dword [ebp + 4]
call fcn.10121f9a
push 0x800700df
lea ecx, [ebp - 0x14]
call fcn.1003ecfb
push 0x10196090
mov eax, ecx
push eax
call sub.msvcrt.dll__CxxThrowException
int3

Function at 0x1012160a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 1
push ebx
push 0x1002c568
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10121668
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push ebx
push ebx
push 0x1002c5ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1012165f
cmp dword [ebp - 8], ebx
setne bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x101973c0]
cmp eax, 0x101973c0
je 0x10121691
test byte [eax + 0x1c], 4
je 0x10121691
movzx ecx, bl
mov edx, 0x1002c630
push ecx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.1003f754
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10125f6f
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 4], edx
mov edi, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10125f93
push 0x19
pop ecx
int 0x29
test byte [ebp - 0xc], 0x44
je 0x10125fdd
push ebx
push esi
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x40]
xor edx, edx
lea ecx, [ebx - 1]
mov eax, ecx
lea esi, [ebx - 1]
and ecx, dword [ebp - 4]
and eax, edi
add eax, ebx
dec ecx
add eax, ecx
not esi
div ebx
xor edx, edx
and esi, edi
mov ecx, eax
mov eax, dword [ebp - 4]
div ebx
add ecx, eax
je 0x10125fdb
xor eax, eax
lock or dword [esi], eax
add esi, ebx
sub ecx, 1
jne 0x10125fcf
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10127d33
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ax, dx
mov dword [ebp - 4], edx
push esi
movzx esi, ax
lea edx, [ebp - 4]
shr ax, 4
inc ax
push edi
movzx ebx, ax
mov word [ebp - 4], ax
call fcn.10127c7a
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x10127deb
push 6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x10127deb
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10127deb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x10127deb
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0xc]
cmp cx, 2
jb 0x10127deb
add ecx, 0xffff
and esi, 0xf
jmp 0x10127db7
movzx eax, word [edi]
lea edi, [edi + eax*2]
add edi, 2
sub esi, 1
jns 0x10127dae
movzx esi, word [edi]
test esi, esi
je 0x10127de5
movzx eax, cx
cmp esi, eax
jbe 0x10127dcc
mov esi, eax
mov edx, dword [ebp + 8]
lea ecx, [edi + 2]
add esi, esi
xor eax, eax
push esi
push ecx
push edx
mov word [esi + edx], ax
call sub.msvcrt.dll_memcpy
add esp, 0xc
shr esi, 1
mov eax, esi
jmp 0x10127ded
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x101282d8
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101a4c2c]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
push 0x234
mov ebx, edx
mov edi, ecx
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x101284bc
lea eax, [ebp - 0x24]
mov dword [esi + 4], edi
push eax
mov ecx, 0x208
mov dword [esi], 0x666e7469
push ecx
lea edi, [esi + 0xc]
mov dword [esi + 8], ebx
push edi
push 1
push 0
push 0
mov dword [ebp - 0x24], ecx
call dword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
test eax, eax
je 0x101284b1
push 0x5c
push edi
call sub.msvcrt.dll_wcsrchr
pop ecx
pop ecx
test eax, eax
je 0x10128351
xor ecx, ecx
mov word [eax], cx
push 0x1002cd30
mov edx, 0x104
mov ecx, edi
call fcn.1003f209
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x101284b1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x101284b1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x101284b1
push dword [ebp - 0x20]
mov edx, 0x104
mov ecx, edi
call fcn.1003f209
push 0x1002cd24
mov edx, 0x104
mov ecx, edi
call fcn.1003f209
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
xor eax, eax
push eax
push 0x10100000
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x214], eax
cmp eax, 0xffffffff
je 0x101284b1
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
and dword [esi + 0x220], 0
mov ecx, edi
push eax
push 8
pop edx
mov dword [esi + 0x224], 2
call fcn.1003ed79
test eax, eax
js 0x101284b1
push dword [ebp - 0x1c]
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x22c], eax
test eax, eax
je 0x101284b1
and dword [esi + 0x230], 0
push 0x30
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x218], eax
test eax, eax
je 0x101284b1
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
push 0x24
pop edx
call fcn.1003ed79
test eax, eax
js 0x101284b1
push dword [ebp - 0x1c]
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x21c], eax
test eax, eax
je 0x101284b1
mov eax, dword [esi + 0x218]
push 0x30
pop ecx
mov dword [eax], 0x31464655
mov eax, dword [esi + 0x218]
mov dword [eax + 4], 0x10001
mov eax, dword [esi + 0x218]
mov dword [eax + 8], ecx
mov eax, dword [esi + 0x218]
mov dword [eax + 0xc], edi
test edi, edi
je 0x101284ba
mov eax, dword [esi + 0x218]
mov dword [eax + 0x18], ecx
jmp 0x101284ba
mov ecx, esi
call fcn.1012810f
xor esi, esi
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10166ce0
mov esp, ebp
pop ebp
ret 4
Function at 0x101284cf
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x10128534
cmp dword [esi], 0x666e7469
jne 0x10128534
test byte [esi + 0x224], 2
je 0x10128534
push edi
xor edi, edi
cmp dword [esi + 0x220], edi
je 0x1012850d
push edi
push edi
push edi
push dword [esi + 0x214]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x220], eax
push edi
lea eax, [ebp - 4]
push eax
push 0x30
push dword [esi + 0x218]
push dword [esi + 0x214]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
test eax, eax
je 0x10128537
mov eax, dword [ebp - 4]
add dword [esi + 0x220], eax
xor eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1012853c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x101285e0
cmp dword [esi], 0x666e7469
jne 0x101285e0
test byte [esi + 0x224], 2
je 0x101285e0
mov ecx, dword [esi + 0x218]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x101285e0
cmp dword [esi + 0x220], eax
je 0x10128594
push 0
push 0
push eax
push dword [esi + 0x214]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x218]
mov dword [esi + 0x220], eax
mov eax, dword [ecx + 0xc]
xor edx, edx
mov ecx, dword [esi + 0x21c]
dec eax
push eax
call fcn.10128e6d
mov eax, dword [esi + 0x218]
push 0
or dword [eax + 0x1c], 1
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x218]
imul eax, dword [eax + 0xc], 0x24
push eax
push dword [esi + 0x21c]
push dword [esi + 0x214]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x101285e3
mov ecx, dword [ebp - 4]
add dword [esi + 0x220], ecx
xor eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10128ccf
Capabilities:
Copy file
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x101a4c2c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, 0x666e7469
push esi
mov esi, edx
test ebx, ebx
je 0x10128cf7
cmp dword [ebx], eax
jne 0x10128cff
test esi, esi
je 0x10128d06
cmp dword [esi], eax
je 0x10128d06
xor eax, eax
jmp 0x10128dcf
xor eax, eax
mov word [ebp - 0x414], ax
mov word [ebp - 0x20c], ax
push edi
test esi, esi
je 0x10128d34
lea eax, [esi + 0xc]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x20c]
call fcn.1003f1d4
mov edi, dword [esi + 4]
jmp 0x10128d36
xor edi, edi
test ebx, ebx
je 0x10128d4e
lea eax, [ebx + 0xc]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x414]
call fcn.1003f1d4
mov ecx, ebx
call fcn.1012810f
mov ecx, esi
call fcn.1012810f
cmp dword [ebp + 8], 0
je 0x10128db4
cmp word [ebp - 0x414], 0
je 0x10128de1
push 0
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10128db4
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
test edi, edi
je 0x10128db4
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push 0x10024f34
push edi
call dword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
cmp word [ebp - 0x20c], 0
je 0x10128dcb
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10166ce0
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
test edi, edi
je 0x10128dcb
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x10024f34
push edi
call dword [sym.imp.WINSPOOL.DRV_SetPrinterDataW]
jmp 0x10128dcb

Function at 0x10128e11
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0
lea eax, [ebp - 4]
mov esi, ecx
push eax
movzx eax, word [edx + 4]
add eax, dword [edx + 8]
push eax
push edx
push dword [esi + 0x214]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10128e68
mov eax, dword [ebp - 4]
add eax, 3
add eax, dword [esi + 0x220]
push 0
and eax, 0xfffffffc
push 0
push eax
push dword [esi + 0x214]
mov dword [esi + 0x220], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0x220], eax
xor eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1012d399
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
call fcn.10129b85
mov dword [ebp - 8], eax
test eax, eax
je 0x1012d4d1
push esi
push 0x100080
push 3
push esi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
je 0x1012d428
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1012d419
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1012d419
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [ebp - 0x14]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1012d442
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
mov dword [ebp - 0xc], edi
jmp 0x1012d42e
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
mov ebx, esi
test ebx, ebx
jne 0x1012d442
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1012d4d1
mov eax, dword [ebp - 4]
cmp eax, 0xdc
jbe 0x1012d4ae
cmp eax, dword [ebx]
jb 0x1012d4ae
cmp dword [ebx + 8], 0x190073
jne 0x1012d4ae
cmp dword [ebx + 4], 0x47504420
jne 0x1012d4ae
mov edx, dword [ebp - 8]
mov ecx, ebx
call fcn.1012d61b
test eax, eax
je 0x1012d4ae
push 0x9c
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1012d4ae
push 0xb
pop ecx
mov edi, eax
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov dword [eax + 0x38], ecx
mov ecx, eax
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], edi
mov dword [eax + 0x34], ebx
call fcn.1012d26f
mov esi, eax
neg esi
sbb esi, esi
and esi, 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x1012d4c0
mov eax, dword [ebp - 0x10]
jmp 0x1012d4d3
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, edi
mov ecx, ebx
call fcn.1010bf24
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10131e82
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101a4c2c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x2c], edx
call fcn.10129b85
mov edi, eax
test edi, edi
je 0x10131f1b
push esi
lea eax, [ebp - 0x28]
xor esi, esi
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x10131ec1
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10131f13
push ebx
push esi
push 0x8100080
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10131f12
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10131f00
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x30], eax
jne 0x10131f00
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x10131f12
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10166ce0
mov esp, ebp
pop ebp
ret 4
Function at 0x10146324
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
test edx, edx
je 0x101463d6
test ecx, ecx
je 0x101463d6
mov esi, dword [ebp + 8]
test esi, esi
je 0x101463d6
cmp edx, 3
ja 0x101463d6
mov word [esi + 2], 0x3d3d
mov al, byte [ecx]
shr al, 2
push ebx
mov byte [esi], al
mov bl, byte [ecx]
and bl, 3
shl bl, 4
mov byte [esi + 1], bl
cmp edx, 1
je 0x1014639b
mov al, byte [ecx + 1]
shr al, 4
or al, bl
mov byte [esi + 1], al
mov bl, byte [ecx + 1]
and bl, 0xf
shl bl, 2
mov byte [esi + 2], bl
cmp edx, 2
je 0x1014639b
mov al, byte [ecx + 2]
shr al, 6
or al, bl
mov byte [esi + 2], al
mov al, byte [ecx + 2]
and al, 0x3f
mov byte [esi + 3], al
xor ecx, ecx
pop ebx
mov al, byte [ecx + esi]
cmp al, 0x1a
jae 0x101463a9
add al, 0x41
jmp 0x101463ca
cmp al, 0x34
jae 0x101463b1
add al, 0x47
jmp 0x101463ca
cmp al, 0x3e
jae 0x101463b9
sub al, 4
jmp 0x101463ca
jne 0x101463bf
mov al, 0x2b
jmp 0x101463ca
cmp al, 0x3f
setne al
dec al
and al, 0xf0
add al, 0x3f
mov byte [ecx + esi], al
inc ecx
cmp ecx, edx
jbe 0x1014639e
mov eax, edx
jmp 0x101463d8
xor eax, eax
pop esi
pop ebp
ret 4