joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11173fc0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
push ecx
push ecx
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x21c]
push eax
mov word [ebp - 0x14], cx
call dword [sym.imp.MSVCR100.dll__wsplitpath]
lea edi, [ebp - 0x14]
add esp, 0x14
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x11174013
mov ecx, dword [0x11203288]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x220]
push edx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov dword [edi], ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
xor ecx, ebp
pop edi
call fcn.111d9022
mov esp, ebp
pop ebp
ret

Function at 0x11174060
Capabilities:
Encrypt data using rc4 prga
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.11173fc0
mov edi, eax
test esi, esi
je 0x111740af
movzx eax, word [esi]
test ax, ax
je 0x111740af
movzx ecx, word [esi + 2]
movzx edx, word [esi + 4]
movzx eax, al
shl eax, 8
and ecx, 0xff
or eax, ecx
shl eax, 8
and edx, 0xff
or eax, edx
jmp 0x111740b2
mov eax, dword [ebp + 0x10]
xor edi, eax
push edi
push str.RegistryMachineSOFTWAREClassesN_x
push ebx
call fcn.1113d940
add esp, 0xc
test esi, esi
je 0x1117412b
mov eax, 0x11219064
lea esp, [esp]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x111740f6
test cx, cx
je 0x111740f2
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x111740f6
add esi, 4
add eax, 4
test cx, cx
jne 0x111740d0
xor eax, eax
jmp 0x111740fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1117412b
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov dword [ebp - 0x48], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1117412b
lea edx, [ebp - 0x44]
push edx
push edi
push str.RegistryMachineSOFTWAREClassesN_x._s
push ebx
call fcn.1113d940
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x11176b30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
test byte [esi + 0xc4], 1
je 0x11176c83
cmp dword [esi + 0xf4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x364], ebx
mov dword [esi + 0x368], eax
mov dword [esi + 0x370], ecx
je 0x11176c83
cmp byte [esi + 0x2ec], 0
jne 0x11176c83
push edi
push 2
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
mov ecx, dword [esi + 8]
push 0
push 0
push str.DisableSyncNumLock
push str.View
call fcn.110bbc00
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
jne 0x11176bdd
push 0x90
call edi
and eax, 1
cmp ebx, eax
je 0x11176bdd
mov ecx, 0x45
lea edx, [ecx + 0x4b]
mov eax, esi
mov byte [esi + 0x30d], 0x45
call fcn.11175070
mov ecx, 0x45
mov edx, 0x8090
mov eax, esi
call fcn.11175070
mov ecx, dword [esi + 8]
push 0
push 0
push str.DisableSyncCapsLock
push str.View
call fcn.110bbc00
test eax, eax
jne 0x11176c32
push 0x14
call edi
and eax, 1
cmp dword [ebp + 8], eax
je 0x11176c32
mov ecx, 0x3a
lea edx, [ecx - 0x26]
mov eax, esi
mov byte [esi + 0x30e], 0x3a
call fcn.11175070
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3a
mov edx, 0x8014
mov eax, esi
call fcn.11175070
mov ecx, dword [esi + 8]
push 0
push 0
push str.DisableSyncScrollLock
push str.View
call fcn.110bbc00
test eax, eax
jne 0x11176c82
push 0x91
call edi
and eax, 1
cmp dword [ebp + 0xc], eax
je 0x11176c82
mov ecx, 0x46
lea edx, [ecx + 0x4b]
mov eax, esi
mov byte [esi + 0x30f], 0x46
call fcn.11175070
mov ecx, 0x46
mov edx, 0x8091
mov eax, esi
call fcn.11175070
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x11179430
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.111bbd10
test eax, eax
je 0x111794c3
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.SystemCurrentControlSetControlGraphicsDriversDCI
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x111794c3
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x111794a3
lea edx, [ebp + 0xc]
push edx
push ecx
lea ecx, [ebp - 8]
push ecx
push 0
push str.Timeout
push eax
mov dword [ebp + 0xc], 4
call fcn.111b8970
mov eax, dword [ebp - 4]
add esp, 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
push 4
lea edx, [ebp + 8]
push edx
push 4
push 0
push str.Timeout
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8

Function at 0x11179510
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov edx, edi
neg edx
sbb edx, edx
and edx, 0xfffffffa
push eax
mov eax, dword [ecx + 0x250]
add edx, 0x2001f
push edx
call eax
mov esi, eax
add esp, 8
test esi, esi
je 0x111795ab
mov dword [ebp + 8], 4
test edi, edi
je 0x1117956d
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push ecx
push edi
lea edx, [ebp + 0xc]
push edx
push 0
push eax
push esi
call fcn.111b8970
add esp, 0x18
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
test byte [ebp + 0x18], 1
mov edi, dword [ebp + 0xc]
je 0x11179592
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp + 0x14]
push edx
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push esi
call fcn.111b8970
add esp, 0x18
test eax, eax
jne 0x111795a4
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x1117a6e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [esi + 0x74c], 0
je 0x1117a84d
push ebx
push edi
xor edi, edi
cmp dword [esi + 0x760], edi
je 0x1117a761
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [eax - 1]
mov eax, dword [esi + 0x764]
or edi, 1
mov ecx, edi
sub ecx, dword [esi + 0x760]
test eax, eax
je 0x1117a723
mov ebx, edi
sub ebx, eax
jmp 0x1117a725
mov ebx, ecx
cmp ecx, 0xc8
jb 0x1117a761
cmp ebx, 0x1f4
jae 0x1117a761
cmp ecx, 0x1f4
jae 0x1117a761
xor edx, edx
mov eax, edi
div ecx
cmp edx, 0x64
jb 0x1117a761
mov eax, dword [ebp + 8]
push eax
push ebx
push ecx
push str.BltPending_skipping_Blt__sinceUpdate_d_ms__sinceBlt_d_ms__from_s_n
call fcn.111bd7b0
add esp, 0x10
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x14c]
test ecx, ecx
je 0x1117a77a
cmp dword [esi + 0x6fc], 4
jl 0x1117a77a
push 4
xor edx, edx
jmp 0x1117a7f6
mov ebx, dword [esi + 0x758]
mov eax, dword [esi + 0x750]
mov edx, dword [esi + 0x754]
mov dword [ebp - 8], ebx
mov ebx, dword [esi + 0x75c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x1117a7e1
test eax, eax
jle 0x1117a7ad
dec eax
and eax, 0xfffffffc
mov dword [ebp - 0x10], eax
test edx, edx
jle 0x1117a7b8
dec edx
and edx, 0xfffffffc
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 8]
add ecx, 4
add ebx, 4
xor edx, edx
and ecx, 0xfffffffc
and ebx, 0xfffffffc
cmp dword [esi + 0x6fc], 2
mov dword [ebp - 8], ecx
setl dl
mov dword [ebp - 4], ebx
dec edx
and edx, 3
inc edx
push edx
jmp 0x1117a7f3
xor eax, eax
cmp dword [esi + 0x6fc], 2
setl al
dec eax
and eax, 3
inc eax
push eax
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.11176060
xor eax, eax
mov dword [esi + 0x750], eax
mov dword [esi + 0x754], eax
mov dword [esi + 0x758], eax
mov dword [esi + 0x75c], eax
mov ecx, dword [esi + 0x74c]
add esp, 4
push ecx
xor ebx, ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x74c], ebx
mov dword [esi + 0x760], ebx
cmp edi, ebx
jne 0x1117a845
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [eax - 1]
or edi, 1
mov dword [esi + 0x764], edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1117b720
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
mov edi, dword [esi + 0x2a0]
test edi, edi
je 0x1117b84d
movsx eax, word [edi + 6]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x2a4]
push ebx
movsx ebx, word [edi + 4]
test eax, eax
je 0x1117b754
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x2a4], 0
jne 0x1117b7d0
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], str.NSMCursorClass
call fcn.110fe3d0
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0x1117b390
call dword [sym.imp.USER32.dll_RegisterClassW]
push esi
call fcn.110fe3d0
mov edx, dword [esi + 0x6c]
push eax
mov eax, dword [ebp - 4]
push 0
push edx
push eax
push ebx
push 0
push 0
push 0x40000000
push 0x11247f3c
push str.NSMCursorClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0x2a4], eax
mov eax, dword [esi + 0x2a8]
test eax, eax
je 0x1117b7f4
mov ecx, dword [esi + 0x2a4]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [esi + 0x2a8], 0
mov eax, dword [ebp - 4]
movsx ecx, word [edi + 2]
xor edx, edx
cmp byte [esi + 0x7d4], dl
setne dl
dec edx
and edx, 0x40
or edx, 0x14
push edx
movsx edx, word [edi]
push eax
mov eax, dword [ebp + 0xc]
push ebx
sub eax, ecx
push eax
mov eax, dword [ebp + 8]
sub eax, edx
push eax
mov eax, dword [esi + 0x2a4]
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 0x2a4]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esi + 0x2a4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x111835a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
test esi, esi
jne 0x111835da
lea ecx, [ebp - 0x34]
push ecx
call fcn.110fcb70
add esp, 4
jmp 0x111835f1
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x34], edx
mov edx, dword [esi + 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 0xc]
push 0
push 0
push 0xa
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0
call fcn.111bb9f0
add esp, 0xc
pop edi
mov dword [ebp - 0x18], eax
pop esi
test eax, eax
je 0x1118362a
mov eax, 0xfffffff8
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x3c]
push ecx
push 0x11183320
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x11183647
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x11183658
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
Function at 0x11188730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp word [edi + 0x326], 0
push ebx
push esi
je 0x11188881
cmp dword [ebp + 8], 0
jne 0x1118879f
mov ecx, dword [edi + 8]
push 0
push 0
push str.MouseDelay
push str.View
call fcn.110bbc00
cmp dword [edi + 0x360], 0
mov esi, eax
je 0x11188774
cdq
sub eax, edx
sar eax, 1
mov esi, eax
test esi, esi
je 0x1118879f
cmp esi, 0xa
jl 0x11188785
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul esi, esi, 0xc8
mov ecx, dword [edi + 0x358]
add ecx, esi
sub ecx, eax
test ecx, ecx
jg 0x1118877d
movzx eax, word [edi + 0x326]
mov esi, dword [edi + 0x10]
mov edx, 0x2e
lea ecx, [eax*4 + 4]
mov dword [ebp - 8], esi
mov word [edi + 0x324], dx
mov dword [ebp - 4], ecx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [esi]
mov edx, dword [edx + 0x50]
mov ebx, eax
mov eax, dword [ebp - 4]
push 0
push eax
lea eax, [edi + 0x324]
push eax
mov ecx, esi
call edx
test eax, eax
jne 0x11188844
cmp dword [ebp + 8], 0
je 0x1118877d
cmp dword [ebp + 0xc], 0
je 0x11188813
cmp dword [edi + 0x3c], 0
je 0x11188813
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, eax
sub eax, ebx
cmp eax, 0x23
jae 0x1118881b
mov ecx, dword [edi + 4]
call fcn.111886d0
test eax, eax
jne 0x111887f6
jmp 0x1118881b
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, eax
sub esi, ebx
cmp esi, 0x23
jae 0x11188829
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x50]
push 0
push eax
lea eax, [edi + 0x324]
push eax
call edx
test eax, eax
je 0x111887e4
mov ecx, dword [edi + 0x6e4]
test ecx, ecx
je 0x11188862
mov eax, dword [ebp - 4]
mov edx, dword [ecx]
mov edx, dword [edx + 0x48]
push 0
push eax
lea eax, [edi + 0x324]
push eax
call edx
xor eax, eax
mov word [edi + 0x326], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x358], eax
mov dword [edi + 0x360], 0
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1118ce10
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
push str.Kernel32
mov dword [ebp - 8], esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push esi
mov dword [ebp - 0x10], eax
push 0x1fffff
lea eax, [ebp - 4]
push eax
call edi
mov ebx, dword [ebp + 8]
push eax
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
mov eax, dword [ebp - 4]
test edi, edi
jne 0x1118ce5f
mov eax, ebx
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1118cec5
cmp dword [ebp - 0xc], 0x103
jne 0x1118cec5
mov edx, dword [ebp - 0x10]
push 0x112383fc
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
test edi, edi
jne 0x1118ce8f
mov ecx, ebx
mov esi, dword [ebp + 0xc]
lea edx, [ebp - 0x14]
push edx
push 0
push esi
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1118cece
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
test esi, esi
jne 0x1118cf0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1118cf0f
mov dword [ebp - 8], 0x42b
jmp 0x1118cf0f
mov eax, dword [ebp - 4]
test edi, edi
jne 0x1118ced7
mov eax, ebx
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1118cf00
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
test esi, esi
jne 0x1118cf05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1118cf05
mov esi, 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1118cf1d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x1118cf2b
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x11197130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x24], 0xffffffff
jne 0x11197155
push 0x28c
push str..._nt_vsmartcrdpublicSmartcardDevice.cpp
push str.m_hDevice___INVALID_HANDLE_VALUE
call fcn.11067750
add esp, 0xc
push 0x28
xor bl, bl
call fcn.111709c0
add esp, 4
test eax, eax
je 0x111971ed
mov ecx, dword [ebp + 8]
push 0
push ecx
push 0
mov ecx, eax
call fcn.11196df0
mov esi, eax
test esi, esi
je 0x111971ed
mov ecx, dword [esi + 4]
lea edx, [esi + 8]
push edx
mov edx, dword [esi]
lea eax, [ebp + 8]
push eax
mov eax, dword [edi + 0x24]
push ecx
push edx
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebx, ebx
jne 0x111971e4
cmp edi, 0x3e5
je 0x111971e4
push edi
push str.CSmartcardDevice___ReadFile_failed___d__n
call fcn.111bd7b0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.MSVCR100.dll_free]
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov al, bl
pop ebx
pop ebp
ret 4
Function at 0x11197960
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x111979d0
push ebx
push esi
push 0xf01ff
push str.SCardSvr
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x111979c0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call ebx
pop esi
pop ebx
pop edi
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebp
ret 4

Function at 0x11197a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111ea3d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x11279148]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x11197a58
push 0x1a4
push str..._nt_vsmartcrdpublicSmartcardDevice.cpp
push str.datalen___0
call fcn.11067750
add esp, 0xc
mov eax, dword [ebp + 0x10]
push 1
lea ecx, [edi + 8]
push ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 0xd], 0
mov dword [eax], 0
call fcn.1113ea20
cmp dword [edi + 0x24], 0xffffffff
mov dword [ebp - 4], 0
je 0x11197b09
push 0x28
call fcn.111709c0
add esp, 4
test eax, eax
je 0x11197b02
mov edx, dword [ebp + 8]
push edx
push esi
push 1
mov ecx, eax
call fcn.11196df0
mov esi, eax
test esi, esi
je 0x11197b02
mov edx, dword [esi + 4]
lea eax, [esi + 8]
push eax
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [edi + 0x24]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebx, ebx
jne 0x11197af4
cmp edi, 0x3e5
je 0x11197af4
push edi
push str.CSmartcardDevice___WriteFile_failed___d__n
call fcn.111bd7b0
mov edx, dword [esi]
push edx
call dword [sym.imp.MSVCR100.dll_free]
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 0x10
jmp 0x11197b0e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov byte [ebp - 0xd], 1
jmp 0x11197b0e
mov edi, 8
jmp 0x11197b0e
mov edi, 6
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.1113e900
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x111987c0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
mov edi, ecx
call sub.MSVCR100.dll_memset
mov ebx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
test ebx, ebx
jne 0x111987ee
mov ebx, 0x11247f3c
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x111987f3
sub eax, edx
sar eax, 1
mov ecx, edi
lea esi, [eax + 1]
call fcn.11198500
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.111709c0
xor ecx, ecx
mov dword [edi], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], esi
mov word [eax], cx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.111709c0
xor ecx, ecx
mov dword [edi + 8], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
mov word [eax], cx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.111709c0
xor ecx, ecx
mov dword [edi + 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov word [eax], cx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.111709c0
xor ecx, ecx
mov dword [edi + 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov word [eax], cx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.111709c0
xor ecx, ecx
mov dword [edi + 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
mov word [eax], cx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.111709c0
mov dword [edi + 0x1c], eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dword [ebp - 8], esi
mov word [eax], cx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.111709c0
xor ecx, ecx
add esp, 0x1c
mov dword [edi + 0x20], eax
mov word [eax], cx
mov edx, dword [ebp - 0x34]
mov ax, word [ebp - 0x28]
lea ecx, [ebp - 0x40]
push ecx
push 0x10000000
push 0
push ebx
mov dword [edi + 4], edx
mov word [edi + 0xc], ax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
setne bl
test bl, bl
je 0x111989bf
mov ecx, edi
call fcn.11198610
mov ax, word [ebp - 0x28]
mov edx, dword [ebp - 0x34]
mov word [edi + 0xc], ax
mov eax, dword [edi + 0x18]
mov dword [edi + 4], edx
mov dword [ebp - 4], eax
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x11198951
mov edi, dword [edi + 0x1c]
sub eax, edx
mov ecx, edi
lea edx, [ecx + 2]
sar eax, 1
mov dword [ebp + 8], edx
jmp 0x11198970
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x11198970
sub ecx, dword [ebp + 8]
sar ecx, 1
add ecx, eax
cmp ecx, esi
jae 0x111989bf
mov eax, edi
mov edx, edi
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x11198990
mov edi, dword [ebp - 4]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x111989a3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4