joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c67935
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov edi, dword [ebp + 8]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1c67958
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c6797d
test eax, 0x410
sete bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8ff11
mov eax, ebx
jmp 0x1c67a2c
push 2
call fcn.01c55c50
add esp, 4
test al, al
je 0x1c67a20
call fcn.01c56670
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x74
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c56810
lea eax, [ebp - 0xb4]
push 0x12
push str.GetFileAttributes
push eax
call fcn.01c23784
add esp, 0xc
mov esi, eax
movzx eax, byte [edi + 0xb]
test al, al
jns 0x1c679ce
mov eax, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc8]
push eax
push edi
push ebx
call fcn.01c44c80
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c679f3
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push esi
call fcn.01c23784
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c67a15
push dword [ebp - 0xc8]
call fcn.01c8fed0
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c568c0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8ff11
xor eax, eax
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c67a37
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
mov esi, dword [ebp + 8]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c67a5a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1c67a8d
and eax, 0x410
cmp eax, 0x410
jne 0x1c67a8d
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8ff11
mov ecx, esi
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01c67b67
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1c67a97
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov bl, 1
test eax, eax
jne 0x1c67b50
push 2
call fcn.01c55c50
add esp, 4
test al, al
je 0x1c67b4e
call fcn.01c56670
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x94
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c56810
lea eax, [ebp - 0xb4]
push 0xb
push str.DeleteFile
push eax
call fcn.01c23784
add esp, 0xc
mov edi, eax
movzx eax, byte [esi + 0xb]
test al, al
jns 0x1c67afc
mov eax, dword [esi + 4]
mov esi, dword [esi]
lea ebx, [ebp - 0xc8]
push eax
push esi
push ebx
call fcn.01c44c80
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c67b21
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push edi
call fcn.01c23784
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c67b43
push dword [ebp - 0xc8]
call fcn.01c8fed0
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c568c0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8ff11
mov eax, ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c67b67
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
mov edi, ecx
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0xb], 0
mov eax, ecx
jns 0x1c67b89
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x1c67c46
push 2
call fcn.01c55c50
add esp, 4
test al, al
je 0x1c67c46
call fcn.01c56670
lea ecx, [ebp - 0xbc]
push eax
push 2
push 0x2f
push str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
call fcn.01c56810
lea eax, [ebp - 0xb4]
push 0x10
push str.RemoveDirectory
push eax
call fcn.01c23784
add esp, 0xc
movzx ecx, byte [edi + 0xb]
test cl, cl
mov dword [ebp - 0xcc], eax
jns 0x1c67bef
mov ecx, dword [edi + 4]
mov edi, dword [edi]
lea ebx, [ebp - 0xc8]
push ecx
push edi
push ebx
call fcn.01c44c80
add esp, 0xc
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x1c67c14
mov eax, dword [ebp - 0xc4]
mov ebx, dword [ebp - 0xc8]
push eax
push ebx
push dword [ebp - 0xcc]
call fcn.01c23784
add esp, 0xc
cmp byte [ebp - 0xbd], 0
jns 0x1c67c3b
push dword [ebp - 0xc8]
call fcn.01c8fed0
add esp, 4
lea ecx, [ebp - 0xbc]
call fcn.01c568c0
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8ff11
mov eax, ebx
add esp, 0xc0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c68bb4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov esi, dword [0x1cd643c]
xor esi, ebp
mov dword [ebp - 8], esi
mov esi, 0x7fffffff
cmp edx, esi
cmovb esi, edx
lea edx, [ebp - 0xc]
mov dword [edx], 0xffffffff
push 0
push edx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1c68bfd
mov esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
jne 0x1c68c00
int3
xor esi, esi
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.01c8ff11
mov eax, esi
add esp, 8
pop esi
pop ebp
ret

Function at 0x1c68c12
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x1cd643c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov esi, 0x7fffffff
cmp eax, esi
cmovb esi, eax
lea eax, [ebp - 0x14]
mov dword [eax], 0xffffffff
push 0
push eax
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1c68c8a
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, ebx
mov ebx, dword [ebp - 0x14]
test ebx, ebx
jne 0x1c68c9c
mov ebx, eax
push eax
mov edi, ecx
call ecx
cmp eax, 3
jne 0x1c68cb5
mov dword [ebp - 0x14], 0xffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov ecx, edi
jne 0x1c68c57
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x6d
setne bl
neg ebx
jmp 0x1c68ca1
cmp ebx, 0xffffffff
je 0x1c68cba
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8ff11
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x14]
jmp 0x1c68ca1
int3
Function at 0x1c69269
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0xb0
mov esi, dword [ebp + 8]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [ebp - 0xc], eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
call fcn.01c69178
add esp, 0x10
or edx, eax
jne 0x1c692ec
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov bl, 1
test eax, eax
jne 0x1c692ec
push 2
call fcn.01c55c50
add esp, 4
test al, al
je 0x1c692ea
call fcn.01c56670
lea esi, [ebp - 0xb8]
mov ecx, esi
push eax
push 2
push 0xf4
push str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
call fcn.01c56810
lea eax, [ebp - 0xb0]
push 0xc
push 0x1cc1507
push eax
call fcn.01c23784
add esp, 0xc
mov ecx, esi
call fcn.01c568c0
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c8ff11
mov eax, ebx
add esp, 0xb0
pop esi
pop ebx
pop ebp
ret

Function at 0x1c69688
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.01c67a37

Function at 0x1c6c790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, dword [0x1cd643c]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x14]
lea esi, [ebp - 0x18]
lea edi, [ebp - 0x10]
push edx
push esi
push edi
push 0
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1c6c7f8
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1c6c7f8
cmp dword [ebp - 0x14], 4
jne 0x1c6c7f8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.01c8ff11
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8

Function at 0x1c6c810
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.01c902e0
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x810]
push 0x800
push 0xff
push ebx
call fcn.01c93b00
add esp, 0xc
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea eax, [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
push eax
push ebx
push ecx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1c6c8e4
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x1c6c899
mov edi, 0x3f4
cmp eax, 1
jne 0x1c6c8e4
mov ecx, esi
push ebx
jmp 0x1c6c8dd
lea edi, [ebp - 0x1010]
push 0x800
push 0xff
push edi
call fcn.01c93b00
add esp, 0xc
push 0x400
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x1c6c8e4
mov ecx, esi
lea eax, [ebp - 0x1010]
push eax
call fcn.01c3f93c
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c8ff11
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c76310
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
movzx edx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test dl, dl
mov dword [ebp - 0x10], ecx
lea ecx, [eax + ecx]
mov dword [ebp - 0x20], edx
lea edx, [esi + edx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
jb 0x1c7637d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x1c76350
cmp edx, 1
jne 0x1c76386
jmp 0x1c763a2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x1c763a2
cmp edx, 2
je 0x1c76399
cmp edx, 3
jne 0x1c763ad
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + 4]
xor ecx, ecx
test edi, edi
je 0x1c76508
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov ebx, eax
shr ebx, 0xf
xor ebx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov edx, edi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul eax, eax, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x28], eax
cmp eax, 1
ja 0x1c76414
lea edx, [edi - 1]
and edx, ebx
jmp 0x1c76420
mov edx, ebx
cmp ebx, edi
jb 0x1c76420
mov eax, ebx
xor edx, edx
div edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x24], edx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1c76508
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov ebx, dword [eax]
test ebx, ebx
je 0x1c76508
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x10]
cmovns eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x1c76476
and eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jne 0x1c76506
mov ebx, dword [ebx]
test ebx, ebx
je 0x1c76506
mov eax, dword [ebx + 4]
cmp dword [ebp - 0x14], eax
jne 0x1c764d0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x1c7648b
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x1c7646c
lea ecx, [ebx + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
js 0x1c764e8
cmp dword [ebp - 0x10], 0
je 0x1c76502
cmp byte [esi], dl
jne 0x1c7646c
add eax, 0xffffffff
xor ecx, ecx
nop dword [eax + eax]
cmp eax, ecx
je 0x1c76502
movzx edx, byte [ebx + ecx + 9]
lea edi, [ecx + 1]
cmp dl, byte [esi + ecx + 1]
mov ecx, edi
je 0x1c764b0
jmp 0x1c7646c
cmp dword [ebp - 0x28], 1
jbe 0x1c76460
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x1c76463
xor edx, edx
div ecx
mov eax, edx
jmp 0x1c76463
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1c76502
push eax
push esi
push ecx
call fcn.01c9266d
add esp, 0xc
test eax, eax
jne 0x1c7646c
mov ecx, ebx
jmp 0x1c76508
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1c7c390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x1cd643c]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x1c7c433
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.01c8fea0
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.01c7c300
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.01c7c450
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x1c7c41d
mov ecx, edi
call fcn.01c7c4a0
push edi
call fcn.01c8fed0
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x1c7c430
push dword [esp + 8]
call fcn.01c8fed0
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.01c8ff11
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1c7d8d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1cf2d38]
mov ecx, dword [0x1cf1960]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1c7d8fb
mov ecx, 0x1cf2d30
pop ebp
jmp fcn.01c5f4a0
push 0x1cf2d38
call fcn.01c8ff57
add esp, 4
cmp dword [0x1cf2d38], 0xffffffff
jne 0x1c7d8f0
mov dword [0x1cf2d34], 0
mov dword [0x1cf2d30], 0
mov ecx, 0x1cf2d30
push 0
call fcn.01c5f510
push 0x1cf2d38
call fcn.01c8ffcd
add esp, 4
jmp 0x1c7d8f0

Function at 0x1c7fd70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x1c7fde9
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x1c7fd8c
xor esi, esi
jmp 0x1c7fdce
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x1cc67a4]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x1cc67a4]
add esi, 2
cmp ebx, esi
jne 0x1c7fda0
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x1c7fde9
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x1cc67a4]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1c84170
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x1cd643c]
xor ecx, ebp
mov dword [ebp - 8], ecx
cmp eax, 3
jne 0x1c84247
mov dword [ebp - 0x14], 0x1c84260
lea eax, [ebp - 0x14]
push 0
push eax
push 0x1c84150
push 0x1cf2d90
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1c84259
cmp dword [0x1cf2d94], 0
jne 0x1c84247
push dword [0x1cf2d98]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1c84247
mov esi, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
push 0x1cf2d9c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x1cf2da8]
mov dword [ebp - 0xc], eax
movsd xmm0, qword [0x1cf2da0]
movsd qword [ebp - 0x14], xmm0
push 0x1cf2d9c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1c84220
push dword [esi]
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1c8422f
push dword [esi + 4]
call eax
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x1c8423e
push dword [esi + 8]
call eax
add esp, 4
push esi
call fcn.01c83670
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.01c8ff11
add esp, 0x10
pop esi
pop ebp
ret 0xc
call fcn.01ca281e
int3
Function at 0x1cb0af1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cb0d3a

Function at 0x1cb3d25
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01cb3d30
Function at 0x100f92b
Capabilities:
Listen for remote procedure calls

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp edi, ebx
jne 0x100f94f
mov eax, 0x80070057
push eax
mov esi, eax
push 0x56
jmp 0x100fa18
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.01011655
mov esi, eax
cmp esi, ebx
jge 0x100f969
push esi
push 0x5a
jmp 0x100fa18
mov eax, dword [ebp + 0xc]
push ebx
push dword [ebp - 4]
mov dword [0x10496b4], eax
mov eax, dword [ebp + 0x10]
push 0x14
push dword [0x1049004]
mov dword [0x10496b8], eax
mov eax, dword [ebp + 0x14]
mov dword [0x10496b0], edi
mov dword [0x10496bc], eax
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
cmp eax, ebx
je 0x100f9b0
jle 0x100f9a9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x6d
jmp 0x100fa18
push ebx
push ebx
push dword [section..data]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIf]
cmp eax, ebx
je 0x100f9d5
jle 0x100f9ce
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x72
jmp 0x100fa18
push ebx
push ebx
push 0xa
push ebx
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
cmp eax, ebx
je 0x100f9f7
jle 0x100f9f0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x75
jmp 0x100fa18
push 1
push 0x14
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
cmp eax, ebx
je 0x100fa27
jle 0x100fa13
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x7a
push 0x10014e8
push 0x10014bc
call fcn.0101159d
cmp dword [ebp - 4], ebx
je 0x100fa3d
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100fe87
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x100ff9f
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x100ff9f
mov edi, 0x10496c4
push edi
call fcn.010126e9
mov esi, eax
test esi, esi
jge 0x100fec2
push esi
push 0x4d
jmp 0x100ffa7
push dword [ebp + 8]
lea eax, [ebp - 4]
push 0x10017fc
push eax
mov dword [0x10496e8], 1
mov dword [0x10496c0], ebx
call fcn.0101152d
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x100fef4
push esi
push 0x5a
jmp 0x100ffa7
push dword [ebp - 4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10496ec], eax
test eax, eax
jne 0x100ff2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100ff1e
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jne 0x100ff29
mov esi, 0x80004005
push esi
push 0x5f
jmp 0x100ffa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100ff45
mov esi, 0xc1420126
push esi
push 0x63
jmp 0x100ffa7
push 0x10496f0
push dword [ebp + 8]
push edi
push dword [0x10496c0]
call fcn.01013cd5
mov esi, eax
test esi, esi
jge 0x100ff64
push esi
push 0x6e
jmp 0x100ffa7
push edi
push dword [0x10496f0]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.0100f92b
mov esi, eax
test esi, esi
jge 0x100ff82
push esi
push 0x75
jmp 0x100ffa7
push 0x10017dc
push 0x20000
mov dword [0x10496f4], 1
call fcn.01011548
pop ecx
pop ecx
jmp 0x100ffb6
mov esi, 0x80070057
push esi
push 0x45
push 0x1001758
push 0x100173c
call fcn.0101159d
cmp dword [ebp - 4], 0
je 0x100ffce
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1012c3d
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
xor edi, edi
mov esi, 0x10c
test edi, edi
je 0x1012c73
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, esi
push esi
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1012cd2
push 9
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, 0x80000005
je 0x1012caa
test eax, eax
jl 0x1012cf1
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jl 0x1012cfe
test eax, eax
jl 0x1012c63
mov esi, dword [edi]
inc esi
inc esi
push esi
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 8], eax
test eax, eax
jne 0x1012d0f
mov eax, 0x8007000e
push eax
push 0x366
jmp 0x1012cdd
mov eax, 0x8007000e
push eax
push 0x34d
mov dword [ebp - 4], eax
push 0x1001f58
push 0x1001fec
call fcn.0101159d
jmp 0x1012d2f
or eax, 0x10000000
push eax
push 0x35a
jmp 0x1012cdd
or ecx, 0x10000000
push ecx
mov dword [ebp - 4], ecx
push 0x35b
jmp 0x1012ce0
push esi
push 0
push eax
call sub.msvcrt.dll_memset
push dword [edi]
mov esi, dword [ebp + 8]
lea eax, [edi + 4]
push eax
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0xc]
add esp, 0x18
mov dword [eax], esi
test edi, edi
je 0x1012d3f
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1012d4e
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1012db3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1012d8e
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jne 0x1012d99
mov ebx, 0x80004005
push ebx
push 0x5f7
push 0x1001f58
push 0x100201c
call fcn.0101159d
jmp 0x1012e48
cmp dword [ebp - 8], ebx
je 0x1012dc7
mov eax, 0x8007007a
push eax
mov ebx, eax
push 0x602
jmp 0x1012d9f
push dword [ebp - 0xc]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1012dfd
mov eax, 0x8007000e
push eax
mov ebx, eax
push 0x606
push 0x1001f58
push 0x100201c
call fcn.0101159d
jmp 0x1012e34
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
jbe 0x1012e2d
push 0
lea ecx, [ebp - 4]
push ecx
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1012e51
add esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x1012e09
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor edi, edi
test edi, edi
je 0x1012e48
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1012e65
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jne 0x1012e70
mov ebx, 0x80004005
push ebx
push 0x618
jmp 0x1012dec