joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029ab4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10057d26
call fcn.100567e0
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x1c], 0x24f9
mov ebx, edx
cmp dword [ebp - 0x1c], 0x287f
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ecx
jle 0x10029b28
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov esi, dword [ebp - 0x24]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x10071338
xor eax, esi
cdq
push edx
push eax
call fcn.100060aa
inc esi
cmp esi, 0xad4
jl 0x10029af3
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x759d
jl 0x10029ae6
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x166
jl 0x10029ae4
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x215b
jge 0x10029b63
mov edx, str.mbskxt_dws_nlfaxro_qcepdevpu
mov ecx, 0x10071338
call fcn.1000aac1
jmp 0x10029b63
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x10029b7d
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebx]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x20fe
jmp 0x10029b8b
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], 0
xor cl, cl
call fcn.100288fa
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002a255
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 8], cl
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], edi
test cl, cl
je 0x1002a307
mov dword [ebp - 0xc], 0x62d6
cmp dword [ebp - 0xc], 0x63c7
push 0
pop esi
jle 0x1002a2d4
push esi
push 0x1f91
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov ebx, esi
mov edi, esi
mov eax, ebx
lea ecx, [ebp - 0x28]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a99
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a2ad
mov eax, dword [eax]
push eax
call fcn.1004027d
pop ecx
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.10006cfe
inc edi
cmp edi, 0x86e
jl 0x1002a291
inc ebx
cmp ebx, 0x3d92
jl 0x1002a28f
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0xc], 0x5feb
jge 0x1002a2e8
push str.sxr_hgtu_naducxtk_qxlw_qqgs_cekc_wnodlwiae_wkhom_nlpa
call fcn.1004027d
pop ecx
mov eax, dword [edi]
mov ecx, edi
push dword [eax + 4]
call fcn.10026852
mov eax, dword [edi]
mov dword [eax + 4], eax
mov eax, dword [edi]
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
mov dword [edi + 4], esi
jmp 0x1002a324
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002a324
push 0x2c6
push 0xb50
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a32b
Capabilities:
Delete directory
Encode data using xor

Disassembly:
mov eax, 0x10057d58
call fcn.100567e0
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
mov eax, edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], eax
cmp byte [ebp + 8], bl
je 0x1002a36e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002a35d
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x2baa
cmp dword [ebp - 0x20], 0x2c54
jle 0x1002a3dd
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x10071338
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.100060aa
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x42e
jl 0x1002a395
inc ebx
push 0
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x23fa
pop ebx
jl 0x1002a38d
inc edi
cmp edi, 0x6007
jl 0x1002a38a
inc esi
cmp esi, 0x53cd
jl 0x1002a388
mov eax, dword [ebp - 0x24]
cmp byte [eax], 0
je 0x1002a3e9
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x2882
jge 0x1002a35d
mov edx, str.ggwvtdeah_cetrdft_irlibhmp
mov ecx, 0x10071338
call fcn.1000aac1
jmp 0x1002a35d

Function at 0x1002a91a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
test cl, cl
je 0x1002a94a
cmp byte [edx], 0
je 0x1002a948
push 0x5590
push 1
push 0x18e8
push 1
push 0x4ff7
mov dl, 1
mov ecx, 0x32d8
call fcn.1002876b
add esp, 0x14
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002a948
xor cl, cl
pop ebp
jmp fcn.1002b04c
Function at 0x1002abdc
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10057d90
call fcn.100567e0
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], eax
je 0x1002ac4e
cmp byte [ebp + 0x10], 0
je 0x1002ac29
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1002ad86
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xeb90
inc dword [edx]
cmp dword [edx], 3
jl 0x1002ac12
jmp 0x1002ad86
push 0
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
push eax
push 1
push 0x3c31
mov dl, 1
mov ecx, 0x65ad
call fcn.10028552
add esp, 0x10
jmp 0x1002ad86
cmp byte [ebp + 0x20], 0
je 0x1002ad78
mov esi, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], eax
mov dword [esi], 0xffffffff
cmp dword [esi], 0xfffffff0
jne 0x1002ad86
push ecx
push 0x33d0
push edx
push 0x5472
push ecx
mov dl, 1
mov ecx, eax
call fcn.10028414
mov dword [ebp - 0x20], 0x14c3
add esp, 0x14
cmp dword [ebp - 0x20], 0x1508
jle 0x1002ad14
push 0x2065
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
xor edi, edi
mov dword [ebp - 0x18], edi
xor eax, eax
mov esi, ebx
mov ecx, edi
mov dword [ebp - 0x14], eax
sar esi, cl
mov ebx, eax
mov edi, 0x4aaa
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x10071338
cdq
push edx
push eax
call fcn.100060aa
dec ebx
dec edi
jne 0x1002acce
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x4d93
jl 0x1002acc7
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x2128
jl 0x1002acbc
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x6102
jl 0x1002acb7
mov esi, dword [ebp + 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x12e5
jge 0x1002ad30
mov edx, str.ahv_yazemzg_uzxnsc
mov ecx, 0x10071338
call fcn.1000aac1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
or dword [ebp - 4], 0xffffffff
dec dword [esi]
jmp 0x1002ac73
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002af82
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
je 0x1002b035
mov dword [ebp - 4], 0x1a5a
cmp dword [ebp - 4], 0xf0c
jge 0x1002b00e
xorps xmm0, xmm0
xor ebx, ebx
push 3
movdqu xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], ebx
pop esi
lea eax, [ebp - 8]
push eax
push 0x1005f9cc
call fcn.1003fcfb
mov eax, dword [ebp - 8]
pop ecx
pop ecx
cmp eax, 4
jg 0x1002afd6
inc dword [ebp + eax*4 - 0x20]
dec esi
jne 0x1002afba
cmp dword [ebp - 0x1c], ebx
jg 0x1002aff6
cmp dword [ebp - 0x18], 1
jg 0x1002aff6
cmp dword [ebp - 0x14], 2
jg 0x1002aff6
cmp dword [ebp - 0x18], 1
jl 0x1002aff8
cmp dword [ebp - 0x10], 2
jl 0x1002aff8
mov bl, 1
test bl, bl
mov ecx, 0x10061b34
mov eax, 0x10061b30
cmove eax, ecx
push eax
call fcn.10040496
pop ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, dword [edi]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ecx]
push dword [eax]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
call fcn.10027f07
add esp, 0x10
jmp 0x1002b045
xor ebx, ebx
push ebx
push 0x8c4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002b04c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10057d9a
call fcn.100567e0
sub esp, 0x10
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002b0fa
mov dword [ebp - 0x18], 0x63ed
cmp dword [ebp - 0x18], 0x6511
jle 0x1002b0ac
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x10071338
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.100060aa
inc edi
cmp edi, 0x45b0
jl 0x1002b07d
inc esi
cmp esi, 0x73e1
jl 0x1002b07b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push ecx
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push 0x5f8f
push eax
mov cl, 1
call fcn.10029666
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x61c6
jge 0x1002b0de
mov edx, str.gilwyomp_mfoqme_jhy_zoaoi_vhknhcyh
mov ecx, 0x10071338
call fcn.1000aac1
jmp 0x1002b108
push ebx
push 0x8c4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036a45
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10036a69
push 8
push 0x2c5d
push 0
call fcn.100372ab
add esp, 0xc
jmp 0x10036b95
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10036b84
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10036af9
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x10036af9
mov dword [ebp - 0xc], 1
jmp 0x10036afd
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jl 0x10036b10
mov dword [ebp - 0x18], 1
jmp 0x10036b14
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 0x689a5a40
jl 0x10036b28
mov dword [ebp - 0x10], 1
jmp 0x10036b2c
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x5c17
jne 0x10036b3e
mov dword [ebp - 0x14], 1
jmp 0x10036b42
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0x9253a34c
jne 0x10036b54
mov dword [ebp - 0x50], 1
jmp 0x10036b58
and dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
push 7
pop eax
cmp eax, 0x2065c829
jge 0x10036b73
mov dword [ebp - 0x1c], 1
jmp 0x10036b77
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
jmp 0x10036b95
push 0
push 0x8c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esp, ebp
pop ebp
ret
Function at 0x10003610
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 8]
call fcn.1000c970
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x100036d5
push 0x10010b50
push 0x10065c34
push 0x1005b350
call fcn.10010b80
add esp, 8
mov ecx, eax
call fcn.1000c6b0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
lea eax, [ebp - 8]
push eax
push 0x400
lea ecx, [ebp - 0x408]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100036c9
cmp dword [ebp - 8], 0
jbe 0x100036c9
mov eax, dword [ebp - 8]
xor ecx, ecx
push ecx
push eax
lea edx, [ebp - 0x408]
push edx
mov ecx, 0x1005b350
call fcn.1000c250
jmp 0x10003689
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003717
push 0x10010b50
push 0x10065c50
push 0x1005b350
call fcn.10010b80
add esp, 8
mov ecx, eax
call fcn.1000c6b0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10005fd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], 0x100060e0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], 0x10066070
lea edx, [ebp - 0x4c]
push edx
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push 0x258
push 0x320
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x10066088
push 0x100660ac
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10006056
xor eax, eax
jmp 0x100060d5
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x1e
push 0x64
push 0xa
push 0xa
push 0x50010001
push 0x100660c4
push 0x100660fc
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x100060d3
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x100060a9
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10006150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006240
push 0
push 0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x10006236
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001b36b
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100061dd
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x18]
jae 0x10006224
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push 0
push 0
lea ecx, [ebp - 0x28]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10006222
push 0
push 0x10066180
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x100061d4
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.1001aef9
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10006ff0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d929
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x518
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x54], ecx
lea edx, [ebp - 0x2d4]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], 0x1006644c
mov dword [ebp - 0x44], 0x41
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100071da
lea ecx, [ebp - 0x2d4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, 0x1005c2ec
call fcn.1000af20
lea ecx, [ebp - 0x2d4]
push ecx
lea ecx, [ebp - 0x84]
call fcn.1000ca00
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
push 0x10066480
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.10010eb0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x84]
call fcn.1000c990
lea edx, [ebp - 0x524]
push edx
lea ecx, [ebp - 0x6c]
call fcn.1000c970
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x100071b3
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0xcc]
call fcn.1000ca00
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 3
push 0x10066490
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0xb4]
push eax
call fcn.10010eb0
add esp, 0xc
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 4
lea edx, [ebp - 0x4f8]
push edx
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x9c]
push ecx
call fcn.10010eb0
add esp, 0xc
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x34]
push eax
mov ecx, 0x1005c2ec
call fcn.1000af80
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9c]
call fcn.1000c990
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb4]
call fcn.1000c990
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcc]
call fcn.1000c990
lea ecx, [ebp - 0x524]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100070ea
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [0x1003fb08], 0xffffffff
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000c990
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10008fb0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0x41
cmp dword [ebp - 8], 0
je 0x100090e8
mov eax, dword [ebp - 8]
and eax, 1
je 0x100090d2
movsx ecx, byte [ebp - 1]
push ecx
push 0x10066808
lea edx, [ebp - 0xc]
push edx
call fcn.10010ee0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x100090d2
push 0x10010b50
lea ecx, [ebp - 0xc]
push ecx
push 0x10066810
push 0x1005b350
call fcn.10010b80
add esp, 8
push eax
call fcn.10010b80
add esp, 8
mov ecx, eax
call fcn.1000c6b0
push 0x10010b50
push 0x10066828
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x10066840
push 0x1005b350
call fcn.10010b80
add esp, 8
mov ecx, eax
call fcn.1000c380
push eax
call fcn.10010b80
add esp, 8
mov ecx, eax
call fcn.1000c6b0
push 0x10010b50
push 0x10066854
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x10]
push edx
push ecx
push 0x10066870
push 0x1005b350
call fcn.10010b80
add esp, 8
mov ecx, eax
call fcn.1000c380
push eax
call fcn.10010b80
add esp, 8
mov ecx, eax
call fcn.1000c6b0
push 0x10010b50
push 0x1006688c
push 0x1005b350
call fcn.10010b80
add esp, 8
mov ecx, eax
call fcn.1000c6b0
mov eax, dword [ebp - 8]
shr eax, 1
mov dword [ebp - 8], eax
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
jmp 0x10008fc3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10028745
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10028784
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10028784
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10028784
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10028784
cmp dword [ecx + 0x74], 0xe
jbe 0x10028784
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002fb10
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10061f50
push 0x10061f48
push 0x1005f6bc
push 0x1f
call fcn.1002f97b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002fb44
push dword [ebp + 8]
mov ecx, esi
call dword [0x1005da84]
call esi
jmp 0x1002fb4a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002fb8e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10061f60
push 0x10061f58
push 0x1005f6e0
push 0x21
call fcn.1002f97b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002fbc5
push dword [ebp + 8]
mov ecx, esi
call dword [0x1005da84]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002fbcd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10061f68
push 0x10061f60
push 0x1005f6f4
push 0x22
call fcn.1002f97b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002fc07
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1005da84]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]