joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a840
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009face
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 4], 0
je 0x1002aa14
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x50], 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002a89a
mov dword [esp + 0x10], ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [0x100c56ec]
test eax, eax
jne 0x1002a8b1
call fcn.100474d0
mov eax, dword [0x100c56ec]
test eax, eax
je 0x1002a8cc
lea ecx, [esp + 0x10]
push ecx
push 0x5f
call eax
test eax, eax
jl 0x1002a8cc
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x10]
call eax
mov ebx, eax
lea ecx, [esp + 0x20]
push ecx
call fcn.1002d670
mov byte [esp + 0x50], 2
push 0
call fcn.10076dd4
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 4
push 4
mov dword [esp + 0x20], edx
lea edx, [esp + 0x1c]
push edx
push 4
push 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push str.fixtime
push eax
call edi
mov edx, dword [esp + 0x24]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push 0
push str.oldtime
push edx
mov dword [esp + 0x30], ebx
call edi
mov edi, dword [esi + 4]
call fcn.1002c010
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
push eax
call fcn.1000ffe0
mov byte [esp + 0x50], 3
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esi + 4]
call fcn.1002c0c0
mov byte [esp + 0x50], 4
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x38]
xor esi, esi
sar eax, 2
test eax, eax
jbe 0x1002a994
cmp esi, eax
jb 0x1002a96b
call fcn.100759ec
mov edx, dword [esp + 0x38]
mov eax, dword [edx + esi*4]
push eax
push 0x100aab60
lea edi, [esp + 0x1c]
call fcn.1000ffc0
mov eax, dword [esp + 0x44]
sub eax, dword [esp + 0x40]
inc esi
sar eax, 2
add esp, 8
cmp esi, eax
jb 0x1002a96b
mov eax, 0x2c
lea ebx, [esp + 0x14]
call fcn.100162d0
mov byte [esp + 0x50], 3
lea ecx, [esp + 0x2c]
push ecx
call fcn.100376e0
mov byte [esp + 0x50], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1002a9d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x50], 1
lea ecx, [esp + 0x20]
push ecx
call fcn.1002d750
mov dword [esp + 0x50], 0xffffffff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002a9fd
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
or eax, 0xffffffff
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002b100
Capabilities:
Access peb ldr_data
Get disk information via ioctl

Disassembly:
push 0xffffffffffffffff
push 0x1009c748
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
mov ecx, str.._
call fcn.10002500
mov dword [esp + 0x28], 0
mov ecx, dword [esp + 0x30]
push ecx
lea edi, [esp + 0x10]
call fcn.1002b360
push 0x3a
call fcn.1002b360
mov edx, dword [esp + 0xc]
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x1002b19d
push 0
lea eax, [esp + 0x14]
push eax
push 0xc
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
test eax, eax
jne 0x1002b1c0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x28], edi
lea ecx, [esp + 0xc]
call fcn.100025b0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1002b1d0
mov edx, dword [esp + 0x18]
mov dword [ebx], edx
mov dword [esp + 0x28], edi
lea ecx, [esp + 0xc]
call fcn.100025b0
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x1002b720
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x48
cmp dword [esi], 0
push edi
jne 0x1002b7a1
mov edi, dword [esi + 0x30]
test edi, edi
je 0x1002b737
call fcn.100316e0
jmp 0x1002b739
xor eax, eax
mov dword [esi + 0x20], eax
call fcn.1002b9f0
shrd eax, edx, 0x14
push 0x40
mov dword [esi + 0x10], eax
lea eax, [esp + 0xc]
shr edx, 0x14
push 0
push eax
mov dword [esi + 0x14], edx
call fcn.10079c60
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
shrd edx, eax, 0x14
shr eax, 0x14
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], 0
call fcn.1002b990
mov dword [esi + 0x28], eax
call fcn.1002b7b0
mov dword [esi + 0x24], eax
mov dword [esi], 1
pop edi
add esp, 0x48
ret

Function at 0x1002b990
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [esp]
mov eax, 3
test ecx, ecx
je 0x1002b9e9
cmp ecx, 6
je 0x1002b9e0
cmp ecx, 9
jne 0x1002b9eb
lea eax, [ecx - 8]
add esp, 0x24
ret
mov eax, 2
add esp, 0x24
ret
xor eax, eax
add esp, 0x24
ret
Function at 0x1002d500
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1009c661
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0xc], ebx
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x18], ax
mov eax, dword [esp + 0x44]
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
call fcn.100073a0
mov dword [esp + 0x34], 1
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1002d560
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea ecx, [esp + 0x14]
call fcn.1000d4f0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0xffffffffffffffff
mov word [esi + 4], cx
push ebx
mov ecx, esi
call fcn.100073a0
mov dword [esp + 0xc], 1
mov byte [esp + 0x34], bl
cmp dword [esp + 0x28], 8
jb 0x1002d5b5
mov edx, dword [esp + 0x14]
push edx
call fcn.100755e2
add esp, 4
xor eax, eax
mov word [esp + 0x14], ax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebx
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x1002d7e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [ecx + 4]
lea eax, [esp + 4]
push eax
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push str.fixtime
push ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
add esp, 0xc
ret

Function at 0x1002d820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push 0
mov esi, ecx
call fcn.10076dd4
mov ecx, dword [esi + 4]
add esp, 4
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push str.fixtime
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002d9f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push 0
mov esi, ecx
call fcn.10076dd4
mov ecx, dword [esi + 4]
add esp, 4
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push str.skagain
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10030e00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.10079c60
add esp, 0xc
push 0x104
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [esp + 0x10]
movzx esi, word [esp + 0x10]
push eax
lea edi, [esp + 0x10]
call fcn.10030ea0
test eax, eax
jne 0x10030e76
push esi
call fcn.10030f60
test eax, eax
jne 0x10030e76
mov ecx, edi
push ecx
push esi
call fcn.10031040
test eax, eax
je 0x10030e80
test ebx, ebx
je 0x10030e80
mov edx, dword [esp + 0xc]
mov dword [ebx], edx
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
xor ecx, esp
call fcn.100755ed
add esp, 0x21c
ret

Function at 0x10030ea0
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x21c
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push 0x208
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.10079c60
movzx ecx, word [esp + 0x234]
push ecx
push str.._c:
mov ecx, 0x104
lea ebx, [esp + 0x2c]
call fcn.10001fd0
add esp, 0x14
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
mov edx, ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10030f2e
push 0
lea eax, [esp + 0xc]
push eax
push 0xc
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x2d1080
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
test eax, eax
jne 0x10030f32
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x10030f47
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10030f42
mov edx, dword [esp + 0x10]
mov dword [edi], edx
mov eax, 1
mov ecx, dword [esp + 0x220]
pop esi
pop ebx
xor ecx, esp
call fcn.100755ed
add esp, 0x21c
ret 4
Function at 0x10031530
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
xor edi, edi
cmp dword [eax + 0x10], edi
je 0x1003154f
cmp esi, edi
je 0x10031545
mov dword [esi], 1
mov eax, 1
pop edi
add esp, 0xc
ret
cmp esi, edi
je 0x100315a6
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edi
push str.solid
push edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x100315a6
cmp dword [esp + 0xc], 4
jne 0x100315a6
mov eax, dword [esp + 4]
cmp eax, 0xa
je 0x10031597
cmp eax, 0xb
jne 0x100315a6
xor ecx, ecx
cmp eax, 0xb
sete cl
mov edi, 1
mov dword [esi], ecx
mov eax, edi
pop edi
add esp, 0xc
ret

Function at 0x100315b0
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x50
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x54]
push esi
push edi
mov dword [ebx + 0x10], eax
test eax, eax
je 0x1003162d
mov eax, dword [str.sotm]
mov dx, word [0x100aca94]
mov ecx, 0xe
mov esi, str.SOFTWARE360Safe_softmgrdg
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x100aca90]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esp + 0x20]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x24], dx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov eax, dword [ebx + 0x1c]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.solid
mov dword [esp + 0x20], 0xb
push eax
jmp 0x10031649
mov edx, dword [ebx + 0x1c]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.solid
mov dword [esp + 0x20], 0xa
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call esi
mov ecx, dword [ebx + 0x1c]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x100a6654
push ecx
mov dword [esp + 0x24], 0x2717
call esi
mov edx, dword [ebx + 0x44]
cmp dword [edx - 0xc], 0
lea edi, [ebx + 0x44]
jne 0x1003168f
call fcn.10031a40
push edx
push eax
push 0x100aca98
call fcn.10012130
add esp, 0xc
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x100316a4
mov eax, dword [eax + 4]
push eax
push edi
call 0x10002bc0
mov edi, dword [edi]
test edi, edi
je 0x100316c6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebx + 0x1c]
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push 0
push str.Ghost
push edx
call esi
mov ecx, dword [esp + 0x54]
pop edi
pop esi
xor ecx, esp
call fcn.100755ed
add esp, 0x50
ret 4
Function at 0x100316e0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1009e4a1
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push esi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
lea eax, [edi + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10031530
test eax, eax
je 0x100317a2
cmp dword [esp + 0x10], ebx
jne 0x10031794
xor esi, esi
cmp dword [edi + 0x14], ebx
jne 0x10031794
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi + 0x1c]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push 0x100a6654
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x18], 0x2717
jne 0x10031789
mov esi, 1
mov dword [edi + 0x14], 1
cmp esi, ebx
je 0x100317a2
push edi
call fcn.100318f0
test eax, eax
jne 0x100318bc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
lea ebx, [esp + 0x18]
call fcn.10030e00
push 0x208
lea ecx, [esp + 0x28]
push 0
push ecx
mov esi, eax
call fcn.10079c60
add esp, 0xc
push 0x104
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100318b0
test esi, esi
je 0x100318b0
mov eax, dword [0x100c49c8]
mov edx, dword [eax + 0xc]
mov ecx, 0x100c49c8
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x240], 1
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.1002da50
mov esi, eax
add esp, 8
mov dword [esp + 0x10], esi
test esi, esi
jne 0x10031885
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], eax
jne 0x1003183e
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.10030270
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
je 0x10031853
call fcn.1002e6f0
mov dword [esp + 0x10], eax
mov esi, eax
test esi, esi
jne 0x10031885
mov edx, dword [esp + 0x18]
lea eax, [edi + 4]
push eax
lea esi, [edi + 0xc]
lea ebx, [edi + 8]
push edx
mov eax, edi
call fcn.10030da0
test eax, eax
je 0x10031885
lea eax, [edi + 4]
test eax, eax
je 0x10031885
cmp dword [eax], 0
je 0x10031885
mov dword [esp + 0x10], 1
mov dword [esp + 0x240], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100318b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ecx
mov ebx, edi
call fcn.100315b0
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.100755ed
mov esp, ebp
pop ebp
ret
Function at 0x100319d0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x20
push esi
xor esi, esi
cmp word [ecx], si
je 0x10031a2b
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x10031a2b
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
shrd ecx, edx, 0xa
shr edx, 0xa
mov dword [edi], ecx
mov dword [edi + 4], edx
lea eax, [esi + 1]
pop esi
add esp, 0x20
ret
mov eax, esi
pop esi
add esp, 0x20
ret
Function at 0x10031a40
Capabilities:
Get disk information
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1009c4f0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call edi
xor ecx, ecx
mov esi, eax
mov edx, 2
mul edx
seto cl
push 0x100c49e4
neg ecx
or ecx, eax
push ecx
call fcn.10076988
mov ebp, eax
add esp, 8
mov dword [esp + 0x30], ebp
cmp ebp, ebx
jne 0x10031ab9
xor eax, eax
xor edx, edx
jmp 0x10031c14
push ebp
push esi
call edi
test eax, eax
je 0x10031c03
jmp 0x10031ad0
xor eax, eax
cmp ax, word [ebp]
je 0x10031bff
mov edi, 7
xor ecx, ecx
mov eax, ebp
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10031af5
sub eax, edx
sar eax, 1
push eax
mov eax, ebp
lea esi, [esp + 0x54]
call fcn.10007450
mov dword [esp + 0x78], ebx
push ebp
call fcn.10031c40
test eax, eax
je 0x10031ba7
push 2
xor edx, edx
push ebx
mov eax, esi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], dx
call fcn.100073a0
mov byte [esp + 0x78], 1
mov esi, 8
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x4c], esi
jb 0x10031bbe
mov ecx, dword [esp + 0x38]
cmp ecx, ebx
je 0x10031b81
lea edi, [esp + 0x24]
call fcn.100319d0
mov edi, 7
cmp eax, ebx
je 0x10031b81
mov eax, dword [esp + 0x24]
add dword [esp + 0x14], eax
mov ecx, dword [esp + 0x28]
adc dword [esp + 0x18], ecx
mov byte [esp + 0x78], bl
cmp dword [esp + 0x4c], esi
jb 0x10031b98
mov edx, dword [esp + 0x38]
push edx
call fcn.100755e2
add esp, 4
xor eax, eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], ax
lea esi, [esp + 0x20]
mov edx, ebp
mov dword [esp + 0x20], ebx
call fcn.100321c0
cmp eax, ebx
jge 0x10031bc4
xor eax, eax
jmp 0x10031bc8
lea ecx, [esp + 0x38]
jmp 0x10031b5f
mov eax, dword [esp + 0x20]
lea ebp, [ebp + eax*2 + 2]
mov dword [esp + 0x78], 0xffffffff
cmp dword [esp + 0x68], 8
jb 0x10031be8
mov ecx, dword [esp + 0x54]
push ecx
call fcn.100755e2
add esp, 4
xor edx, edx
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], ebx
mov word [esp + 0x54], dx
cmp ebp, ebx
jne 0x10031ad0
mov ebp, dword [esp + 0x30]
push ebp
call fcn.10076993
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100755ed
add esp, 0x68
ret
Function at 0x10032420
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1009a8b0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100c230c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x5c]
xor ebx, ebx
cmp byte [ebp], bl
je 0x10032506
cmp dword [ebp + 0x20], 0xffffffff
je 0x10032506
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x64], ebx
call fcn.10038360
mov esi, eax
mov dword [esp + 0x54], ebx
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.10038360
mov byte [esp + 0x54], 1
mov esi, dword [esi + 0x14]
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x10032499
mov eax, dword [eax + 4]
jmp 0x1003249c
add eax, 4
push ebx
lea edx, [esp + 0x60]
push edx
mov edx, dword [ebp + 0x20]
lea ecx, [esi + esi]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [esp + 0x54], bl
cmp dword [esp + 0x2c], edi
jb 0x100324c8
mov eax, dword [esp + 0x18]
push eax
call fcn.100755e2
add esp, 4
mov esi, 7
xor ecx, ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], cx
mov dword [esp + 0x54], 0xffffffff
cmp dword [esp + 0x48], edi
jb 0x100324f7
mov edx, dword [esp + 0x34]
push edx
call fcn.100755e2
add esp, 4
xor eax, eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], ax
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 4
Function at 0x10032920
Capabilities:
Check if file exists
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x100c230c]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
mov ebp, dword [esp + 0x228]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.NtFsControlFile
push str.ntdll.dll
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [esi + 0x6c24], eax
test eax, eax
jne 0x1003297f
mov dword [esi], 2
xor eax, eax
jmp 0x10032aa9
push str.NtWaitForSingleObject
push str.ntdll.dll
call edi
push eax
call ebx
mov dword [esi + 0x6c28], eax
test eax, eax
je 0x10032972
mov eax, dword [esp + 0x230]
mov dword [esi + 0x63f4], eax
cmp eax, 1
jne 0x10032a27
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.10079c60
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x18]
push edx
lea edi, [esi + 0x69f6]
push str._sPrefetchNTOSBOOT_B00DFAAD.pf
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10032a04
mov dword [esi], 1
jmp 0x10032aa9
mov eax, dword [esp + 0x14]
push ebp
push eax
push 1
push edi
mov ecx, dword [esp + 0x20]
mov edx, esi
call fcn.100332e0
test eax, eax
jne 0x10032a3a
mov dword [esi], 3
jmp 0x10032aa9
cmp eax, 2
jne 0x10032a3a
mov ecx, dword [esp + 0x14]
push ebp
push ecx
push eax
push 0x100a6f30
jmp 0x10032a0d
lea edx, [esi + 8]
push edx
mov ecx, esi
call fcn.10035a80
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x63ec], eax
mov dword [esi + 0x63e8], ecx
call fcn.1006c390
test eax, eax
je 0x10032a79
cmp dword [eax], 3
jge 0x10032a79
mov edx, dword [esi + 0x63ec]
add edx, dword [esi + 0x63e8]
mov dword [esi + 0x63f0], edx
jmp 0x10032a85
mov ecx, dword [esi + 0x63ec]
mov dword [esi + 0x63f0], ecx
test eax, eax
je 0x10032a9a
cmp dword [eax], 3
jge 0x10032a9a
mov dword [esi + 0x641c], 1
jmp 0x10032aa4
mov dword [esi + 0x641c], 0
mov eax, 1
mov ecx, dword [esp + 0x224]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.100755ed
add esp, 0x21c
ret 0xc
Function at 0x10034c50
Capabilities:
Create thread

Disassembly:
push edi
push 0
push 0
push esi
push 0x10034c40
mov dword [esi + 0x6c1c], ecx
mov dword [esi + 0x6c20], eax
push 0
push 0
mov dword [esi + 0x642c], ecx
mov dword [esi + 0x6430], eax
call fcn.10077690
mov edi, eax
mov eax, dword [esi + 0x67e0]
imul eax, eax, 0xea60
add esp, 0x18
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10034cb9
test edi, edi
je 0x10034ca4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [esi + 0x63f8], eax
mov dword [esi + 0x6428], eax
xor eax, eax
pop edi
ret
test edi, edi
je 0x10034cc4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
ret