joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006c00
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.1000c6a0
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x10006c35
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10025308]
xor eax, edx
inc ecx
dec esi
jne 0x10006c16
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10006c51
push esi
push 0x100234f4
push eax
call dword [0x1001b4a4]
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x10007140
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x10024dd4]
push ebx
push 0
push 0x80
push 4
push 0
push 3
add eax, 0xd
push 0x40000000
push eax
call dword [0x1001b1e0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100071e3
push 0
push ebx
mov dword [esp + 0xc], 0
call dword [0x1001b1e8]
cmp eax, 0x3200000
jae 0x1000718f
push 2
push 0
push 0
push ebx
call dword [0x1001b1e4]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
call dword [0x1001b12c]
mov edi, eax
push edi
call fcn.100199d0
add esp, 4
mov esi, eax
test edi, edi
jle 0x100071c0
mov ecx, ebp
mov ebp, edi
sub ecx, esi
mov dl, byte [ecx + eax]
xor dl, 0x44
mov byte [eax], dl
inc eax
dec ebp
jne 0x100071b4
lea eax, [esp + 0x10]
push 0
push eax
push edi
push esi
push ebx
call dword [0x1001b1dc]
push ebx
call dword [0x1001b158]
push esi
call fcn.100199d6
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10007950
Capabilities:
Create process on windows
Get file size

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
test eax, eax
push edi
mov dword [esp + 0x10], 0x100245fc
mov dword [esp + 0x14], 0x100245f0
mov dword [esp + 0x18], 0x100245e8
jbe 0x1000797c
lea ebx, [eax - 1]
jmp 0x1000797e
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_LocalSize]
lea edi, [esp + ebx*4 + 0x10]
test eax, eax
jbe 0x1000798f
dec eax
jmp 0x10007994
mov eax, 2
cmp ebx, eax
ja 0x100079bf
mov eax, dword [edi]
push eax
push 0
call ebp
mov esi, eax
test esi, esi
je 0x100079b5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, dword [esp + 0x20]
inc ebx
add edi, 4
jmp 0x10007988
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10007ff0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [0x100222e0]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push esi
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [0x1001b140]
lea edx, [esp + 0x10]
push 0x10022b3c
push edx
call sym.comsvcs.dll_DllCanUnloadNow
add esp, 8
lea eax, [esp + 0x10]
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push eax
call dword [0x1001b1e0]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100080ad
push edi
push esi
push ebx
call dword [0x1001b1e8]
mov edi, eax
push edi
call dword [0x1001b37c]
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x1001b210]
xor eax, eax
test edi, edi
jbe 0x10008084
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x10008076
push edi
push esi
mov ecx, ebp
call fcn.1000eda0
push esi
mov edi, eax
call dword [0x1001b380]
add esp, 4
push ebx
call dword [0x1001b158]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x10008490
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b8c0
push 0x100199f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xbe037055
xor esi, esi
push esi
call fcn.1000ee00
add esp, 8
cmp eax, esi
jne 0x100084e0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
push eax
push esi
push 0x400
call dword [0x1001b1b0]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp ebx, esi
je 0x100085c0
lea eax, [ebp - 0x30]
push eax
push 8
push ebx
call dword [0x1001b094]
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x100085c0
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x38]
push ecx
push esi
push esi
push 1
mov edx, dword [ebp - 0x30]
push edx
mov edi, dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
call edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
test eax, eax
jbe 0x100085c0
push eax
call fcn.100199d0
add esp, 4
mov esi, eax
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x30]
push edx
call edi
mov dword [ebp - 0x24], eax
test eax, eax
je 0x100085c0
mov dword [ebp - 0x140], 0x104
mov dword [ebp - 0x144], 0x100
push 0x100
call fcn.100199d0
add esp, 4
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x144]
push edx
push eax
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call 0x100085d2
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
test ebx, ebx
je 0x100085dd
push ebx
call dword [0x1001b158]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x100085eb
push eax
call dword [0x1001b158]
test esi, esi
je 0x100085f8
push esi
call fcn.100199d6
add esp, 4
mov esp, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008950
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x30
push esi
lea eax, [esp + 0x14]
mov esi, ecx
push edi
mov dword [esp + 8], eax
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x20]
push ecx
push 4
push edx
push eax
call sub.KERNEL32.dll_GetProcessTimes
test eax, eax
je 0x1000898c
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, esi
call fcn.10009010
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
mov word [edx], 0x500
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
mov word [eax + 2], 0x500
mov eax, dword [esp + 0x10]
push edx
push eax
call sub.KERNEL32.dll_WinExec
mov ecx, dword [esp + 0x14]
push ecx
call fcn.100199d6
mov edx, dword [esp + 0x10]
add esp, 4
push edx
call sub.KERNEL32.dll_OpenProcess
mov ecx, dword [esp + 8]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x30
ret 4

Function at 0x10008ee0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b8a0
push 0x100199f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x530
push ebx
push esi
push edi
mov byte [ebp - 0x53c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x53b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], eax
push 0xf003f
push eax
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
mov edi, eax
mov dword [ebp - 0x13c], edi
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
push edi
call dword [0x1001b084]
mov esi, eax
mov dword [ebp - 0x540], esi
test edi, edi
jne 0x10008f65
test esi, esi
je 0x10008fd0
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.MSVCRT.dll_atoi]
test eax, eax
je 0x10008fd0
cmp dword [ebp - 0x134], 1
je 0x10008f9f
lea ecx, [ebp - 0x138]
push ecx
push 1
push esi
call dword [sym.imp.MSVCRT.dll_rand]
test eax, eax
je 0x10008fd0
push 0x320
call dword [0x1001b168]
push ebx
mov edx, dword [str.3817__:_]
push edx
lea eax, [ebp - 0x53c]
push eax
call dword [0x1001b4a4]
add esp, 0xc
push esi
call dword [sym.imp.MSVCRT.dll_ceil]
lea ecx, [ebp - 0x53c]
push ecx
push 0x80000002
call dword [0x1001b404]
mov dword [ebp - 4], 0xffffffff
call fcn.10008ff9
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100095a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x100095b0
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x100095cc
cmp al, 0x2b
jne 0x100095cc
mov al, 1
ret
xor al, al
ret
Function at 0x1000af80
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x40
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
mov ebx, eax
cmp ebx, esi
je 0x1000b0e6
push ebp
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x10]
mov esi, dword [sym.imp.SHLWAPI.dll_SHCopyKeyA]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x38]
push 0x24
push eax
push 3
push edi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x1001b37c]
add esp, 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push 3
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
mov edx, eax
shl edx, 7
add edx, eax
lea edi, [edx*8 + 1]
push edi
call fcn.100199d0
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea esi, [ebp + 1]
and ecx, 3
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0
test eax, eax
jbe 0x1000b0b6
mov eax, dword [esp + 0x28]
lea edi, [eax + 0xc]
mov ecx, dword [esp + 0x54]
mov eax, dword [edi - 4]
test ecx, eax
je 0x1000b0a2
mov edx, dword [edi - 0xc]
push 0x63
push edx
push esi
call dword [0x1001b398]
mov eax, dword [edi]
add esp, 0xc
mov dword [esi + 0x2bc], eax
mov ecx, dword [edi + 4]
push 0
mov dword [esi + 0x2c8], ecx
mov ecx, dword [esp + 0x28]
push esi
push ebx
call fcn.10004f60
mov eax, dword [esp + 0x1c]
add esi, 0x408
add eax, 0x408
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc eax
add edi, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
jb 0x1000b056
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0x8b
call fcn.10006c70
mov eax, dword [esp + 0x28]
push eax
call dword [0x1001b380]
push ebp
call fcn.100199d6
add esp, 8
push ebx
call dword [sym.imp.MSVCRT.dll_strncat]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x1000b150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x1000b25d
mov eax, dword [ebx + 0x3c]
mov ebp, dword [esp + 0x12c]
add eax, ebx
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add esi, ebx
mov dword [esp + 0x1c], eax
test ebp, 0x80000000
jne 0x1000b1fb
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
add eax, ebx
cmp edx, ecx
mov dword [esp + 0x18], ecx
jbe 0x1000b219
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push 0
mov edi, dword [ecx]
add edi, ebx
push edi
call fcn.1000c200
add esp, 4
push eax
push edi
call fcn.10006c00
and eax, 0x7fffffff
add esp, 0xc
cmp eax, ebp
je 0x1000b1e6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jb 0x1000b1a3
jmp 0x1000b219
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [edx + eax*2]
mov dx, word [ecx + ebx]
mov word [esp + 0x10], dx
jmp 0x1000b219
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov eax, ebp
add edx, ecx
and eax, 0xffff
cmp eax, edx
jae 0x1000b25d
cmp eax, ecx
jb 0x1000b25d
sub bp, cx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
lea edx, [ecx + eax*4]
mov eax, dword [edx + ebx]
add eax, ebx
je 0x1000b25f
cmp eax, esi
jb 0x1000b25f
mov ecx, dword [esp + 0x1c]
add ecx, esi
cmp eax, ecx
jae 0x1000b25f
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov esi, eax
je 0x1000b25d
lea edx, [esp + 0x20]
sub edx, eax
mov al, byte [esi]
inc ecx
mov byte [edx + esi], al
inc esi
cmp al, 0x2e
je 0x1000b26a
cmp byte [esi], 0
jne 0x1000b24d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
test ecx, ecx
jle 0x1000b25d
mov byte [esp + ecx + 0x20], 0x64
inc ecx
mov al, 0x6c
lea edx, [esp + 0x20]
mov byte [esp + ecx + 0x20], al
inc ecx
push edx
mov byte [esp + ecx + 0x24], al
mov byte [esp + ecx + 0x25], 0
call fcn.10006700
add esp, 4
lea eax, [esp + 0x20]
push eax
call fcn.10006470
push 0
push esi
mov edi, eax
call fcn.1000c200
add esp, 4
push eax
push esi
call fcn.10006c00
and eax, 0x7fffffff
push eax
push edi
call fcn.1000b150
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret

Function at 0x1000b310
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x1001a118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call fcn.100157c0
push 0xf003f
push 0
push 0
mov dword [esp + 0x1c], 0
mov dword [esi], 0x1001b9a8
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
push 0x30
mov ecx, esi
mov dword [esi + 0x10], eax
call sym.comsvcs.dll_CoCreateActivity
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1000b7e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x20]
push esi
xor esi, esi
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__strupr]
test eax, eax
je 0x1000b810
xor eax, eax
pop esi
add esp, 0x14
ret
push ebp
mov ebp, dword [esp + 0x30]
cmp ebp, esi
push edi
jne 0x1000b8d2
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xd], eax
push 0xa
mov dword [esp + 0x15], eax
push ecx
mov dword [esp + 0x1d], eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
call fcn.10009540
add esp, 8
push 1
push str.W_Dfkb
call fcn.10015900
push 1
push 0x1002316c
call fcn.10015900
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
push edx
push 0xf003f
push esi
push eax
push ecx
call dword [0x1001b060]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0xc]
push esi
push edx
push eax
call dword [0x1001b0bc]
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ecx
call edi
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push 8
push edx
push eax
call dword [0x1001b0b8]
mov esi, eax
lea ecx, [esp + 0xc]
neg esi
sbb esi, esi
push ecx
inc esi
call dword [0x1001b19c]
mov eax, dword [esp + 0x2c]
push eax
call edi
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x24]
push ebx
push edx
push 0x20019
push esi
push eax
push ecx
mov dword [esp + 0x48], esi
call dword [0x1001b060]
mov eax, dword [esp + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x34]
push edx
push esi
push esi
push esi
push ebp
push eax
call ebx
test eax, eax
jne 0x1000b960
mov ecx, dword [esp + 0x34]
add ecx, 2
push ecx
call fcn.100199d0
mov ecx, dword [esp + 0x2c]
add esp, 4
lea edx, [esp + 0x34]
mov edi, eax
push edx
lea eax, [esp + 0x30]
push edi
push eax
push 0
push ebp
push ecx
call ebx
test eax, eax
jne 0x1000b957
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push edx
push edi
push eax
push 0
push ebp
push ecx
call dword [0x1001b06c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push edi
call fcn.100199d6
add esp, 4
mov edx, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edx
call edi
mov eax, dword [esp + 0x30]
pop ebx
push eax
call edi
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 0x14
ret
Function at 0x1000c320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b888
push 0x100199f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
cmp eax, 3
ja case.default.0x1000c357
jmp dword [eax*4 + 0x1000c49c]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
test eax, eax
jne case.default.0x1000c357
lea ecx, [ebp - 0x24]
push ecx
push 0x2001f
push ebx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x1001b060]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne case.default.0x1000c357
mov edx, dword [ebp + 0x14]
cmp edx, ebx
jbe case.default.0x1000c357
cmp edx, 2
jbe 0x1000c3e3
cmp edx, 4
jne case.default.0x1000c357
push edx
lea ecx, [ebp + 0x1c]
push ecx
push edx
push ebx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [0x1001b06c]
test eax, eax
jne case.default.0x1000c357
jmp 0x1000c467
mov esi, dword [ebp + 0x18]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push esi
push edx
push ebx
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [0x1001b06c]
test eax, eax
jne case.default.0x1000c357
jmp 0x1000c467
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push ebx
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x1001b060]
test eax, eax
jne case.default.0x1000c357
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
test eax, eax
jne case.default.0x1000c357
jmp 0x1000c467
lea edx, [ebp - 0x24]
push edx
push 0x2001f
push ebx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x1001b060]
test eax, eax
jne case.default.0x1000c357
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
jne case.default.0x1000c357
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.1000c48e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000c6a0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x10025308
mov eax, edx
mov esi, 8
test al, 1
je 0x1000c6bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x1000c6be
shr eax, 1
dec esi
jne 0x1000c6af
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x10025708
jl 0x1000c6a8
pop esi
ret
Function at 0x1000c6e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10019d03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.100157c0
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x1001b8b4
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.100199d0
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x1000c747
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.10009e40
jmp 0x1000c749
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x10014710
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.100096f0
push 1
push ebx
push ebx
push esi
push 0x10006350
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.100096f0
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1000ce30
Capabilities:
Enumerate devices by category

Disassembly:
push 0xffffffffffffffff
push 0x10019e3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x828
lea eax, [esp + 0x14]
push ebp
push eax
xor ebp, ebp
push 0x1001ef10
push 1
push ebp
push 0x1001efa0
mov byte [esp + 0x1b], 0
call dword [0x1001b604]
cmp eax, ebp
je 0x1000ce87
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ebp
push edx
mov ecx, dword [eax]
push 0x1001ef90
push eax
mov dword [esp + 0x844], ebp
call dword [ecx + 0xc]
cmp eax, ebp
je 0x1000cedc
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebp
je 0x1000cec4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebp
jne 0x1000cfef
push ebx
mov ebx, dword [0x1001b13c]
push esi
mov esi, dword [esp + 0x844]
push edi
mov edi, dword [0x1001b12c]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0x1001b9d8
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x1000cfc4
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push 0
mov word [esp + 0x2c], 8
mov ecx, dword [eax]
push edx
push 0x10022c64
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1000cfba
mov eax, dword [esp + 0x30]
push eax
call dword [0x1001b36c]
add esp, 4
test eax, eax
jbe 0x1000cfba
test esi, esi
je 0x1000cfb6
mov edx, dword [esp + 0x30]
push 0
push 0
lea ecx, [esp + 0x40]
push 0x800
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call ebx
lea eax, [esp + 0x38]
push 0x64
push eax
push esi
call dword [0x1001b398]
add esp, 0xc
push esi
call edi
push esi
lea ebp, [eax + ebp + 1]
call edi
mov ecx, dword [esp + 0x30]
lea esi, [esi + eax + 1]
push ecx
call dword [0x1001b3dc]
inc byte [esp + 0x13]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
je 0x1000cf1a
pop edi
pop esi
pop ebx
mov eax, dword [esp + 0x840]
test eax, eax
je 0x1000cffc
mov dword [eax], ebp
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
test eax, eax
je 0x1000d015
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x82c]
mov al, byte [esp + 7]
pop ebp
mov dword fs:[0], ecx
add esp, 0x834
ret