joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aa80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000aa9b
inc ebx
push edi
je 0x1000aaf4
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000aad9
jmp 0x1000ab08
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ab10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000ab2e
inc ebx
push edi
je 0x1000ab87
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000ab7e
jmp 0x1000abf2
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 1
push 0
push str.Description
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
adc byte [ebx - 0x7a76fe40], al
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ac00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000ac1e
inc ebx
push edi
je 0x1000ac77
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000ac6f
jmp 0x1000ace2
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
inc eax
add byte [eax], al
add byte [ebx], dh
ror byte [ebp - 0x10243], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
mov dword [ebp - 0x110], eax
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x104]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x10
call fcn.100037e0
mov eax, dword [ebp - 4]
mov dword [eax], 0x100123b8
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000b1a0
inc ebx
push edi
je 0x1000b1f9
pop eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
add ecx, 0x124
push ecx
push 0xfa
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._08x.tmp
mov edx, dword [ebp - 4]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 0x124]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add byte [edx - 1], dl
adc eax, sym.imp.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b230
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10011b2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x100123b8
mov dword [ebp - 4], 0
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000b273
inc ebx
push edi
je 0x1000b2cc
pop eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004cd0
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0xc], 0
je 0x1000b29d
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x14]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004cd0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10003860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
hlt

Function at 0x1000b520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000b53c
inc ebx
push edi
je 0x1000b595
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
push 0
push 0x10002800
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
ret 0x8901

Function at 0x1000b560
Capabilities:
Empty the recycle bin

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000b57e
inc ebx
push edi
je 0x1000b5d7
pop eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x1000b59a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
xor edx, edx
mov ecx, 0x224
div ecx
cmp dword [ebp - 8], eax
jae 0x1000b5d3
push 3
push 0x100146d0
mov edx, dword [ebp - 4]
add edx, 0x24
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1000c8c0
mov ecx, dword [ebp - 4]
add ecx, 0x224
mov dword [ebp - 4], ecx
jmp 0x1000b591
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b5f0
Capabilities:
Create directory
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000b60e
inc ebx
push edi
je 0x1000b667
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000b632
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x1b62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cld
mov edx, dword [ebp - 4]
add edx, 0x400
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1000b68a
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0x1b61
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b640
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000b65e
inc ebx
push edi
je 0x1000b6b7
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx

Function at 0x1000b7b0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000b7ce
inc ebx
push edi
je 0x1000b827
pop eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x220
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
add edx, 0x18
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 8
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x220
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x1000b83f
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov ecx, dword [ebp + 8]
push ecx
push 0x10014600
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x120
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x20
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b980
Capabilities:
Get disk information
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
push ebx
push esi
push edi
mov dword [ebp - 0x378], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000b9a4
inc ebx
push edi
je 0x1000b9fd
pop eax
mov ecx, dword [ebp - 0x378]
call fcn.1000dce0
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
jne 0x1000b9d1
mov eax, dword [ebp - 0x378]
mov dword [eax + 4], 0x1b69
jmp 0x1000bada
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x108]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 4], eax
inc ebp
cld
mov dword [ebp - 0x10c], 0
jmp 0x1000ba1a
mov edx, dword [ebp - 0x10c]
add edx, 4
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 4]
jae 0x1000bacd
mov ecx, dword [ebp - 0x10c]
lea edx, [ebp + ecx - 0x108]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebp - 0x10c]
movsx ecx, byte [ebp + eax - 0x108]
cmp ecx, 0x41
je 0x1000bac8
mov edx, dword [ebp - 0x10c]
movsx eax, byte [ebp + edx - 0x108]
cmp eax, 0x42
je 0x1000bac8
mov dword [ebp - 0x370], 0
mov ecx, 0x96
xor eax, eax
lea edi, [ebp - 0x368]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x370]
push ecx
mov edx, dword [ebp - 0x10c]
lea eax, [ebp + edx - 0x108]
push eax
mov ecx, dword [ebp - 0x378]
call fcn.1000b7b0
mov dword [ebp - 0x374], 0
push 0
lea ecx, [ebp - 0x374]
push ecx
push 0x260
lea edx, [ebp - 0x370]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1000ba0b
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000baf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x22c], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000bb14
inc ebx
push edi
je 0x1000bb6d
pop eax
mov dword [ebp - 0x228], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x228]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x1000bb58
jmp 0x1000bb7b
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0x224
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
std
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000bb90
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
push edi
mov dword [ebp - 0x460], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000bbb4
inc ebx
push edi
je 0x1000bc0d
pop eax
mov eax, dword [ebp - 0x460]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x458], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x457]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x458]
push ecx
push str._s.
inc esi
add dword [eax], edx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x354], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x350]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x354]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000bc68
mov edx, dword [ebp - 0x460]
mov dword [edx + 4], 0x1b58
jmp 0x1000bd77
mov ecx, dword [ebp - 0x460]
call fcn.1000dce0
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0xffffffff
jne 0x1000bc9e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x460]
mov dword [ecx + 4], 0x1b69
jmp 0x1000bd77
mov dword [ebp - 4], 0
mov byte [ebp - 0x214], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 4], 0
jne 0x1000bd60
push 0x10014610
lea edx, [ebp - 0x328]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1000bd30
push 0x1001460c
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1000bd30
lea ecx, [ebp - 0x328]
push ecx
lea edx, [ebp - 0x458]
push edx
push str._s_s
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x45c]
push edx
mov ecx, dword [ebp - 0x460]
call fcn.1000baf0
lea eax, [ebp - 0x354]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000bd5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1000bd59
mov dword [ebp - 4], 1
jmp 0x1000bd5b
jmp 0x1000bd60
jmp 0x1000bcbe
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bf60
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
push ebx
push esi
push edi
mov dword [ebp - 0x460], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000bf84
inc ebx
push edi
je 0x1000bfdd
pop eax
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x454], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x453]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x454]
push edx
push str._s.
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x350], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x34c]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x350]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000c021
hlt
xor eax, eax
jmp 0x1000c173
mov dword [ebp - 4], 0
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 4], 0
jne 0x1000c164
push 0x10014610
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1000c128
push 0x1001460c
lea ecx, [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1000c128
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x454]
push eax
push str._s_s
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0x350]
and edx, 0x10
test edx, edx
je 0x1000c0e7
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x460]
call fcn.1000bf60
test eax, eax
jne 0x1000c0e5
xor eax, eax
jmp 0x1000c173
jmp 0x1000c128
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x330]
mov dword [ebp - 0x45c], ecx
mov edx, dword [ebp - 0x334]
mov dword [ebp - 0x458], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x45c]
mov edx, dword [eax + 4]
adc edx, dword [ebp - 0x458]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea ecx, [ebp - 0x350]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000c15f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1000c151
mov dword [ebp - 4], 1
jmp 0x1000c15f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1000c173
jmp 0x1000c041
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000c180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000c19e
inc ebx
push edi
je 0x1000c1f7
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 5
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
clc
invalid
Function at 0x1000c550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
mov dword [ebp - 0x234], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000c574
inc ebx
push edi
je 0x1000c5cd
pop eax
mov dword [ebp - 0x230], 0
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x22c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x230]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
jne 0x1000c5a7
jmp 0x1000c60c
mov dword [ebp - 0x20c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
mov edx, dword [ebp - 0x214]
mov dword [ebp - 0x208], edx
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0x208
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, esi
std
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c6e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push ebx
push esi
push edi
mov dword [ebp - 0x458], ecx
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x1000c704
inc ebx
push edi
je 0x1000c75d
pop eax
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x454], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x453]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x454]
push edx
push str._s.
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x350], 0
mov ecx, 0x4f
xor eax, eax
lea edi, [ebp - 0x34c]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x350]
push ecx
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000c7a1
hlt
xor eax, eax
jmp 0x1000c8a8
mov dword [ebp - 4], 0
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [ebp - 4], 0
jne 0x1000c899
push 0x10014610
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1000c85d
push 0x1001460c
lea ecx, [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x1000c85d
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x454]
push eax
push str._s_s
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0x350]
and edx, 0x10
test edx, edx
je 0x1000c847
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x458]
call fcn.1000c6e0
test eax, eax
jne 0x1000c845
xor eax, eax
jmp 0x1000c8a8
jmp 0x1000c85d
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x458]
call fcn.1000c550
lea ecx, [ebp - 0x350]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000c894
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1000c886
mov dword [ebp - 4], 1
jmp 0x1000c894
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1000c8a8
jmp 0x1000c7c1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8