joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fa9c
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
lea esi, [esp + 0x24]
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], esi
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x46fae8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x3c], ecx
mov dword [esp + 8], 0x1c
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
mov ecx, dword [ebp - 0x3c]
je 0x46fba0
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
je 0x46fb94
cmp eax, 4
je 0x46fb94
mov dword [ebp - 0x40], ecx
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [ebp - 0x3c], edx
mov dword [esp + 8], 0x40
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp - 0x20]
mov edi, ebx
mov ecx, dword [ebp - 0x40]
rep movsb byte es:[edi], byte [esi]
cmp eax, 0x40
je 0x46fb98
cmp eax, 4
je 0x46fb98
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0046fa9c
Function at 0x471124
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 0x14]
mov eax, dword [sym.imp.msvcrt.dll__osver]
mov eax, dword [eax]
test ah, 0x80
je 0x471146
mov edx, dword [0x4a9540]
test edx, edx
jne 0x47116c
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [0x4a9540], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
lea edx, [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.kernel32.dll_GetFileSize
sub esp, 8
mov dword [ebp - 0x28], eax
inc eax
je 0x4712b8
mov esi, dword [ebp - 0x20]
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0xc], 1
lea edx, [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.kernel32.dll_SetFilePointer
sub esp, 0x10
mov dword [ebp - 0x20], eax
inc eax
je 0x471334
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], edi
jbe 0x4712f0
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.kernel32.dll_SetFilePointer
sub esp, 0x10
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x28]
sbb edi, dword [ebp - 0x24]
cmp edi, 0
jl 0x47129e
nop
jle 0x4712d0
mov dword [ebp - 0x3c], esi
cmp edi, 0
jl 0x471253
jle 0x4712dc
mov dword [ebp - 0x3c], 0x200
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0x10], 0
lea ecx, [ebp - 0x2c]
mov dword [esp + 0xc], ecx
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x4a9340
mov dword [esp], eax
call sub.kernel32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x471304
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x3c], eax
ja 0x471304
xor edx, edx
sub esi, eax
sbb edi, edx
cmp edi, 0
jge 0x471238
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp], eax
call sub.kernel32.dll_FlushFileBuffers
push eax
jmp 0x471146
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4711b3
mov eax, 0xffffffff
jmp 0x471163
cmp esi, 0
jbe 0x47129e
jmp 0x47123e
cmp esi, 0x200
jbe 0x471253
jmp 0x47124c
jb 0x471146
cmp eax, dword [ebp - 0x28]
ja 0x4711f8
jmp 0x471146
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.kernel32.dll_SetFilePointer
sub esp, 0x10
jmp 0x4712c5
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4712c5
jmp 0x4711e9
Function at 0x737760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x26c000]
push edi
jmp 0x73777a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x737781
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x737770
mov eax, 1
add ebx, ebx
jne 0x737793
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7377a4
jne 0x7377c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7377c3
dec eax
add ebx, ebx
jne 0x7377b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x737788
add ebx, ebx
jne 0x7377bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x737815
xor ecx, ecx
sub eax, 3
jb 0x7377db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x73784a
sar eax, 1
mov ebp, eax
jmp 0x7377e6
add ebx, ebx
jne 0x7377e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7377b4
inc ecx
add ebx, ebx
jne 0x7377f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7377b4
add ebx, ebx
jne 0x737801
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7377f6
jne 0x737812
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7377f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x737834
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x737826
jmp 0x737776
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x737834
add edi, ecx
jmp 0x737776
pop esi
mov edi, esi
mov ecx, 0x16486
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x737852
cmp byte [edi], 0xc4
jne 0x737852
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x737857
lea edi, [esi + 0x334000]
mov eax, dword [edi]
or eax, eax
je 0x7378cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x33dc3c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33dd80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x737884
mov ecx, edi
jns 0x7378b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x33dd88]
or eax, eax
je 0x7378c9
mov dword [ebx], eax
add ebx, 4
jmp 0x7378a1
call dword [esi + 0x33dd84]
mov ebp, dword [esi + 0x33dd8c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x737903
sub esp, 0xffffff80
jmp 0x595d94
Function at 0x5f1609
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x5f1a90
call fcn.005f17b4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x5f2370
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x5f13c4
cmp eax, esi
jne 0x5f13b7
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x5f13c7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x5f139e
xor esi, esi
inc esi
mov eax, dword [0x5f236c]
cmp eax, esi
jne 0x5f13da
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x5f1409
mov eax, dword [0x5f236c]
test eax, eax
jne 0x5f1403
mov dword [0x5f236c], esi
push 0x5f10b8
push 0x5f10ac
call fcn.005f1300
pop ecx
pop ecx
test eax, eax
je 0x5f1409
jmp 0x5f152d
mov dword [0x5f2034], esi
mov eax, dword [0x5f236c]
cmp eax, esi
jne 0x5f142d
push 0x5f10a8
push 0x5f10a0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x5f236c], 2
cmp dword [ebp - 0x20], ebx
jne 0x5f143a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x5f2374], ebx
je 0x5f145b
push 0x5f2374
call fcn.005f1729
pop ecx
test eax, eax
je 0x5f145b
push ebx
push 2
push ebx
call dword [0x5f2374]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x5f152d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x5f14c5
cmp cx, bx
je 0x5f1480
cmp dword [ebp - 0x1c], ebx
jne 0x5f14c5
movzx ecx, word [eax]
cmp cx, bx
je 0x5f1495
cmp cx, 0x20
ja 0x5f1495
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x5f1480
test byte [ebp - 0x40], 1
je 0x5f14a1
movzx ecx, word [ebp - 0x3c]
jmp 0x5f14a4
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x5f0000
call main
mov dword [0x5f2030], eax
cmp dword [0x5f2024], ebx
jne 0x5f150a
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x5f14d6
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x5f146a
cmp dword [0x5f2034], ebx
jne 0x5f1518
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x5f2030]
jmp 0x5f1539
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.005f17f9
ret
call fcn.005f1901
jmp 0x5f1361
Function at 0x417b80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x417ba2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417ba9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417b98
mov eax, 1
add ebx, ebx
jne 0x417bbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417bb0
jne 0x417bcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417bb0
xor ecx, ecx
sub eax, 3
jb 0x417be0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417c52
mov ebp, eax
add ebx, ebx
jne 0x417beb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417bf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417c1c
inc ecx
add ebx, ebx
jne 0x417c08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417bfd
jne 0x417c19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417bfd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417c3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417c2d
jmp 0x417b9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417c3c
add edi, ecx
jmp 0x417b9e
pop esi
mov edi, esi
mov ecx, 0xf7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417c5a
cmp byte [edi], 5
jne 0x417c5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417c5f
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417cd7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417c8c
mov ecx, edi
jns 0x417cbb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1784c]
or eax, eax
je 0x417cd1
mov dword [ebx], eax
add ebx, 4
jmp 0x417ca9
call dword [esi + 0x17848]
mov ebp, dword [esi + 0x17850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417d0b
sub esp, 0xffffff80
jmp 0x40b1e5
Function at 0x4163c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x43d4a0
cmp edx, dword [eax]
je 0x4163e3
add eax, 8
inc ecx
cmp eax, 0x43d530
jl 0x4163d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x43d4a0]
jne 0x416511
mov eax, dword [0x43d858]
cmp eax, 1
je 0x4164eb
test eax, eax
jne 0x416414
cmp dword [0x43d3f0], 1
je 0x4164eb
cmp edx, 0xfc
je 0x416511
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41644b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00416970
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00416ae0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41648e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00416ae0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x419430
push edi
call fcn.00417770
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00416970
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00416980
lea eax, [ebp - 0xa0]
push 0x419410
push eax
call fcn.00416980
push dword [esi + 0x43d4a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00416980
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004176de
add esp, 0x2c
pop edi
jmp 0x416511
lea eax, [ebp + 8]
lea esi, [esi + 0x43d4a4]
push 0
push eax
push dword [esi]
call fcn.00416ae0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100e177
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push 4
push 0x28
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jge 0x100e19c
xor al, al
jmp 0x100e1c4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
push 4
mov dword [ebp - 0x10], eax
push 0x28
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
setge al
leave
ret 0xc

Function at 0x100f094
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.01015a1e
Function at 0x100fc37
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 8]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
add eax, ebx
adc ecx, esi
mov dword [ebp - 0xc], eax
mov eax, 0x10000
xor edx, edx
div dword [ebp - 4]
push ecx
push dword [ebp - 0xc]
mov dword [ebp - 8], ecx
push esi
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], esi
push ebx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
jmp 0x100fd3f
mov esi, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push dword [ebp + 8]
push eax
call fcn.0100bced
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
push dword [ebp - 0xc]
xor ecx, ecx
add eax, dword [ebp + 8]
adc ecx, dword [ebp + 0xc]
push ecx
push eax
call fcn.0100ddc7
test al, al
je 0x100fcd0
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sbb ecx, dword [ebp + 0xc]
imul esi, eax
mov dword [ebp - 0x30], ecx
jmp 0x100fcd7
mov esi, dword [ebp + 0x10]
imul esi, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], ebx
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp + 0x14]
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push dword [edi + 0x24]
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0xc0000017
mov dword [edi + 0x34], eax
jne 0x100fd13
shr dword [ebp + 0x10], 1
mov eax, dword [ebp + 0x10]
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], ebx
jmp 0x100fd28
mov ecx, 0xc0000000
mov edx, eax
and edx, ecx
cmp edx, ecx
je 0x100fd55
cmp dword [ebp - 0x18], esi
jne 0x100fd55
add dword [ebp + 0x14], esi
push dword [ebp - 8]
mov eax, dword [ebp + 0x10]
push dword [ebp - 0xc]
xor ecx, ecx
add dword [ebp + 8], eax
adc dword [ebp + 0xc], ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100f04a
test al, al
jne 0x100fc85
inc al
pop edi
pop esi
pop ebx
leave
ret 0x10
mov edi, dword [edi + 0x124]
cmp edi, ebx
je 0x100fd97
mov edx, eax
and edx, ecx
cmp edx, ecx
push esi
jne 0x100fd7b
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push eax
push 0x100139c
push 0x69a4
jmp 0x100fd8e
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x1001390
push 0x69a5
push edi
call fcn.0100d309
add esp, 0x1c
xor al, al
jmp 0x100fd4e
Function at 0x100fe4b
Capabilities:
Get disk information via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x36d8
call sub.ntdll.dll__chkstk
mov eax, dword [0x105b00c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
push 0xc
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 0x36d0]
push eax
push ebx
push ebx
push 0x2d1080
lea eax, [ebp - 0x36d8]
push eax
push ebx
push ebx
mov esi, ecx
push ebx
push dword [esi + 0x24]
mov byte [esi + 0x106], bl
call edi
cmp eax, ebx
mov dword [esi + 0x34], eax
jl 0x100ff25
cmp dword [ebp - 0x36d0], 7
jne 0x100ff25
cmp dword [ebp - 0x36c8], 0xffffffff
je 0x100ff25
cmp dword [ebp - 0x36c8], ebx
je 0x100ff25
push 0x36c0
lea eax, [ebp - 0x36c4]
push eax
push ebx
push ebx
push 0x70050
lea eax, [ebp - 0x36d8]
push eax
push ebx
push ebx
push ebx
push dword [esi + 0x24]
call edi
cmp eax, ebx
mov dword [esi + 0x34], eax
jge 0x100fee6
xor al, al
jmp 0x100ff27
cmp dword [ebp - 0x36c4], ebx
jne 0x100ff25
mov ecx, dword [ebp - 0x36c0]
cmp ecx, 4
jbe 0x100fefc
push 4
pop ecx
xor edx, edx
cmp ecx, ebx
jbe 0x100ff25
lea eax, [ebp - 0x367c]
mov edi, dword [eax]
cmp edi, dword [ebp - 0x36c8]
je 0x100ff1e
inc edx
add eax, 0x90
cmp edx, ecx
jb 0x100ff08
jmp 0x100ff25
mov byte [esi + 0x106], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01059e06
leave
ret

Function at 0x101039a
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov ecx, dword [ebp + 8]
mov ax, word [ecx + 0xc]
shl ax, 1
mov word [ebp - 8], ax
mov word [ebp - 6], ax
mov eax, dword [ecx + 8]
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0x20], eax
mov al, byte [ebp + 0x10]
xor esi, esi
neg al
push edi
mov edi, dword [ebp + 0x14]
push 0x10
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 0x40
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
or eax, 1
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov ebx, eax
cmp ebx, esi
jge 0x1010428
mov ecx, dword [ebp + 0x1c]
cmp ecx, esi
je 0x101048b
xor eax, eax
cmp ebx, 0xc0000022
setne al
dec eax
and eax, 0x3fe
add eax, 0x7d7
jmp 0x1010463
push 0x11
push 4
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
cmp ebx, esi
jge 0x101046b
cmp ebx, 0x80000011
je 0x1010457
cmp ebx, 0xc00000a3
mov eax, 0x7d6
jne 0x101045c
mov eax, 0x830
mov ecx, dword [ebp + 0x1c]
cmp ecx, esi
je 0x101048b
push eax
call fcn.0100f02b
jmp 0x101048b
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
push esi
push esi
push esi
push esi
push 0x90083
mov dword [eax], ecx
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtFsControlFile]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x18
Function at 0x101300d
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x16c
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov dword [ebp - 8], 0xffffd8f0
mov ebx, 0x10600f8
jmp 0x1013039
lea eax, [ebp - 8]
push eax
push 0
call dword [sym.imp.ntdll.dll_NtDelayExecution]
xor ecx, ecx
inc ecx
mov edx, ebx
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x101302d
mov edi, dword [0x105b020]
mov eax, edi
and eax, dword [0x105b024]
cmp eax, 0xffffffff
jne 0x10130f2
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor edi, edi
push edi
push 0x2c
lea eax, [ebp - 0x34]
push eax
push edi
call esi
test eax, eax
jl 0x1013103
push edi
push 0x138
lea eax, [ebp - 0x16c]
push eax
push 2
call esi
test eax, eax
jl 0x1013103
mov eax, dword [ebp - 0x140]
mul dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x18]
mov edi, eax
mov esi, edx
xor eax, eax
cmp eax, esi
ja 0x10130b1
jb 0x10130ad
cmp ecx, edi
jae 0x10130b1
mov edi, ecx
mov esi, eax
mov eax, edi
and eax, esi
cmp eax, 0xffffffff
jne 0x10130bf
push 0xfffffffffffffffe
pop edi
or esi, eax
test esi, esi
ja 0x10130d7
jb 0x10130cd
cmp edi, 0x19000
ja 0x10130d7
xor edi, edi
and dword [0x105b024], edi
jmp 0x10130ec
push 0
push 0xa
push esi
push edi
call sub.ntdll.dll__aulldiv
sub edi, eax
sbb esi, edx
mov dword [0x105b024], esi
mov dword [0x105b020], edi
xor esi, esi
cmp esi, dword [0x105b024]
jb 0x101310e
ja 0x1013103
cmp dword [ebp + 8], edi
jbe 0x101310e
or eax, 0xffffffff
lock xadd dword [ebx], eax
xor eax, eax
jmp 0x101313e
mov eax, dword fs:[0x18]
push dword [ebp + 8]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
je 0x1013137
mov ecx, dword [ebp + 8]
sub dword [0x105b020], ecx
sbb dword [0x105b024], esi
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x101596d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov cx, word [ebp + 0xc]
xor eax, eax
push eax
push eax
mov word [ebp - 8], ax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 6], cx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 4], ecx
push 0x1001710
lea ecx, [ebp - 8]
push 2
mov dword [ebp - 0x3c], 0x30
mov dword [ebp - 0x38], 0x10016f8
mov dword [ebp - 0x34], ecx
call dword [sym.imp.ntdll.dll_RtlQueryRegistryValues]
xor ecx, ecx
test eax, eax
setge cl
mov al, cl
leave
ret 8

Function at 0x10159e3
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.01015944
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
push 7
push 0x10016f8
push 0x1001710
push 2
call dword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
xor ecx, ecx
test eax, eax
setge cl
mov al, cl
pop ebp
ret 4