joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a350
Capabilities:
Acquire debug privileges

Disassembly:
adc eax, sym.imp.KERNEL32.dll_GetCurrentProcess
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a367
jae 0x1000a2ff
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
jmp 0x1000a37a

Function at 0x1000a400
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jge 0x1000a3f8
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx]
sar eax, 4
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jle 0x1000a3ac
mov ecx, dword [ebp - 8]
add ecx, 0x37
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [eax + edx*2], cl
jmp 0x1000a3bb
mov ecx, dword [ebp - 8]
add ecx, 0x30
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov byte [eax + edx*2], cl
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx]
and edx, 0xf
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 9
jle 0x1000a3e3
mov eax, dword [ebp - 8]
add eax, 0x37
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx*2 + 1], al
jmp 0x1000a3f3
mov eax, dword [ebp - 8]
add eax, 0x30
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx*2 + 1], al
jmp 0x1000a371
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a417
jae 0x1000a3af
xor dword [eax + 0x6a], ebx
add byte [eax - 0x80], ch
add byte [eax], al
add byte [edx + 3], ch
pop eax
push 0
push 0x80
push 3
push 0
push 1
push bind
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a441
xor eax, eax
jmp 0x1000a46f
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a480
Capabilities:
Delete file
Write file on windows

Disassembly:
adc eax, sym.imp.KERNEL32.dll_CreateFileA
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a497
jae 0x1000a42f
xor dword [eax - 0x75], ebx
inc ebp
or byte [eax - 1], dl
adc eax, sym.imp.KERNEL32.dll_DeleteFileA
pop eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000a4cb
xor eax, eax
jmp 0x1000a4f9
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a517
jae 0x1000a4af
xor dword [eax - 0x39], ebx
inc ebp
lock add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.10011192
cmp dword [ebp - 4], 0
jne 0x1000a548
or eax, 0xffffffff
jmp 0x1000a604
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000a566
or eax, 0xffffffff
jmp 0x1000a604
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10011180
mov dword [ebp - 8], 0
jmp 0x1000a595
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x1000a5f4
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
imul edx, edx, 0x4c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx + 0x30]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x1000a5f2
mov edx, dword [ebp - 8]
imul edx, edx, 0x4c
mov eax, dword [ebp - 0xc]
add eax, edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x1000a604
jmp 0x1000a58c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a610
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a627
jae 0x1000a5bf
xor dword [eax + 0x68], ebx
aas
add byte [edi], cl
add byte [edx], ch
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a642
jmp 0x1000a68c
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a66a
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]

Function at 0x1000a6a0
Capabilities:
Start service

Disassembly:
and byte [ecx], al
adc byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 0xc], dh
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000a68c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a6ba
jae 0x1000a652
xor dword [eax - 0x39], ebx
test eax, edi
invalid
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x1000a6f5
or eax, 0xffffffff
jmp 0x1000a7a2
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xc8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._svchost.exe__k
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
push 1
push 2
push 0x110
push 0xf01ff
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000a793
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a7b0
Capabilities:
Delete service

Disassembly:
add dword [edi], ecx
add byte [ebx - 0x74adf3ab], cl
inc ebp
or byte [eax - 0x75], dl
invalid
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a7c7
jae 0x1000a75f
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a7f3
or eax, 0xffffffff
jmp 0x1000a83d
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a81d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1000a83d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a850
Capabilities:
Set registry value

Disassembly:
inc eax
and byte [ecx], al
adc byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 0xe], dh
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a86a
jae 0x1000a802
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a8ae
jmp 0x1000a91c
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 2
push 0
push str.ServiceDll
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a947
jae 0x1000a8df
xor dword [eax - 0x39], ebx
inc ebp
cld
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a985
jmp 0x1000a9b4
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a9c0
Capabilities:
Set registry value

Disassembly:
add byte [eax + 0x202c15ff], al
add dword [eax], edx
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
je 0x1000a9da
jae 0x1000a972
xor dword [eax - 0x39], ebx
test eax, edi
invalid
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000aa2a
jmp fcn.1000aa9e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
Function at 0x1000b0d0
Capabilities:
Delete file

Disassembly:
in eax, 0x5d
ret
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100118fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x100123c8
mov dword [ebp - 4], 0
push eax
xor eax, eax
xor eax, eax
je 0x1000b10f
jae 0x1000b0a7
xor dword [eax - 0x75], ebx
dec ebp
in al, dx
pop eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c70
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0xc], 0
je 0x1000b139
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
Function at 0x1000b180
Capabilities:
Delete file

Disassembly:
mov ah, 0x62
add byte [eax], al
add esp, 4
mov edx, dword [ebp - 0x14]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10003810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b19a
jae 0x1000b132
xor dword [eax - 0x75], ebx
inc ebp
or byte [eax + 0x68], dl
inc edx
pop ds
add byte [eax], al
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f42
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.10004ad0
test eax, eax
jne 0x1000b1ba
xor eax, eax
jmp 0x1000b346
mov ecx, 1
test ecx, ecx
je 0x1000b341
mov ecx, dword [ebp - 8]
call fcn.1000da50
test eax, eax
jne 0x1000b1d8
jmp 0x1000b341
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1771
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1a
ja case.0x1000b209.12
mov ecx, dword [ebp - 0xc]
jmp dword [ecx*4 + 0x1000b34f]
mov ecx, dword [ebp - 8]
call fcn.1000c950
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000c9f0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d5a0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d4d0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d6f0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d650
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b490
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b9f0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b800
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b530
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000bca0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000bbe0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b750
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b4e0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b400
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000bfe0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000c470
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000b3c0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000cd20
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000cae0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000d090
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000cdb0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000ceb0
jmp 0x1000b32e
mov ecx, dword [ebp - 8]
call fcn.1000cfd0
jmp 0x1000b32e
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0x1b5e
mov ecx, dword [ebp - 8]
call fcn.1000db20
test eax, eax
jne 0x1000b33c
jmp 0x1000b341
jmp 0x1000b1ba
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b3c0
Capabilities:
Create thread

Disassembly:
mov dl, 0
adc al, ch
mov dl, 0
adc byte [edx + esi*4], al
adc byte [ecx - 0x4e], dl
add byte [eax], dl
and al, 0xb3
add byte [eax], dl
sub dh, byte [edx - 0x4dc8f000]
add byte [eax], dl
and al, 0xb3
add byte [eax], dl
aam 0xb2
add byte [eax], dl
mov dl, 0
adc ah, bh
mov dl, 0
adc byte [eax], dl
mov bl, 0
adc byte [esi], al
mov bl, 0
adc byte [ebx + esi*4], ah
add byte [eax], dl
sbb dh, byte [ebx - 0x4d7af000]
add byte [eax], dl
adc byte [edx - 0x4de2f000], dh
add byte [eax], dl
fidiv word [edx - 0x3333f000]
int3
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b3d8
jae 0x1000b370
xor dword [eax - 0x75], ebx
inc ebp
cld
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
push 0
push 0x100027e0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b490
Capabilities:
Create directory

Disassembly:
add bh, dh
int1
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b4aa
jae 0x1000b442
xor dword [eax - 0x75], ebx
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000b4ce
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x1b62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b530
Capabilities:
Create directory
Move file

Disassembly:
in al, dx
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b4fa
jae 0x1000b492
xor dword [eax - 0x75], ebx
inc ebp
clc
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x400
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1000b526
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0x1b61
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov dword [ebp - 0x114], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b550
jae 0x1000b4e8
xor dword [eax - 0x75], ebx
test esp, ebp
invalid
pop eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x5c
push 0
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000b5a5
mov eax, dword [ebp - 0x114]
mov dword [eax + 4], 0x1b63
jmp fcn.1000b626
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [ebp - 4]
add edx, 1
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x114]
call fcn.1000dac0
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
jne 0x1000b5e8
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 4], 0x1b69
jmp fcn.1000b626
Function at 0x1000b630
Capabilities:
Get disk information
Get disk size

Disassembly:
imul ebx, dword [ebx], 0x3eeb0000
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.1000c020
test eax, eax
jne 0x1000b619
mov edx, dword [ebp - 0x114]
mov dword [edx + 4], 0x1b58
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b64a
jae 0x1000b5e2
xor dword [eax - 0x75], ebx
inc ebp
or byte [eax - 0x75], dl
dec ebp
or al, 0x81
shl dword [eax], 2
add byte [eax], al
pop eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x220
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
add edx, 0x18
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 8
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x220
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x1000b6bb
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov ecx, dword [ebp + 8]
push ecx
push 0x10014600
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x120
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x20
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1000b750
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
mov dword [ebp - 0x268], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b770
jae 0x1000b708
xor dword [eax - 0x75], ebx
test dword [eax - 0x74000003], ebx
dec eax
or al, 0x89
lea ebx, [ebp + edi*8 - 0x7a380001]
mov al, byte [0xfffffd]
add byte [eax], al
add byte [ecx + 0x96], bh
pop eax
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], 0
mov ecx, 0x96
xor eax, eax
lea edi, [ebp - 0x258]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x268]
call fcn.1000b630
mov ecx, dword [ebp - 0x268]
Function at 0x1000b960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x22c], ecx
push eax
xor eax, eax
xor eax, eax
je 0x1000b980
jae 0x1000b918
xor dword [eax - 0x39], ebx
test eax, ebx
std
invalid
pop eax
mov dword [ebp - 0x228], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x228]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]