joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100aeb4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
push ebx
push esi
mov esi, dword [ecx + 0x10]
push edi
xor ebx, ebx
jmp 0x100ae3e
shl eax, 1
inc ebx
test eax, eax
jge 0x100ae3b
mov eax, ebx
imul eax, eax, 0x204
lea eax, [eax + esi + 0x144]
push 0x3f
mov dword [ebp - 8], eax
pop edx
mov dword [eax + 8], eax
mov dword [eax + 4], eax
add eax, 8
dec edx
jne 0x100ae57
push 4
mov edi, ebx
push 0x1000
shl edi, 0xf
add edi, dword [ecx + 0xc]
push 0x8000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x100ae8a
or eax, 0xffffffff
jmp 0x100af27
lea edx, [edi + 0x7000]
cmp edi, edx
mov dword [ebp - 4], edx
ja 0x100aeda
mov ecx, edx
sub ecx, edi
shr ecx, 0xc
lea eax, [edi + 0x10]
inc ecx
or dword [eax - 8], 0xffffffff
or dword [eax + 0xfec], 0xffffffff
lea edx, [eax + 0xffc]
mov dword [eax], edx
lea edx, [eax - 0x1004]
mov dword [eax - 4], 0xff0
mov dword [eax + 4], edx
mov dword [eax + 0xfe8], 0xff0
add eax, 0x1000
dec ecx
jne 0x100aea2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, 0x1f8
lea ecx, [edi + 0xc]
mov dword [eax + 4], ecx
mov dword [ecx + 8], eax
lea ecx, [edx + 0xc]
mov dword [eax + 8], ecx
mov dword [ecx + 4], eax
and dword [esi + ebx*4 + 0x44], 0
xor edi, edi
inc edi
mov dword [esi + ebx*4 + 0xc4], edi
mov al, byte [esi + 0x43]
mov cl, al
inc cl
test al, al
mov eax, dword [ebp + 8]
mov byte [esi + 0x43], cl
jne 0x100af17
or dword [eax + 4], edi
mov edx, 0x80000000
mov ecx, ebx
shr edx, cl
not edx
and dword [eax + 8], edx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004d08
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
cmp dword [ebp + 8], edi
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
push eax
je 0x1004d28
push dword [ebp + 8]
jmp 0x1004d2f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.010053c1
mov ebx, eax
cmp ebx, edi
jne 0x1004e34
mov edx, dword [ebp - 4]
cmp edx, edi
je 0x1004e34
mov ax, word [edx]
cmp ax, di
je 0x1004e34
mov dword [ebp + 8], edi
cmp ax, 0x2f
je 0x1004d68
inc edx
inc edx
mov ax, word [edx]
cmp ax, di
jne 0x1004d58
cmp word [edx], di
je 0x1004e2b
push 2
pop ebx
add edx, ebx
cmp word [edx], di
mov eax, edx
je 0x1004d93
mov cx, word [eax]
cmp cx, 0x20
je 0x1004d93
cmp cx, 0x3a
je 0x1004d93
add eax, ebx
cmp word [eax], di
jne 0x1004d7d
movzx ecx, word [eax]
cmp ecx, edi
je 0x1004e05
cmp ecx, 0x20
je 0x1004dfd
cmp ecx, 0x3a
jne 0x1004e09
mov word [eax], di
add eax, ebx
cmp word [eax], 0x22
je 0x1004dd3
cmp word [eax], di
mov esi, eax
je 0x1004dc3
cmp word [esi], 0x20
je 0x1004dc3
add esi, ebx
cmp word [esi], di
jne 0x1004db6
cmp word [esi], di
je 0x1004dcf
mov word [esi], di
add esi, ebx
jmp 0x1004e09
xor esi, esi
jmp 0x1004e09
add eax, ebx
cmp word [eax], di
mov esi, eax
je 0x1004de9
cmp word [esi], 0x22
je 0x1004def
add esi, ebx
cmp word [esi], di
jne 0x1004ddc
cmp word [esi], 0x22
jne 0x1004e2f
mov word [esi], di
add esi, ebx
mov dword [ebp + 8], 1
jmp 0x1004e09
mov word [eax], di
lea esi, [eax + 2]
jmp 0x1004e07
xor esi, esi
xor eax, eax
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
push dword [ebp + 0xc]
push eax
push edx
call fcn.01004bb6
mov ebx, eax
cmp ebx, edi
jne 0x1004e34
cmp esi, edi
mov edx, esi
jne 0x1004d49
jmp 0x1004e34
xor ebx, ebx
jmp 0x1004e34
mov ebx, 0x8000ffff
push dword [ebp - 4]
call sub.msvcrt.dll_free
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x1004f3b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], 1
je 0x1005024
cmp dword [ebp + 0xc], ebx
je 0x1005024
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, ebx
jne 0x1005011
cmp dword [ebp - 4], ebx
je 0x1005013
mov dword [ebp + 0xc], ebx
mov esi, 0x104
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x428]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
cmp edi, 0x103
je 0x100500c
cmp edi, ebx
jne 0x1005003
cmp dword [ebp - 0x14], 1
jne 0x1005003
cmp dword [ebp - 0x10], esi
jae 0x1005003
cmp dword [ebp - 0xc], esi
jae 0x1005003
mov ecx, dword [ebp - 0x18]
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.01004bb6
test eax, eax
jne 0x100502b
inc dword [ebp + 0xc]
cmp edi, ebx
je 0x1004f9a
jmp 0x100502b
mov dword [ebp - 8], ebx
jmp 0x100502b
jg 0x1005018
mov dword [ebp - 8], eax
jmp 0x100502b
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005013
mov dword [ebp - 8], 0x80070057
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x100503c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x1005779
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f8
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
je 0x10058b4
push 2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10058b4
push esi
push 0x1001940
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x10057f1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10057ce
call esi
jmp 0x10057da
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x10058ae
mov dword [ebp - 4], 0x80004005
jmp 0x10058ae
push edi
xor eax, eax
mov ecx, 0xfa
lea edi, [ebp - 0x3f8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x3e8
lea eax, [ebp - 0x3f8]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
jmp 0x100588f
cmp dword [ebp - 8], 0
jbe 0x100586a
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
lea eax, [esi + 0x38]
push 0x100192c
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x100584c
lea eax, [esi + 0x38]
push 0x1001924
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x100585c
push esi
push dword [ebp + 8]
call fcn.01005629
test eax, eax
mov dword [ebp - 4], eax
jne 0x10058a4
mov eax, dword [ebp - 8]
sub eax, dword [esi]
mov dword [ebp - 8], eax
add esi, dword [esi]
test eax, eax
ja 0x1005824
xor eax, eax
mov ecx, 0xfa
lea edi, [ebp - 0x3f8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x3e8
lea eax, [ebp - 0x3f8]
push eax
push 0
push 9
push dword [ebp - 0xc]
lea esi, [ebp - 0x3f8]
call ebx
test eax, eax
jne 0x100581e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
pop edi
mov eax, dword [ebp - 4]
pop esi
jmp 0x10058b9
mov eax, 0x80070057
pop ebx
leave
ret 4
Function at 0x1005ebd
Capabilities:
Get file size
Read file via mapping

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
call fcn.01005d57
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 0x20c], eax
jne 0x1005ef7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002cb8
jmp 0x1005f69
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x208], eax
jne 0x1005f18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002c80
jmp 0x1005f69
push edi
push edi
push edi
push 2
push edi
push dword [esi + 0x20c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [esi + 0x20c], 0xffffffff
mov dword [esi + 0x210], eax
jne 0x1005f47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002c44
jmp 0x1005f69
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 0x214], eax
jne 0x1005f89
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002c0c
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call dword [sym.imp.msvcrt.dll_fprintf]
add esp, 0xc
mov ecx, esi
call fcn.01005d57
mov eax, edi
pop edi
pop esi
ret 4
push dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi + 0x214]
mov dword [esi + 0x218], eax
mov eax, dword [esi + 0x208]
xor edi, edi
mov dword [esi + 0x21c], eax
inc edi
jmp 0x1005f82
Function at 0x1005fb1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
push esi
push edi
push 0x1001920
push dword [ebp + 8]
xor edi, edi
mov esi, 0x105
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], edi
call dword [sym.imp.msvcrt.dll__wfopen]
cmp eax, edi
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
je 0x1006155
push ebx
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.msvcrt.dll_fprintf]
push 0x1002fa8
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100614a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x224]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x10060ab
mov ecx, dword [ebp - 0x18]
cmp ecx, 4
mov eax, dword [ecx*4 + 0x100c3c8]
je 0x1006068
lea ecx, [ebp - 0x430]
push ecx
push eax
lea eax, [ebp - 0x224]
push eax
push 0x1002f9c
jmp 0x100607b
push dword [ebp - 0x430]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x1002f8c
push dword [ebp - 0x10]
call ebx
add esp, 0x14
inc dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x1006043
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_fclose]
xor eax, eax
cmp dword [ebp + 0x10], eax
pop ecx
je 0x100614a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push esi
lea ecx, [ebp - 0x224]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
call ebx
test eax, eax
jne 0x100614a
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
push dword [ebp + 0xc]
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x63c]
push 0x100126c
push eax
call edi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x63c]
push eax
call edi
add esp, 0x18
push dword [ebp + 0x10]
lea eax, [ebp - 0x63c]
push eax
push dword [ebp + 8]
call fcn.01005fb1
inc dword [ebp - 4]
push esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], esi
push dword [ebp - 0xc]
call ebx
test eax, eax
je 0x10060ed
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
pop ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop esi
leave
ret 0xc
Function at 0x10068f5
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x1006978
push 2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006978
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1006972
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1006958
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.010066b8
mov ebx, eax
test ebx, ebx
jne 0x1006972
push esi
lea eax, [ebp - 0x208]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x1006931
push edi
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
pop edi
mov eax, ebx
pop esi
jmp 0x100697d
mov eax, 0x80070057
pop ebx
leave
ret 4

Function at 0x100699b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], 0x105
mov dword [ebp - 4], edi
je 0x1006a34
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x1006a34
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x1003ae8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10069ee
mov esi, 0x80004005
jmp 0x1006a21
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1002408
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10069e7
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
call fcn.010053c1
mov esi, eax
cmp dword [ebp - 4], edi
je 0x1006a2f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
jmp 0x1006a39
mov eax, 0x80070057
pop edi
leave
ret 4
Function at 0x1006dd2
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], edi
je 0x1006ed0
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x770
push dword [ebp + 8]
call esi
test eax, eax
jne 0x1006ed0
cmp dword [ebp + 0xc], edi
je 0x1006ed0
push 2
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x1006ed0
push ebx
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1006ecb
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1006e84
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x1006e99
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01006abd
mov edi, eax
test edi, edi
jne 0x1006ec4
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x1006e3a
jmp 0x1006ec4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1006eab
call esi
mov edi, eax
jmp 0x1006ebb
call esi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jne 0x1006ec4
mov edi, 0x80004005
push ebx
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov eax, edi
pop ebx
jmp 0x1006ed5
mov eax, 0x80070057
pop edi
pop esi
leave
ret 8
Function at 0x100898b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
lea eax, [ebp - 0x41c]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [ebp - 4], ebx
call fcn.01009963
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.01009aa4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100126c
lea eax, [ebp - 0x214]
push eax
call edi
push dword [0x100c648]
lea eax, [ebp - 0x214]
push eax
call edi
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x1008a56
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x100cc9c], 4
mov dword [ebp - 4], eax
je 0x1008b6f
push 4
push 0x10043f0
push 0x1ce
push str.d:xpclient_adminpchealth_srenumlogs_respoint.cpp
call fcn.0100a280
test eax, eax
je 0x1008b6f
push dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
push 0x10043a8
push ebx
call fcn.010081e5
add esp, 0x10
jmp 0x1008b6f
cmp dword [esi], ebx
mov edi, 0x210
jne 0x1008ab9
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [esi], eax
jne 0x1008ab9
test byte [0x100cc9c], 4
mov dword [ebp - 4], 0xe
je 0x1008b66
push 4
push 0x10043f0
push 0x1db
push str.d:xpclient_adminpchealth_srenumlogs_respoint.cpp
call fcn.0100a280
test eax, eax
je 0x1008b66
push 0x10043dc
push ebx
call fcn.010081e5
pop ecx
pop ecx
jmp 0x1008b66
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0xc]
push eax
push edi
push dword [esi]
push dword [ebp - 8]
call ebx
test eax, eax
je 0x1008b21
cmp dword [ebp - 0xc], edi
jne 0x1008b21
mov eax, dword [esi]
xor ecx, ecx
cmp dword [eax + 4], 0xd
push 0
sete cl
lea eax, [ebp - 0xc]
push eax
push 8
add esi, 0x23c
push esi
push dword [ebp - 8]
mov dword [esi + 8], ecx
call ebx
test eax, eax
je 0x1008b01
cmp dword [ebp - 0xc], 8
je 0x1008b66
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x100cc9c], 4
mov dword [ebp - 4], eax
je 0x1008b66
push 4
push 0x10043f0
push 0x1ef
jmp 0x1008b3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x100cc9c], 4
mov dword [ebp - 4], eax
je 0x1008b66
push 4
push 0x10043f0
push 0x1e4
push str.d:xpclient_adminpchealth_srenumlogs_respoint.cpp
call fcn.0100a280
test eax, eax
je 0x1008b66
push dword [ebp - 4]
lea eax, [ebp - 0x214]
push eax
push 0x10043c4
push 0
call fcn.010081e5
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1009582
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
cmp dword [ebp + 0x10], eax
push edi
mov dword [ebp - 4], eax
mov dword [esi + 0xc], ecx
mov dword [esi], 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0xfffffff7
je 0x1009716
cmp dword [ebp + 8], eax
je 0x1009716
cmp dword [ebp + 0xc], eax
je 0x1009716
push dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x10045d0
push eax
call edi
add esp, 0x10
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100971e
mov eax, dword [ebp + 0x10]
add eax, 0x2c
push eax
call fcn.01009a03
test eax, eax
je 0x100961e
cmp eax, dword [esi + 4]
jae 0x1009616
mov dword [esi + 4], eax
cmp eax, dword [esi + 8]
jbe 0x100961e
mov dword [esi + 8], eax
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10095fe
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esi + 8]
or dword [ebp + 0x14], 0xffffffff
test eax, eax
je 0x100971e
cmp dword [ebp + 0x18], 0
je 0x100964c
dec eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x100971e
cmp dword [esi + 0xc], 0
je 0x1009660
mov eax, dword [esi + 4]
push dword [ebp + 0xc]
mov dword [esi], eax
push eax
push dword [ebp + 8]
mov ebx, 0x10045c0
lea eax, [ebp - 0x20c]
push ebx
push eax
call edi
mov eax, dword [esi]
add esp, 0x14
cmp eax, dword [esi + 4]
jb 0x100971e
mov eax, dword [esi]
cmp eax, dword [esi + 8]
ja 0x10096fe
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x14], eax
jne 0x1009704
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [esi]
push dword [ebp + 8]
push 0x10045ac
push eax
call edi
add esp, 0x14
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x14], eax
jne 0x1009704
cmp dword [esi + 0xc], 0
je 0x10096e0
inc dword [esi]
jmp 0x10096e2
dec dword [esi]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [esi]
push dword [ebp + 8]
push ebx
push eax
call edi
mov eax, dword [esi]
add esp, 0x14
cmp eax, dword [esi + 4]
jae 0x1009686
cmp dword [ebp + 0x14], 0xffffffff
je 0x100971e
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 1
jmp 0x100971e
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1009982
Capabilities:
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10099fb
mov esi, 0x104
push esi
lea eax, [ebp - 0x208]
push eax
push 0x1004654
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10099fb
push 0xa
push 0x1004674
push edi
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x10099f3
push esi
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x10099fb
lea eax, [ebp - 0x410]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
inc eax
jmp 0x10099fd
lea eax, [ebp - 0x208]
jmp 0x10099e4
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x1009a2a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [0x100cc84], edi
mov dword [ebp - 4], edi
jne 0x1009a9c
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push dword [0x100ca38]
mov dword [ebp - 8], 0x64
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1009a8e
push esi
lea eax, [ebp - 8]
push eax
mov esi, 0x100cc20
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [0x100ca40]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1009a8d
mov dword [0x100cc84], esi
pop esi
cmp dword [ebp - 4], edi
je 0x1009a9c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x100cc84]
pop edi
leave
ret
Function at 0x1009e8c
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1004770
call fcn.0100a218
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1009ec7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009ec7
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1009edf
cmp eax, 0x20b
je 0x1009ecc
mov dword [ebp - 0x1c], edi
jmp 0x1009ef3
cmp dword [ecx + 0x84], 0xe
jbe 0x1009ec7
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1009eed
cmp dword [ecx + 0x74], 0xe
jbe 0x1009ec7
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100ccc0], 0xffffffff
or dword [0x100ccc4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100cc94]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100cc90]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100ccbc], eax
call fcn.0100a212
cmp dword [0x100cb90], edi
jne 0x1009f4e
push fcn.0100a212
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100a200
push 0x1001244
push 0x1001240
call sub.msvcrt.dll__initterm
mov eax, dword [0x100cc8c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x100cc88]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x100123c
push 0x1001234
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100730a
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1009fc5
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1009ffa
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100a251
ret