joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10080598
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10097288]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov ebp, dword [esp + 0x2c]
lea eax, [esp + 0x30]
mov edx, dword [esp + 0x28]
dec ebp
mov esi, dword [esp + 0x34]
dec edx
mov ecx, esi
mov dword [esp + 0x20], 0
shr ebp, cl
push eax
shr edx, cl
inc ebp
inc edx
mov dword [ebx], 0x1008e1cc
mov eax, ebp
mov dword [ebx + 4], 0
imul eax, edx
lea ecx, [ebx + 4]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [esp + 0x2c], edx
add eax, 0x10
push eax
call fcn.10008850
mov eax, dword [ebx + 4]
mov edx, eax
mov ecx, dword [esp + 0x28]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ebp
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
and edx, 0xf
je 0x100087c8
sub eax, edx
add eax, 0x10
mov dword [ebx + 0x10], eax
cmp ebp, 1
jbe 0x100087e3
push 0x20
push ebp
push ecx
push 0x1008e03c
push 6
call fcn.100520e0
add esp, 0x14
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
Function at 0x10045ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x14]
shl ebp, 4
mov eax, dword [ebx + 0x4028]
push esi
push edi
mov dword [esp + 0x14], ebx
add ebp, dword [eax]
cmp byte [ebp], 0xff
jne 0x10045dd3
mov esi, dword [esp + 0x28]
test esi, esi
jle 0x10045d22
mov edi, edi
push 0x1008e6b4
push 0xa
call fcn.100520e0
add esp, 8
dec esi
jne 0x10045d10
mov eax, dword [ebp + 0xc]
mov edi, dword [ebx + 0x401c]
lea esi, [eax + eax*4]
shl esi, 5
mov eax, dword [esi + edi + 0x98]
test eax, eax
jle 0x10045d5d
cdq
push edx
push eax
push dword [esi + edi + 0x7c]
push dword [esi + edi + 0x78]
call fcn.1007f810
mov ecx, eax
call fcn.1007fb8e
divsd xmm0, qword [0x1008f1e0]
jmp 0x10045d65
movsd xmm0, qword [0x1008f1e8]
sub esp, 8
movsd qword [esp], xmm0
push 0
push 0x1555
push dword [esi + edi + 0x7c]
push dword [esi + edi + 0x78]
call fcn.1007f810
push edx
push eax
mov eax, dword [esi + edi + 0x98]
cdq
push edx
push eax
push 0x1008e6b8
push 0xa
call fcn.100520e0
mov eax, dword [ebp + 0xc]
add esp, 0x20
lea ecx, [eax + eax*4]
mov eax, dword [ebx + 0x401c]
shl ecx, 5
mov eax, dword [ecx + eax + 0x98]
test eax, eax
jne 0x10045dc8
mov eax, 0xffffff9c
or edx, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14
cdq
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14
mov ebx, dword [esp + 0x28]
test ebx, ebx
jle 0x10045df2
mov esi, ebx
lea ecx, [ecx]
push 0x1008e6b4
push 0xa
call fcn.100520e0
add esp, 8
dec esi
jne 0x10045de0
movsx eax, word [ebp + 2]
mov edi, dword [esp + 0x2c]
cdq
push edx
push eax
push dword [ebp + 4]
movsx eax, byte [ebp]
push eax
push edi
push 0x1008e6f0
push 0xa
call fcn.100520e0
mov ecx, dword [esp + 0x30]
lea esi, [ebx + 1]
mov ebx, dword [esp + 0x3c]
add esp, 0x1c
push edi
push esi
push dword [esp + 0x2c]
push ebx
push dword [ebp + 8]
call fcn.10045ce0
mov ecx, dword [ebp + 8]
push edi
push esi
push dword [esp + 0x2c]
inc ecx
mov dword [esp + 0x34], eax
push ebx
push ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x30], edx
call fcn.10045ce0
mov esi, dword [esp + 0x28]
mov ecx, 0x200
mov edi, dword [esp + 0x1c]
add esi, eax
movsx eax, word [ebp + 2]
adc edi, edx
cdq
idiv ebx
mov word [ebp + 2], ax
cmp ax, cx
jle 0x10045e71
mov word [ebp + 2], cx
cmp word [ebp + 2], 1
jge 0x10045e81
mov eax, 1
mov word [ebp + 2], ax
movzx ecx, word [ebp + 2]
cmp cx, 0xf
jle 0x10045e92
and ecx, 0xfffffff8
mov word [ebp + 2], cx
mov eax, dword [esp + 0x24]
cdq
cmp edi, edx
jg 0x10045ea5
jl 0x10045ea1
cmp esi, eax
jae 0x10045ea5
mov byte [ebp], 0xff
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14
Function at 0x1004dad0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100815b6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10097288]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
lea ecx, [edi + 0x3c]
movdqu xmm0, xmmword [esi]
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esi + 0x10]
movdqu xmmword [edi + 0x10], xmm0
movdqu xmm0, xmmword [esi + 0x20]
movdqu xmmword [edi + 0x20], xmm0
movq xmm0, qword [esi + 0x30]
movq qword [edi + 0x30], xmm0
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
lea eax, [esi + 0x3c]
push eax
call fcn.1004dfc0
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x50]
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
lea eax, [esi + 0x50]
push eax
call fcn.1004dd60
lea eax, [esi + 0x5c]
mov byte [esp + 0x18], 1
push eax
lea ecx, [edi + 0x5c]
call fcn.1004dd60
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov al, byte [esi + 0x6c]
mov byte [edi + 0x6c], al
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1004f380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
mov ebx, ecx
mov dword [esp + 4], ebx
push ebp
push esi
mov ecx, dword [ebx + 8]
push edi
mov edi, dword [esp + 0x2c]
dec eax
je 0x1004f3b5
dec eax
je 0x1004f3ad
dec eax
je 0x1004f3a5
mov esi, ecx
jmp 0x1004f3b8
lea esi, [edi + 0x14]
lea esi, [ecx + esi*2]
jmp 0x1004f3b8
lea esi, [edi + 2]
lea esi, [ecx + esi*2]
jmp 0x1004f3b8
lea esi, [ecx + 2]
cmp byte [esp + 0x30], 0
je 0x1004f3c4
movzx edx, word [esi]
jmp 0x1004f3ce
movzx eax, word [esi]
mov edx, 0x1000
sub edx, eax
movzx eax, word [edx*2 + 0x1009f7e0]
cdq
add dword [ecx + 0x48], eax
movzx eax, byte [esp + 0x30]
adc dword [ecx + 0x4c], edx
movzx ecx, word [esi]
shl eax, 0xc
add ecx, eax
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
mov byte [esp + 0x2c], 0xff
mov ax, word [eax + ecx*2]
mov word [esi], ax
mov ebp, dword [ebx + 8]
xor ebx, ebx
mov ecx, dword [ebp + 0x40]
lea esi, [ebp + 0x3c]
sub ecx, dword [esi]
mov eax, dword [ebp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x4c]
mov dword [esp + 0x1c], eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1004f519
mov eax, dword [ebp + 0x50]
xor ebp, ebp
mov dword [esp + 0x14], eax
lea esp, [esp]
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, ebx
shr eax, 5
lea edx, [ecx + eax*4]
mov ecx, ebx
and ecx, 0x1f
mov eax, 1
shl eax, cl
test dword [edx], eax
mov ecx, dword [esi]
mov eax, dword [esp + 0x28]
jne 0x1004f46a
add ecx, 0x3c
add ecx, ebp
dec eax
je 0x1004f485
dec eax
je 0x1004f47d
dec eax
jne 0x1004f488
lea ecx, [ecx + edi*2]
add ecx, 0x28
jmp 0x1004f488
lea ecx, [ecx + edi*2]
add ecx, 4
jmp 0x1004f488
add ecx, 2
cmp byte [esp + 0x30], 0
mov eax, dword [esp + 0x14]
lea esi, [eax + ebx*8]
je 0x1004f49b
movzx edx, word [ecx]
jmp 0x1004f4a5
movzx eax, word [ecx]
mov edx, 0x1000
sub edx, eax
movzx eax, word [edx*2 + 0x1009f7e0]
cdq
add dword [esi], eax
adc dword [esi + 4], edx
mov esi, dword [esp + 0x10]
movzx edx, word [ecx]
add edx, dword [esp + 0x20]
mov eax, dword [esi]
mov ax, word [eax + edx*2]
mov word [ecx], ax
mov esi, dword [esi + 8]
mov ecx, dword [esi + 0x50]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + ebx*8]
mov ecx, dword [ecx + ebx*8 + 4]
cmp ecx, dword [esp + 0x1c]
ja 0x1004f4f2
jb 0x1004f4e6
cmp eax, dword [esp + 0x18]
jae 0x1004f4f2
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x2c], bl
mov ecx, dword [esi + 0x40]
add esi, 0x3c
mov eax, 0x88888889
inc ebx
add ebp, 0x78
sub ecx, dword [esi]
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x1004f440
mov eax, dword [esp + 0x10]
mov cl, byte [esp + 0x2c]
pop edi
pop esi
mov eax, dword [eax + 8]
pop ebp
pop ebx
mov byte [eax + 0x6c], cl
add esp, 0x14
ret 0xc
Function at 0x1006d8e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, edx
lea eax, [ebx + 2]
xor esi, esi
mov ebp, ecx
cmp eax, edi
jae 0x1006d915
movzx esi, byte [ebx + ebp + 2]
movzx eax, byte [ebx + ebp + 1]
shl esi, 4
xor esi, eax
movzx eax, byte [ebx + ebp]
shl esi, 4
xor esi, eax
pop edi
movzx eax, si
pop esi
pop ebp
pop ebx
ret
cmp ebx, edi
jb 0x1006d920
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, esi
sub edi, ebx
je 0x1006d940
xor ecx, ecx
add ebx, ebp
lea ebx, [ebx]
movzx eax, byte [ebx + edx]
inc edx
shl eax, cl
add ecx, 8
xor esi, eax
cmp edx, edi
jne 0x1006d930
pop edi
movzx eax, si
pop esi
pop ebp
pop ebx
ret
Function at 0x100017f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.1024a480
add esp, 0xc
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [0x104ff31c], 0
lea edx, [ebp - 0x108]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10001876
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0x1000186b
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0x1000186b
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
add ecx, 0x20
mov edx, dword [ebp - 4]
mov byte [edx], cl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1000183d
push str.powershell.exe
lea ecx, [ebp - 0x108]
push ecx
call fcn.1024a5e0
add esp, 8
test eax, eax
je 0x100018c8
mov dword [0x104ff324], 1
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x104ff318], eax
push 0x104ff30c
push 0
push 0
push 0x10001700
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x104ff320], eax
mov esp, ebp
pop ebp
ret

Function at 0x10035a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x10035a9b
jmp 0x10035aca
cmp dword [0x104ff474], 0
je 0x10035ab1
mov eax, dword [ebp + 0xc]
push eax
call dword [0x104ff474]
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
push str.error:__s_n
call dword [0x103a5d0c]
add esp, 8
push 0xfffffffffffffffb
call fcn.10259a35
pop ebp
ret

Function at 0x100367c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push eax
call fcn.10251edf
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10036802
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 4], 0
jg 0x10036810
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
jmp 0x10036828
mov edx, dword [ebp - 4]
and edx, 0xffff
or edx, 0x70000
or edx, 0x80000000
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10037d10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x620], 0
cmp dword [ebp + 0xc], 0
je 0x10037d3a
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x104
jae 0x10037d4a
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x104
xor eax, eax
jmp 0x10037ea9
lea ecx, [ebp - 0x620]
push ecx
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x10037e93
mov dx, word [0x103daa88]
mov word [ebp - 4], dx
mov al, byte [0x103daa8a]
mov byte [ebp - 2], al
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x620]
mov dword [ebp - 8], ecx
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 8]
mov dl, byte [ecx]
mov byte [ebp + eax - 4], dl
push 0x104
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x10037e63
lea edx, [ebp - 0x11c]
push edx
call fcn.1024e180
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x104
jae 0x10037e63
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10259d26
add esp, 0xc
test eax, eax
jne 0x10037df9
mov dword [ebp - 0x14], 1
jmp 0x10037e00
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10037e63
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x10037e63
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x103daa80
push 0x104
lea edx, [ebp - 0x220]
push edx
call fcn.10037990
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
call fcn.1024e180
add esp, 4
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call fcn.10037910
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0
je 0x10037e7d
jmp 0x10037e63
cmp dword [ebp - 0x10], 0
jne 0x10037e91
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x10037d87
jmp 0x10037ea4
push str.TranslatePathFromDeviceToLetter:_GetLogicalDriveStrings_failed
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x10037ea9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10037eb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x10037ec0
xor eax, eax
jmp 0x10037f09
cmp dword [0x1065f9e4], 0
jne 0x10037ed4
push 0x1065f9e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1065f9e4], 0
jne 0x10037eee
push str.GetAllocationBase:_Failed_to_obtain_system_page_size._n
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x10037f09
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x10037f06
xor eax, eax
jmp 0x10037f09
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x10037f10
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x10037f20
xor eax, eax
jmp 0x10037f69
cmp dword [0x1065f9e4], 0
jne 0x10037f34
push 0x1065f9e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1065f9e4], 0
jne 0x10037f4e
push str.GetBaseAddress:_Failed_to_obtain_system_page_size._n
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x10037f69
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x10037f66
xor eax, eax
jmp 0x10037f69
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret

Function at 0x10037f70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x10037f80
xor eax, eax
jmp 0x10037fda
cmp dword [0x1065f9e4], 0
jne 0x10037f94
push 0x1065f9e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1065f9e4], 0
jne 0x10037fae
push str.GetRegionSize:_Failed_to_obtain_system_page_size._n
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x10037fda
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x10037fd7
mov edx, dword [ebp + 8]
push edx
push str.GetRegionSize:_unable_to_query_memory_address_0x_p
call fcn.1003e700
add esp, 8
xor eax, eax
jmp 0x10037fda
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x10037ff0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 8], 0
jne 0x10038003
xor eax, eax
jmp 0x100380a8
cmp dword [0x1065f9e4], 0
jne 0x10038017
push 0x1065f9e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1065f9e4], 0
jne 0x10038031
push str.GetAllocationSize:_Failed_to_obtain_system_page_size._n
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x100380a8
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x1003805a
mov edx, dword [ebp + 8]
push edx
push str.GetAllocationSize:_unable_to_query_memory_address_0x_p
call fcn.1003e700
add esp, 8
xor eax, eax
jmp 0x100380a8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
jne 0x100380a2
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x100380a0
mov eax, dword [ebp - 4]
push eax
push str.GetAllocationSize:_unable_to_query_memory_page_0x_p
call fcn.1003e700
add esp, 8
xor eax, eax
jmp 0x100380a8
jmp 0x10038066
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x100380b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x100380be
jmp 0x1003810f
cmp dword [0x1065f9e4], 0
jne 0x100380d2
push 0x1065f9e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1065f9e4], 0
jne 0x100380ea
push str.GetMemoryInfo:_Failed_to_obtain_system_page_size._n
call fcn.1003e700
add esp, 4
jmp 0x1003810f
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x1003810f
mov edx, dword [ebp + 8]
push edx
push str.GetMemoryInfo:_unable_to_query_memory_address_0x_p
call fcn.1003e700
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x10038120
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [ebp + 8], 0
jne 0x10038133
xor eax, eax
jmp 0x10038203
cmp dword [0x1065f9e4], 0
jne 0x10038147
push 0x1065f9e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1065f9e4], 0
jne 0x10038164
push str.GetAccessibleSize:_Failed_to_obtain_system_page_size._n
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x10038203
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x1003818d
mov edx, dword [ebp + 8]
push edx
push str.GetAccessibleSize:_unable_to_query_memory_address_0x_p
call fcn.1003e700
add esp, 8
xor eax, eax
jmp 0x10038203
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
jne 0x100381fd
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x100381d9
mov eax, dword [ebp - 4]
add eax, dword [0x1065f9e4]
push eax
push str.GetAccessibleSize:_unable_to_query_memory_page_0x_p
call fcn.1003e700
add esp, 8
xor eax, eax
jmp 0x10038203
mov ecx, dword [ebp - 0x10]
and ecx, 0xee
jne 0x100381e6
jmp 0x100381fd
mov edx, dword [ebp - 0x10]
and edx, 0x101
je 0x100381f3
jmp 0x100381fd
cmp dword [ebp - 0x10], 0
jne 0x100381fb
jmp 0x100381fd
jmp 0x10038199
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10038210
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x10038223
xor eax, eax
jmp 0x100382a6
cmp dword [0x1065f9e4], 0
jne 0x10038237
push 0x1065f9e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1065f9e4], 0
jne 0x10038251
push str.IsAddressAccessible:_Failed_to_obtain_system_page_size._n
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x100382a6
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10079430
add esp, 8
test eax, eax
jne 0x1003827a
mov edx, dword [ebp + 8]
push edx
push str.IsAddressAccessible:_unable_to_query_memory_address_0x_p
call fcn.1003e700
add esp, 8
xor eax, eax
jmp 0x100382a6
mov eax, dword [ebp - 8]
and eax, 0xee
jne 0x10038288
xor eax, eax
jmp 0x100382a6
mov ecx, dword [ebp - 8]
and ecx, 0x101
je 0x10038297
xor eax, eax
jmp 0x100382a6
cmp dword [ebp - 8], 0
jne 0x100382a1
xor eax, eax
jmp 0x100382a6
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100383f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x104
call fcn.100730e0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10038421
push str.GetResultsPath:_Error_allocating_memory_for_full_path_string
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x10038529
push 0x104
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.1024a480
add esp, 0xc
mov ecx, 1
imul edx, ecx, 0
movsx eax, byte [edx + 0x104f1fa4]
test eax, eax
je 0x10038470
push 0x104f1fa4
call fcn.1024e180
add esp, 4
add eax, 1
push eax
push 0x104f1fa4
push 0x104
mov ecx, dword [ebp - 4]
push ecx
call fcn.10259d1b
add esp, 0x10
jmp 0x10038488
push 0xc
push str.C:_windows_
push 0x104
mov edx, dword [ebp - 4]
push edx
call fcn.10259d1b
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x10038526
mov eax, dword [ebp - 4]
push eax
call fcn.1024e180
add esp, 4
mov esi, eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1024e180
add esp, 4
lea edx, [esi + eax + 1]
cmp edx, 0x104
jb 0x100384d5
push str.GetResultsPath:_Error__destination_path_too_long._n
call fcn.1003cfa0
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.100731f0
add esp, 4
xor eax, eax
jmp 0x10038529
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10038526
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10038526
mov ecx, dword [ebp - 4]
push ecx
push str.GetResultsPath:_Error_creating_output_directory__s
call fcn.1003e700
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.100731f0
add esp, 4
xor eax, eax
jmp 0x10038529
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10038bc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x10038bda
push str.GetPageAddress:_Error___Supplied_address_zero._n
call fcn.1003cfa0
add esp, 4
xor eax, eax
jmp 0x10038c1a
cmp dword [0x1065f9e4], 0
jne 0x10038bee
push 0x1065f9e0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x1065f9e4], 0
jne 0x10038c08
push str.GetPageAddress:_Failed_to_obtain_system_page_size._n
call fcn.1003e700
add esp, 4
xor eax, eax
jmp 0x10038c1a
mov eax, dword [ebp + 8]
xor edx, edx
div dword [0x1065f9e4]
imul eax, dword [0x1065f9e4]
pop ebp
ret