joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10852b6
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1099a38]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push edi
push 0x104
lea edx, [ebp - 0x20c]
push edx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
push edi
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextW]
test eax, eax
lea eax, [ebp - 0x20c]
je 0x1085325
push edi
push edi
push eax
call sub.msvcrt.dll_wcstoul
push eax
push 0x102ab3c
push esi
push 0x102ab28
lea eax, [ebp - 0x20c]
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x24
jmp 0x1085341
push dword [ebp + 0x18]
push 0x102ab3c
push esi
push 0x102ab28
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
push edi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0x14

Function at 0x1085376
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0106bfb4
mov eax, dword [0x1099a38]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x100c], eax
xor eax, eax
mov ecx, 0x200
lea edi, [ebp - 0x804]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1010]
push eax
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x1004]
push eax
push ebx
push dword [ebp - 0x1008]
xor edi, edi
push edx
push edi
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetLineTextW]
cmp eax, edi
mov dword [ebp - 0x1008], eax
jne 0x1085423
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x108540a
push dword [ebp - 0x1010]
push ebx
push 0x102ab74
call fcn.01071ac0
add esp, 0xc
jmp 0x108548d
push 0x400
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0x14]
push edi
call fcn.01031fb1
test eax, eax
je 0x108548d
lea eax, [ebp - 0x1004]
push eax
push 0x102ab3c
push ebx
push 0x102ab60
lea eax, [ebp - 0x804]
push esi
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x18
push edi
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x100c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1085483
push ebx
push 0x102ab40
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x108548d
mov dword [ebp - 0x1008], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1008]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 0x14
Function at 0x1085502
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1085560
cmp dword [ebp + 0xc], 0x104
jb 0x1085560
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x102aba8
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1085560
push edi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push esi
push esi
push 0x102aba0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x1085560
inc esi
mov eax, esi
pop esi
leave
ret 8

Function at 0x1085567
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1099a38]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], eax
je 0x10855ff
mov eax, 0x104
cmp dword [ebp + 0xc], eax
jb 0x10855ff
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x10855af
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102ac1c
jmp 0x10855f3
lea eax, [ebp - 0x20c]
push eax
push 0x102ac0c
lea eax, [ebp - 0x414]
push 0x103
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x10
push esi
push edi
push 0x102ac04
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10855fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102abe0
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x10855ff
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0106bc50
leave
ret 8

Function at 0x108560f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1099a38]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], eax
je 0x10856a7
mov eax, 0x104
cmp dword [ebp + 0xc], eax
jb 0x10856a7
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1085657
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102ac1c
jmp 0x108569b
lea eax, [ebp - 0x108]
push eax
push 0x102ac44
lea eax, [ebp - 0x20c]
push 0x103
push eax
call sub.msvcrt.dll__snprintf
add esp, 0x10
push esi
push edi
push 0x102ac40
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x10856a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x102abe0
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x10856a7
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0106bc50
leave
ret 8
Function at 0x10856b7
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1099a38]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
xor eax, eax
cmp esi, 0x400
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x418], eax
jb 0x10857ff
cmp edi, eax
je 0x10857ff
mov dword [edi], eax
cmp byte [0x10f6840], al
je 0x10857ff
push ebx
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0xffffffffffffffff
mov ebx, 0x10f6840
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1085747
and dword [ebp - 0x418], eax
push ebx
push 0x102ac6c
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x10857fe
cmp dword [0x109ab70], 0
jne 0x10857bf
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01085567
test eax, eax
je 0x10857fe
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
jne 0x10857a0
lea eax, [ebp - 0x414]
push eax
push 0x102ac4c
call fcn.01071ac0
add esp, 0xc
jmp 0x10857fe
lea ebx, [esi - 1]
mov esi, 0x1019670
push esi
push ebx
push dword [ebp - 0x420]
call sub.msvcrt.dll__snwprintf
mov dword [edi], eax
lea eax, [ebp - 0x20c]
jmp 0x10857e3
lea eax, [ebp - 0x414]
push eax
lea ebx, [esi - 1]
mov esi, 0x1019670
push esi
push ebx
push dword [ebp - 0x420]
call sub.msvcrt.dll__snwprintf
mov dword [edi], eax
lea eax, [ebp - 0x414]
push eax
push esi
push ebx
push dword [ebp - 0x41c]
call sub.msvcrt.dll__snwprintf
add esp, 0x20
mov dword [ebp - 0x418], 1
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
pop esi
call fcn.0106bc50
leave
ret 0x10
Function at 0x1087602
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push 0x20
push 0x102b3d8
call fcn.0106bf63
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x20]
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [ebp - 0x30], eax
cmp eax, ebx
jl 0x108768f
push 0xff8
push 8
push dword [0x1116ab8]
call esi
mov edi, eax
mov dword [ebp - 0x24], edi
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x2c], esi
push dword [ebp + 0xc]
push esi
call fcn.010875b1
mov byte [ebp - 0x19], al
cmp al, bl
je 0x108766c
push esi
push edi
call fcn.010874e9
mov eax, dword [esi]
cmp eax, ebx
jne 0x108768b
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebp - 0x24], ebx
or dword [ebp - 4], 0xffffffff
call fcn.010876d5
call fcn.0106bf9e
ret 8
add esi, eax
jmp 0x1087652
cmp eax, 0xc0000004
je 0x10876a7
mov dword [0x1116ab4], 0x4ab
push eax
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
cmp dword [ebp - 0x20], ebx
je 0x10876bf
push dword [ebp - 0x20]
push ebx
push dword [0x1116ab8]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x28]
push ebx
push dword [0x1116ab8]
call esi
mov dword [ebp - 0x20], eax
jmp 0x1087622
Function at 0x108874f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1099a38]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x214]
push eax
call fcn.01088615
test eax, eax
jne 0x108881c
lea eax, [ebp - 0x214]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1088788
mov ecx, dword [ebp + 8]
sub eax, edx
push esi
mov esi, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x108879a
sub ecx, edx
lea eax, [ecx + esi + 1]
cmp eax, 0x104
jbe 0x10887b3
push 0x7a
pop eax
jmp 0x108881b
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10887be
lea eax, [ebp - 0x10c]
push 0x102b518
push eax
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
jne 0x10887e3
push 0x57
jmp 0x10887b0
push edi
mov edi, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x214]
mov esi, 0x102b510
push eax
movsd dword es:[edi], dword [esi]
push 0x1020a90
push ebx
movsb byte es:[edi], byte [esi]
call fcn.0106bf51
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop edi
jne 0x1088819
mov byte [ebx], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0106bc50
leave
ret 8

Function at 0x1088829
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1099a38]
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call fcn.010886d9
test eax, eax
jne 0x1088873
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x108886e
test al, 0x50
jne 0x108886e
mov dword [esi], 1
jmp 0x1088871
and dword [esi], 0
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.0106bc50
leave
ret 4
Function at 0x108a83c
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
mov esi, ecx
je 0x108a944
cmp byte [edi], bl
je 0x108a944
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x108a944
mov dword [eax], ebx
cmp dword [esi], 0xffffffff
je 0x108a875
xor eax, eax
inc eax
jmp 0x108a947
push ebx
push dword [ebp + 0x18]
push 3
push ebx
push dword [ebp + 0x14]
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x108a8ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
push esi
push 0x102be44
push 0x102be1c
jmp 0x108a92f
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x108a8d9
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x108a8d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov esi, eax
push esi
push 0x102be44
push 0x102bdf4
jmp 0x108a92f
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x108a906
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov esi, eax
push esi
push 0x102be44
push 0x102bdc4
jmp 0x108a92f
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [esi + 8], eax
jne 0x108a93b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov esi, eax
push esi
push 0x102be44
push 0x102bd90
call fcn.01071aea
add esp, 0x10
mov eax, esi
jmp 0x108a947
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x108a947
push 0x57
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x108a9c8
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
jmp 0x108aa08
and dword [ebp + 0x10], 0
cmp ebx, 0x100000
mov esi, ebx
jbe 0x108a9e7
mov esi, 0x100000
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x108aa1c
cmp dword [ebp + 0x10], esi
jne 0x108aa14
sub ebx, esi
add dword [ebp + 0xc], esi
test ebx, ebx
jne 0x108a9d4
mov al, 1
pop esi
pop ebx
pop ebp
ret 0xc
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x108aa0e
Function at 0x108c7d7
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
push edi
push 0x8000000
push 3
push edi
push 3
mov esi, ecx
push 0x80000000
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x108c823
push dword [esi + 0x10]
push 0x102c910
push 0x102c8f0
call fcn.01071aea
add esp, 0xc
push 0x57
pop eax
jmp 0x108c8f1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x108c854
push dword [esi + 0x10]
push 0x102c910
push 0x102c8c8
call fcn.01071aea
add esp, 0xc
mov dword [ebp - 8], 0x57
jmp 0x108c8e5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x108c88b
push dword [ebp - 4]
push 0x102c910
push 0x102c89c
call fcn.01071aea
add esp, 0xc
mov dword [ebp - 8], 0xe
jmp 0x108c8d2
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x108c8c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 0x10]
mov dword [ebp - 8], eax
push 0x102c910
push 0x102c878
call fcn.01071aea
add esp, 0x10
jmp 0x108c8d2
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 0xc]
call fcn.0108c552
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], edi
je 0x108c8e4
push dword [ebp - 0xc]
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x108cacf
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
push 0x8000000
push 3
push edi
push 3
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x108cb04
push 0x57
pop eax
jmp 0x108cba6
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esi + 0x28], eax
jne 0x108cb24
mov dword [ebp + 8], 0x57
jmp 0x108cb73
push eax
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, edi
mov dword [esi + 0x24], eax
jne 0x108cb3f
mov dword [ebp + 8], 0xe
jmp 0x108cb73
mov ecx, dword [esi + 0x28]
push edi
lea edx, [ebp - 4]
push edx
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x108cb64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x108cb73
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x28]
je 0x108cb8d
mov dword [ebp + 8], 0xd
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x108cb88
push eax
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x24], edi
mov eax, dword [ebp + 8]
jmp 0x108cba5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi + 0x28]
mov ecx, esi
push dword [esi + 0x24]
call fcn.0108d1a6
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x108d78f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x102c978
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x108d7f8
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x102c960
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x108d7f8
cmp dword [ebp - 0xc], 4
jne 0x108d7f8
mov eax, dword [ebp - 0x10]
shr eax, 8
leave
ret
xor eax, eax
leave
ret

Function at 0x108d993
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
mov eax, edx
not eax
je 0x108d9b8
mov ecx, dword [ebp + 8]
push esi
movzx esi, word [ecx]
and esi, 0xffffffdf
rol eax, 3
xor eax, esi
inc ecx
inc ecx
dec edx
jne 0x108d9a7
pop esi
pop ebp
ret 8
Function at 0x108dde7
Capabilities:
Enumerate files on windows

Disassembly:
push 0x268
push 0x102ca80
call fcn.0106bf63
mov eax, dword [0x1099a38]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x270], edi
or dword [ebp - 0x274], 0xffffffff
mov dword [ebp - 4], edi
mov ecx, 0x40000
call fcn.0108d854
mov dword [0x1116d1c], eax
cmp esi, edi
je 0x108de39
push 0x105
push esi
call fcn.0108d8d3
mov dword [ebp - 0x270], eax
jmp 0x108de5c
push 0x13e
push 0x1116ae0
call fcn.0108db3e
mov dword [ebp - 0x270], eax
push 0x102ca08
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push edi
push dword [ebp - 0x270]
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, eax
mov dword [ebp - 0x278], edi
mov word [edi], 0x5c
inc edi
inc edi
mov dword [ebp - 0x278], edi
push 0x102c9fc
push edi
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
call esi
add esp, 0x10
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x274], eax
cmp eax, 0xffffffff
jne 0x108dee1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
je 0x108debd
call ebx
jmp 0x108dec2
mov eax, 0xe00b0000
mov dword [0x1116d2c], eax
mov dword [0x1116d28], 0x5d6
xor eax, eax
push eax
push eax
push eax
push 0xe00bffff
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea eax, [ebp - 0x240]
push eax
push edi
call esi
pop ecx
pop ecx
push dword [ebp + 0xc]
push dword [ebp - 0x270]
call fcn.0108dbce
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x108dee1
or dword [ebp - 4], 0xffffffff
call fcn.0108df2b
mov ecx, dword [ebp - 0x1c]
call fcn.0106bc50
call fcn.0106bf9e
ret 8
Function at 0x108df50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x1c
push 0x102ca90
call fcn.0106bf63
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jne 0x108df72
xor eax, eax
jmp 0x108e064
mov dword [edi], ebx
push ebx
push ebx
push ebx
push 2
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x108e01f
push ebx
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x108e01f
mov esi, eax
or esi, 1
mov dword [ebp - 4], ebx
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x108e009
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp esi, ebx
je 0x108e009
movzx eax, word [esi]
mov ecx, eax
shr ecx, 1
add ecx, eax
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [edi], eax
cmp eax, ebx
je 0x108e009
movzx ecx, word [esi]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x20], 1
mov edi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
jmp 0x108e01f
cmp dword [ebp - 0x24], ebx
je 0x108e02d
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], ebx
je 0x108e03b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [edi]
cmp eax, ebx
je 0x108e061
cmp dword [ebp - 0x20], ebx
jne 0x108e061
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [edi]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x20]
call fcn.0106bf9e
ret 8
Function at 0x108e757
Capabilities:
Get common file path

Disassembly:
push 0x10
push 0x102cbc8
call fcn.0106bf63
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov esi, 0xe00bffff
cmp dword [0x1116d30], ebx
je 0x108e796
mov dword [0x1116d2c], 0xe00b0002
mov dword [0x1116d28], 0x55
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 4], 1
push ebx
push 0x100000
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1116d30], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x108e7e1
call edi
test eax, eax
je 0x108e7c3
call edi
jmp 0x108e7c8
mov eax, 0xe00b0000
mov dword [0x1116d2c], eax
mov dword [0x1116d28], 0x62
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x105
push 0x1116ae0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x108e81d
call edi
test eax, eax
je 0x108e7ff
call edi
jmp 0x108e804
mov eax, 0xe00b0000
mov dword [0x1116d2c], eax
mov dword [0x1116d28], 0x6c
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
push 0x1116ae0
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x108e83c
cmp word [eax + 2], bx
jne 0x108e83c
mov word [eax], bx
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
test edi, esi
je 0x108e84e
call fcn.0108d78f
mov dword [ebp + 0xc], eax
test esi, 2
jne 0x108e861
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0108e4cd
test esi, 4
jne 0x108e87c
call fcn.0108d6ec
shr esi, 3
and esi, edi
push esi
push dword [ebp + 0x14]
call fcn.0108dde7
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
call fcn.0108e88b
jmp 0x108e8b9
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
call fcn.0106bf9e
ret 0x10

Function at 0x108ec69
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push dword [ebp + 8]
xor edi, edi
inc edi
call esi
cmp eax, 0xffffffff
jne 0x108ec96
push dword [ebp + 8]
push 0x102ccac
push edi
call fcn.0108e8f0
add esp, 0xc
xor edi, edi
push dword [ebp + 0xc]
call esi
cmp eax, 0xffffffff
jne 0x108ecb4
push dword [ebp + 0xc]
push 0x102cc78
push 1
call fcn.0108e8f0
add esp, 0xc
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 8