joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000dadd
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
lea ebp, [esp - 0x3dc]
sub esp, 0x45c
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x3d8], eax
mov eax, dword [ebp + 0x3ec]
push ebx
push str.Floppy
push eax
call fcn.10040c70
pop ecx
test eax, eax
mov eax, dword [ebp + 0x3e8]
pop ecx
setne cl
dec eax
dec eax
push 0
pop ebx
je 0x1000db35
dec eax
je 0x1000db40
dec eax
dec eax
je 0x1000db2c
xor eax, eax
jmp 0x1000dc67
mov dword [ebp - 0x68], 0x1006d30c
jmp 0x1000db47
mov dword [ebp - 0x68], 0x1006d31c
cmp cl, bl
jne 0x1000db47
mov dword [ebp - 0x68], 0x1006d2fc
push 0x12
push ebx
push ebx
push dword [ebp - 0x68]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 0x64], eax
cmp eax, 0xffffffff
je 0x1000db25
push esi
push 0x3ff
lea eax, [ebp - 0x27]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x28], bl
call fcn.10040850
add esp, 0xc
push 0x1c
pop esi
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x44], esi
push dword [ebp - 0x68]
push ebx
push dword [ebp - 0x64]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
test eax, eax
je 0x1000dc5a
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
cmp dword [ebp - 0x6c], ebx
je 0x1000dc4a
cmp dword [ebp - 0x6c], 0x400
ja 0x1000dc4a
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x60], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
je 0x1000dc4a
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000dc4a
push ebx
lea eax, [ebp - 0x74]
push eax
push 0xc
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x2d1080
push edi
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1000dc43
mov eax, dword [ebp + 0x3e4]
cmp eax, dword [ebp - 0x7c]
je 0x1000dc7d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x1f4
jl 0x1000db79
push dword [ebp - 0x64]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp + 0x3d8]
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x3dc
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x64]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [ebp - 0x4c]
jmp 0x1000dc65
Function at 0x1000e0b5
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
mov esi, dword [ebp + 0x1a8]
push edi
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1b0]
push ebx
push esi
mov dword [ebp - 0x70], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jne 0x1000e16e
push 0x1ff
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.10040850
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.1003d08f
lea eax, [ebp - 0x64]
push 0x2e
push eax
call fcn.10040730
add esp, 0x1c
cmp eax, ebx
je 0x1000e16a
mov byte [eax], bl
mov eax, dword [ebp - 0x70]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000e130
sub eax, esi
cmp dword [ebp + 0x1b4], eax
jae 0x1000e14f
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x70]
call fcn.100074d8
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x1a0
leave
ret
xor eax, eax
jmp 0x1000e152
push edi
call fcn.10040c33
push edi
push ebx
push eax
mov dword [ebp - 0x68], eax
call fcn.10007496
add esp, 0x10
push dword [ebp - 0x68]
push edi
push ebx
push esi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1000e19e
push dword [ebp - 0x68]
call fcn.10040b8d
pop ecx
mov eax, ebx
jmp 0x1000e152
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x68]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x6c], ebx
call sub.VERSION.dll_VerQueryValueA
cmp dword [ebp - 0x74], ebx
je 0x1000e1f5
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax + 2]
push dword [ebp - 0x80]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x64]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.10040b98
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
call sub.VERSION.dll_VerQueryValueA
cmp dword [ebp - 0x6c], ebx
je 0x1000e217
mov esi, dword [ebp + 0x1b4]
mov edi, dword [ebp - 0x70]
lea eax, [esi - 1]
push eax
push dword [ebp - 0x6c]
push edi
call fcn.1000752a
add esp, 0xc
mov byte [edi + esi - 1], bl
xor ebx, ebx
inc ebx
jmp 0x1000e191
Function at 0x1000e21f
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x18c], eax
or dword [ebp - 0x78], 0xffffffff
push ebx
xor ebx, ebx
cmp dword [0x101434ac], 4
push esi
jne 0x1000e258
push str.Is_MouseClickCheck_
push ebx
call fcn.1003dfed
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1000e364
push edi
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, eax
cmp edi, ebx
je 0x1000e363
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [0x101434ac], 4
jne 0x1000e2a7
push dword [ebp - 0x78]
push edi
push str.Is_MouseClickCheck_sub__d___d_
push ebx
call fcn.1003dfed
add esp, 0x10
mov eax, dword [ebp - 0x78]
cmp eax, dword [0x1013ee84]
jne 0x1000e324
push 0x1ff
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.10040850
add esp, 0xc
mov esi, 0x200
push esi
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x1000e31c
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.ConsoleWindowClass
lea eax, [ebp - 0x74]
push eax
call ebx
test eax, eax
je 0x1000e31c
push esi
lea eax, [ebp - 0x74]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x1000e31c
push 0x10142848
lea eax, [ebp - 0x74]
push eax
call ebx
test eax, eax
je 0x1000e31c
mov dword [0x100724a8], 0x5b6a7988
jmp 0x1000e363
push edi
call fcn.1003accc
jmp 0x1000e362
cmp eax, ebx
je 0x1000e363
cmp eax, dword [0x1016e46c]
je 0x1000e348
cmp eax, dword [0x1016e470]
je 0x1000e348
cmp eax, dword [0x1016e474]
je 0x1000e348
cmp eax, dword [0x1016e478]
jne 0x1000e363
call fcn.10034bb6
cmp dword [0x101434ac], 4
jne 0x1000e363
push str.MouseClickCheck_5
push ebx
call fcn.1003dfed
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp + 0x18c]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x190
leave
ret
Function at 0x1000e5f8
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x388]
sub esp, 0x408
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x384], eax
mov eax, dword [ebp + 0x394]
push esi
mov esi, dword [ebp + 0x390]
mov dword [ebp - 0x80], eax
test eax, eax
jne 0x1000e62e
mov al, 1
jmp 0x1000e79c
push ebx
push 0x1005f540
push esi
mov ebx, esi
call fcn.10040c70
pop ecx
pop ecx
cmp eax, esi
jne 0x1000e645
lea ebx, [esi + 4]
mov esi, 0x1ff
push esi
lea eax, [ebp + 0x185]
push 0
push eax
mov byte [ebp + 0x184], 0
call fcn.10040850
mov eax, ebx
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000e668
push edi
sub eax, ecx
mov edi, 0x200
cmp eax, edi
jae 0x1000e68a
lea eax, [ebp + 0x184]
push ebx
push eax
call fcn.100074d8
pop ecx
pop ecx
cmp byte [ebp + 0x184], 0
je 0x1000e6a0
lea eax, [ebp + 0x184]
push eax
call fcn.10042449
pop ecx
cmp dword [0x10167b88], 0
je 0x1000e6b8
push ebx
call fcn.1000d9b3
pop ecx
test al, al
jne 0x1000e798
push esi
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.10040850
mov eax, dword [ebp - 0x80]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000e6d1
sub eax, ecx
cmp eax, edi
jae 0x1000e6ec
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
call fcn.100074d8
pop ecx
pop ecx
cmp byte [ebp - 0x7c], 0
je 0x1000e6fc
lea eax, [ebp - 0x7c]
push eax
call fcn.10042449
pop ecx
mov al, byte [ebp + 0x184]
cmp al, byte [ebp - 0x7c]
je 0x1000e794
cmp al, 0x41
jl 0x1000e713
cmp al, 0x5a
jle 0x1000e742
cmp byte [ebx], 0x5c
je 0x1000e742
cmp byte [ebx + 1], 0x5c
je 0x1000e742
cmp dword [0x10144ec4], 0
jne 0x1000e742
lea eax, [ebp + 0x184]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp + 0x184]
push eax
call fcn.10042449
pop ecx
cmp byte [0x102ca000], 0
jne 0x1000e750
call sym.TC_AD.DLL_FDrv
cmp byte [ebp + 0x185], 0x3a
jne 0x1000e771
movsx eax, byte [ebp + 0x184]
lea ecx, [eax - 0x41]
cmp ecx, 0x1a
jge 0x1000e771
cmp byte [eax + 0x102c9fbf], 3
je 0x1000e794
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000e776
sub eax, edx
cmp eax, 2
jbe 0x1000e798
mov al, byte [ebx + 1]
cmp al, 0x3a
je 0x1000e798
cmp byte [ebx], 0x5c
jne 0x1000e794
cmp al, 0x5c
je 0x1000e798
mov al, 1
jmp 0x1000e79a
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp + 0x384]
xor ecx, ebp
pop esi
call fcn.1004083f
add ebp, 0x388
leave
ret
Function at 0x1000f2be
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x188]
sub esp, 0x208
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x184], eax
test byte [0x1013ee90], 8
push ebx
push esi
mov esi, dword [ebp + 0x194]
push edi
mov dword [ebp - 0x80], 0xea60
je 0x1000f2f9
mov dword [ebp - 0x80], 0x2710
push 0x1ff
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.10040850
add esp, 0xc
cmp byte [esi], 0
je 0x1000f3cc
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000f31e
sub eax, edx
cmp eax, 0x200
jae 0x1000f3cc
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.100074d8
lea eax, [ebp - 0x7c]
push eax
call fcn.10042449
mov edi, dword [ebp + 0x190]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
mov ebx, 0x10081570
cmp dword [0x1013ec34], edi
jne 0x1000f3b3
cmp byte [0x10081570], 0
je 0x1000f3b3
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.10007480
pop ecx
pop ecx
test eax, eax
je 0x1000f3b3
call esi
mov ecx, dword [0x1008177c]
mov edx, dword [ebp - 0x80]
add ecx, edx
cmp ecx, eax
jbe 0x1000f3b3
cmp dword [0x101434ac], 0x48
jne 0x1000f3a7
lea eax, [ebp - 0x7c]
push eax
push str.SendInfoDisplayEDRL_dup___s
push 0
call fcn.1003dfed
add esp, 0xc
call esi
mov dword [0x1008177c], eax
xor eax, eax
inc eax
jmp 0x1000f3ce
lea eax, [ebp - 0x7c]
push eax
push ebx
call fcn.100074d8
pop ecx
pop ecx
call esi
mov dword [0x1008177c], eax
mov dword [0x1013ec34], edi
xor eax, eax
mov ecx, dword [ebp + 0x184]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x188
leave
ret
Function at 0x100103d6
Capabilities:
Get file size

Disassembly:
push ebp
lea ebp, [esp - 0xf8c]
mov eax, 0x100c
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0xf88], eax
mov ecx, dword [ebp + 0xf98]
push ebx
push edi
mov edi, dword [ebp + 0xf9c]
xor ebx, ebx
mov dword [ebp - 0x80], ecx
cmp edi, ebx
jne 0x10010413
xor eax, eax
jmp 0x100104ea
cmp edi, 0xffffffff
je 0x1001040c
mov eax, dword [ebp + 0xf94]
cmp eax, ebx
je 0x1001040c
cmp ecx, ebx
je 0x1001040c
cmp byte [eax], bl
je 0x1001040c
mov dl, byte [ecx]
cmp dl, bl
je 0x1001040c
mov eax, ecx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10010436
sub eax, esi
cmp eax, 0x1f6
ja 0x100104bf
cmp dword [0x10144ec8], ebx
je 0x1001046f
test dword [ebp + 0xfa0], 0x40000000
je 0x1001046f
push edx
call sym.TC_AD.DLL_isUSB
pop ecx
test al, al
jne 0x1001046a
cmp dl, 0x5c
jne 0x1001046f
or eax, 0xffffffff
jmp 0x100104e9
push 0xfff
lea eax, [ebp - 0x77]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], bl
call fcn.10040850
add esp, 0xc
test byte [0x1013dc2c], 1
je 0x10010496
push 2
push 2
jmp 0x100104d5
push ebx
lea eax, [ebp - 0x7c]
push eax
mov esi, 0x1000
push esi
lea eax, [ebp - 0x78]
push eax
push edi
call dword [0x101a7f18]
test eax, eax
je 0x100104bf
push ebx
push ebx
push ebx
push edi
call dword [0x101a7f14]
cmp dword [ebp - 0x7c], ebx
jg 0x100104c3
xor eax, eax
jmp 0x100104e9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x7c], esi
jg 0x100104d3
mov esi, dword [ebp - 0x7c]
push eax
push esi
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
mov ecx, 0x10171a78
call fcn.1002864d
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp + 0xf88]
pop edi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0xf8c
leave
ret
Function at 0x10010b03
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [0x1013f2ec]
inc eax
and eax, 0x1f
mov dword [0x1013f2ec], eax
imul eax, eax, 0x208
mov esi, 0x100cb988
add eax, esi
push 0x208
push eax
call fcn.100074a5
mov eax, dword [0x1013f2ec]
push dword [esp + 0x18]
imul eax, eax, 0x208
add eax, esi
push eax
call fcn.100074d8
mov eax, dword [0x1013f2ec]
imul eax, eax, 0x208
add esp, 0x10
mov dword [eax + 0x100cbb8c], ebx
mov dword [eax + 0x100cbb88], edi
pop edi
pop esi
pop ebx
ret

Function at 0x1001183d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x10011953
cmp byte [esi], bl
je 0x10011953
push str._USB
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1001187f
push 0x10
pop eax
jmp 0x10011955
mov cl, byte [esi]
cmp cl, 0x5c
jne 0x1001188a
push 0x20
jmp 0x10011879
cmp cl, 0x41
jl 0x10011894
cmp cl, 0x5a
jle 0x100118a6
cmp cl, 0x61
jl 0x10011953
cmp cl, 0x7a
jg 0x10011953
push edi
xor eax, eax
mov byte [ebp - 0xc], bl
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
movsx eax, cl
push eax
lea eax, [ebp - 0xc]
push str._c:_
push eax
call fcn.10040b98
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
pop edi
je 0x100118e4
dec eax
je 0x10011877
dec eax
dec eax
je 0x1001194c
dec eax
jne 0x10011953
mov eax, 0x80
jmp 0x10011955
cmp dword [0x10141c2c], ebx
je 0x10011953
push 0x1ff
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.10040850
movsx eax, byte [esi]
push eax
lea eax, [ebp - 0xc]
push 0x1005fc68
push eax
mov dword [ebp - 0x210], 0x200
call fcn.10040b98
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.MPR.dll_WNetGetConnectionA
cmp eax, ebx
je 0x1001194c
cmp eax, 0x8ca
je 0x1001194c
cmp eax, 0x4b1
jne 0x10011953
push 0x40
jmp 0x10011879
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
leave
ret
Function at 0x100119f4
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
cmp esi, ebx
je 0x10011ab6
cmp byte [esi], bl
je 0x10011ab6
cmp edi, ebx
je 0x10011ab6
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp byte [esi], 0x5c
jne 0x10011a48
inc esi
cmp byte [esi], 0x5c
jne 0x10011a48
inc esi
cmp dword [0x101434ac], ebx
je 0x10011a5f
push esi
push str.pre_gethostbyname___s_
push ebx
call fcn.1003dfed
add esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x10011aad
mov eax, dword [eax + 0xc]
cmp dword [eax], ebx
je 0x10011aad
push 4
push dword [eax]
lea eax, [ebp - 0x198]
push eax
call fcn.100074bf
add esp, 0xc
push dword [ebp - 0x198]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
cmp esi, ebx
je 0x10011ac5
cmp dword [0x101434ac], ebx
je 0x10011aad
push esi
push str.gethostbyname___s_
push ebx
call fcn.1003dfed
add esp, 0xc
push esi
push edi
call fcn.100074d8
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
leave
ret
mov byte [edi], bl
jmp 0x10011ab6

Function at 0x10011df0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x10142448
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.TerminateProcess4Ransom__d___s_
xor esi, esi
push esi
call fcn.1003dfed
add esp, 0x10
push 1
push dword [0x1013ec54]
call dword [0x10170374]
lea eax, [esp + 4]
push eax
push esi
push esi
push 0x10011de7
push esi
push esi
call fcn.10041127
add esp, 0x18
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
pop ecx
ret
Function at 0x10018b22
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc790]
mov eax, 0xc810
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0xc78c], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc798]
mov byte [ebp - 0x75], bl
cmp dword [0x101434ac], ebx
je 0x10018b63
push str.ChkRS_SETUP_EXP_start_n
push ebx
call fcn.1003dfed
pop ecx
pop ecx
push ebx
push 0x80
push 3
push ebx
push 3
push closesocket
push esi
mov dword [ebp - 0x7c], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x80], eax
cmp eax, ebx
je 0x10018cbb
cmp eax, 0xffffffff
je 0x10018cbb
push edi
xor eax, eax
mov edi, 0x1013dc04
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jmp 0x10018c73
push 0xc800
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
call fcn.10040850
add esp, 0xc
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0xc7ff
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne byte [ebp - 0x75]
cmp byte [ebp - 0x75], bl
je 0x10018c97
cmp dword [ebp - 0x7c], ebx
je 0x10018c97
xor ecx, ecx
lea eax, [ebp + ecx - 0x74]
cmp byte [eax], bl
jne 0x10018bf7
mov byte [eax], 0x20
inc ecx
cmp ecx, 0xc7fe
jl 0x10018bec
xor edi, edi
mov byte [ebp + 0xc78b], bl
cmp dword [0x100743ac], ebx
je 0x10018c5b
cmp edi, 7
jge 0x10018c5b
lea esi, [edi*4 + 0x100743ac]
mov eax, dword [esi]
cmp byte [eax], bl
je 0x10018c51
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.10040c70
pop ecx
pop ecx
test eax, eax
je 0x10018c51
mov byte [edi + 0x1013dc04], 1
cmp dword [0x101434ac], ebx
je 0x10018c51
push dword [esi]
push str.Found_ChkRS_SETUP_EXP___s__n
push ebx
call fcn.1003dfed
add esp, 0xc
inc edi
cmp dword [edi*4 + 0x100743ac], ebx
jne 0x10018c10
xor ecx, ecx
xor eax, eax
cmp byte [eax + 0x1013dc04], bl
je 0x10018c68
inc ecx
inc eax
cmp eax, 7
jl 0x10018c5f
cmp ecx, 3
jge 0x10018c7e
cmp dword [ebp - 0x7c], ebx
ja 0x10018ba6
jmp 0x10018c97
mov byte [ebp - 0x75], 1
cmp dword [0x101434ac], ebx
je 0x10018c97
push str.ChkRS_SETUP_EXP_g_bRansomGoGo__false_n
push ebx
call fcn.1003dfed
pop ecx
pop ecx
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
cmp dword [0x101434ac], ebx
je 0x10018cb6
push str.ChkRS_SETUP_EXP_end_n_n
push ebx
call fcn.1003dfed
pop ecx
pop ecx
mov al, byte [ebp - 0x75]
jmp 0x10018cd4
cmp dword [0x101434ac], ebx
je 0x10018cd2
push esi
push str.ChkRS_SETUP_EXP_Real_CreateFileW_error__s__n
push ebx
call fcn.1003dfed
add esp, 0xc
xor al, al
mov ecx, dword [ebp + 0xc78c]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0xc790
leave
ret
Function at 0x10029229
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf9c]
mov eax, 0x101c
call fcn.10040c40
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0xf98], eax
mov eax, dword [ebp + 0xfa4]
push ebx
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xfa8]
push edi
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xfac]
mov edi, 0x7ff
xor ebx, ebx
push edi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x799]
push ebx
push eax
mov byte [ebp + 0x798], bl
call fcn.10040850
push edi
lea eax, [ebp - 0x67]
lea esi, [edi + 1]
push ebx
push eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x68], bl
call fcn.10040850
add esp, 0x18
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x100292bb
cmp dword [ebp - 0x6c], ebx
je 0x10029345
mov dword [ebp - 0x70], ebx
xor edi, edi
jmp 0x1002932c
cmp edi, ebx
jne 0x10029337
push esi
lea eax, [ebp + 0x798]
push ebx
push eax
call fcn.10040850
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.10040850
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x798]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
cmp edi, ebx
jne 0x10029329
cmp dword [ebp - 0x74], esi
jae 0x10029329
push dword [ebp - 0x80]
lea eax, [ebp + 0x798]
push eax
call fcn.10040c70
pop ecx
pop ecx
test eax, eax
jne 0x10029333
inc dword [ebp - 0x70]
cmp dword [ebp - 0x6c], ebx
jne 0x100292c2
jmp 0x10029345
mov al, 1
jmp 0x10029347
cmp dword [ebp - 0x6c], ebx
je 0x10029345
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp + 0xf98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0xf9c
leave
ret
Function at 0x1002935f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3a0]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x3a8]
xor ebx, ebx
mov esi, 0x1ff
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x195]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
mov byte [ebp + 0x194], bl
call fcn.10040850
push esi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.10040850
add esp, 0x18
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push dword [ebp - 0x78]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002945c
cmp dword [ebp - 0x70], ebx
je 0x1002945c
cmp dword [ebp - 0x70], 0xffffffff
je 0x1002945c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 0x200
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp - 0x74]
mov esi, eax
cmp byte [ebp + 0x194], bl
je 0x10029453
lea eax, [ebp + 0x194]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
push str._s_s
push eax
call fcn.10040b98
push dword [ebp - 0x80]
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.10029229
add esp, 0x1c
test al, al
jne 0x10029476
mov byte [ebp + 0x194], bl
cmp esi, 0x103
jne 0x100293ea
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp + 0x394]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x398
leave
ret
mov al, 1
jmp 0x1002945e