joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022f6
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
and dword [edi], 0
push dword [ebp + 8]
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x1002371
cmp word [ebx + 8], 2
jne 0x100234e
cmp word [ebx + 0xa], 4
jne 0x100234e
mov esi, dword [ebx + 0xc]
jmp 0x1002348
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0100228c
test eax, eax
mov dword [edi], eax
je 0x100236c
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x100232c
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call fcn.01007ea0
add esp, 0xc
mov byte [esi + 0x400], 0
xor eax, eax
jmp 0x1002397
push 8
pop eax
jmp 0x1002397
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x1002397
dec ecx
je 0x1002392
dec ecx
je 0x100238b
dec ecx
jmp 0x1002397
mov eax, 0x2afb
jmp 0x1002397
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x10029e6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [0x100e2c0], 0
mov eax, dword [0x100d084]
mov dword [ebp - 4], eax
mov dword [ebp - 0x230], 0x1001220
mov dword [ebp - 0x22c], 0x1002596
mov dword [ebp - 0x228], 0x1001214
mov dword [ebp - 0x224], 0x1002817
mov dword [ebp - 0x220], 0x1001204
mov dword [ebp - 0x21c], fcn.01002553
jne 0x1002b67
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002b5d
xor eax, eax
mov cl, byte [ebp + eax - 0x218]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1002a5e
push edi
lea edi, [ebp - 0x110]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002a79
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, 0x10011fc
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x110]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x1002abc
push 0x1001220
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002ab8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x1002b13
xor eax, eax
mov cl, byte [ebp + eax - 0x218]
mov byte [ebp + eax - 0x110], cl
inc eax
test cl, cl
jne 0x1002abe
lea edi, [ebp - 0x110]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1002ad8
mov esi, 0x10011f4
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x110]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x1002b5a
push 0x1001220
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1002b0f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x1002b5a
xor edi, edi
push dword [ebp + edi*8 - 0x230]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + edi*8 - 0x22c], eax
je 0x1002b36
inc edi
cmp edi, 3
jl 0x1002b15
jmp 0x1002b3f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x1002b5a
xor eax, eax
mov ecx, dword [ebp + eax - 0x22c]
mov dword [eax + 0x100d06c], ecx
add eax, 8
cmp eax, 0x18
jl 0x1002b45
pop esi
pop ebx
pop edi
mov dword [0x100e2c0], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [eax*8 + 0x100d06c]
call fcn.01007a9b
leave
ret 4
Function at 0x1007be2
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x18
push 0x1001798
call fcn.0100900c
mov edi, 0x94
mov eax, edi
call fcn.01008580
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 0x10]
mov dword [0x100e2e4], eax
mov ecx, dword [esi + 4]
mov dword [0x100e2f0], ecx
mov edx, dword [esi + 8]
mov dword [0x100e2f4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x100e2e8], esi
cmp eax, 2
je 0x1007c42
or esi, 0x8000
mov dword [0x100e2e8], esi
shl ecx, 8
add ecx, edx
mov dword [0x100e2ec], ecx
cmp word [0x1000000], 0x5a4d
jne 0x1007c80
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1007c80
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1007c99
cmp ecx, 0x20b
je 0x1007c86
and dword [ebp - 0x1c], 0
jmp 0x1007cb0
cmp dword [eax + 0x1000084], 0xe
jbe 0x1007c80
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x1007caa
cmp dword [eax + 0x1000074], 0xe
jbe 0x1007c80
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.01008fb0
pop ecx
test eax, eax
jne 0x1007cdd
cmp dword [0x100e2d4], 2
je 0x1007cca
call fcn.010087fa
push 0x1c
call fcn.0100860d
push 0xff
call fcn.010082b0
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01008de0
test eax, eax
jge 0x1007cf2
push 0x1b
call fcn.01007bb3
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x100f894], eax
call fcn.01008cb3
mov dword [0x100e2cc], eax
call fcn.01008c0a
test eax, eax
jge 0x1007d18
push 8
call fcn.01007bb3
pop ecx
call fcn.010089b0
test eax, eax
jge 0x1007d29
push 9
call fcn.01007bb3
pop ecx
call fcn.0100830a
mov dword [ebp - 0x24], eax
test eax, eax
je 0x1007d3c
push eax
call fcn.01007bb3
pop ecx
mov eax, dword [0x100e304]
mov dword [0x100e308], eax
push eax
push dword [0x100e2fc]
push dword [0x100e2f8]
call fcn.0100719a
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], 0
jne 0x1007d6c
push esi
call fcn.010083ea
call fcn.01008422
jmp 0x1007d9e
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.01009047
ret
Function at 0x100860d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100d084]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x100d090]
je 0x1008637
inc eax
cmp eax, 0x12
jb 0x1008628
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x100d090]
mov dword [ebp - 0x110], esi
jne 0x10087e2
mov eax, dword [0x100e2d4]
cmp eax, 1
je 0x10087b0
test eax, eax
jne 0x100866d
cmp dword [0x100d08c], 1
je 0x10087b0
cmp ecx, 0xfc
je 0x10087e2
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10086a8
push 5
pop ecx
mov esi, 0x1001b0c
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebx, [ebp - 0x10c]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10086b3
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x10086eb
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10086cb
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x1001b08
push ebx
call fcn.01007ea0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10086f0
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x110]
mov eax, dword [eax + 0x100d094]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100870a
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.01008580
mov edx, esp
push 6
pop ecx
mov esi, 0x1001aec
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1008736
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1008742
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100875b
mov eax, dword [ebp - 0x110]
mov esi, 0x1001ae8
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x100d094]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1008779
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1008785
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push 0x1001ac0
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0100a7b8
add esp, 0xc
jmp 0x10087e2
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10087e2
mov esi, dword [esi + 0x100d094]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x10087c7
push 0
sub ecx, edx
lea edx, [ebp - 0x114]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x120]
mov ecx, dword [ebp - 4]
call fcn.01007a9b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1008cb3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e438]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push edi
xor ebx, ebx
xor edi, edi
cmp eax, ebx
jne 0x1008cff
call esi
mov edi, eax
cmp edi, ebx
je 0x1008ce5
mov dword [0x100e438], 1
jmp 0x1008d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1008cfa
push 2
pop eax
mov dword [0x100e438], eax
jmp 0x1008cff
mov eax, dword [0x100e438]
cmp eax, 1
jne 0x1008d7c
cmp edi, ebx
jne 0x1008d10
call esi
mov edi, eax
cmp edi, ebx
je 0x1008d85
cmp word [edi], bx
mov eax, edi
je 0x1008d25
inc eax
inc eax
cmp word [eax], bx
jne 0x1008d17
inc eax
inc eax
cmp word [eax], bx
jne 0x1008d17
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, edi
push ebx
sar eax, 1
inc eax
push eax
push edi
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1008d73
push eax
call fcn.0100855c
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
je 0x1008d73
push ebx
push ebx
push dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push edi
push ebx
push ebx
call esi
test eax, eax
jne 0x1008d70
push dword [ebp - 4]
call fcn.01007e52
pop ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1008dd4
cmp eax, 2
je 0x1008d89
cmp eax, ebx
je 0x1008d89
xor eax, eax
jmp 0x1008dd6
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x1008d85
cmp byte [esi], bl
je 0x1008da6
inc eax
cmp byte [eax], bl
jne 0x1008d9c
inc eax
cmp byte [eax], bl
jne 0x1008d9c
sub eax, esi
inc eax
mov edi, eax
push edi
call fcn.0100855c
cmp eax, ebx
pop ecx
je 0x1008dcd
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a7b8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x100e450], ebx
push esi
push edi
jne 0x100a83a
push 0x1002010
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100a875
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002004
push edi
call esi
test eax, eax
mov dword [0x100e450], eax
je 0x100a875
push 0x1001ff4
push edi
call esi
push 0x1001fe0
push edi
mov dword [0x100e454], eax
call esi
cmp dword [0x100e2e4], 2
mov dword [0x100e458], eax
jne 0x100a83a
push 0x1001fc4
push edi
call esi
test eax, eax
mov dword [0x100e460], eax
je 0x100a83a
push 0x1001fac
push edi
call esi
mov dword [0x100e45c], eax
mov eax, dword [0x100e45c]
test eax, eax
je 0x100a87f
call eax
test eax, eax
je 0x100a866
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x100e460]
test eax, eax
je 0x100a866
test byte [ebp - 8], 1
jne 0x100a87f
cmp dword [0x100e2f0], 4
jb 0x100a879
or byte [ebp + 0x12], 0x20
jmp 0x100a89e
xor eax, eax
jmp 0x100a8ae
or byte [ebp + 0x12], 4
jmp 0x100a89e
mov eax, dword [0x100e454]
test eax, eax
je 0x100a89e
call eax
mov ebx, eax
test ebx, ebx
je 0x100a89e
mov eax, dword [0x100e458]
test eax, eax
je 0x100a89e
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x100e450]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100ade2
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x100ae13
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x100ae1a
cmp ebx, dword [ebp + 8]
jae 0x100ae1a
xor eax, eax
jmp 0x100b00a
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x100ae2b
xor eax, eax
inc eax
jmp 0x100b009
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x100ae41
cmp ecx, edx
jae 0x100af86
cmp dword [eax + 4], 0
je 0x100ae4a
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x100ae32
cmp dword [ebp + 8], 0
je 0x100ae6c
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x100af86
cmp eax, esi
jae 0x100af86
mov eax, dword [0x100e468]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x100ae91
cmp dword [esi*4 + 0x100e470], edi
je 0x100af8a
inc esi
cmp esi, eax
jl 0x100ae7f
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100b006
cmp dword [ebp - 8], 0x1000000
jne 0x100b006
test byte [ebp - 0xc], 0xcc
je 0x100af0f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x100b006
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100b006
cmp word [eax + 0x18], 0x10b
jne 0x100b006
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x100b006
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x100af0f
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x100af0f
test byte [ecx + 0x27], 0x80
jne 0x100af86
push 1
push 0x100e4b0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x100ae23
mov ecx, dword [0x100e468]
test ecx, ecx
mov edx, ecx
jle 0x100af43
lea eax, [ecx*4 + 0x100e46c]
cmp dword [eax], edi
je 0x100af43
dec edx
sub eax, 4
test edx, edx
jg 0x100af37
test edx, edx
jne 0x100af74
push 0xf
pop ebx
cmp ecx, ebx
jg 0x100af50
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x100af68
lea eax, [edx*4 + 0x100e470]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x100af56
cmp ecx, 0x10
jge 0x100af74
inc ecx
mov dword [0x100e468], ecx
push 0
push 0x100e4b0
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x100ae23
xor eax, eax
jmp 0x100b009
test esi, esi
jle 0x100ae23
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x100e4b0
call ebx
test eax, eax
jne 0x100ae23
cmp dword [esi*4 + 0x100e470], edi
je 0x100afe0
mov eax, dword [0x100e468]
lea esi, [eax - 1]
test esi, esi
jl 0x100afce
cmp dword [esi*4 + 0x100e470], edi
je 0x100afca
dec esi
jns 0x100afbe
test esi, esi
jge 0x100afde
cmp eax, 0x10
jge 0x100afd9
inc eax
mov dword [0x100e468], eax
lea esi, [eax - 1]
jmp 0x100afe0
je 0x100aff8
xor ecx, ecx
test esi, esi
jl 0x100aff8
lea eax, [ecx*4 + 0x100e470]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x100afe6
push 0
push 0x100e4b0
call ebx
jmp 0x100ae23
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100b5b5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x100f768]
mov eax, dword [0x100d084]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], edi
jae 0x100b79b
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x100f780]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x424], ebx
je 0x100b79b
and dword [ebp - 0x414], 0
and dword [ebp - 0x420], 0
cmp dword [ebp + 0x10], 0
jne 0x100b626
xor eax, eax
jmp 0x100b7af
test al, 0x20
je 0x100b639
push 2
push 0
push 0
push ecx
call fcn.0100c29c
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x100b6f9
and dword [ebp - 0x40c], 0
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x410], edi
jbe 0x100b775
mov ecx, dword [ebp - 0x410]
xor edi, edi
sub ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x100b6a8
mov edx, dword [ebp - 0x410]
inc dword [ebp - 0x410]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x100b696
inc dword [ebp - 0x420]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x424]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x100b672
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b727
mov eax, dword [ebp - 0x418]
add dword [ebp - 0x414], eax
cmp eax, edi
jl 0x100b733
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x41c]
cmp eax, dword [ebp + 0x10]
jb 0x100b65e
jmp 0x100b733
push 0
lea ecx, [ebp - 0x418]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b727
mov eax, dword [ebp - 0x418]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x414], eax
jmp 0x100b733
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x414]
test eax, eax
jne 0x100b793
cmp dword [ebp - 0x40c], eax
je 0x100b76f
push 5
pop eax
cmp dword [ebp - 0x40c], eax
jne 0x100b761
mov dword [0x100e2d8], 9
mov dword [0x100e2dc], eax
jmp 0x100b7ac
push dword [ebp - 0x40c]
call fcn.0100c166
pop ecx
jmp 0x100b7ac
mov edi, dword [ebp - 0x41c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x100b787
cmp byte [edi], 0x1a
je 0x100b61f
mov dword [0x100e2d8], 0x1c
jmp 0x100b7a5
sub eax, dword [ebp - 0x420]
jmp 0x100b7af
mov dword [0x100e2d8], 9
and dword [0x100e2dc], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01007a9b
leave
ret
Function at 0x100c0e2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 4
pop eax
call fcn.01008580
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100c148
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x100e2e4]
mov esi, dword [ebp - 0x40]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
lea edx, [esi - 1]
and ecx, 0x103
not edx
and edx, ebx
inc ecx
sub edx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffff1
add eax, 0x11
imul eax, esi
add eax, edi
cmp edx, eax
jae 0x100c14c
xor eax, eax
jmp 0x100c159
lea eax, [ebp - 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x50]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100013e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x100310c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x420], esi
jmp 0x10001420
mov edx, dword [esi + 0x10032340]
lea ecx, [ebp - 0x41c]
push ecx
push 8
push ebx
push 0x10029950
push edx
call edi
test eax, eax
jne 0x10001508
xor esi, esi
cmp dword [ebp - 0x418], ebx
jne 0x100014c8
lea ebx, [ebx]
mov edx, dword [ebp - 0x41c]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push esi
push edx
mov dword [ebp - 0x424], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100014c8
mov eax, dword [ebp - 0x428]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push 0x10029980
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x41c]
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
push 8
push ebx
lea ecx, [ebp - 0x414]
push ecx
push edx
call edi
test eax, eax
je 0x100014c8
mov dword [ebp - 0x418], ebx
inc esi
jmp 0x10001450
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x418]
cmp eax, ebx
jne 0x100014f7
mov esi, dword [ebp - 0x420]
add esi, 4
mov dword [ebp - 0x420], esi
cmp esi, 8
jb 0x10001420
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001475c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x418]
jmp 0x100014e5
Function at 0x10001b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10026110
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x100310c0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
mov dword [esp + 0x54], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x10029b98
push 0x80000002
mov dword [esp + 0x28], ebx
call edi
cmp eax, ebx
jne 0x10001c5f
mov esi, dword [esp + 0x14]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push edx
mov byte [esp + 0x58], 1
push esi
mov dword [esp + 0x28], ebx
call edi
cmp eax, ebx
jne 0x10001c4c
mov eax, dword [esp + 0x14]
mov ecx, 4
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x28]
push ecx
push ebx
push 0x10029c10
push eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001c4c
test dword [esp + 0x18], 0x400
je 0x10001c4c
mov edx, dword [ebp + 8]
mov ebx, dword [edx]
push 0x10029c38
call fcn.1000f970
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
test eax, eax
je 0x10001c2e
push eax
call edi
test esi, esi
je 0x10001c35
push esi
call edi
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [esp + 0x48], bl
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x10001c5f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
push 0x10029c7c
mov eax, 1
call fcn.1000f970
add esp, 4
test esi, esi
je 0x10001c81
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8