joyce8/EMBER2024-capa huggingface dataset:
Function at 0x558f70
Capabilities:
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x55d7b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push str..pipecoverdes_open_for_user_
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_8]
lea ecx, [esp]
mov dword [esp + 0x14], 0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_9]
lea eax, [esp + 4]
push eax
mov byte [esp + 0x18], 1
push 0x400
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x400
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetBuffer_2]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [esp + 4]
push ecx
lea ecx, [esp + 4]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::ReleaseBuffer_1]
push 0x5f
push 0x5c
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Replace]
lea edx, [esp]
push edx
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004079b0
add esp, 0xc
lea ecx, [esp]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov ecx, dword [esp + 0xc]
mov eax, esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x559030
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
sub esp, 0xc
push ebx
mov ebx, eax
test ebx, ebx
je 0x5590a9
cmp byte [ebx], 0
je 0x5590a9
mov eax, ebx
mov byte [esp + 7], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x559050
push esi
sub eax, edx
push edi
lea esi, [esp + 0x10]
mov edi, eax
call fcn.00558f70
mov eax, dword [eax]
push 0x14
lea ecx, [esp + 0x18]
push ecx
push 1
lea edx, [esp + 0x1b]
push edx
inc edi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
mov ebx, eax
neg ebx
sbb bl, bl
mov ecx, esi
inc bl
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
test bl, bl
pop edi
pop esi
jne 0x5590a9
mov al, byte [esp + 7]
test al, al
je 0x5590ab
inc dword [0x68c950]
pop ebx
add esp, 0xc
ret
xor al, al
pop ebx
add esp, 0xc
ret

Function at 0x559100
Capabilities:
Create pipe
Resume thread

Disassembly:
push ecx
push esi
lea esi, [esp + 4]
mov dword [edi + 8], eax
call fcn.00558f70
mov eax, dword [eax]
push 0
push 0
push 0x400
push 0
push 1
push 6
push 0x80003
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, esi
mov dword [edi + 4], eax
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
cmp dword [edi + 4], 0xffffffff
pop esi
je 0x55916d
push 0
push 4
push 0
push 0
push edi
push 0x558dc0
mov byte [edi + 0xc], 0
call sub.MFC71.DLL_AfxBeginThread
mov dword [edi], eax
mov dword [eax + 0x28], 0
mov ecx, dword [edi]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
pop ecx
ret
mov byte [edi + 0xc], 1
mov dword [edi], 0
mov eax, edi
pop ecx
ret
Function at 0x6ad82560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, 0x25fffffc
lea eax, [ebp - 0x354]
push eax
call fcn.6ad81cdd
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.6ad81c92
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
invalid
inc dword [edi]

Function at 0x6ad83bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub eax, 0x9cfffff8
mov byte [ebp - 0x7d2], 0xc0
mov byte [ebp - 0x7d1], 0x82
mov byte [ebp - 0x7d0], 0x81
mov byte [ebp - 0x7cf], 0x89
mov byte [ebp - 0x7ce], 0xee
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.6ad81cdd
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.6ad81c3e
add esp, 0xc
jmp 0x6ad83c45
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.6ad81ccd
invalid

Function at 0x6ad855e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
mov eax, esi
mov ecx, esi
sub esp, 0x2c
cpuid
mov ebp, eax
test eax, eax
je 0x6ad8568c
mov edi, eax
mov ecx, esi
mov eax, 1
cpuid
mov eax, ecx
mov ebp, ecx
shr eax, 9
and eax, 1
mov ebx, eax
or ebx, 2
test ecx, 0x80000
cmove ebx, eax
mov eax, ebx
or eax, 4
test ecx, 0x100000
cmovne ebx, eax
test ecx, 0x8000000
je 0x6ad85663
mov ecx, esi
xgetbv
and ebp, 0x10000000
je 0x6ad85663
and eax, 6
mov dword [esp + 0x1c], 0
mov edx, dword [esp + 0x1c]
mov ecx, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
or ecx, 8
xor eax, 6
or eax, edx
cmove ebx, ecx
mov ebp, ebx
cmp edi, 6
jbe 0x6ad8568c
mov eax, 7
xor ecx, ecx
cpuid
mov eax, ebp
or eax, 0x10
test bh, 1
cmovne ebp, eax
mov eax, ebp
or eax, 0x20
and ebx, 0x20000000
cmovne ebp, eax
mov dword [esp], str.WIMLIB_DISABLE_CPU_FEATURES
mov dword [0x6adff03c], ebp
call sub.msvcrt.dll_getenv
mov esi, dword [0x6adff03c]
mov ebx, eax
test eax, eax
jne 0x6ad856d0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, edi
mov eax, ebx
sub edx, ebx
lea ebx, [edi + 1]
call fcn.6ad85570
not eax
and esi, eax
mov dword [0x6adff03c], esi
mov dword [esp + 4], 0x2c
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
mov edi, eax
test eax, eax
jne 0x6ad856b8
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, ebx
call fcn.6ad85570
not eax
and eax, esi
mov dword [0x6adff03c], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6ad8e300
Capabilities:
Create directory

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x6ad8e320
xor eax, eax
add esp, 0x14
pop ebx
pop esi
ret
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
cmp dword [eax], 0x11
je 0x6ad8e314
call esi
cmp dword [eax], 0xd
jne 0x6add56d4
jmp 0x6ad8e314
mov dword [esp + 4], ebx
mov dword [esp], str.Failed_to_create_directory___ls_
call fcn.6add55d2
mov eax, 0x25
jmp 0x6ad8e316
Function at 0x6ad91be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x3c]
mov eax, dword [edi + 0x20]
cmp eax, 0xfffe
ja 0x6ad91d22
mov edx, dword [edi]
lea ebx, [edi + 4]
cmp edx, ebx
je 0x6ad91cc8
add eax, 1
mov dword [esp], edx
imul eax, eax, 0x1c
mov dword [esp + 4], eax
call fcn.6adaef00
mov ebx, eax
test eax, eax
je 0x6ad91d1e
mov dword [edi], eax
mov eax, dword [edi + 0x20]
imul eax, eax, 0x1c
xor ecx, ecx
xor ebp, ebp
add ebx, eax
lea edx, [ebx + 4]
mov eax, ebx
mov dword [ebx], 0
and edx, 0xfffffffc
mov dword [ebx + 0x18], 0
sub eax, edx
add eax, 0x1c
and eax, 0xfffffffc
mov dword [edx + ebp], ecx
add ebp, 4
cmp ebp, eax
jb 0x6ad91c51
movzx edx, byte [esp + 0x34]
movzx eax, byte [ebx + 0x1b]
shl edx, 5
and eax, 0x1f
or eax, edx
mov byte [ebx + 0x1b], al
mov eax, dword [esp + 0x38]
cmp word [eax], 0
jne 0x6ad91d08
mov dword [ebx], 0x6ade07e2
mov eax, dword [edi + 0x78]
lea edx, [eax + 1]
add eax, eax
mov dword [edi + 0x78], edx
mov edx, dword [ebx + 0x18]
and eax, 0x1ffffffe
or eax, 1
mov dword [ebx + 4], esi
and edx, 0xe0000000
or eax, edx
mov dword [ebx + 0x18], eax
test esi, esi
je 0x6ad91cb6
mov eax, dword [edi + 0x38]
and eax, 0x3fffffff
add dword [esi + 0x24], eax
add dword [edi + 0x20], 1
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x6ad91c2b
add eax, 1
imul eax, eax, 0x1c
mov dword [esp], eax
call fcn.6adaeec0
mov ebx, eax
test eax, eax
je 0x6ad91d1e
imul edx, dword [edi + 0x20], 0x1c
mov eax, dword [edi]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_memcpy
mov dword [edi], ebx
mov eax, dword [edi + 0x20]
jmp 0x6ad91c2b
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.6ad8d840
mov dword [ebx], eax
test eax, eax
jne 0x6ad91c83
xor ebx, ebx
jmp 0x6ad91cba
mov eax, dword [edi + 0x2c]
xor ebx, ebx
sub eax, 0x14
mov dword [esp], eax
call fcn.6ad86960
mov dword [esp], str.Inode_has_too_many_streams__Path__ls_
mov dword [esp + 4], eax
call fcn.6add55aa
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x1b
jmp 0x6ad91cba
Function at 0x6ada29a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.6adafbc0
test eax, eax
jne 0x6ada2ae5
lea eax, [esi + 0x3fffffff]
mov ecx, eax
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 0x130]
mov esi, dword [eax + ecx*4]
mov ecx, dword [esi + 8]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x44], ecx
test ecx, ecx
je 0x6ada2b18
mov eax, dword [ebp + 4]
lea edx, [eax*8 + 8]
test eax, eax
je 0x6ada2a09
mov eax, dword [ebp + 8]
lea edi, [edx + eax - 8]
nop
add edx, dword [eax]
add eax, 8
cmp eax, edi
jne 0x6ada2a00
lea edi, [edx + 7]
and edi, 0xfffffff8
mov dword [ebp], edi
mov dword [esp], ecx
call fcn.6ad866c0
mov dword [esp + 0x4c], 0
lea eax, [edi + eax + 8]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.6ad86980
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
test eax, eax
jne 0x6add5e2b
mov dword [esp], edi
call fcn.6adaeec0
mov esi, eax
test eax, eax
je 0x6add5e2b
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.6ada73a0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call fcn.6ad87cc0
sub eax, esi
cmp eax, edi
jne 0x6ada2af0
mov eax, dword [ebx + 0x130]
mov edx, dword [esp + 0x3c]
add ebx, 0x158
mov ecx, dword [esp + 0x78]
mov eax, dword [eax + edx*4]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x20], ecx
lea ecx, [eax + 0x10]
add eax, 0x68
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x30]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 0x2a]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 1
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.6adb40c0
mov dword [esp], esi
mov dword [esp + 0x3c], eax
call fcn.6adaeef0
mov eax, dword [esp + 0x3c]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0xdf
mov dword [esp + 4], str.src_metadata_resource.c
mov dword [esp], str.p___buf__len
call dword [0x6add9074]
jmp 0x6ada2a82
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.6ad87280
test eax, eax
jne 0x6ada2ae5
mov ecx, dword [esp + 0x44]
mov dword [esi + 8], ecx
jmp 0x6ada29ea
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp], str.Failed_to_allocate__llu_bytes_for_metadata_resource
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.6add55aa
mov eax, 0x27
jmp 0x6ada2ae5
Function at 0x6adab230
Capabilities:
Hash data using sha1

Disassembly:
push esi
push ebx
sub esp, 0x74
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov esi, dword [esp + 0x80]
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
mov dword [esp + 0x28], 0xc3d2e1f0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0
cmp ebx, 0x3f
ja 0x6adab2a0
test ebx, ebx
jne 0x6adab2be
mov eax, dword [esp + 0x88]
mov dword [esp + 4], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call fcn.6adab0f0
add esp, 0x74
pop ebx
pop esi
ret
mov ecx, ebx
mov edx, esi
lea eax, [esp + 0x18]
shr ecx, 6
call fcn.6ada9e00
mov eax, ebx
and ebx, 0x3f
and eax, 0xffffffc0
add esi, eax
test ebx, ebx
je 0x6adab280
cmp ebx, 4
jb 0x6adab2f0
mov eax, dword [esi + ebx - 4]
mov dword [esp + ebx + 0x28], eax
sub ebx, 1
cmp ebx, 4
jb 0x6adab280
and ebx, 0xfffffffc
xor eax, eax
mov edx, dword [esi + eax]
mov dword [esp + eax + 0x2c], edx
add eax, 4
cmp eax, ebx
jb 0x6adab2d8
jmp 0x6adab280
test ebx, ebx
je 0x6adab280
movzx eax, byte [esi]
mov byte [esp + 0x2c], al
test bl, 2
je 0x6adab280
movzx eax, word [esi + ebx - 2]
mov word [esp + ebx + 0x2a], ax
jmp 0x6adab280

Function at 0x6adac660
Capabilities:
Read file on windows

Disassembly:
push ebp
xor ebp, ebp
push edi
xor edi, edi
push esi
xor esi, esi
push ebx
sub esp, 0x2c
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0x19
jmp 0x6adac682
mov ebp, ebx
sub dword [esp + 0x14], 1
lea edi, [edi + edi + 0x100]
je 0x6add6338
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.6adaef00
mov ebx, eax
test eax, eax
je 0x6add6338
mov dword [esp], 0
call dword [0x6add908c]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, edi
sub eax, esi
mov dword [esp + 8], eax
lea eax, [ebx + esi]
mov dword [esp], eax
call sub.msvcrt.dll_fread
add esi, eax
cmp edi, esi
je 0x6adac680
mov dword [esp], 0
call dword [0x6add908c]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
je 0x6add6356
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Too_much_data_sent_on_stdin_
call fcn.6add55aa
mov dword [esp], ebp
call fcn.6adaeef0
mov eax, 0x18
jmp 0x6adac707
mov dword [esp], str.Error_reading_stdin
call fcn.6add55d2
mov dword [esp], ebx
call fcn.6adaeef0
mov eax, 0x32
jmp 0x6adac707
Function at 0x6adace40
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 8], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x6adace20
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x6adace9a
mov dword [ebx], eax
mov eax, 1
add esp, 0x28
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.Failed_to_create_thread
mov dword [esp], eax
call fcn.6add80b9
xor eax, eax
jmp 0x6adace95

Function at 0x6adb0f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
movzx eax, byte [eax + 0x2c]
and eax, 0xf
cmp al, 1
je 0x6adb0f71
mov dword [esp + 8], 0xfb
mov dword [esp + 4], str.src_write.c
mov dword [esp], str.blob__blob_location__BLOB_IN_WIM
call dword [0x6add9074]
mov edx, dword [ebx + 0x30]
mov esi, dword [edx + 8]
mov edi, dword [edx + 0xc]
mov ecx, dword [edx + 0x10]
movzx eax, byte [edx + 0x28]
mov dword [esp + 0x18], esi
mov esi, dword [edx + 0x18]
mov dword [esp + 0x1c], edi
mov edi, dword [edx + 0x1c]
mov dword [esp + 0x20], esi
mov edx, dword [edx + 0x14]
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], ecx
test al, 0x10
je 0x6adb1010
mov edi, dword [ebx + 0x38]
mov ecx, dword [ebx + 8]
mov dword [ebx + 0x78], 0
mov ebp, dword [ebx + 0x3c]
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x68], ecx
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x70], edi
mov edi, dword [ebx + 0xc]
and ecx, 0xff000000
mov dword [ebx + 0x74], ebp
and edi, 0xffffff
mov dword [ebx + 0x54], edx
or ecx, edi
mov dword [ebx + 0x6c], ecx
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov byte [ebx + 0x6f], al
mov dword [ebx + 0x48], esi
mov esi, dword [esp + 0x20]
mov dword [ebx + 0x4c], edi
mov edi, dword [esp + 0x24]
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x58], esi
mov dword [ebx + 0x5c], edi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, edx
mov edx, dword [ebx + 0x6c]
and ecx, 0xffffff
mov dword [ebx + 0x70], esi
mov esi, dword [esp + 0x20]
mov dword [ebx + 0x74], edi
and edx, 0xff000000
mov edi, dword [esp + 0x24]
mov dword [ebx + 0x78], esi
mov esi, dword [esp + 0x2c]
or edx, ecx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x7c], edi
mov dword [ebx + 0x68], esi
mov byte [ebx + 0x6f], al
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6adb6dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x144]
test eax, eax
je 0x6adb6e50
mov esi, dword [ebx + 0x58]
lea eax, [esp + 0x1c]
mov dword [esp + 4], ebx
add ebx, 0x48
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.6ada6030
mov edi, eax
test eax, eax
jne 0x6adb6e3c
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, esi
jne 0x6add6bd9
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.6adaeef0
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 0x148]
mov edi, 0x2d
mov dword [esp], eax
call fcn.6ad90ee0
test al, al
je 0x6adb6de9
jmp 0x6adb6e3c
mov dword [esp], str.Failed_to_extract_XML_data
mov edi, 0x48
call fcn.6add55d2
jmp 0x6adb6e30
Function at 0x6adbdc50
Capabilities:
Get disk information

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x24c
mov dword [edx], 0
mov byte [ecx], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0x6adead52
mov dword [esp], eax
call sub.msvcrt.dll_wcsncmp
mov edx, eax
lea eax, [esi + 8]
test edx, edx
cmovne eax, esi
movzx ecx, word [eax]
mov edx, ecx
and edx, 0xffffffdf
sub edx, 0x41
cmp dx, 0x19
ja 0x6adbdca3
cmp word [eax + 2], 0x3a
je 0x6adbdd20
xor edx, edx
xor eax, eax
mov word [esp + 0x2e], dx
lea ebp, [esp + 0x36]
mov dword [esp + 0x1c], 0x105
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
sub esp, 0x20
test eax, eax
je 0x6adbdd3d
mov dword [esp + 4], 0x6adeadb2
mov dword [esp], ebp
call sub.msvcrt.dll_wcsstr
test eax, eax
je 0x6adbdd0d
or dword [ebx], 0xc00000
mov byte [edi], 1
add esp, 0x24c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov word [esp + 0x2e], cx
mov word [esp + 0x34], ax
lea eax, [esp + 0x2e]
mov dword [esp + 0x30], 0x5c003a
jmp 0x6adbdcac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Failed_to_get_volume_information_for___ls_
mov dword [esp], eax
call fcn.6add8098
jmp 0x6adbdd0d

Function at 0x6adbdec0
Capabilities:
Get file attributes

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x5c
mov eax, dword [edx + 0x24]
test byte [ecx + 0xe], 0x10
jne 0x6adbdede
mov edx, dword [ecx + 0xdc]
mov ebx, ecx
test edx, edx
jne 0x6adbdef0
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
and eax, 0x800
mov dword [esp + 0x10], 4
mov edi, eax
setne al
mov dword [esp + 0xc], 0x28
mov ebp, eax
lea eax, [esp + 0x28]
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ecx + 0x1a8]
mov dword [esp + 4], eax
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
test eax, eax
js 0x6adbdf3d
mov eax, dword [esp + 0x48]
mov edx, ebp
shr eax, 0xb
and eax, 1
cmp dl, al
je 0x6adbdede
mov eax, ebp
mov dword [esp], esi
movzx ebp, al
lea eax, [esp + 0x26]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0x9c040
mov word [esp + 0x26], bp
call fcn.6adbccc0
mov esi, eax
test eax, eax
jns 0x6adbdede
mov eax, ebx
call fcn.6adbcf80
test edi, edi
mov ecx, 0x6adeadd4
mov dword [esp], esi
mov edx, eax
mov eax, str.clear
mov dword [esp + 4], str.Cant__s_compression_attribute_on___ls_
cmovne eax, ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call fcn.6add8103
mov eax, 0x39
jmp 0x6adbdee0
Function at 0x6adc14a0
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x98
lea edx, [esp + 0x28]
mov dword [esp + 0x10], 0x12
mov dword [esp + 8], edx
lea edx, [esp + 0x20]
mov dword [esp + 0xc], 0x68
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
test eax, eax
jns 0x6adc14df
cmp eax, 0x80000005
jne 0x6adc153b
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x2c]
mov dword [ebx], eax
mov eax, dword [esp + 0x60]
mov dword [ebx + 0xc], edx
mov edx, dword [esp + 0x3c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], edx
mov edx, dword [esp + 0x34]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x38]
mov dword [ebx + 0x1c], edx
mov edx, dword [esp + 0x6c]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x24], edx
mov edx, dword [esp + 0x5c]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x70]
mov dword [ebx + 0x30], eax
xor eax, eax
add esp, 0x98
pop ebx
ret

Function at 0x6adc1830
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, edx
push ebx
sub esp, 0xb4
lea edx, [esp + 0x30]
mov dword [esp + 0x10], 0x15
mov dword [esp + 8], edx
lea edx, [esp + 0x28]
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ntdll.dll_NtQueryInformationFile
sub esp, 0x14
mov ebx, eax
test eax, eax
js 0x6adc1873
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x6adc1880
add esp, 0xb4
mov eax, ebx
pop ebx
pop esi
ret
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call fcn.6ad8d800
mov dword [esi + 0x20], eax
test eax, eax
je 0x6adc18aa
mov eax, dword [esp + 0x30]
mov word [esi + 0x26], ax
add esp, 0xb4
mov eax, ebx
pop ebx
pop esi
ret
mov ebx, 0xc0000017
jmp 0x6adc1873