joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100196f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
xor eax, eax
jne 0x100196f9
cmp dword [ebp + 0xc], 0
je 0x1001970c
mov dword [ebp - 0xc], 1
jmp 0x10019713
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x10019726
mov eax, 0xd
jmp 0x1001977b
xor edx, edx
jne 0x100196fd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x10019739
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100199c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x100199c9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10019a0c
mov eax, dword [ebp - 8]
jmp 0x10019a72
cmp dword [ebp - 0xc], 1
je 0x10019a1f
cmp dword [ebp - 0xc], 2
je 0x10019a1f
mov eax, 0xd
jmp 0x10019a72
cmp dword [ebp + 0xc], 0
je 0x10019a66
cmp dword [ebp - 4], 0
je 0x10019a55
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x10019a4c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x10019a53
mov eax, 0xd
jmp 0x10019a72
jmp 0x10019a66
mov edx, 2
imul edx, edx, 0
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov word [ecx + edx], ax
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001a970
Capabilities:
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059250
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1006e1e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 1
push 0x10065ab0
lea ecx, [ebp + 8]
call fcn.10002200
push eax
call fcn.1002de83
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001aa6a
mov eax, dword [ebp - 0x10]
push eax
call fcn.10021010
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
call fcn.1002db91
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 1
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1002e1d1
add esp, 0x10
mov edx, dword [ebp - 0x10]
push edx
call fcn.1002e4be
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
lea eax, [ebp + 0xc]
push eax
call fcn.10003c60
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x24]
call fcn.1001ab50
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1002dc23
add esp, 4
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10002290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002290
mov eax, dword [ebp - 0x30]
jmp 0x1001ab3c
push str.__Out:
lea ecx, [ebp - 0x20]
call fcn.10002210
mov byte [ebp - 4], 2
push 0x10065ac0
lea ecx, [ebp - 0x1c]
call fcn.10002210
mov byte [ebp - 4], 3
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.10003c80
add esp, 0xc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x38]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.10003c80
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 5
lea edx, [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.10003c80
add esp, 0xc
lea ecx, [ebp - 0x44]
call fcn.10002290
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x48]
call fcn.10002290
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4c]
call fcn.10002290
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.10002290
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.10002290
push 1
call fcn.1002fe28
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10002290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001ab50
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100591f8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1006e1e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 1
push eax
call fcn.1002db91
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
call fcn.100017a0
mov dword [ebp - 0x18], eax
push 0x10065ac4
lea ecx, [ebp + 0x10]
call fcn.10002200
push eax
call fcn.1002de83
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001abed
mov edx, dword [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1002e3d4
add esp, 0x10
mov edx, dword [ebp - 0x10]
push edx
call fcn.1002e4be
add esp, 4
jmp 0x1001abf4
push 1
call fcn.1002fe28
mov eax, dword [ebp - 0x14]
push eax
call fcn.1002dc23
add esp, 4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.10002290
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001b9b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100595eb
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x1006e1e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push 0x2c
call fcn.1002d4bc
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x1001ba08
push 0
push 3
push 0x10065c04
mov ecx, dword [ebp - 0x20]
call fcn.10001070
mov dword [ebp - 0x24], eax
jmp 0x1001ba0f
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
mov dword [ecx + 0x20], edx
push 0x18
push 0x8e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1001ba44
jmp 0x1001bb4c
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1001ba60
jmp 0x1001bb4c
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1001ba7c
jmp 0x1001bb4c
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0xd], 0
mov ecx, dword [ebp - 0x2c]
add ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x18], ecx
jae 0x1001bb4c
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov ax, word [edx]
mov word [ebp - 0x14], ax
mov ecx, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x18], ecx
movsx edx, word [ebp - 0x14]
push edx
call fcn.1002db91
add esp, 4
mov dword [ebp - 0x34], eax
movsx eax, word [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x34]
push edx
call fcn.10031570
add esp, 0xc
movsx eax, word [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x1001bb29
movsx edx, word [ebp - 0x14]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
push 0
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x60]
call fcn.1001e380
push eax
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.1001e3c0
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x1001bb3a
mov dword [ebp - 0x3c], 1
jmp 0x1001bb41
mov dword [ebp - 0x3c], 0
mov dl, byte [ebp - 0x3c]
mov byte [ebp - 0xd], dl
jmp 0x1001ba93
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10020c80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a378
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1006e1e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.100052c0
mov byte [ebp - 4], 1
push 0x10065c08
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.10008a00
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.100088f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.10002290
lea ecx, [ebp - 0x14]
call fcn.10002200
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x28], eax
cmp dword [ebp + 0xc], 0
je 0x10020d16
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x28]
mov dword [ecx], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10020d2c
mov dword [ebp - 0x18], 1
jmp 0x10020d33
mov dword [ebp - 0x18], 0
mov al, byte [ebp - 0x18]
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10002290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002290
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100210b0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059928
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1006e1e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
lea eax, [ebp + 8]
push eax
call fcn.10003c60
mov dword [ebp - 0x2c], eax
call fcn.10020e70
add esp, 4
mov byte [ebp - 0xd], al
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x1002111f
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002290
mov eax, dword [ebp - 0x20]
jmp 0x100211de
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
jmp 0x10021138
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp + 0xc]
jge 0x10021167
lea ecx, [ebp + 8]
call fcn.10002200
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1002115a
jmp 0x10021167
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002112f
cmp dword [ebp - 0x14], 0
jne 0x100211c6
push 0xad43
mov ecx, dword [0x1007054c]
call fcn.1001bc00
push eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.10008a00
add esp, 0xc
push 1
lea ecx, [ebp - 0x1c]
call fcn.10002200
push eax
lea ecx, [ebp + 8]
call fcn.10002200
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
lea ecx, [ebp - 0x1c]
call fcn.10002200
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1c]
call fcn.10002290
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002290
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100212e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059a96
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x1006e1e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x270], 0
push 0x10065c5c
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28c]
push ecx
call fcn.10008a00
add esp, 0xc
mov dword [ebp - 0x278], eax
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp - 0x278]
call fcn.10002200
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x268], eax
lea ecx, [ebp - 0x28c]
call fcn.10002290
cmp dword [ebp - 0x268], 0xffffffff
je 0x1002145b
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x26c]
call fcn.100052e0
mov byte [ebp - 4], 2
push 0xa
lea ecx, [ebp - 0x27c]
push ecx
lea ecx, [ebp - 0x26c]
call fcn.10008980
mov dword [ebp - 0x280], eax
mov edx, dword [ebp - 0x280]
mov dword [ebp - 0x288], edx
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xc]
call fcn.10002200
push eax
mov ecx, dword [ebp - 0x288]
call fcn.10008910
test eax, eax
jne 0x100213d5
mov dword [ebp - 0x274], 1
jmp 0x100213df
mov dword [ebp - 0x274], 0
mov al, byte [ebp - 0x274]
mov byte [ebp - 0x261], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x27c]
call fcn.10002290
movzx ecx, byte [ebp - 0x261]
test ecx, ecx
je 0x10021423
lea edx, [ebp - 0x26c]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.10026de0
mov eax, dword [ebp - 0x270]
add eax, 1
mov dword [ebp - 0x270], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x26c]
call fcn.10002290
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x268]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10021371
mov eax, dword [ebp - 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 0x284], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10002290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10002290
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002d4ad
mov esp, ebp
pop ebp
ret
Function at 0x100214b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059a3d
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x1006e1e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x264], 0
mov dword [ebp - 4], 1
push 0x10065c64
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28c]
push ecx
call fcn.10008a00
add esp, 0xc
mov dword [ebp - 0x288], eax
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp - 0x288]
call fcn.10002200
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
lea ecx, [ebp - 0x28c]
call fcn.10002290
cmp dword [ebp - 0x270], 0xffffffff
je 0x100216b3
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x26c]
call fcn.100052e0
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp + 0x10]
call fcn.10002200
push eax
lea ecx, [ebp - 0x26c]
call fcn.10005380
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0
jle 0x100215dc
mov ecx, dword [ebp - 0x278]
push ecx
lea edx, [ebp - 0x284]
push edx
lea ecx, [ebp - 0x26c]
call fcn.10008980
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x264]
or ecx, 1
mov dword [ebp - 0x264], ecx
mov edx, dword [ebp - 0x280]
push edx
call fcn.100222c0
add esp, 4
movzx eax, al
test eax, eax
je 0x100215dc
mov dword [ebp - 0x274], 1
jmp 0x100215e6
mov dword [ebp - 0x274], 0
mov cl, byte [ebp - 0x274]
mov byte [ebp - 0x265], cl
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x264]
and edx, 1
je 0x10021616
and dword [ebp - 0x264], 0xfffffffe
lea ecx, [ebp - 0x284]
call fcn.10002290
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x1002167b
mov ecx, dword [ebp - 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x26c]
push edx
mov ecx, dword [ebp + 8]
call fcn.10003c60
mov eax, dword [ebp - 0x264]
or eax, 2
mov dword [ebp - 0x264], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x26c]
call fcn.10002290
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.10002290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.10002290
mov eax, dword [ebp + 8]
jmp 0x100216ed
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x26c]
call fcn.10002290
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10021541
mov eax, dword [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x10065c68
mov ecx, dword [ebp + 8]
call fcn.100052e0
mov ecx, dword [ebp - 0x264]
or ecx, 2
mov dword [ebp - 0x264], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.10002290
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.10002290
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002d4ad
mov esp, ebp
pop ebp
ret
Function at 0x10023c30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x1006e1e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x261], 1
push 0x10065d44
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x298]
push ecx
call fcn.10008a00
add esp, 0xc
mov dword [ebp - 0x294], eax
lea edx, [ebp - 0x260]
push edx
mov ecx, dword [ebp - 0x294]
call fcn.10002200
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x278], eax
lea ecx, [ebp - 0x298]
call fcn.10002290
cmp dword [ebp - 0x278], 0xffffffff
je 0x10023e2a
mov dword [ebp - 0x274], 0x10065d4c
lea eax, [ebp - 0x234]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
mov dx, word [ecx]
mov word [ebp - 0x280], dx
mov eax, dword [ebp - 0x274]
cmp dx, word [eax]
jne 0x10023d3a
cmp word [ebp - 0x280], 0
je 0x10023d2e
mov ecx, dword [ebp - 0x26c]
mov dx, word [ecx + 2]
mov word [ebp - 0x27e], dx
mov eax, dword [ebp - 0x274]
cmp dx, word [eax + 2]
jne 0x10023d3a
add dword [ebp - 0x26c], 4
add dword [ebp - 0x274], 4
cmp word [ebp - 0x27e], 0
jne 0x10023cd4
mov dword [ebp - 0x288], 0
jmp 0x10023d45
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x288], ecx
mov edx, dword [ebp - 0x288]
mov dword [ebp - 0x28c], edx
cmp dword [ebp - 0x28c], 0
je 0x10023e01
mov dword [ebp - 0x270], 0x10065d50
lea eax, [ebp - 0x234]
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov dx, word [ecx]
mov word [ebp - 0x27c], dx
mov eax, dword [ebp - 0x270]
cmp dx, word [eax]
jne 0x10023dda
cmp word [ebp - 0x27c], 0
je 0x10023dce
mov ecx, dword [ebp - 0x268]
mov dx, word [ecx + 2]
mov word [ebp - 0x27a], dx
mov eax, dword [ebp - 0x270]
cmp dx, word [eax + 2]
jne 0x10023dda
add dword [ebp - 0x268], 4
add dword [ebp - 0x270], 4
cmp word [ebp - 0x27a], 0
jne 0x10023d74
mov dword [ebp - 0x284], 0
jmp 0x10023de5
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x284], ecx
mov edx, dword [ebp - 0x284]
mov dword [ebp - 0x290], edx
cmp dword [ebp - 0x290], 0
je 0x10023e01
mov byte [ebp - 0x261], 0
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0x278]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10023cbe
mov edx, dword [ebp - 0x278]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, byte [ebp - 0x261]
mov byte [ebp - 0x262], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002290
mov al, byte [ebp - 0x262]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002d4ad
mov esp, ebp
pop ebp
ret
Function at 0x10024820
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006e1e0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push 0xaddc
mov ecx, dword [0x1007054c]
call fcn.1001bc00
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100248c2
push 0xadf2
mov ecx, dword [0x1007054c]
call fcn.1001bc00
push eax
lea ecx, [ebp - 0x1c]
call fcn.1002ae80
lea ecx, [ebp - 0x20]
push ecx
push 0x2001f
push 0
lea ecx, [ebp - 0x1c]
call fcn.1002a360
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100248b0
push 0x10070554
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
call fcn.1002a380
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d4ad
mov esp, ebp
pop ebp
ret

Function at 0x10025290
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x1006e1e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x60], 0x20
mov dword [ebp - 0x58], 5
mov dword [ebp - 0x5c], 0xbb8
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x100252ce
mov eax, 1
jmp 0x1002537f
mov byte [ebp - 0x34], 0
xor eax, eax
mov dword [ebp - 0x33], eax
mov word [ebp - 0x2f], ax
mov byte [ebp - 0x2d], al
mov byte [ebp - 0x24], 0
xor ecx, ecx
mov dword [ebp - 0x23], ecx
mov dword [ebp - 0x1f], ecx
mov dword [ebp - 0x1b], ecx
mov dword [ebp - 0x17], ecx
mov dword [ebp - 0x13], ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov word [ebp - 7], cx
mov byte [ebp - 5], cl
mov dword [ebp - 0x28], 1
jmp 0x10025312
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 5
jg 0x10025373
mov al, byte [ebp - 0x28]
mov byte [ebp - 0x34], al
mov dword [ebp - 0x54], 0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
push 0xbb8
push 0x1c
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x34]
push eax
push 0x20
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x38], ecx
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.10027370
jmp 0x10025309
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d4ad
mov esp, ebp
pop ebp
ret