joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10026b10
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.10026b10
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10026b10
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x40b468
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x416408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406147
mov dword [ebp - 0x14], eax
cmp dword [0x4564b4], esi
jne 0x40b55b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40b4e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b63b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40b63b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b63b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4564b4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4564b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4564bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4564c4], eax
test eax, eax
je 0x40b558
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4564c0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b580
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b573
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40b595
push 4
pop eax
jmp 0x40b63d
cmp dword [ebp - 0x14], esi
je 0x40b595
push dword [0x4564b4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b57a
mov eax, dword [0x4564c0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40b5f3
cmp dword [0x4564c4], edi
je 0x40b5f3
push eax
call ebx
push dword [0x4564c4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b5f3
test eax, eax
je 0x40b5f3
call ecx
test eax, eax
je 0x40b5e8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b5e8
test byte [ebp - 8], 1
jne 0x40b5f3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40b623
mov eax, dword [0x4564b8]
cmp eax, edi
je 0x40b620
push eax
call ebx
test eax, eax
je 0x40b620
call eax
mov esi, eax
test esi, esi
je 0x40b620
mov eax, dword [0x4564bc]
cmp eax, edi
je 0x40b620
push eax
call ebx
test eax, eax
je 0x40b620
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4564b4]
call ebx
test eax, eax
je 0x40b63b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40b63d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403ac6
mov esp, ebp
pop ebp
ret
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x1000e6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000e6af
pop dword [ebp - 0x2c]
mov eax, 0xa0799767
sub eax, 0x9078b0b8
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x78452cba
sub dword [ebp - 0x3c], 0x29f2e76f
mov dword [ebp - 0x38], 0x593f3bd1
add dword [ebp - 0x38], 0xd8f41074
mov dword [ebp - 0x34], 0xa92dbd8b
add dword [ebp - 0x34], 0xa31e86a3
mov dword [ebp - 0x30], 0x54c8f717
add dword [ebp - 0x30], 0xab3708e9
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xab50c1ce
sub eax, 0x9b4f616e
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xe1d34a66
add dword [ebp - 0x3c], 0x929f1ef0
mov dword [ebp - 0x38], 0xc977feb0
sub dword [ebp - 0x38], 0x880b9d3b
mov dword [ebp - 0x34], 0x9e363601
add dword [ebp - 0x34], 0xc539366b
mov dword [ebp - 0x30], 0xe9bfed00
sub dword [ebp - 0x30], 0xe9bfed00
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x3ffb2fff
sub eax, 0x2ff9cf9b
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x37b07
push 0
call eax
mov ecx, 0x4767
mov edx, eax
mov ebx, 0xe5ef19fd
sub ebx, 0xd5ece3fd
add ebx, dword [ebp - 0x2c]
mov esi, 0x6bfb1d0c
add esi, 0xf2010bba
add dword [ebp - 0x10], 0xc9cba951
mov edi, dword [ebx]
sub dword [ebp - 0x18], 0xea12d636
xor edi, esi
mov dword [ebp - 0x1c], 0xed169b19
mov dword [edx], edi
add dword [ebp - 0xc], 0xecc2df3b
add edx, 0x27275081
add edx, 0xd8d8af83
add ebx, 0x637439a6
add ebx, 0x9c8bc65e
loop 0x1000e7cb
add eax, 0x1106f
mov ebx, eax
add eax, 5
mov ecx, 0xe335c6a4
add ecx, 0x2cca395c
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1007592d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x64
mov eax, 0x1010af12
call fcn.10062c32
push ecx
push 0x1013d750
lea ecx, [ebp - 0x70]
call fcn.100e5537
xor ebx, ebx
mov ecx, 0x1013d744
mov dword [ebp - 4], ebx
call fcn.10076078
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
push 0x20119
push 0x1002f7c8
push 0x80000002
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.100e5537
mov esi, dword [ebp - 0x5c]
test eax, eax
jne 0x100759f8
push ecx
push 0x104
lea ecx, [ebp - 0x50]
call fcn.100e5537
mov byte [ebp - 4], 2
mov edi, ebx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100759f0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
push dword [ebp - 0x50]
call fcn.100e5537
push eax
mov ecx, 0x1013d744
mov byte [ebp - 4], 3
call fcn.100e5537
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1006af06
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
sub eax, ecx
sar eax, 1
inc edi
jmp 0x1007599f
lea ecx, [ebp - 0x50]
call fcn.10075865
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
push 0x20219
push 0x1002f7c8
push 0x80000002
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.100e5537
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x10075ad9
push ecx
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.100e5537
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
mov edi, dword [ebp - 0x50]
sar eax, 1
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x64]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x44]
push eax
push ecx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10075a99
push dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x1c]
call fcn.100e5537
push eax
mov ecx, 0x1013d744
mov byte [ebp - 4], 6
call fcn.100e5537
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 5
call fcn.1006af06
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sar eax, 1
inc ebx
jmp 0x10075a46
lea ecx, [ebp - 0x1c]
call fcn.10075865
test edi, edi
je 0x10075aac
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10075ab7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov edi, ebx
mov ebx, 0x80
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x10002784
call fcn.1006d7a9
mov eax, edi
mov edx, ebx
call fcn.10062bca
ret
cmp eax, 2
je 0x10075b11
cmp eax, 3
je 0x10075b11
call fcn.100758f8
mov edi, eax
mov ebx, edx
or edi, dword [ebp - 0x44]
or ebx, 0x112a
cmp dword [ebp - 0x50], 0
je 0x10075b04
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10075ac0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10075ac0
cmp dword [ebp - 0x50], 0
je 0x10075b20
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10075ab9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10075ab9
Function at 0x1007df31
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push 0x3c
mov eax, 0x1010b978
call fcn.10062c32
mov eax, edx
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov dword [eax], ebx
mov dword [ebp - 0x3c], edx
mov dword [edx], ebx
mov edx, ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], esi
mov byte [esi], bl
call fcn.1007daa2
cmp dword [eax + 0x14], 8
jb 0x1007df68
mov eax, dword [eax]
push ebx
push 0x80
push 3
push ebx
push 1
push Ordinal_1
push eax
call dword [sym.imp.kernel32.dll_CreateFileW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.1006af06
cmp esi, 0xffffffff
jne 0x1007df95
xor al, al
jmp 0x1007e0b5
mov edi, dword [sym.imp.kernel32.dll_CloseHandle]
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], esi
call fcn.100e5537
push ebx
push ebx
push ebx
push 2
push ebx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x1007dfcd
lea ecx, [ebp - 0x40]
call fcn.100e5537
jmp 0x1007df8e
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], edi
push eax
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], esi
call fcn.100e5537
push ebx
push ebx
push ebx
push 4
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x1007e0a3
push 0xc
call fcn.100e5537
pop ecx
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov eax, dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov dword [ecx], 0x10002e14
mov dword [ecx + 4], eax
mov eax, 0x5a4d
mov dword [ecx + 8], edi
mov dword [ebp - 0x2c], ecx
cmp word [edi], ax
jne 0x1007e09b
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
je 0x1007e046
mov eax, dword [ebp - 0x30]
mov dword [eax], 1
lea ecx, [ebp - 0x2c]
call fcn.100e5537
mov bl, 1
jmp 0x1007e0a3
movzx eax, word [esi + 4]
mov edx, 0x14c
mov ecx, eax
cmp ax, dx
je 0x1007e074
mov eax, 0x8664
cmp cx, ax
jne 0x1007e09b
mov eax, dword [ebp - 0x30]
mov dword [eax], 3
mov ecx, dword [ebp - 0x3c]
movzx eax, word [esi + 0x5c]
mov dword [ecx], eax
jmp 0x1007e03a
mov eax, dword [ebp - 0x30]
mov edx, edi
mov ecx, esi
mov dword [eax], 2
call fcn.1007e8fa
test eax, eax
je 0x1007e069
mov eax, dword [eax + 0x10]
and al, 3
cmp al, 1
jne 0x1007e069
mov eax, dword [ebp - 0x44]
mov byte [eax], 1
jmp 0x1007e069
lea ecx, [ebp - 0x2c]
call fcn.100e5537
lea ecx, [ebp - 0x48]
call fcn.100e5537
lea ecx, [ebp - 0x40]
call fcn.100e5537
mov al, bl
call fcn.10062bca
ret 8
Function at 0x1007fcb3
Capabilities:
Get disk information

Disassembly:
push 0x8c
mov eax, 0x1010bd10
call fcn.10062c32
mov dword [ebp - 0x98], edx
mov edi, ecx
push ecx
push 0x400
lea ecx, [ebp - 0x88]
call fcn.100e5537
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x88]
push dword [ebp - 0x88]
sar eax, 1
push eax
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
mov esi, dword [ebp - 0x88]
mov ecx, eax
mov eax, dword [ebp - 0x84]
sub eax, esi
sar eax, 1
cmp ecx, eax
jbe 0x1007fd40
push ecx
lea ecx, [ebp - 0x88]
call fcn.100e5537
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x88]
push dword [ebp - 0x88]
sar eax, 1
push eax
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
mov esi, dword [ebp - 0x88]
mov ecx, eax
test ecx, ecx
je 0x1007fdec
mov eax, dword [0x100307c0]
push ecx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x94]
mov ax, word [0x100307c4]
push 0x400
mov word [ebp - 0x18], ax
call fcn.100e5537
mov byte [ebp - 4], 1
movzx eax, word [esi]
test ax, ax
je 0x1007fde1
mov ecx, eax
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x94]
sar eax, 1
push eax
push dword [ebp - 0x94]
lea eax, [ebp - 0x1c]
mov word [ebp - 0x1c], cx
push eax
call dword [sym.imp.kernel32.dll_QueryDosDeviceW]
test eax, eax
je 0x1007fdcc
push dword [ebp - 0x94]
lea ecx, [ebp - 0x4c]
call fcn.100e5537
lea edx, [ebp - 0x4c]
mov byte [ebp - 4], 2
mov ecx, edi
call fcn.10073212
test al, al
jne 0x1007fdff
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.1006af06
add esi, 2
cmp word [esi], bx
jne 0x1007fdcc
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x1007fd79
lea ecx, [ebp - 0x94]
call fcn.10075865
lea ecx, [ebp - 0x88]
call fcn.10075865
mov al, bl
call fcn.10062bca
ret
push 0xffffffffffffffff
push dword [ebp - 0x3c]
lea eax, [ebp - 0x7c]
mov ecx, edi
push eax
call fcn.100e5537
mov esi, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
xor eax, eax
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], 7
call fcn.100e5537
push esi
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x64]
call fcn.1007f926
mov ecx, dword [ebp - 0x98]
push eax
call fcn.100e5537
lea ecx, [ebp - 0x64]
call fcn.1006af06
lea ecx, [ebp - 0x34]
call fcn.1006af06
lea ecx, [ebp - 0x7c]
call fcn.1006af06
lea ecx, [ebp - 0x4c]
call fcn.1006af06
lea ecx, [ebp - 0x94]
call fcn.10075865
mov bl, 1
jmp 0x1007fdec
Function at 0x1007ff2f
Capabilities:
Enumerate files on windows

Disassembly:
push 0x5c
mov eax, 0x1010bddb
call fcn.10062c32
mov eax, edx
mov dword [ebp - 0x4c], eax
mov esi, ecx
mov ecx, eax
call fcn.10076078
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
mov edx, esi
mov dword [ebp - 0x48], 0x104
call fcn.1007fe85
mov byte [ebp - 4], 1
push dword [ebp - 0x48]
lea ecx, [ebp - 0x58]
call fcn.100e5537
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1007ff81
mov eax, dword [esi]
mov edi, dword [ebp - 0x58]
lea ecx, [ebp - 0x48]
push edi
push ecx
push ebx
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileNameW]
mov ebx, eax
mov dword [ebp - 0x5c], ebx
cmp ebx, 0xffffffff
jne 0x1007ffdb
call dword [sym.imp.kernel32.dll_GetLastError]
push 0
pop ebx
cmp eax, 0xea
je 0x1007ff6c
call fcn.1007fc7e
mov esi, eax
mov edi, edx
call dword [sym.imp.kernel32.dll_GetLastError]
or esi, eax
or edi, 0x3125
lea ecx, [ebp - 0x2c]
call fcn.1006af06
lea ecx, [ebp - 0x58]
call fcn.10075865
mov eax, esi
mov edx, edi
jmp 0x100800cf
mov eax, dword [sym.imp.kernel32.dll_FindClose]
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x64], ebx
call fcn.100e5537
push edi
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.100e5537
mov ecx, dword [ebp - 0x4c]
push eax
mov byte [ebp - 4], 3
call fcn.100e5537
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.1006af06
mov eax, dword [ebp - 0x54]
sub eax, edi
sar eax, 1
mov dword [ebp - 0x48], eax
push eax
lea ecx, [ebp - 0x58]
call fcn.100e5537
mov edi, dword [ebp - 0x58]
lea eax, [ebp - 0x48]
push edi
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileNameW]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
test esi, esi
jne 0x10080060
cmp ebx, 0x26
je 0x100800b0
cmp ebx, 0xea
jne 0x1008008a
mov eax, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x5c]
jmp 0x10080025
push edi
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.100e5537
mov ecx, dword [ebp - 0x4c]
push eax
mov byte [ebp - 4], 4
call fcn.100e5537
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.1006af06
mov ebx, dword [ebp - 0x5c]
jmp 0x1008001b
mov ecx, dword [ebp - 0x4c]
call fcn.10076078
call fcn.1007fc7e
mov esi, eax
lea ecx, [ebp - 0x60]
mov edi, edx
or esi, ebx
or edi, 0x3425
call fcn.100e5537
jmp 0x1007ffc2
lea ecx, [ebp - 0x60]
call fcn.100e5537
lea ecx, [ebp - 0x2c]
call fcn.1006af06
lea ecx, [ebp - 0x58]
call fcn.10075865
xor eax, eax
mov edx, 0x80
call fcn.10062bca
ret
Function at 0x100804d0
Capabilities:
Get common file path

Disassembly:
push 0x25c
mov eax, 0x1010bee5
call fcn.10062c32
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x268], ebx
call fcn.100e5537
and eax, 0xffff0000
cmp eax, 0x800000
jl 0x10080545
xor eax, eax
mov dword [ebp - 0x220], ebx
push 0x100307cc
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
call fcn.100e5537
lea edx, [ebp - 0x230]
mov dword [ebp - 0x268], 1
mov ecx, edi
call fcn.10073212
mov byte [ebp - 0x261], 1
test al, al
jne 0x1008054b
mov byte [ebp - 0x261], bl
test byte [ebp - 0x268], 1
je 0x1008055f
lea ecx, [ebp - 0x230]
call fcn.1006af06
cmp byte [ebp - 0x261], bl
je 0x100805e1
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 4], ebx
mov esi, edi
cmp dword [edi + 0x14], 8
jb 0x10080586
mov esi, dword [edi]
push ecx
lea eax, [ebp - 0x224]
mov ecx, esi
push eax
call fcn.10080745
mov edx, eax
mov ecx, esi
call fcn.100e5537
mov dword [ebp - 0x268], eax
test eax, eax
je 0x10080681
mov esi, ebx
push dword [esi + 0x10009008]
push eax
call fcn.100e5537
pop ecx
pop ecx
test eax, eax
je 0x10080673
mov eax, dword [ebp - 0x268]
add esi, 4
cmp esi, 0x18
jb 0x100805ae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.10074e3b
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10080690
cmp eax, esi
ja 0x10080690
xor eax, eax
mov dword [ebp - 0x238], ebx
mov word [ebp - 0x248], ax
lea ecx, [ebp - 0x248]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x234], 7
push eax
call fcn.100e5537
push edi
lea edx, [ebp - 0x248]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x260]
call fcn.10080ccb
cmp dword [eax + 0x14], 8
jb 0x10080650
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
lea ecx, [ebp - 0x260]
mov esi, eax
call fcn.1006af06
lea ecx, [ebp - 0x248]
call fcn.1006af06
mov eax, esi
jmp 0x10080692
push dword [ebp - 0x268]
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, eax
lea ecx, [ebp - 0x224]
call fcn.10074e3b
mov eax, ebx
jmp 0x10080692
xor eax, eax
call fcn.10062bca
ret