joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10092d04
Capabilities:
Inspect section memory permissions

Disassembly:
mov dword [ebp + 0xc], ebx
jmp 0x10092d0f
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10092d27
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10092d45
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10092da3
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10092d8a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10092d93
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10092d9d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10092d7f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10092d09
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10092df0
dec eax
je 0x10092de7
sub eax, 3
je 0x10092dde
mov dword [ebp - 4], 0x40
jmp 0x10092e0d
mov dword [ebp - 4], 4
jmp 0x10092df3
mov dword [ebp - 4], 0x20
jmp 0x10092df3
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push esp
invalid
invalid
invalid
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10092e3f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10092dbf
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10092650
pop edx
sal dword [edx], 0xf5
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x10092e4b
invalid

Function at 0x1009560e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x414
mov eax, 0x100d208c
call fcn.10022400
mov esi, dword [ebp + 8]
push 0x200
lea ecx, [ebp - 0x420]
call fcn.10025cfa
xor eax, eax
mov word [ebp - 0x40c], ax
and dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
push esi
call fcn.1004a509
lea eax, [ebp - 0x420]
push eax
call fcn.1003b2a8
mov edx, 0x104
cmp eax, edx
jbe 0x10095680
mov eax, dword [ebp - 0x420]
xor ecx, ecx
mov byte [ebp - 0x418], 1
mov word [eax + 0x208], cx
push edx
lea ecx, [ebp - 0x420]
call fcn.100430fc
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.10027c42
mov al, bl
call fcn.10022631
ret 4

Function at 0x100959a2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4
Function at 0x100aa8f2
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x100aa8ff
lea esi, [ecx - 0x90]
jmp 0x100aa901
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp dword [esi + 0x60], 0
je 0x100aa91e
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x100b0eaf
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
cmp ax, word [0x1013d9ae]
je 0x100b0f41
push edi
mov esi, eax
lea eax, [ebp - 0x20]
push eax
xor edi, edi
push esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
call fcn.10026649
test eax, eax
js 0x100b0f22
mov eax, dword [ebp - 0x20]
push edi
push edi
push 0xa
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0x85
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call fcn.100b0f59
test eax, eax
je 0x100b0f22
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100c6081
mov eax, dword [ebp - 0x1c]
test eax, eax
js 0x100b0f2e
cmp eax, 3
jle 0x100b0f30
mov eax, edi
shl esi, 0x10
and eax, 3
or esi, eax
mov dword [0x1013d9ac], esi
pop edi
jmp 0x100b0f47
mov esi, dword [0x1013d9ac]
mov ecx, dword [ebp - 4]
and esi, 3
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002238e
leave
ret

Function at 0x100b253d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1013e23c], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x100b2566
mov esi, 0x8ff000ff
jmp 0x100b25ab
test ebx, ebx
je 0x100b25a6
call fcn.1002685f
mov esi, eax
test esi, esi
js 0x100b25ab
push edi
call fcn.100b3088
mov edi, eax
test edi, edi
je 0x100b25a6
test byte [edi + 0x1f], 4
jne 0x100b259d
push edi
call fcn.100b4960
mov esi, eax
test esi, esi
jns 0x100b259d
cmp esi, 0x8007000e
je 0x100b25ab
xor esi, esi
mov eax, dword [ebp + 0xc]
dec eax
je 0x100b25be
dec eax
je 0x100b25d6
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002238e
leave
ret 0xc
mov eax, dword [edi + 0x18]
test eax, eax
je 0x100b25d6
cmp byte [edi + 0x1e], 0
jbe 0x100b25d6
mov eax, dword [eax]
and eax, 0xff
mov dword [ebx], eax
jmp 0x100b25ab
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x100b25a6
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR100.dll__wtoi]
pop ecx
push ebx
push eax
call fcn.100b244d
mov esi, eax
jmp 0x100b25ab
Function at 0x100b3ec5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
and dword [ebp - 0x220], 0
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x1013e224
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [edi + 0x1f]
test byte [ebx], 2
jne 0x100b40b2
cmp dword [edi + 0x14], 0
je 0x100b3f1d
push dword [edi + 0x14]
mov ecx, 0x1013e240
call fcn.10026d4d
and dword [edi + 0x14], 0
mov byte [edi + 0x1d], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
push 8
lea eax, [ebp - 0x14]
push eax
push 0x1004
push dword [edi + 4]
call esi
test eax, eax
je 0x100b4020
lea eax, [ebp - 0x238]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x100b40e8
push 0
call fcn.10026fd0
mov dword [ebp - 0x218], eax
test eax, eax
js 0x100b4020
mov eax, dword [ebp - 0x234]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
mov dword [ebp - 0x220], 1
neg ecx
or ecx, eax
push ecx
mov ecx, 0x1013e240
call fcn.10024e30
mov dword [edi + 0x14], eax
test eax, eax
je 0x100b4033
xor ebx, ebx
cmp dword [ebp - 0x234], ebx
jbe 0x100b3fe5
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x238]
push dword [eax + ebx*4]
call fcn.100b0fa1
mov dword [ebp - 0x218], eax
test eax, eax
js 0x100b3fd5
movzx edx, byte [edi + 0x1d]
mov ecx, dword [edi + 0x14]
mov eax, dword [ebp - 0x21c]
mov dword [ecx + edx*4], eax
inc byte [edi + 0x1d]
jmp 0x100b3fdc
cmp eax, 0x8007000e
je 0x100b4006
inc ebx
cmp ebx, dword [ebp - 0x234]
jb 0x100b3fa1
cmp byte [edi + 0x1d], 0
lea ebx, [edi + 0x1f]
jne 0x100b409e
mov eax, dword [ebp - 0x220]
mov byte [edi + 0x1d], al
mov eax, dword [edi + 0x14]
and dword [eax], 0
jmp 0x100b409e
push dword [edi + 0x14]
mov ecx, 0x1013e240
call fcn.10026d4d
and dword [edi + 0x14], 0
mov byte [edi + 0x1d], 0
jmp 0x100b40b1
push 4
mov ecx, 0x1013e240
call fcn.10024e30
mov dword [edi + 0x14], eax
test eax, eax
jne 0x100b403f
mov dword [ebp - 0x218], 0x8007000e
jmp 0x100b40b1
mov byte [edi + 0x1d], 1
and dword [eax], 0
push 0x100
lea eax, [ebp - 0x214]
push eax
push 4
push dword [edi + 4]
call esi
test eax, eax
je 0x100b409e
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.100b3e55
test eax, eax
je 0x100b4092
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.100b63a9
mov ecx, dword [edi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x100b40b1
cmp dword [edi + 8], 0xc00
je 0x100b40aa
or byte [ebx], 2
and dword [ebp - 0x218], 0
pop esi
push 0x1013e224
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], 0
pop edi
pop ebx
je 0x100b40d4
lea eax, [ebp - 0x238]
push eax
call fcn.10027b57
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
xor ecx, ebp
call fcn.1002238e
leave
ret 4
Function at 0x100b8cf9
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push edi
jne 0x100b8d0b
mov edi, 0x80004003
jmp 0x100b8d55
push 1
xor edi, edi
push edi
push 0x80
push 2
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.100c6aec
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x100b8d50
push esi
push eax
call fcn.100b8d61
pop ecx
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
pop esi
jne 0x100b8d55
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 0x80004005
xor eax, eax
test edi, edi
setns al
pop edi
leave
ret 4

Function at 0x100b8da9
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push ebx
xor esi, esi
call fcn.100c6c87
pop ecx
pop ecx
mov dword [ebp + 8], eax
test eax, eax
je 0x100b8e32
cmp eax, ebx
ja 0x100b8e32
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push edx
push eax
mov eax, dword [ebp + 8]
push 0x100b8e3c
sub ebx, eax
push 0xffffffffffffffff
lea eax, [edi + eax*2]
push ebx
push eax
call dword [sym.imp.MSVCR100.dll__snwprintf_s]
add esp, 0x18
test eax, eax
jle 0x100b8e32
push esi
call fcn.100b977f
pop ecx
test eax, eax
je 0x100b8e08
push edi
call fcn.100b8cf9
mov esi, eax
test esi, esi
jne 0x100b8e32
push 0
call fcn.100b977f
pop ecx
test eax, eax
jne 0x100b8e32
cmp word [0x1013e31c], ax
je 0x100b8e32
push 1
push edi
push 0x1013e31c
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100b8e32
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100b9d48
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x240], eax
mov esi, 0x104
lea eax, [ebp - 0x22c]
push esi
push eax
call fcn.100bd390
pop ecx
pop ecx
test eax, eax
jne 0x100b9d85
or eax, 0xffffffff
jmp 0x100b9f2b
push ebx
xor eax, eax
lea ebx, [ebp - 0x22c]
push edi
mov dword [ebp - 0x234], ebx
cmp word [ebp - 0x22c], ax
je 0x100b9dac
add ebx, 2
cmp word [ebx], ax
jne 0x100b9d9e
mov dword [ebp - 0x234], ebx
push 1
call fcn.100bd328
pop ecx
push dword [0x1013b6dc]
call fcn.10023b00
mov edi, eax
mov dword [ebp - 0x230], edi
cmp edi, 0x64
jbe 0x100b9dcf
xor edi, edi
inc edi
lea eax, [ebp - 0x22c]
sub ebx, eax
sar ebx, 1
push edi
push 0x100b9f38
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.100bad60
add esp, 0x10
test ebx, ebx
js 0x100b9e80
cmp ebx, esi
ja 0x100b9e80
lea ecx, [ebp - 0x23c]
mov eax, esi
sub eax, ebx
push ecx
push eax
call fcn.100bbe3e
pop ecx
pop ecx
push dword [ebp - 0x23c]
lea eax, [ebp - 0x24]
push dword [ebp - 0x234]
push eax
call fcn.100c5e5e
push 1
push 0
push 0x80
push 1
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x22c]
push eax
call fcn.100c6aec
mov dword [ebp - 0x238], eax
cmp eax, 0xffffffff
jne 0x100b9ee3
cmp edi, 0x64
jb 0x100b9e5b
xor edi, edi
inc edi
cmp edi, dword [ebp - 0x230]
jne 0x100b9dd9
push edi
push 0x100b9f38
lea eax, [ebp - 0x24]
push 0xffffffffffffffff
push eax
call fcn.100bad60
add esp, 0x10
test ebx, ebx
jns 0x100b9e86
call dword [sym.imp.MSVCR100.dll__invalid_parameter_noinfo_noreturn]
cmp ebx, esi
ja 0x100b9e80
lea eax, [ebp - 0x230]
push eax
sub esi, ebx
push esi
call fcn.100bbe3e
pop ecx
pop ecx
push dword [ebp - 0x230]
lea eax, [ebp - 0x24]
push dword [ebp - 0x234]
push eax
call fcn.100c5e5e
mov ebx, 0x80
push ebx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push 0
push ebx
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x22c]
push eax
call fcn.100c6aec
mov esi, eax
jmp 0x100b9ee9
mov esi, dword [ebp - 0x238]
cmp edi, 0x64
jb 0x100b9ef0
xor edi, edi
cmp byte [ebp + 0x10], 0
je 0x100b9f05
lea eax, [edi + 1]
push eax
push dword [0x1013b6dc]
call fcn.100c8b4d
call fcn.100b9bc9
mov eax, dword [ebp - 0x240]
pop edi
pop ebx
test eax, eax
je 0x100b9f29
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.100b88c6
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002238e
leave
ret
Function at 0x100ba00d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x100ba01c
xor eax, eax
leave
ret
and dword [ebp - 4], 0
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor esi, esi
push eax
inc esi
call fcn.100badb5
mov ebx, eax
push ebx
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100ba140
push 0x1013e2a4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
call fcn.100b977f
pop ecx
test eax, eax
jne 0x100ba061
xor esi, esi
jmp 0x100ba12a
cmp byte [0x1013e52f], 0
je 0x100ba074
push 0x72766c72
call fcn.100b86e6
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov byte [0x1013e52f], 1
call fcn.100badb5
pop ecx
cmp eax, ebx
jne 0x100ba095
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x100ba0c1
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
lea eax, [ebp - 4]
push eax
call fcn.100badb5
mov ebx, eax
push ebx
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100ba0c1
push 0x72766c73
call fcn.100b86e6
xor esi, esi
cmp dword [ebp + 0x14], 0
jne 0x100ba0cf
cmp ebx, 0xea60
ja 0x100ba05a
test esi, esi
je 0x100ba0e5
push dword [ebp + 0xc]
push dword [ebp - 4]
push ebx
push edi
call fcn.100baf6e
add esp, 0x10
mov esi, eax
mov byte [0x1013e52f], 0
test esi, esi
je 0x100ba120
push 0
lea eax, [ebp - 8]
push eax
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100ba10f
cmp dword [ebp - 8], ebx
jne 0x100ba10f
xor esi, esi
inc esi
jmp 0x100ba111
xor esi, esi
push ebx
push edi
push dword [ebp + 0x10]
call fcn.100bb23e
add esp, 0xc
jmp 0x100ba12a
push 0x74697970
call fcn.100b86e6
push 0x1013e2a4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x100ba140
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x100bb23e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x100bb286
push esi
push 1
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call fcn.100c6aec
mov esi, eax
cmp esi, 0xffffffff
je 0x100bb285
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret
Function at 0x100bb288
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
test dword [0x1013e2cc], 0x2000
je 0x100bb2b4
call fcn.100bd2ad
jmp 0x100bb349
push ebx
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.100bd390
pop ecx
pop ecx
test eax, eax
je 0x100bb348
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x100bb358
call fcn.100c6705
call fcn.100b9d03
test al, al
je 0x100bb346
push edi
call fcn.100b9f48
push 1
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.100b9d48
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x100bb345
push esi
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
call fcn.100ba00d
add esp, 0x10
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x414]
test esi, esi
jne 0x100bb336
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100bb345
push ebx
push 0x1013e31c
push eax
call fcn.100b88c6
add esp, 0xc
pop edi
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002238e
leave
ret
Function at 0x100bc74c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov byte [eax], bl
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], ebx
mov esi, ebx
mov byte [edi], 1
call fcn.100bd204
mov dword [ebp - 0x220], eax
cmp eax, 3
je 0x100bc966
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100bc6fd
pop ecx
pop ecx
test eax, eax
je 0x100bc966
xor eax, eax
inc eax
push eax
push ebx
push 0x80
push 3
push ebx
push eax
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call fcn.100c6aec
mov dword [ebp - 0x210], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x210]
cmp ecx, 0xffffffff
jne 0x100bc804
cmp eax, 0x20
jne 0x100bc7fa
push 0x1c8016
call fcn.100b86e6
mov eax, ebx
mov byte [edi], al
jmp 0x100bc966
cmp eax, 5
je 0x100bc7f1
xor eax, eax
inc eax
jmp 0x100bc7f3
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi - 0x8c]
cmp eax, 0xf74
ja 0x100bc950
push edi
call fcn.100bc59a
mov esi, eax
test esi, esi
je 0x100bc950
push ebx
lea eax, [ebp - 0x218]
push eax
push edi
push esi
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100bc950
cmp edi, dword [ebp - 0x218]
jne 0x100bc950
push ebx
push edi
push esi
call fcn.100b9c14
add esp, 0xc
test eax, eax
je 0x100bc950
cmp dword [esi + 0x78], ebx
jne 0x100bc950
mov eax, dword [esi + 0x7c]
push 0xc
xor edx, edx
pop ecx
div ecx
mov ecx, eax
imul ecx, ecx, 0xc
mov dword [ebp - 0x214], eax
cmp dword [esi + 0x7c], ecx
jne 0x100bc950
lea edi, [esi + 0x80]
test eax, eax
jle 0x100bc924
cmp dword [edi], 0x2102
ja 0x100bc8ca
je 0x100bc8ea
cmp dword [edi], 0x10
je 0x100bc8ea
cmp dword [edi], 0x195b
je 0x100bc8ea
cmp dword [edi], 0x19df
jbe 0x100bc8fa
cmp dword [edi], 0x19e2
ja 0x100bc8fa
jmp 0x100bc8ea
cmp dword [edi], 0x24c8
jb 0x100bc8fa
cmp dword [edi], 0x24cb
jbe 0x100bc8ea
cmp dword [edi], 0x24cd
je 0x100bc8ea
cmp dword [edi], 0x2696
jne 0x100bc8fa
push dword [edi + 4]
push dword [edi]
call fcn.100b89d6
mov eax, dword [ebp - 0x214]
cmp dword [edi], 0x195b
je 0x100bc912
cmp dword [edi], 0x19e1
je 0x100bc912
cmp dword [edi], 0x24cd
jne 0x100bc913
inc ebx
add edi, 0xc
dec eax
mov dword [ebp - 0x214], eax
jne 0x100bc8a1
cmp ebx, 3
je 0x100bc932
call fcn.100c325e
test eax, eax
je 0x100bc93d
cmp ebx, 2
jl 0x100bc93d
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 1
jmp 0x100bc950
xor eax, eax
inc eax
cmp dword [ebp - 0x220], eax
jne 0x100bc950
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], al
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100bc966
push esi
call fcn.10039c2a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002238e
leave
ret
Function at 0x100bcb02
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100be3ca
and dword [ebp - 0x38], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x38]
push eax
push 0x11
call fcn.100b89d6
push dword [ebp - 0x24]
push 0x12
call fcn.100b89d6
mov edi, SysReAllocStringLen
xor ecx, ecx
mov eax, edi
cpuid
lea esi, [ebp - 0x14]
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
cmp dword [ebp - 0x14], edi
jbe 0x100bcb89
xor ecx, ecx
lea eax, [edi + 1]
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test dword [ebp - 8], 0x20000000
je 0x100bcb85
push 9
jmp 0x100bcb8e
push 0
jmp 0x100bcb8e
push 0xffff
push 0x2699
call fcn.100b89d6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002238e
leave
ret

Function at 0x100bcfe2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x118
lea eax, [ebp - 0x11c]
push esi
push eax
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], esi
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 1
push esi
push 0x100bd170
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bd08a
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x134]
push eax
push esi
push 0x100bd19c
push dword [ebp - 0x128]
mov dword [ebp - 0x12c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100bd07c
push dword [ebp - 0x130]
push 0x22df
call fcn.100b89d6
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100bd094
push 0x1c800b
call fcn.100b86e6
lea eax, [ebp - 0x120]
push eax
call fcn.100c4850
pop ecx
pop esi
test al, al
je 0x100bd115
push dword [ebp - 0x114]
push 0x1a
call fcn.100b89d6
movzx ecx, word [ebp - 0xc]
movzx eax, word [ebp - 0xa]
shl ecx, 0x10
or ecx, eax
push ecx
push 0x43
call fcn.100b89d6
movzx eax, word [ebp - 8]
push eax
push 0x3a5
call fcn.100b89d6
push dword [ebp - 0x11c]
push 0x22e1
call fcn.100b89d6
push dword [ebp - 0x118]
push 0x22e2
call fcn.100b89d6
movzx eax, word [ebp - 0xc]
push eax
push 0x22e4
call fcn.100b89d6
movzx eax, word [ebp - 0xa]
push eax
push 0x22e5
call fcn.100b89d6
lea eax, [ebp - 0x124]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
test eax, eax
je 0x100bd14e
push dword [ebp - 0x124]
push 0x1af7
call fcn.100b89d6
jmp 0x100bd164
push 0xffffffffffffffff
push 0x1af7
call fcn.100b89d6
push 0x1c800c
call fcn.100b86e6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002238e
leave
ret
Function at 0x100bd1b9
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1001e618]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x44], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add ecx, 0x80000
adc eax, 0
shrd ecx, eax, 0x14
push ecx
push 0xc
shr eax, 0x14
call fcn.100b89d6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002238e
leave
ret

Function at 0x100bd390
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
call fcn.10024772
test eax, eax
je 0x100bd3b3
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.100c6c87
pop ecx
pop ecx
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 8]
push 1
push dword [ebp + 0xc]
call fcn.100bd788
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100bd443
push edi
call fcn.100b889e
cmp word [edi + eax*2 - 2], 0x5c
pop ecx
je 0x100bd3f5
push 0xffffffffffffffff
push 0x100029b4
push dword [ebp + 0xc]
push edi
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x100bd443
push 0xffffffffffffffff
push 0x100bd44c
push dword [ebp + 0xc]
push edi
call dword [sym.imp.MSVCR100.dll_wcsncat_s]
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x100bd443
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100bd443
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [eax - 0xb7]
neg ebx
sbb ebx, ebx
inc ebx
jne 0x100bd443
push 0x1cb247
call fcn.100b86e6
pop edi
mov eax, ebx
pop ebx
pop ebp
ret