joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3412c1d0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x34145286
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.340accc0
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.340accc0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x3412c309
mov edx, dword [0x341a2104]
mov cx, word [0x341a2108]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.340a6b90
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.340ad260
mov edx, dword [0x34146a5c]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.340a75b0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.340ad260
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.340a7330
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.340a7330
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x3412c22b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret

Function at 0x34132a42
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push accept
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x34132ad2
cmp eax, ebx
je 0x34132ad2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x34132ada
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x34132c85
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x34132dd7
xor edx, edx
cmp eax, edx
je 0x34132dd7
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x34132cba
cmp eax, ecx
jb 0x34132cba
xor ecx, ecx
jmp 0x34132cbf
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x34132cd9
jg 0x34132dd7
cmp eax, dword [esi + 8]
ja 0x34132dd7
cmp ecx, edx
jne 0x34132cf3
cmp eax, dword [esi + 0x42c]
ja 0x34132cf3
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x34132d38
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x34132d13
cmp edi, edx
jb 0x34132d13
xor edx, edx
jmp 0x34132d18
mov edx, 1
cmp ecx, ebx
ja 0x34132d38
cmp dword [esp + 0x14], edx
jg 0x34132d38
jl 0x34132d28
cmp eax, edi
ja 0x34132d38
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.34132df0
test eax, eax
je 0x34132dd7
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x34132d86
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push accept
push ecx
call edi
cmp eax, 0xffffffff
je 0x34132dc7
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x34132dc7
jmp 0x34132d96
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x34132dc7
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x34132dc7
cmp dword [edi], ebp
jne 0x34132dc7
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x34135e60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.340be600
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x34135fb4
cmp ebx, 0x80
jg 0x34135fb4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.34136770
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x34135ef7
test ebp, ebp
jle 0x34135f45
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x34135ee4
jmp 0x34135f41
xor esi, esi
test ebp, ebp
jle 0x34135f45
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x34135f27
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x34135f23
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, reloc.WS2_32.dll_getsockopt
jns 0x34135f54
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x34135f85
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x34135f9c
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x34135f98
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10001852
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x10001880
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x10001877
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x1000186f
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x100018a1
mov esp, ebp
pop ebp
ret

Function at 0x100018a5
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x10001911
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x1000193e
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x1000192d
xor ecx, eax
xor edx, ebx
dec edi
jne 0x1000191e
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x10001964
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x10001905
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x10001990
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10007af0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10007b52
test eax, eax
je 0x10007b33
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10007b33
cmp word [eax], 0x5a4d
jne 0x10007b33
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10007b33
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10007c24
mov eax, dword [ebp + 8]
jmp 0x10007b4c
mov esp, ebp
pop ebp
ret 4

Function at 0x10007b52
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10007c05
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x10007dc0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10007de2
mov eax, 0xfffffffd
jmp 0x10007ec2
mov ebx, dword [0x10163584]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10007e90
mov ebx, dword [0x10163584]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10007e31
mov ebx, dword [0x10163584]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10007e31
mov eax, 1
jmp 0x10007e36
mov eax, 0
test eax, eax
je 0x10007e62
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10007e4b
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x10163584]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10007eb8
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10007ec2
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f2df
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x1000f2e8
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x1000f30b
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x1000f30b
mov eax, ebx
jmp 0x1000f320
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x1000f2f7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret
Function at 0x1005def0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100f8d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.100ee163
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10061c70
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x1005df44
jmp dword [ecx*4 + 0x1005e0ac]
mov al, byte [esi]
test al, al
je 0x1005df72
cmp al, 0x20
je 0x1005df5e
cmp al, 0xa1
jne 0x1005df72
cmp byte [esi + 1], al
jne 0x1005df72
test al, 0x80
je 0x1005df6a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x1005df72
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1005df51
test ecx, ecx
je case.default.0x1005df44
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x1005df44
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x1005dfb8
cmp dl, 0xa1
jne 0x1005dfac
cmp byte [eax + 1], 0xa1
jne 0x1005dfac
test ecx, ecx
jne 0x1005dfa4
mov edi, eax
mov ecx, 1
inc eax
jmp 0x1005dfcc
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x1005dfe6
jmp 0x1005dfcc
cmp dl, 0x20
jne 0x1005dfca
test ecx, ecx
jne 0x1005dfc3
mov edi, eax
mov ecx, 1
jmp 0x1005dfcc
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x1005df8c
cmp ecx, 1
jne case.default.0x1005df44
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1005df44
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x1005df44
mov al, byte [esi]
test al, al
je 0x1005e03e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x1005e024
mov cl, byte [esi + 1]
test cl, cl
je 0x1005e03e
cmp al, 0xa1
jne 0x1005e014
cmp cl, al
je 0x1005e021
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10061f40
inc esi
jmp 0x1005e036
cmp al, 0x20
je 0x1005e036
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10061f80
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1005dffd
push 0
lea ecx, [esp + 0x14]
call fcn.10061f80
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1006efa0
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x1005e071
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x1011bac8
call fcn.10061e70
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.100ee0f5
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1005efb0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, 0x1013f268
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
push ecx
call fcn.1005ef70
add esp, 8
mov byte [esp + 8], al
or esi, 0xffffffff
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005f05a
lea edx, [esp + 0xc]
lea ecx, [esp + 0x1c]
push edx
push ecx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
push ecx
call eax
test eax, eax
je 0x1005f0bb
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x1005f03c
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
jmp 0x1005f044
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, 0xa
call fcn.100dead0
mov edx, dword [esp + 0x28]
pop edi
pop esi
mov dword [edx], eax
add esp, 0x1c
ret
lea eax, [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x1005f0af
mov eax, dword [esp + 0x34]
test eax, eax
mov eax, dword [esp + 0x30]
je 0x1005f08d
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push 0x400
imul edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], eax
add esp, 0x1c
ret
mov edx, dword [esp + 0x28]
pop edi
mov dword [edx], esi
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
pop esi
add esp, 0x1c
ret
Function at 0x1005f8d0
Capabilities:
Access peb ldr_data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x100f8de8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x1015f428]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
push esi
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push edi
mov dword [esp + 0x30], 0
call fcn.1005f770
add esp, 0x14
dec esi
neg esi
sbb esi, esi
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x24]
add esi, 3
lea edx, [esp + 0x30]
lea ecx, [esi + esi*2]
push edx
push 0x20006
push 0
lea esi, [edi + ecx*4]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov dword [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1005f972
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1005fa2b
mov edx, dword [esi + 8]
push edx
call fcn.1006dd20
add esp, 4
test eax, eax
mov eax, dword [esi + 8]
je 0x1005f9c2
cmp eax, 0x80000301
jne 0x1005f990
mov eax, dword [esi]
jmp 0x1005f99d
push 0
push esi
push 0x7d1
call fcn.100733f0
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
push 4
push ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1005fa20
jmp 0x1005fa1a
cmp eax, reloc.WS2_32.dll_connect
jne 0x1005f9f1
mov esi, dword [esi]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x30]
not ecx
push ecx
mov ecx, dword [esp + 0x30]
push esi
push 1
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1005fa20
jmp 0x1005fa1a
cmp eax, reloc.WS2_32.dll_getpeername
jne 0x1005fa20
mov esi, dword [esi]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 4]
add esi, 8
push eax
push esi
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1005fa20
mov dword [ebx], 1
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.100ee0f5
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10068130
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100f945b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.100ede6a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x100681b2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.100ebd44
mov eax, dword [eax]
push 0x10142d60
push eax
call fcn.100de2e4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.100ee0f5
test bl, bl
je 0x100681b2
push 0x10142d60
lea ecx, [esp + 0xc]
call fcn.100ee485
push 0x10142d6c
lea ecx, [esp + 0xc]
call fcn.100ee485
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x100681ee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.100ee0f5
jmp 0x100682b9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10068272
lea edx, [esp + 0x7c]
push 0x10142d68
push edx
call fcn.100de2e4
add esp, 8
test eax, eax
je 0x10068272
lea eax, [esp + 0x7c]
push 0x10142d64
push eax
call fcn.100de2e4
add esp, 8
test eax, eax
je 0x10068272
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10068202
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.100ee0f5
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x10068ab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10068b12
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc