joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104d7fa
Capabilities:
Get disk information

Disassembly:
push 0x27c
mov eax, 0x10cdde6
call fcn.01098a33
mov eax, dword [ebp + 8]
xor esi, esi
push esi
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x230], esp
push 0xff
push 1
push 0xe20
push 0x10075f8
mov ebx, 0x1003990
push ebx
mov edi, 0x1003928
push edi
mov dword [ebp - 0x234], eax
call fcn.0109958e
lea ecx, [ebp - 0x288]
call fcn.0109aa5f
push esi
push 0xf003f
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], esi
call fcn.010ac28a
push 0x1003454
lea eax, [ebp - 0x248]
push 0x80000002
push eax
mov byte [ebp - 4], 1
call fcn.010abc06
add esp, 0xc
test al, al
je 0x104da1c
mov dword [ebp - 0x228], esi
mov esi, 0x10063bc
mov dword [ebp - 0x22c], esi
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 2
call fcn.01090452
push 0
lea eax, [ebp - 0x228]
push eax
push 0x1003470
lea ecx, [ebp - 0x248]
call fcn.010ac02b
test al, al
je 0x104da0f
and dword [ebp - 0x220], 0
mov dword [ebp - 0x224], esi
push 0x1003490
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 3
call fcn.0104a3e1
push dword [ebp - 0x228]
lea ecx, [ebp - 0x224]
call fcn.0104c1b3
mov esi, dword [ebp - 0x220]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x104d904
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x104d92a
push 0x100163c
lea ecx, [ebp - 0x224]
call fcn.0104c1b3
push 0x104
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x104d9ac
push dword [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb al, al
inc al
pop ecx
movzx eax, al
pop ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.0104693b
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.01091a02
lea ecx, [ebp - 0x22c]
call fcn.01091a02
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.010abdbc
lea ecx, [ebp - 0x288]
call fcn.0109ab18
mov al, bl
call fcn.01098ac5
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x104d9c0
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0x220]
push dword [ebp - 0x224]
push 0x1003ca0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x230], esp
push 0xff
push 1
push 0xe36
push 0x10075f8
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x288]
push eax
call fcn.0109a735
add esp, 0x6c
lea ecx, [ebp - 0x224]
call fcn.01091a02
lea ecx, [ebp - 0x22c]
call fcn.01091a02
xor esi, esi
push esi
lea ecx, [ebp - 0x288]
call fcn.0104693b
mov bl, al
jmp 0x104d988
Function at 0x104da34
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push 0x68c
mov eax, 0x10cde29
call fcn.01098a33
mov eax, dword [ebp + 8]
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x654], esp
push 0xff
push 1
push 0xe55
mov ebx, 0x10076f8
push ebx
mov edi, 0x1003990
push edi
mov esi, 0x1003928
push esi
mov dword [ebp - 0x658], eax
call fcn.0109958e
lea ecx, [ebp - 0x698]
call fcn.0109aa5f
and dword [ebp - 4], 0
push 0
push 0x220
lea eax, [ebp - 0x230]
push eax
push 0x12
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
je 0x104db03
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1007698
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x654], esp
push 0xff
push 1
push 0xe5f
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x698]
push eax
call fcn.0109a735
add esp, 0x64
push 0
lea ecx, [ebp - 0x698]
call fcn.0104693b
mov bl, al
lea ecx, [ebp - 0x698]
call fcn.0109ab18
mov al, bl
call fcn.01098ac5
ret 4
lea eax, [ebp - 0x230]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x648]
cmp dword [eax + 4], 0
je 0x104dc19
and dword [ebp - 0x64c], 0
mov dword [ebp - 0x650], 0x10063bc
push 0x1003490
lea ecx, [ebp - 0x650]
mov byte [ebp - 4], 1
call fcn.0104a3e1
mov eax, dword [ebp - 0x648]
push dword [eax + 0x14]
lea ecx, [ebp - 0x650]
call fcn.0104c1b3
mov eax, dword [ebp - 0x64c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x104db61
sub eax, ecx
mov ecx, dword [ebp - 0x64c]
sar eax, 1
cmp word [ecx + eax*2 - 2], 0x5c
je 0x104db8d
push 0x100163c
lea ecx, [ebp - 0x650]
call fcn.0104c1b3
push 0x104
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x64c]
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x104dbdf
push 0x104
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x104dbdf
push dword [ebp - 0x658]
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x104dc51
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x654], eax
add eax, dword [eax]
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x648], eax
mov byte [ebp - 4], 0
call fcn.01091a02
mov eax, dword [ebp - 0x654]
cmp dword [ebp - 0x648], eax
jne 0x104db0f
jmp 0x104dadf
push 0x1007638
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x654], esp
push 0xff
push 1
push 0xe6b
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x698]
push eax
call fcn.0109a735
add esp, 0x60
jmp 0x104dadf
push 1
lea ecx, [ebp - 0x698]
call fcn.0104693b
lea ecx, [ebp - 0x650]
mov bl, al
call fcn.01091a02
jmp 0x104daee
Function at 0x105053b
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp eax, 2
jne 0x105058e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x1009290
push 0x80042308
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0x10], esp
push 0xff
push 1
push 0x5c
push 0x1009268
push 0x1009254
push 0x10091e8
call fcn.0109958e
push dword [ebp + 8]
call fcn.0109b3d6
test eax, eax
je 0x10505d7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x10091bc
jle 0x10505a9
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0x10], esp
push 0xff
push 1
push 0x5f
push 0x1009268
push 0x1009254
push 0x10091e8
call fcn.0109958e
push dword [ebp + 8]
call fcn.0109c5e0
pop ebp
ret 0xc
Function at 0x10505e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x10e3200]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0x14]
push 8
mov dword [ebp - 0x34], ecx
pop ecx
mov ebx, 0x10093ac
mov esi, ebx
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 0x18]
xor edi, edi
mov dword [ebp - 0x3c], eax
mov dword [eax + 8], edi
lea eax, [esi + esi]
push eax
push edi
push edx
mov dword [ebp - 0x2c], edx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esi + esi - 2]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x10506a4
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0x1009374
jle 0x1050677
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xff
push 1
push 0xa8
push ebx
push 0x1009254
push 0x10091e8
call fcn.0109958e
push dword [ebp - 0x3c]
call fcn.0109c5e0
cmp dword [ebp - 0x2c], 1
je 0x1050790
push 1
push 0xff
push 1
push 0xae
push ebx
mov edi, 0x1009254
push edi
mov esi, 0x10091e8
push esi
lea ecx, [ebp - 0x1a0]
call fcn.0109958e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xf0]
push ecx
mov ecx, eax
call fcn.01099fa0
push 1
lea ecx, [ebp - 0x148]
push ecx
mov ecx, eax
call fcn.01099fa0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x98]
push ecx
mov ecx, eax
call fcn.01099bfb
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x30], esp
push dword [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.01099bfb
push 0x3007
push dword [ebp - 0x3c]
call fcn.0109bd5c
add esp, 0x64
lea ecx, [ebp - 0x98]
call fcn.0109963e
lea ecx, [ebp - 0x148]
call fcn.0109963e
lea ecx, [ebp - 0xf0]
call fcn.0109963e
lea ecx, [ebp - 0x1a0]
call fcn.0109963e
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x34]
push eax
push 0x10092d0
push 0x80042302
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0xff
push 1
push 0xaf
push ebx
push edi
push esi
call fcn.0109958e
push dword [ebp - 0x3c]
call fcn.0109b3d6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010989ab
leave
ret 0x18
Function at 0x10507a6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x10e3200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
push 8
pop ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
push 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov ebx, 0x100947c
mov esi, ebx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
pop edi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
xor esi, esi
lea ecx, [ebp - 0x3c]
push ecx
push eax
mov dword [edx + 8], esi
mov dword [eax], esi
lea eax, [ebp - 0x30]
push eax
push esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x38], edx
push dword [ebp - 0x28]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x1050856
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
push 0x1009374
jle 0x1050829
and eax, 0xffff
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0xff
push 1
push 0xf3
push ebx
push 0x1009254
push 0x10091e8
call fcn.0109958e
push dword [ebp - 0x38]
call fcn.0109c5e0
cmp dword [ebp - 0x30], edi
je 0x1050941
push 1
push 0xff
push 1
push 0xf9
push ebx
mov edi, 0x1009254
push edi
mov esi, 0x10091e8
push esi
lea ecx, [ebp - 0x19c]
call fcn.0109958e
push dword [ebp - 0x30]
lea ecx, [ebp - 0xec]
push ecx
mov ecx, eax
call fcn.01099fa0
push 4
lea ecx, [ebp - 0x144]
push ecx
mov ecx, eax
call fcn.01099fa0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
call fcn.01099bfb
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x28], esp
push dword [ebp - 0x34]
push ecx
mov ecx, eax
call fcn.01099bfb
push 0x3007
push dword [ebp - 0x38]
call fcn.0109bd5c
add esp, 0x64
lea ecx, [ebp - 0x94]
call fcn.0109963e
lea ecx, [ebp - 0x144]
call fcn.0109963e
lea ecx, [ebp - 0xec]
call fcn.0109963e
lea ecx, [ebp - 0x19c]
call fcn.0109963e
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
push eax
push 0x10093d0
push 0x80042302
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0xff
push 1
push 0xfa
push ebx
push edi
push esi
call fcn.0109958e
push dword [ebp - 0x38]
call fcn.0109b3d6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010989ab
leave
ret 0x14
Function at 0x10559e2
Capabilities:
Resume thread

Disassembly:
push 0x44
mov eax, 0x10d1ce9
call fcn.010989c0
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 1
push 0x171
push 0x100bfd8
mov ebx, 0x100bfc4
push ebx
mov edi, 0x100bf78
push edi
call fcn.0109958e
lea ecx, [ebp - 0x50]
call fcn.0109aa5f
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
and dword [ebp - 4], 0
test eax, eax
je 0x1055aed
cmp dword [esi + 0x10], 2
jne 0x1055aed
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1055add
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
push 0x100bee8
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x184
push 0x100bfd8
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109d083
add esp, 0x6c
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100be88
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x187
push 0x100bfd8
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109a735
add esp, 0x68
lea ecx, [ebp - 0x50]
mov dword [esi + 0x10], 5
call fcn.0109ab18
mov eax, 0x8007000e
jmp 0x1055b2e
lea ecx, [ebp - 0x50]
mov byte [esi + 0x14], 1
call fcn.0109ab18
xor eax, eax
jmp 0x1055b2e
push dword [esi + 0x10]
push 0x100be6c
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x176
push 0x100bfd8
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109a735
add esp, 0x64
lea ecx, [ebp - 0x50]
call fcn.0109ab18
mov eax, 0x8000ffff
call fcn.01098aac
ret 4
Function at 0x105681b
Capabilities:
Create thread

Disassembly:
push 0xf4
mov eax, 0x10ce733
call fcn.010989c0
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 1
push 0x122
mov ebx, 0x100c7a0
push ebx
mov edi, 0x100bfc4
push edi
mov esi, 0x100bf78
push esi
call fcn.0109958e
lea ecx, [ebp - 0x50]
call fcn.0109aa5f
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 8], ecx
jne 0x1056a25
cmp dword [eax + 0x10], 1
jne 0x1056a25
lea edx, [eax + 0xc]
push edx
push 4
push eax
push 0x1055c3c
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x105694d
call dword [sym.imp.msvcrt.dll__errno]
push dword [eax]
push 0x100c750
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x13a
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109a735
add esp, 0x64
push 1
push 0xff
push 0xb
push 0x13b
push ebx
push edi
push esi
lea ecx, [ebp - 0x100]
call fcn.0109958e
push 0
lea ecx, [ebp - 0xa8]
push ecx
mov ecx, eax
call fcn.0109a044
mov esi, eax
call dword [sym.imp.msvcrt.dll__errno]
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push dword [eax]
push ecx
mov ecx, esi
call fcn.0109a044
lea eax, [ebp - 0x50]
push 0x3008
push eax
call fcn.0109bd5c
add esp, 0x64
lea ecx, [ebp - 0xa8]
call fcn.0109963e
lea ecx, [ebp - 0x100]
call fcn.0109963e
lea ecx, [ebp - 0x50]
call fcn.0109ab18
mov eax, 0x8007000e
jmp 0x1056a62
cmp eax, 0xffffffff
jne 0x1056a03
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0xb
je 0x105693b
call dword [sym.imp.msvcrt.dll__errno]
push dword [eax]
push 0x100c750
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x147
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109a735
add esp, 0x64
push 1
push 0xff
push 0xb
push 0x148
push ebx
push edi
push esi
lea ecx, [ebp - 0xa8]
call fcn.0109958e
push 0xffffffffffffffff
lea ecx, [ebp - 0x100]
push ecx
mov ecx, eax
call fcn.0109a044
mov esi, eax
call dword [sym.imp.msvcrt.dll__errno]
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push dword [eax]
push ecx
mov ecx, esi
call fcn.0109a044
lea eax, [ebp - 0x50]
push 0x3008
push eax
call fcn.0109bd5c
add esp, 0x64
lea ecx, [ebp - 0x100]
call fcn.0109963e
lea ecx, [ebp - 0xa8]
jmp 0x1056936
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea ecx, [ebp - 0x50]
mov byte [esi + 4], al
mov dword [esi + 0x10], 2
call fcn.0109ab18
xor eax, eax
jmp 0x1056a62
push dword [eax + 0x10]
push 0x100be6c
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 0xb
push 0x127
push ebx
push edi
push esi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109a735
add esp, 0x64
lea ecx, [ebp - 0x50]
call fcn.0109ab18
mov eax, 0x8000ffff
call fcn.01098aac
ret 4
Function at 0x1057acd
Capabilities:
Resume thread

Disassembly:
push 0x44
mov eax, 0x10d1ce9
call fcn.010989c0
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 1
push 0x1f7
push 0x100d324
mov ebx, 0x100bfc4
push ebx
mov edi, 0x100bf78
push edi
call fcn.0109958e
lea ecx, [ebp - 0x50]
call fcn.0109aa5f
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp dword [esi + 8], 0
je 0x1057c82
mov eax, dword [esi]
mov ecx, esi
mov byte [esi + 5], 1
call dword [eax + 0xc]
cmp byte [ebp + 0xc], 0
je 0x1057bda
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1057bda
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
push 0x100bee8
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 0xb
push 0x20a
push 0x100d324
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109d083
add esp, 0x6c
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100be88
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 0xb
push 0x20d
push 0x100d324
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109a735
add esp, 0x68
lea ecx, [ebp - 0x50]
mov dword [esi + 0x10], 5
call fcn.0109ab18
mov eax, 0x8000ffff
call fcn.01098aac
ret 8
push 0xffffffffffffffff
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x1057c82
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 8]
push 0x100d260
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 0xb
push 0x219
push 0x100d324
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109d083
add esp, 0x6c
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100d1f0
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 0xb
push 0x21c
push 0x100d324
push ebx
push edi
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.0109a735
mov dword [esi + 0x10], 5
add esp, 0x68
mov esi, 0x8000ffff
lea ecx, [ebp - 0x50]
call fcn.0109ab18
mov eax, esi
jmp 0x1057bd2
xor esi, esi
jmp 0x1057c73
Function at 0x1071e8e
Capabilities:
Get common file path

Disassembly:
push 0x254
mov eax, 0x10d0512
call fcn.01098a33
mov eax, dword [ebp + 8]
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0xff
push 1
push 0x53
mov ebx, 0x1018b30
push ebx
mov edi, 0x1018b1c
push edi
mov esi, 0x1018ab0
push esi
mov dword [ebp - 0x220], eax
call fcn.0109958e
lea ecx, [ebp - 0x260]
call fcn.0109aa5f
and dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1071f42
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1071f0c
and eax, 0xffff
or eax, 0x80070000
push 0x1018a88
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0xff
push 1
push 0x5a
push ebx
push edi
push esi
mov dword [ebp - 0x258], eax
call fcn.0109958e
lea eax, [ebp - 0x260]
push eax
call fcn.01043227
add esp, 0x60
push 0x104
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x1071fa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1071f72
and eax, 0xffff
or eax, 0x80070000
push 0x1018a64
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x21c], esp
push 0xff
push 1
push 0x60
push ebx
push edi
push esi
mov dword [ebp - 0x258], eax
call fcn.0109958e
lea eax, [ebp - 0x260]
push eax
call fcn.01043227
add esp, 0x60
lea ecx, [ebp - 0x260]
call fcn.0109ab18
call fcn.01098ac5
ret 4

Function at 0x1071fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret 4

Function at 0x1071fe1
Capabilities:
Move file

Disassembly:
push 0x44
mov eax, 0x10d1ce9
call fcn.010989c0
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 1
push 0x16b
mov ebx, 0x1018ba0
push ebx
mov edi, 0x1018b1c
push edi
mov esi, 0x1018ab0
push esi
call fcn.0109958e
lea ecx, [ebp - 0x50]
call fcn.0109aa5f
and dword [ebp - 4], 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x107207c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x107204c
and eax, 0xffff
or eax, 0x80070000
push 0x1018b84
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 0xc], esp
push 0xff
push 1
push 0x179
push ebx
push edi
push esi
mov dword [ebp - 0x48], eax
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.01043227
add esp, 0x60
lea ecx, [ebp - 0x50]
call fcn.0109ab18
call fcn.01098aac
ret 8
Function at 0x1072091
Capabilities:
Delete file

Disassembly:
push 0x44
mov eax, 0x10d1ce9
call fcn.010989c0
push 0
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0xff
push 1
push 0x183
mov ebx, 0x1018c10
push ebx
mov edi, 0x1018b1c
push edi
mov esi, 0x1018ab0
push esi
call fcn.0109958e
lea ecx, [ebp - 0x50]
call fcn.0109aa5f
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1072127
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10720f7
and eax, 0xffff
or eax, 0x80070000
push 0x1018bf4
sub esp, 0x58
mov ecx, esp
mov dword [ebp + 8], esp
push 0xff
push 1
push 0x18b
push ebx
push edi
push esi
mov dword [ebp - 0x48], eax
call fcn.0109958e
lea eax, [ebp - 0x50]
push eax
call fcn.01043227
add esp, 0x60
lea ecx, [ebp - 0x50]
call fcn.0109ab18
call fcn.01098aac
ret 4
Function at 0x1090055
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10e3200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x22a]
push eax
mov dword [ebp - 0x238], 0x104
mov dword [ebp - 0x234], 0x10
call sub.msvcrt.dll_memset
add esp, 0xc
push 7
xor eax, eax
pop ecx
push eax
push eax
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
call sub.CLUSAPI.dll_GetClusterResourceState
mov esi, eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp esi, 2
je 0x10900ff
push 0x102af20
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x230], esp
push 0xff
push 1
push 0xc8b
jmp 0x1090176
test eax, eax
je 0x109015a
push 0xf
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x109015a
push 0x102aec8
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x230], esp
push 0xff
push 1
push 0xc93
push 0x102ae60
push 0x102a8a4
push 0x102a838
call fcn.0109958e
push ebx
call fcn.0109a735
add esp, 0x60
mov al, 1
jmp 0x1090195
push 0x102adf8
sub esp, 0x58
mov ecx, esp
mov dword [ebp - 0x230], esp
push 0xff
push 1
push 0xc8f
push 0x102ae60
push 0x102a8a4
push 0x102a838
call fcn.0109958e
push ebx
call fcn.0109a735
add esp, 0x60
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010989ab
leave
ret 8