joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b834
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [0x100c51b8]
xor ecx, esp
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x18]
mov dword [esp], ecx
mov edx, dword [esp]
xor ebp, ebp
mov dword [ecx], ebp
lea ebx, [esp + 0x14]
mov dword [esp + 4], ebx
mov edx, dword [esp + 4]
mov dword [ebx], esi
push ecx
push 0x101
push ebp
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0xc], eax
mov ecx, 0x48982d3f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp ecx, 0x4478125c
jg 0x1005b8f8
cmp ecx, 0x1c29349b
jg 0x1005b93e
cmp ecx, 0xdcc0bdd7
je 0x1005b99a
cmp ecx, 0xdef4a049
je 0x1005b9a9
cmp ecx, 0xe1de696f
jne 0x1005b891
xor esi, esi
push dword [esp + 0x40]
push esi
mov ebp, dword [esp + 0x44]
push ebp
call fcn.1008c000
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push esi
push edi
push dword [esp + 0x2c]
call ebx
mov ecx, 0x38f32ecb
test eax, eax
je 0x1005b891
mov ecx, 0xdcc0bdd7
jmp 0x1005b891
cmp ecx, 0x48982d3e
jle 0x1005b973
cmp ecx, 0x7bee44bd
je 0x1005b9d1
cmp ecx, 0x5f8ce17c
je 0x1005b9e5
cmp ecx, 0x48982d3f
jne 0x1005b891
cmp dword [esp + 0xc], 0
mov ecx, 0xdef4a049
je 0x1005b891
mov ecx, 0x5f8ce17c
jmp 0x1005b891
cmp ecx, 0x38f32ecb
je 0x1005b9f2
cmp ecx, 0x3a94b103
jne 0x1005ba27
mov ecx, 0x46308266
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x14], eax
jg 0x1005b891
mov ecx, 0xe1de696f
jmp 0x1005b891
cmp ecx, 0x4478125d
je 0x1005ba18
cmp ecx, 0x46308266
jne 0x1005b891
mov esi, 3
mov ecx, 0x38f32ecb
jmp 0x1005b891
mov esi, 4
mov ecx, 0x38f32ecb
jmp 0x1005b891
lea eax, [esp + 0x14]
push eax
xor eax, eax
push eax
push eax
push eax
push edi
push dword [esp + 0x2c]
call ebx
mov ecx, 0x3a94b103
test eax, eax
je 0x1005b891
mov ecx, 0x4478125d
jmp 0x1005b891
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1c29349c
jmp 0x1005b891
mov ecx, 0x38f32ecb
xor esi, esi
inc esi
jmp 0x1005b891
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
mov ecx, 0x1c29349c
je 0x1005b891
mov ecx, 0x7bee44bd
jmp 0x1005b891
mov esi, 2
mov ecx, 0x38f32ecb
jmp 0x1005b891
cmp ecx, 0x1c29349c
jne 0x1005b891
mov eax, dword [esp + 4]
mov eax, dword [esp]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005ba53
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [0x100c51b8]
xor ecx, esp
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x18]
mov dword [esp], ecx
mov edx, dword [esp]
xor ebp, ebp
mov dword [ecx], ebp
lea ebx, [esp + 0x14]
mov dword [esp + 4], ebx
mov edx, dword [esp + 4]
mov dword [ebx], esi
push ecx
push 0x101
push ebp
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0xc], eax
mov ecx, 0x48982d3f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp ecx, 0x4478125c
jg 0x1005bb17
cmp ecx, 0x1c29349b
jg 0x1005bb5d
cmp ecx, 0xdcc0bdd7
je 0x1005bbb9
cmp ecx, 0xdef4a049
je 0x1005bbc8
cmp ecx, 0xe1de696f
jne 0x1005bab0
xor esi, esi
push dword [esp + 0x40]
push esi
mov ebp, dword [esp + 0x44]
push ebp
call fcn.1008c000
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push esi
push edi
push dword [esp + 0x2c]
call ebx
mov ecx, 0x38f32ecb
test eax, eax
je 0x1005bab0
mov ecx, 0xdcc0bdd7
jmp 0x1005bab0
cmp ecx, 0x48982d3e
jle 0x1005bb92
cmp ecx, 0x7bee44bd
je 0x1005bbf0
cmp ecx, 0x5f8ce17c
je 0x1005bc04
cmp ecx, 0x48982d3f
jne 0x1005bab0
cmp dword [esp + 0xc], 0
mov ecx, 0xdef4a049
je 0x1005bab0
mov ecx, 0x5f8ce17c
jmp 0x1005bab0
cmp ecx, 0x38f32ecb
je 0x1005bc11
cmp ecx, 0x3a94b103
jne 0x1005bc46
mov ecx, 0x46308266
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x14], eax
jg 0x1005bab0
mov ecx, 0xe1de696f
jmp 0x1005bab0
cmp ecx, 0x4478125d
je 0x1005bc37
cmp ecx, 0x46308266
jne 0x1005bab0
mov esi, 3
mov ecx, 0x38f32ecb
jmp 0x1005bab0
mov esi, 4
mov ecx, 0x38f32ecb
jmp 0x1005bab0
lea eax, [esp + 0x14]
push eax
xor eax, eax
push eax
push eax
push eax
push edi
push dword [esp + 0x2c]
call ebx
mov ecx, 0x3a94b103
test eax, eax
je 0x1005bab0
mov ecx, 0x4478125d
jmp 0x1005bab0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1c29349c
jmp 0x1005bab0
mov ecx, 0x38f32ecb
xor esi, esi
inc esi
jmp 0x1005bab0
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
mov ecx, 0x1c29349c
je 0x1005bab0
mov ecx, 0x7bee44bd
jmp 0x1005bab0
mov esi, 2
mov ecx, 0x38f32ecb
jmp 0x1005bab0
cmp ecx, 0x1c29349c
jne 0x1005bab0
mov eax, dword [esp + 4]
mov eax, dword [esp]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005bc72
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x3c]
mov ecx, dword [0x100c51b8]
xor ecx, esp
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x18]
mov dword [esp], ecx
mov edx, dword [esp]
xor edx, edx
mov dword [ecx], edx
lea ebx, [esp + 0x14]
mov dword [esp + 4], ebx
mov esi, dword [esp + 4]
mov dword [ebx], eax
mov eax, dword [esp + 0x34]
push ecx
push 0x108
push edx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0xc], eax
mov eax, 0xac767e9b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, 0x8bb5c9fc
cmp eax, 0xe31a2079
jle 0x1005bcf5
cmp eax, 0x368a5a9a
jg 0x1005bd22
cmp eax, 0xe31a207a
je 0x1005bd6d
cmp eax, 0xe764e198
jne 0x1005bcd0
jmp 0x1005bdc0
cmp eax, 0x87541dbf
je 0x1005bd7a
cmp eax, 0x8bb5c9fc
je 0x1005bd8e
cmp eax, 0xac767e9b
jne 0x1005bcd0
cmp dword [esp + 0xc], 0
mov eax, 0xe31a207a
mov ecx, 0x43ad9032
cmove eax, ecx
jmp 0x1005bcd0
cmp eax, 0x368a5a9b
je 0x1005bdb1
cmp eax, 0x43ad9032
jne 0x1005bcd0
mov eax, dword [esp + 0x18]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x58]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 4], ecx
mov dword [esp], eax
call esi
test eax, eax
mov eax, 0x368a5a9b
cmove eax, edi
xor ebp, ebp
jmp 0x1005bcd0
mov eax, 0x8bb5c9fc
xor ebp, ebp
inc ebp
jmp 0x1005bcd0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xe764e198
jmp 0x1005bcd0
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
mov eax, 0x87541dbf
mov ecx, 0xe764e198
cmove eax, ecx
jmp 0x1005bcd0
mov ebp, 2
mov eax, 0x8bb5c9fc
jmp 0x1005bcd0
mov eax, dword [esp + 4]
mov eax, dword [esp]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10061a43
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2a4
mov esi, dword [esp + 0x2b8]
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x2a0], eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea edi, [esp + 0x1a1]
mov dword [esp], edi
mov ecx, dword [esp]
mov ebx, 0xff
push ebx
push eax
push dword [esp + 8]
call fcn.1008c000
add esp, 0xc
lea eax, [esp + 0x10]
mov dword [esp + 8], eax
mov ecx, dword [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push edi
call dword [sym.imp.WS2_32.dll_gethostname]
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [esp + 4], eax
mov eax, 0xd0eb1fa3
mov ebp, 0x6e02fdc3
mov ebx, 0x9f2120d2
cmp eax, 0x4d1acc92
jle 0x10061afb
cmp eax, 0x767ac582
jg 0x10061b17
cmp eax, 0x4d1acc93
je 0x10061b66
cmp eax, 0x6e02fdc3
jne 0x10061acd
mov eax, dword [esp + 8]
mov eax, dword [esp]
mov eax, 0xa4f07f7f
jmp 0x10061acd
cmp eax, 0xd0eb1fa2
jle 0x10061b27
cmp eax, 0xd0eb1fa3
je 0x10061b7c
cmp eax, 0x274dbe54
jne 0x10061acd
mov eax, 0x6e02fdc3
jmp 0x10061acd
cmp eax, 0x767ac583
je 0x10061b8e
cmp eax, 0x7808693d
je 0x10061b5c
jmp 0x10061acd
cmp eax, 0x9f2120d2
jne 0x10061b9f
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
push eax
call fcn.1009ee80
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.10007b00
mov eax, 0x274dbe54
jmp 0x10061acd
mov eax, dword [esp + 4]
cmp word [eax + 0xa], 0
mov eax, 0x7808693d
cmovg eax, ebx
jmp 0x10061acd
cmp dword [esp + 4], 0
mov eax, 0x4d1acc93
cmove eax, ebp
jmp 0x10061acd
mov ecx, esi
call fcn.100087f0
mov eax, 0xa4f07f7f
jmp 0x10061acd
cmp eax, 0xa4f07f7f
jne 0x10061acd
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x2a4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10062b42
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x224], eax
lea edi, [esp + 0x18]
mov dword [esp + 8], edi
mov eax, dword [esp + 8]
mov ebx, 0x104
mov dword [edi], ebx
lea ebp, [esp + 0x120]
mov dword [esp], ebp
mov eax, dword [esp]
xor esi, esi
push ebx
push esi
push dword [esp + 8]
call fcn.1008c000
add esp, 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push ebx
push esi
push dword [esp + 0xc]
call fcn.1008c000
add esp, 0xc
mov dword [esp + 0xc], ebp
mov ebp, dword [esp + 0x23c]
push edi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [esp + 0x14], eax
mov eax, 0xb1d9e55b
mov edi, 0x4b7a365
cmp eax, 0xc81ae8c8
jle 0x10062c05
cmp eax, 0x4b7a364
jg 0x10062c40
cmp eax, 0xc81ae8c9
je 0x10062c6a
cmp eax, 0xf107ccea
jne 0x10062bc8
mov esi, dword [esp + 0xc]
push esi
call fcn.1009ee80
add esp, 4
mov ecx, ebp
push eax
push esi
call fcn.10007b00
mov eax, 0x4b7a365
jmp 0x10062bc8
cmp eax, 0xafd5f314
je 0x10062cc7
cmp eax, 0xb1d9e55b
je 0x10062c82
cmp eax, 0xbaca5cfe
jne 0x10062bc8
mov esi, dword [esp + 0x10]
push esi
call fcn.1009ee80
add esp, 4
mov ecx, dword [esp + 0x240]
push eax
push esi
call fcn.10007b00
mov eax, 0x2588954f
jmp 0x10062bc8
cmp eax, 0x4b7a365
je 0x10062c94
cmp eax, 0x2588954f
jne 0x10062bc8
cmp dword [ebp + 0x10], 0
mov eax, 0xafd5f314
mov ecx, 0xc81ae8c9
cmove eax, ecx
mov bl, 1
jmp 0x10062bc8
mov eax, dword [esp + 0x240]
cmp dword [eax + 0x10], 0
setne bl
mov eax, 0xafd5f314
jmp 0x10062bc8
cmp dword [esp + 0x14], 0
mov eax, 0xf107ccea
cmove eax, edi
jmp 0x10062bc8
mov dword [esp + 0x18], 0x104
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
mov eax, 0xbaca5cfe
mov ecx, 0x2588954f
cmove eax, ecx
jmp 0x10062bc8
mov eax, dword [esp + 4]
mov eax, dword [esp]
mov eax, dword [esp + 8]
and bl, 1
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.100879aa
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100665c1
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [0x100c51b8]
xor eax, ebp
mov dword [esp + 0x70], eax
lea esi, [esp + 0x30]
mov dword [esp], esi
mov eax, dword [esp]
mov eax, dword [esp]
xorps xmm0, xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov dword [esi], 0x40
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov esi, 0xd6e4727d
cmp esi, 0x3f4a4cc0
jg 0x1006667d
cmp esi, 0xd6e4727d
je 0x1006668f
cmp esi, 0x2b4c1e2a
jne 0x1006665c
mov esi, 0x46ae8f05
xor ebx, ebx
jmp 0x1006665c
cmp esi, 0x3f4a4cc1
je 0x100666a3
cmp esi, 0x46ae8f05
jne 0x1006665c
jmp 0x1006670c
cmp dword [esp + 0x2c], 0
mov esi, 0x3f4a4cc1
mov edi, 0x2b4c1e2a
cmove esi, edi
jmp 0x1006665c
mov esi, dword [ebp + 8]
mov ebx, dword [esp + 0x28]
mov dword [esi], ebx
mov esi, dword [ebp + 0xc]
mov ebx, dword [esp + 0x24]
mov dword [esi], ebx
mov ebx, dword [esp + 0x20]
mov dword [esi + 4], ebx
mov esi, dword [ebp + 0x10]
mov ebx, dword [esp + 0x18]
mov dword [esi], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esi + 4], ebx
mov esi, dword [ebp + 0x14]
mov ebx, dword [esp + 0x10]
mov dword [esi], ebx
mov ebx, dword [esp + 0x14]
mov dword [esi + 4], ebx
mov esi, dword [ebp + 0x18]
mov ebx, dword [esp + 8]
mov dword [esi], ebx
mov ebx, dword [esp + 0xc]
mov dword [esi + 4], ebx
mov esi, dword [ebp + 0x1c]
mov dword [esi], eax
mov edi, dword [esp + 4]
mov dword [esi + 4], edi
mov esi, dword [ebp + 0x20]
mov dword [esi], edx
mov dword [esi + 4], ecx
mov bl, 1
mov esi, 0x46ae8f05
jmp 0x1006665c
mov eax, dword [esp]
and bl, 1
mov ecx, dword [esp + 0x70]
xor ecx, ebp
call fcn.100879aa
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100669ee
Capabilities:
Get file version info

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x130
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x144]
mov dword [esp + 4], eax
lea eax, [esp + 0x15c]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [ecx], esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov dword [ecx], esi
lea ebp, [esp + 0x28]
mov dword [esp + 8], ebp
mov eax, dword [esp + 8]
push 0x104
push esi
push dword [esp + 0x10]
call fcn.1008c000
add esp, 0xc
mov ecx, dword [esp + 4]
call fcn.10007bca
push esi
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [esp + 0xc], eax
mov eax, 0x5d935ed9
mov edi, 0x68dc7e95
mov ebx, 0xffff
cmp eax, 0x1fe7d434
jle 0x10066aac
cmp eax, 0x1fe7d435
je 0x10066b02
cmp eax, 0x68dc7e95
je 0x10066b7d
cmp eax, 0x5d935ed9
jne 0x10066a7b
cmp dword [esp + 0xc], 0
mov eax, 0xa8976c71
cmovle eax, edi
xor ecx, ecx
jmp 0x10066a7b
cmp eax, 0xa8976c71
je 0x10066b5a
cmp eax, 0x18f2131c
jne 0x10066a7b
mov ecx, dword [esp + 4]
call fcn.10007bca
push dword [esp]
push dword [esp + 0x10]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0x100be360
push dword [esp + 0xc]
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
mov eax, 0x1fe7d435
jmp 0x10066b72
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
mov ecx, eax
and ecx, ebx
shr eax, 0x10
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 8]
mov esi, edx
and esi, ebx
shr edx, 0x10
push ecx
push eax
push esi
push edx
push str._d._d._d._d
push 0x104
push ebp
call fcn.10009906
add esp, 0x1c
mov eax, dword [esp + 0x14]
mov esi, dword [eax]
push ebp
call fcn.1009ee80
add esp, 4
mov ecx, esi
push eax
push ebp
call fcn.10007b00
mov eax, 0x68dc7e95
mov ecx, dword [esp]
jmp 0x10066a7b
push dword [esp + 0xc]
call fcn.1005c524
add esp, 4
mov dword [esp], eax
cmp dword [esp], 0
mov eax, 0x18f2131c
cmove eax, edi
mov ecx, dword [esp]
jmp 0x10066a7b
push ecx
call fcn.1005c627
add esp, 4
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x10], 0
setne bl
mov eax, dword [esp + 8]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 4]
call fcn.100087f0
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.100879aa
mov eax, ebx
add esp, 0x130
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10067be4
Capabilities:
Get system information on windows

Disassembly:
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x34]
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x24], eax
mov edi, esp
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [edi + 0x14]
mov dword [esi], eax
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100879aa
add esp, 0x28
pop esi
pop edi
ret
Function at 0x10067c17
Capabilities:
Enumerate pe sections
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x100c51b8]
xor eax, ebp
mov dword [esp + 0x40], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [eax], 0x5c3a43
mov byte [esp + 7], 0x43
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, 0x4abb68b4
cmp eax, 0x1a6ddeab
jg 0x10067c8d
cmp eax, 0x12737925
je 0x10067cd7
cmp eax, 0x168bd8c9
je 0x10067d9e
cmp eax, 0x18b5c1e4
jne 0x10067c5e
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov eax, 0x1a6ddeac
jmp 0x10067c5e
cmp eax, 0x1a6ddeac
je 0x10067d77
cmp eax, 0x34471b54
je 0x10067d4c
cmp eax, 0x4abb68b4
jne 0x10067c5e
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov al, byte [esp + 7]
mov byte [esp + 6], al
mov al, byte [esp + 6]
cmp al, 0x5b
mov eax, 0x168bd8c9
mov ecx, 0x12737925
cmovl eax, ecx
jmp 0x10067c5e
mov al, byte [esp + 6]
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x38], ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
lea ebx, [esp + 0x30]
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], ecx
lea edx, [esp + 0x2c]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], ecx
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push edx
push ebx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
mov eax, 0x34471b54
mov ecx, 0x18b5c1e4
cmove eax, ecx
jmp 0x10067c5e
mov eax, dword [esp + 0x30]
mul dword [esp + 0x38]
mov ecx, edx
mov ebx, dword [esp + 0x2c]
mul ebx
mov esi, eax
mov edi, edx
imul ecx, ebx
add edi, ecx
add esi, dword [esp + 8]
adc edi, dword [esp + 0xc]
mov eax, 0x1a6ddeac
jmp 0x10067c5e
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov al, byte [esp + 6]
inc al
mov byte [esp + 7], al
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edi
jmp 0x10067c59
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.100879aa
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1006a19e
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x30
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x2c], eax
lea esi, [esp + 8]
mov dword [esp], esi
mov eax, dword [esp]
mov eax, dword [esp]
xorps xmm0, xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [esi]
mov word [esp + 6], ax
mov ecx, 0x67c51d65
xor eax, eax
inc eax
cmp ecx, 0xc43a7817
je 0x1006a234
cmp ecx, 0x67c51d65
jne 0x1006a1e2
mov ecx, 0xc43a7817
movzx edx, word [esp + 6]
cmp dx, 8
jg 0x1006a216
xor esi, esi
test dx, dx
je 0x1006a1e2
cmp dx, 6
jne 0x1006a22d
mov esi, 2
jmp 0x1006a1e2
cmp dx, 0xc
je 0x1006a226
cmp dx, 9
jne 0x1006a22d
mov esi, eax
jmp 0x1006a1e2
mov esi, 3
jmp 0x1006a1e2
mov esi, 4
jmp 0x1006a1e2
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x30
pop esi
ret
Function at 0x1007e370
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push esi
sub esp, 8
push str.LIBCURL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], eax
mov eax, 0x4e36c67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, 0x5f904c3a
mov ebx, 0xcf566ab3
cmp eax, 0x4e36c67d
jg 0x1007e3d0
cmp eax, 0xc8d2b0e9
je 0x1007e495
cmp eax, 0xcf566ab3
je 0x1007e3f3
cmp eax, 0x2583a465
jne 0x1007e399
mov eax, dword [esp + 4]
push 3
call eax
add esp, 4
mov dword [0x100c51b0], eax
mov eax, 0x5f904c3a
jmp 0x1007e399
cmp eax, 0x6ce55092
je 0x1007e3fa
cmp eax, 0x5f904c3a
je 0x1007e3f3
cmp eax, 0x4e36c67e
jne 0x1007e399
cmp dword [esp], 0
mov eax, 0x6ce55092
cmove eax, ebx
jmp 0x1007e399
mov eax, 0xc8d2b0e9
jmp 0x1007e399
push str.curl_easy_init
push dword [esp + 4]
call esi
mov dword [0x100c6598], eax
push str.curl_easy_setopt
push dword [esp + 4]
call esi
mov dword [0x100c659c], eax
push str.curl_slist_append
push dword [esp + 4]
call esi
mov dword [0x100c65a0], eax
push str.curl_easy_perform
push dword [esp + 4]
call esi
mov dword [0x100c65a4], eax
push str.curl_easy_cleanup
push dword [esp + 4]
call esi
mov dword [0x100c65a8], eax
push str.curl_slist_free_all
push dword [esp + 4]
call esi
mov dword [0x100c65ac], eax
push str.curl_global_init
push dword [esp + 4]
call esi
mov dword [0x100c65b0], eax
push str.curl_global_cleanup
push dword [esp + 4]
call esi
mov dword [0x100c65b4], eax
mov eax, dword [0x100c65b0]
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
mov eax, 0x2583a465
cmove eax, edi
jmp 0x1007e399
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x1007fccf
Capabilities:
Get graphical window text

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x104
mov esi, dword [esp + 0x118]
mov eax, dword [0x100c51b8]
xor eax, esp
mov dword [esp + 0x100], eax
mov ebx, 0x100
xor ebp, ebp
mov edi, esp
push ebx
push ebp
push edi
call fcn.1008c000
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [esi], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
push edi
call fcn.1009ee80
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.10007b00
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.100879aa
mov eax, esi
add esp, 0x104
pop esi
pop edi
pop ebx
pop ebp
ret