joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101baa10
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, eax
test esi, esi
push edi
je 0x101babe4
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x101babe4
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x101babe4
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x101babe4
cmp byte [esp + 0x3c], al
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
je 0x101baaa3
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x101babe4
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x101babe4
mov edi, dword [sym.imp.USER32.dll_ClientToScreen]
lea edx, [esp + 0x18]
push edx
push esi
call edi
lea eax, [esp + 0x20]
push eax
push esi
call edi
jmp 0x101baaca
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x101babe4
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x101babe4
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
mov ebp, eax
test ebp, ebp
je 0x101babe4
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
jne 0x101bab03
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
lea esi, [esp + 0x28]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call fcn.101c69b0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
cmp edx, eax
jge 0x101bab34
mov edx, eax
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
jge 0x101bab46
mov ecx, eax
mov dword [esp + 0x1c], ecx
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
cmp ebx, eax
jle 0x101bab58
mov ebx, eax
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x34]
cmp eax, esi
jle 0x101bab6a
mov eax, esi
mov dword [esp + 0x24], eax
sub ebx, edx
sub eax, ecx
test ebx, ebx
mov dword [esp + 0x10], eax
jle 0x101babd8
test eax, eax
jle 0x101babd8
push eax
push ebx
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
test esi, esi
je 0x101babd8
push esi
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push 0xcc0020
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push eax
push ecx
push ebp
push edx
push ebx
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x14]
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
call edi
push ebp
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x101bf0e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
push ebx
push ebp
push esi
push edi
je 0x101bf217
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
call eax
movzx ecx, word [esp + 0x1c]
push 0x10242940
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x101bf217
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x101bf217
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x101bf217
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x101bf210
push ebp
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x101bf210
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x101bf209
push ebp
push edi
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edx, [esp + 0x10]
push edx
push 0
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x101bf209
mov eax, dword [esp + 0x10]
test eax, eax
je 0x101bf209
push eax
call fcn.101beb40
add esp, 4
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
test edi, edi
je 0x101bf1f3
mov eax, dword [edi + 8]
test eax, eax
mov dword [edi + 8], 0
jne 0x101bf1e9
mov esi, dword [esp + 0x18]
add esi, 0x1c
lea ebx, [esp + 0x10]
call fcn.101bf3e0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x101bf7b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101dd078
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], 0
push 0xffffffffffffffff
lea ecx, [eax + 0x2c]
push 0
lea eax, [esp + 0x20]
call fcn.10007880
mov dword [esp + 0xc], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x101bf808
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], 0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0x20
Function at 0x101c03d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101dd078
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], 0
push 0xffffffffffffffff
lea ecx, [eax + 0x20]
push 0
lea eax, [esp + 0x20]
call fcn.10007880
mov dword [esp + 0xc], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x101c0428
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], 0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 0x20
Function at 0x101c32eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
push edi
mov edi, dword [ebp + 8]
jb 0x101c3433
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + ecx - 4]
push ebx
mov dword [ebp - 8], ecx
push esi
lea esi, [eax + edi]
jmp 0x101c3323
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x101c3328
inc esi
cmp esi, dword [ebp - 8]
jb 0x101c331a
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 8]
jae 0x101c3414
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x101c33a7
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp - 4], eax
je 0x101c3354
cmp cl, 0xff
jne 0x101c33d6
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
sub edi, eax
sub edi, 5
test edx, edx
mov ebx, edi
mov dword [ebp - 0xc], ebx
je 0x101c33e7
movzx edi, byte [edx + 0x102359f0]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
shr ebx, cl
test bl, bl
je 0x101c3397
cmp bl, 0xff
jne 0x101c33e4
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, dword [ebp - 0xc]
jmp 0x101c336f
dec ecx
shl edx, cl
and edx, 7
je 0x101c3341
movzx ecx, byte [edx + 0x102359f0]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x102359e8], 0
mov cl, byte [ebx + 4]
je 0x101c33d3
test cl, cl
je 0x101c33d3
cmp cl, 0xff
jne 0x101c3341
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x101c3315
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x101c3315
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
and ecx, edx
mov edx, dword [ebp + 0xc]
pop esi
mov dword [edx], ecx
pop ebx
pop edi
leave
ret
Function at 0x101c4f00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push ebp
push esi
call fcn.101c5210
mov edi, eax
test edi, edi
jne 0x101c4f26
push ebp
push esi
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
pop ebp
ret 8
mov ecx, dword [edi + 4]
test ecx, ecx
push ebx
lea ebx, [ebp - 0x600]
je 0x101c4f40
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 5
cmp ebx, eax
jb 0x101c4f42
xor ebx, ebx
test ecx, ecx
je 0x101c4fa7
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 5
cmp ebx, eax
jae 0x101c4fa7
mov esi, ebx
shl esi, 5
add esi, dword [edi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x10]
jb 0x101c4fa7
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x101c4f86
mov edx, dword [esi + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edx
mov edx, dword [esi + 0x18]
push edx
mov edx, dword [esp + 0x1c]
push ebx
push edx
call eax
mov ecx, dword [esp + 0x14]
push ebp
push ecx
call fcn.101c5210
mov ecx, eax
test ecx, ecx
je 0x101c4fa7
mov eax, ebp
call fcn.101c4c70
cmp eax, ebx
jne 0x101c4fa7
call edi
mov dword [esi + 0x14], eax
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x101c6020
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x101e6879
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x20], edi
mov esi, ecx
mov dword [esp + 0x10], edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov dword [esp + 0x14], esi
mov word [esi + 4], di
mov dword [esp + 0x20], edi
push ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, edi
jle 0x101c60d3
lea ebp, [eax + eax]
xor ecx, ecx
lea eax, [ebp + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101d19a9
add esp, 4
push ebp
mov edi, eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebp
jg 0x101c60ca
mov word [edi + eax*2], 0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x101c60b4
sub eax, edx
sar eax, 1
push eax
push edi
call fcn.10007a00
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x101c6cc0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
cmp byte [esp + 0x30], 0
push ebx
push ebp
push esi
push edi
mov esi, eax
je 0x101c6d5b
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x101c6d15
push esi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
mov edi, eax
push edi
call ebp
test eax, eax
je 0x101c6d15
jmp 0x101c6d00
push 5
push edi
call ebx
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
push edi
call ebp
test eax, eax
jne 0x101c6d00
push 5
push esi
call ebx
mov edi, dword [esp + 0x44]
mov eax, dword [edi]
cmp eax, 3
jne 0x101c6d2e
push 0
push 0xf030
jmp 0x101c6d3f
cmp eax, 1
je 0x101c6d38
cmp eax, 2
jne 0x101c6d4b
push 0
push 0xf120
push 0x112
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi], 0xffffffff
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x2c
ret
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x101c6da7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x44]
mov dword [edx], ecx
push 0
push 0xf020
push 0x112
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
jne 0x101c6e01
push esi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov esi, eax
push esi
call ebx
test eax, eax
je 0x101c6e01
mov ebp, dword [sym.imp.USER32.dll_GetParent]
lea esp, [esp]
push 0
push esi
call edi
push esi
call ebp
mov esi, eax
push esi
call ebx
test eax, eax
jne 0x101c6df0
push esi
call ebx
test eax, eax
je 0x101c6e0d
push 0
push esi
call edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x2c
ret
Function at 0x101c8020
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x38
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
test esi, esi
mov dword [esp], 0x3c
mov dword [esp + 4], 0
je 0x101c804d
mov dword [esp + 8], esi
jmp 0x101c8057
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [esp + 8], eax
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
lea edx, [esp]
push edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x3c], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x101c80a6
mov eax, 0x20
cmp eax, dword [esp + 0x20]
sbb eax, eax
neg eax
add esp, 0x3c
ret
xor al, al
add esp, 0x3c
ret
Function at 0x101c8800
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x101e67a1
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10293044]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
mov edi, ecx
push eax
mov ebp, 1
mov dword [esp + 0x18], 0
mov ebx, ebp
xor eax, eax
mov edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], 0x25
call fcn.10016200
xor ebx, ebx
push 0xffffffffffffffff
cmp eax, 0xffffffff
push ebx
mov eax, edi
jne 0x101c888a
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov ecx, esi
mov word [esi + 4], bx
call fcn.10007880
mov dword [esp + 0x48], ebx
mov dword [esp + 0x14], ebp
jmp 0x101c89b1
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
call fcn.10007880
mov dword [esp + 0x48], ebp
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [esp + 0x10], eax
jb 0x101c88b7
mov eax, dword [eax]
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x101c890b
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push ebx
mov eax, edi
mov ecx, esi
mov word [esi + 4], bx
call fcn.10007880
mov dword [esp + 0x14], ebp
mov byte [esp + 0x48], bl
cmp dword [esp + 0x38], 8
jb 0x101c88fe
mov ecx, dword [esp + 0x24]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x38], 7
jmp 0x101c89a8
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101d19a9
add esp, 4
cmp dword [edi + 0x18], 8
mov ebp, eax
mov eax, dword [esp + 0x10]
jb 0x101c8935
mov eax, dword [eax]
mov edi, dword [esp + 0x18]
lea ecx, [edi + 1]
push ecx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
jbe 0x101c895e
cmp eax, edi
ja 0x101c895e
lea edx, [esp + 0x20]
push edx
mov edx, ebp
mov word [ebp + eax*2], bx
call fcn.1000bb00
push ebp
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
push 0xffffffffffffffff
mov edi, 7
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push ebx
lea eax, [esp + 0x28]
mov ecx, esi
mov word [esi + 4], bx
call fcn.10007880
mov dword [esp + 0x14], 1
mov byte [esp + 0x48], bl
cmp dword [esp + 0x38], 8
jb 0x101c89a4
mov eax, dword [esp + 0x24]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x38], edi
mov word [esp + 0x24], bx
mov dword [esp + 0x34], ebx
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.101d19cc
add esp, 0x3c
ret
Function at 0x101c92e0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x101fb409
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x5c], ebx
mov ebp, dword [esp + 0x64]
mov dword [esp + 0x14], ebx
mov esi, 7
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], ebx
mov dword [esp + 0x34], ebp
mov word [ebp + 4], bx
mov dword [esp + 0x5c], ebx
push ebp
mov edi, 1
push 5
mov dword [esp + 0x1c], edi
call fcn.101c7330
add esp, 8
push 6
mov dword [esp + 0x34], esi
push 0x10243d64
lea esi, [esp + 0x20]
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], bx
call fcn.10007a00
mov dword [esp + 0x5c], edi
mov eax, esi
push eax
push ebp
lea edi, [esp + 0x40]
call fcn.1019f140
add esp, 8
mov byte [esp + 0x5c], 2
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.10007880
mov byte [esp + 0x5c], 1
mov esi, 8
cmp dword [esp + 0x50], esi
jb 0x101c939d
mov ecx, dword [esp + 0x3c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edi, 7
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], bx
mov byte [esp + 0x5c], bl
cmp dword [esp + 0x30], esi
jb 0x101c93c6
mov edx, dword [esp + 0x1c]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], bx
call fcn.1019b690
add esp, 4
test al, al
jne 0x101c93f5
cmp dword [ebp + 0x18], esi
jb 0x101c93ea
mov eax, dword [ebp + 4]
jmp 0x101c93ed
lea eax, [ebp + 4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, ebp
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x101cadd0
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x101f1a16
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x10293044]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x84c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x85c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea ecx, [esp + 0x44]
push ecx
push 0x3fe
mov dword [esp + 0x2c], eax
call ebp
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x101caeab
lea ecx, [esp + 0x44]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x854], ebx
cmp edi, 0x3fe
jbe 0x101caeb2
xor ecx, ecx
lea eax, [edi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101d19a9
mov esi, eax
add esp, 4
mov ecx, esi
lea edx, [esp + 0x18]
call fcn.100710a0
push esi
push edi
call ebp
cmp eax, ebx
je 0x101cae93
cmp eax, edi
ja 0x101cae93
mov word [esi + eax*2], bx
mov word [esi + eax*2 + 2], bx
mov edi, eax
mov dword [esp + 0x20], esi
mov ecx, esi
jmp 0x101caebc
mov dword [esp + 0x854], 0xffffffff
mov eax, dword [esp + 0x18]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
xor al, al
jmp 0x101caf8b
mov word [esp + edi*2 + 0x44], bx
mov word [esp + edi*2 + 0x46], bx
xor eax, eax
xor ebp, ebp
cmp edi, ebx
jbe 0x101caf71
mov dword [esp + 0x1c], 2
mov edx, dword [esp + 0x1c]
cmp word [ecx + edx - 2], bx
jne 0x101caf61
cmp eax, ebp
je 0x101caf61
lea ecx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x101caf00
sub eax, esi
sar eax, 1
push eax
push ecx
lea esi, [esp + 0x30]
call fcn.10007a00
mov byte [esp + 0x854], 1
mov eax, esi
mov esi, dword [esp + 0x24]
push eax
call fcn.10033760
mov byte [esp + 0x854], bl
cmp dword [esp + 0x40], 8
jb 0x101caf49
mov ecx, dword [esp + 0x2c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
lea eax, [ebp + 1]
add dword [esp + 0x1c], 2
add ebp, 1
cmp ebp, edi
jb 0x101caed0
mov dword [esp + 0x854], 0xffffffff
mov edx, dword [esp + 0x18]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x84c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x830]
xor ecx, esp
call fcn.101d19cc
add esp, 0x844
ret
Function at 0x101cafc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x42c
mov eax, dword [0x10293044]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [esp + 0x434]
push ebx
push ebp
mov ebp, dword [esp + 0x438]
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [esp + 0x18], eax
call fcn.1000bb60
cmp dword [ebx + 0x18], 8
mov dword [esp + 0x10], 0
jb 0x101cb006
mov ebx, dword [ebx + 4]
jmp 0x101cb009
add ebx, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push ebx
push edi
call esi
cmp eax, 5
jne 0x101cb045
test ebx, ebx
je 0x101cb0e6
mov edx, ebx
mov ecx, edi
call fcn.101cb770
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x101cb0e6
mov esi, dword [esp + 0x10]
test esi, esi
je 0x101cb0e6
push 0x410
push eax
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0x40f
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [ebp + 0x18], 8
jb 0x101cb083
mov eax, dword [ebp + 4]
jmp 0x101cb086
lea eax, [ebp + 4]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x101cb0ce
lea eax, [esp + 0x20]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x101cb0b0
mov esi, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x24]
push edx
call fcn.10007a00
mov eax, dword [esp + 0x10]
test eax, eax
je 0x101cb0dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x101cb0e8
xor al, al
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101d19cc
add esp, 0x42c
ret 8