joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e4df
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x10022df0]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10002cdc
mov ebx, eax
cmp ebx, esi
je 0x1000e552
lea ecx, [ebp - 0x74]
call fcn.10001ba0
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013502
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000e56a
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000e4df
cmp eax, esi
jne 0x1000e59c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000e55a
lea ecx, [ebp - 0x74]
call fcn.10001ba0
push dword [ebp - 0x78]
mov ecx, edi
call fcn.1000bfdf
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001ba0
mov eax, esi
jmp 0x1000e538
Function at 0x1000115e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x100c5688
pushal
loop 0x100c568a
invalid
dec dword [ebx - 0x1d9f73]
dec dword [ebx - 0x6a76cfaf]
pop esp
loop 0x100c5699
invalid
dec dword [ebx - 0x1da37b]
dec dword [ecx - 0x15c37b]
call dword [ecx - 0x7f]
jmp 0x100d28aa
xor cl, dh
add eax, dword [ebx]
jns 0x100d28c5
invalid
add al, 0x6f
aad 4
invalid

Function at 0x1000119f
Capabilities:
Read file via mapping

Disassembly:
jmp 0x1003278b
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
cmp dword [edi + 0x408], ebx
jne 0x10032840
mov esi, dword [esp + 0x18]
test esi, esi
js 0x10032840
push 2
push ebx
push esi
call sym.CoreFoundation.dll__NS_lseek
mov ebp, eax
mov eax, dword [esp + 0x28]
push esi
push ebp
push edi
mov dword [edi + 0x414], eax
call fcn.100305b2
push esi
mov dword [edi + 0x40c], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x1c
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 2
push ebx
push ebx
push eax
call esi
push eax
push dword [esp + 0x28]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0x10032847
push dword [edi + 0x40c]
push ebp
push ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x10032847
mov dword [edi + 0x408], eax
mov bl, 1
mov eax, dword [esp + 0x14]
mov dword [edi + 0x424], esi
mov dword [edi + 0x428], eax
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret
xor al, al
jmp 0x10032842
Function at 0x10001537
Capabilities:
Read file via mapping

Disassembly:
jmp 0x100320b3
sub esp, 0x138
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x134], eax
mov eax, dword [esp + 0x13c]
lea ecx, [esp + 0x30]
push ebx
push ebp
push esi
push edi
push 0x8000100
push 0x104
push ecx
push eax
call sym.CoreFoundation.dll_CFStringGetCString
add esp, 0x10
test al, al
je 0x10032207
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x44]
push eax
call sym.CoreFoundation.dll__NS_stat
pop ecx
pop ecx
test eax, eax
jne 0x10032207
xor esi, esi
lea eax, [esp + 0x40]
push esi
push 0x8080
push eax
call sym.CoreFoundation.dll__NS_open
add esp, 0xc
test eax, eax
js 0x10032207
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10032207
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
test ebp, ebp
je 0x10032207
push dword [esp + 0x24]
push esi
push esi
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x10032207
cmp dword [edi], 0xbabeface
jne 0x100321aa
push 0x42c
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov esi, eax
pop ecx
pop ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x40c], ecx
mov ecx, dword [edi + 4]
mov dword [esi + 0x410], ecx
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x414], ecx
mov ecx, dword [edi + 8]
mov dword [esi + 0x418], ecx
jmp 0x100321e7
cmp dword [edi], 0xcafebabe
je 0x100321ba
cmp dword [edi], 0xddba11
jne 0x10032203
push 0x42c
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov esi, eax
mov eax, dword [esp + 0x2c]
pop ecx
pop ecx
mov dword [esi + 0x40c], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x414], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x418], eax
mov dword [esi + 0x424], ebp
mov dword [esi + 0x428], ebx
mov dword [esi + 0x420], 1
mov dword [esi + 0x408], edi
mov eax, esi
jmp 0x10032209
xor eax, eax
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x138
ret
Function at 0x10001591
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1009dd14
sub esp, 0xc4
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0xc0], eax
push ebx
mov ebx, dword [0x1018cc4c]
push ebp
push esi
mov esi, dword [esp + 0xd4]
push edi
push str.length
call ebx
mov ebp, dword [0x1018cc54]
push eax
push esi
call ebp
mov edi, eax
add esp, 0xc
lea eax, [esp + 0x10]
cmp edi, 0x60
jg 0x1009dd6f
push edi
push 0
push eax
push str.getCharacters:range:
call ebx
pop ecx
push eax
push esi
call ebp
add esp, 0x14
mov ebx, edi
jmp 0x1009ddc1
push 0x20
push 0
push eax
push str.getCharacters:range:
call ebx
pop ecx
push eax
push esi
call ebp
add esp, 0x14
mov eax, edi
sar eax, 1
sub eax, 0x10
push 0x20
push eax
lea eax, [esp + 0x58]
push eax
push str.getCharacters:range:
call ebx
pop ecx
push eax
push esi
call ebp
add esp, 0x14
lea eax, [edi - 0x20]
push 0x20
push eax
lea eax, [esp + 0x98]
push eax
push str.getCharacters:range:
call ebx
pop ecx
push eax
push esi
call ebp
add esp, 0x14
push 0x60
pop ebx
lea esi, [esp + 0x10]
mov edx, edi
cmp ebx, 0x60
jg 0x1009de2f
mov eax, ebx
mov ebp, esi
and eax, 0xfffffffc
lea ebp, [ebp + eax*2]
mov eax, esi
lea ebx, [eax + ebx*2]
cmp eax, ebp
jae 0x1009de26
movzx eax, word [esi]
imul ecx, eax, 0x101
movzx eax, word [esi + 2]
imul edx, edx, 0x4060401
add ecx, eax
movzx eax, word [esi + 4]
imul ecx, ecx, 0x101
add ecx, eax
movzx eax, word [esi + 6]
imul ecx, ecx, 0x101
add esi, 8
add ecx, eax
add edx, ecx
cmp esi, ebp
jb 0x1009dde0
jmp 0x1009de26
movzx eax, word [esi]
imul edx, edx, 0x101
add edx, eax
add esi, 2
cmp esi, ebx
jb 0x1009de18
jmp 0x1009def3
push 8
lea esi, [esp + 0x18]
pop ebp
movzx eax, word [esi - 4]
imul ecx, eax, 0x101
movzx eax, word [esi - 2]
imul edx, edx, 0x4060401
add ecx, eax
movzx eax, word [esi]
imul ecx, ecx, 0x101
lea esi, [esi + 8]
add ecx, eax
movzx eax, word [esi - 6]
imul ecx, ecx, 0x101
add ecx, eax
add edx, ecx
sub ebp, 1
jne 0x1009de36
mov eax, ebx
sar eax, 1
lea esi, [esp + eax*2 - 0x10]
lea ebp, [esp + eax*2 + 0x30]
jmp 0x1009dead
movzx eax, word [esi]
movzx ecx, word [esi + 2]
imul eax, eax, 0x101
imul edx, edx, 0x4060401
add ecx, eax
movzx eax, word [esi + 4]
imul ecx, ecx, 0x101
add ecx, eax
movzx eax, word [esi + 6]
imul ecx, ecx, 0x101
add ecx, eax
add edx, ecx
add esi, 8
cmp esi, ebp
jb 0x1009de7b
lea esi, [esp + 0x10]
lea ebx, [esi + ebx*2]
lea esi, [ebx - 0x40]
jmp 0x1009deef
movzx eax, word [esi]
movzx ecx, word [esi + 2]
imul eax, eax, 0x101
imul edx, edx, 0x4060401
add ecx, eax
movzx eax, word [esi + 4]
imul ecx, ecx, 0x101
add ecx, eax
movzx eax, word [esi + 6]
imul ecx, ecx, 0x101
add ecx, eax
add edx, ecx
add esi, 8
cmp esi, ebx
jb 0x1009debd
and edi, 0x1f
mov eax, edx
mov ecx, edi
pop edi
pop esi
shl eax, cl
mov ecx, dword [esp + 0xc8]
add eax, edx
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0xc4
ret

Function at 0x100015c3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x100c57db
jmp 0x100d6437
pop edx
push edi
xchg eax, ecx
or byte [ebp + 0x438f5d2], al
add al, 0x85
cli
xchg esp, eax
ret 0x404
Function at 0x10001780
Capabilities:
Get common file path

Disassembly:
jmp 0x100686f2
sub esp, 0x20c
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
mov ebp, dword [esp + 0x214]
lea eax, [esp + 4]
push esi
push eax
xor esi, esi
push esi
push esi
push dword [esp + 0x228]
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x100687cd
mov ecx, esi
lea eax, [esp + 8]
cmp word [esp + 8], cx
je 0x10068744
lea eax, [eax + 2]
inc ecx
cmp word [eax], si
jne 0x1006873b
push ebx
push ecx
lea eax, [esp + 0x10]
push eax
push ebp
call sym.CoreFoundation.dll_CFStringCreateWithCharacters
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100687cc
call sym.CoreFoundation.dll_CFBundleGetMainBundle
test eax, eax
je 0x10068773
push dword [sym.CoreFoundation.dll_kCFBundleNameKey]
push eax
call sym.CoreFoundation.dll_CFBundleGetValueForInfoDictionaryKey
pop ecx
pop ecx
jmp 0x10068775
mov eax, esi
push edi
test eax, eax
je 0x10068794
push eax
push ebx
push str.__Apple_Computer___
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push esi
push ebp
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x14
jmp 0x100687ab
push ebx
push str.__Apple_Computer_
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push esi
push ebp
call sym.CoreFoundation.dll_CFStringCreateWithFormat
add esp, 0x10
push ebx
mov edi, eax
call sym.CoreFoundation.dll_CFRelease
pop ecx
test edi, edi
je 0x100687cb
push edi
push esi
push ebp
call sym.CoreFoundation.dll_CFStringCreateMutableCopy
push edi
mov esi, eax
call sym.CoreFoundation.dll_CFRelease
add esp, 0x10
pop edi
pop ebx
mov ecx, dword [esp + 0x210]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.1000234c
add esp, 0x20c
ret
Function at 0x100017d0
Capabilities:
Read file on windows

Disassembly:
jmp 0x10051c4f
sub esp, 0x3c
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push ebx
mov ebx, dword [esp + 0x5c]
push ebp
mov ebp, dword [esp + 0x50]
push esi
mov esi, dword [esp + 0x4c]
push edi
mov dword [esp + 0x14], eax
xor edi, edi
mov eax, dword [esp + 0x64]
push 0x1b6
or eax, 0x8080
mov dword [esp + 0x14], esi
push eax
push ecx
mov dword [ebp], edi
call sym.CoreFoundation.dll__NS_open
add esp, 0xc
mov dword [ebx], eax
test eax, eax
jns 0x10051ca7
xor al, al
jmp 0x10051da0
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
pop ecx
pop ecx
test eax, eax
jns 0x10051cd5
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call edi
push dword [ebx]
mov esi, dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
or dword [ebx], 0xffffffff
pop ecx
call edi
mov dword [eax], esi
jmp 0x10051ca0
mov eax, dword [esp + 0x1e]
mov ecx, 0x8000
and eax, 0xf000
cmp ax, cx
je 0x10051d02
push dword [ebx]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
or dword [ebx], 0xffffffff
pop ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0xd
jmp 0x10051ca0
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x10051d31
push edi
push 4
push esi
call sym.CoreFoundation.dll_CFAllocatorAllocate
add esp, 0xc
mov dword [ebp], eax
cmp byte [sym.CoreFoundation.dll___CFOASafe], 0
je 0x10051d98
push str.CFUtilities__file_bytes_
push eax
call sym.CoreFoundation.dll___CFSetLastAllocationEventName
pop ecx
pop ecx
jmp 0x10051d98
mov esi, dword [esp + 0x60]
cmp esi, eax
jge 0x10051d3d
test esi, esi
jne 0x10051d3f
mov esi, eax
push edi
mov edi, dword [esp + 0x14]
push esi
push edi
call sym.CoreFoundation.dll_CFAllocatorAllocate
add esp, 0xc
mov dword [ebp], eax
cmp byte [sym.CoreFoundation.dll___CFOASafe], 0
je 0x10051d67
push str.CFUtilities__file_bytes_
push eax
call sym.CoreFoundation.dll___CFSetLastAllocationEventName
pop ecx
pop ecx
push esi
push dword [ebp]
push dword [ebx]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
test eax, eax
jns 0x10051d96
push dword [ebp]
push edi
call sym.CoreFoundation.dll_CFAllocatorDeallocate
push dword [ebx]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
add esp, 0xc
or dword [ebx], 0xffffffff
jmp 0x10051ca0
mov edi, esi
mov eax, dword [esp + 0x14]
mov dword [eax], edi
mov al, 1
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x3c
ret
Function at 0x10001802
Capabilities:
Move file

Disassembly:
jmp 0x10069090
push ecx
push ebx
push ebp
push esi
push edi
push 0
push dword [esp + 0x1c]
call fcn.1006839c
push 0
push dword [esp + 0x28]
mov ebx, eax
call fcn.1006839c
add esp, 0x10
mov ebp, eax
push 1
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
test esi, esi
setne byte [esp + 0x13]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test esi, esi
jne 0x10069118
test edi, edi
je 0x1006910f
cmp edi, 1
jbe 0x100690e9
cmp edi, 3
jbe 0x10069101
cmp edi, 5
je 0x100690f3
cmp edi, 0x6e
je 0x10069101
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], edi
jmp 0x10069118
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0xd
jmp 0x10069118
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 2
jmp 0x10069118
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
and dword [eax], 0
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push ebx
call esi
push ebp
call esi
movzx eax, byte [esp + 0x1b]
pop ecx
pop ecx
pop edi
pop esi
pop ebp
dec eax
pop ebx
pop ecx
ret

Function at 0x100019e2
Capabilities:
Delete directory

Disassembly:
jmp 0x1006915a
push esi
push edi
push 0
push dword [esp + 0x10]
call fcn.1006839c
mov edi, eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrmdir]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
mov eax, esi
pop edi
pop esi
ret
Function at 0x10001ccb
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
jmp 0x10080da2
sub esp, 0x18
push ebp
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x2c]
mov ebp, esi
mov dword [esp + 0xc], esi
test edi, edi
je 0x10080dcc
push edi
call sym.CoreFoundation.dll_CFDataGetBytePtr
push edi
mov dword [esp + 0x14], eax
call sym.CoreFoundation.dll_CFDataGetLength
pop ecx
pop ecx
mov ebp, eax
push dword [esp + 0x30]
call sym.CoreFoundation.dll_CFDataGetBytePtr
push dword [esp + 0x34]
mov dword [esp + 0x18], eax
call sym.CoreFoundation.dll_CFDataGetLength
mov edi, dword [esp + 0x30]
pop ecx
pop ecx
mov dword [esp + 0x2c], eax
test byte [edi + 4], 0x10
je 0x10080ef9
push ebx
mov ebx, dword [edi + 0x14]
cmp ebx, 0xffffffff
je 0x10080ef8
push edi
call sym.CoreFoundation.dll_CFRetain
mov dword [esp], 0x10189b14
call sym.CoreFoundation.dll___CFSpinLock
movsd xmm1, qword [esp + 0x3c]
xorps xmm0, xmm0
comisd xmm0, xmm1
pop ecx
jae 0x10080e54
comisd xmm1, xmmword [0x10145390]
jae 0x10080e54
push ecx
push ecx
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_floor]
movsd xmm1, qword [esp + 0x40]
fstp qword [esp + 0x28]
cvttsd2si eax, qword [esp + 0x28]
pop ecx
pop ecx
mov dword [esp + 0x18], eax
jmp 0x10080e5c
mov dword [esp + 0x18], getpeername
push ecx
push ecx
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_floor]
movsd xmm0, qword [esp + 0x40]
fstp qword [esp + 0x28]
subsd xmm0, qword [esp + 0x28]
mulsd xmm0, qword [0x10149990]
movsd qword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_floor]
fstp qword [esp + 0x28]
cvttsd2si eax, qword [esp + 0x28]
pop ecx
pop ecx
push 8
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push 0x1005
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10080ed4
test ebp, ebp
jle 0x10080ed4
push ebp
push eax
push esi
push dword [esp + 0x3c]
push dword [esp + 0x24]
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
jmp 0x10080ee4
push esi
push dword [esp + 0x34]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.WS2_32.dll_send]
push 0x10189b14
mov esi, eax
call sym.CoreFoundation.dll___CFSpinUnlock
push edi
call sym.CoreFoundation.dll_CFRelease
pop ecx
pop ecx
pop ebx
xor eax, eax
test esi, esi
pop edi
setg al
pop esi
dec eax
pop ebp
add esp, 0x18
ret

Function at 0x10001e01
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
jmp 0x100c57bb
nop
invalid
loope 0x100c57a2
add word [eax], ax
Function at 0x10001e0b
Capabilities:
Get hostname

Disassembly:
jmp 0x10068b3d
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x101844f8]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x101
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
movzx ecx, byte [ebp - 0x80]
xor edx, edx
test eax, eax
lea eax, [ebp - 0x80]
push 0x8000100
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
cmovne ecx, edx
mov byte [ebp - 0x80], cl
call sym.CoreFoundation.dll_CFStringCreateWithCString
mov ecx, dword [ebp + 0x84]
add esp, 0xc
xor ecx, ebp
call fcn.1000234c
add ebp, 0x88
leave
ret
Function at 0x10002126
Capabilities:
Get session user name

Disassembly:
jmp 0x10068499
push ebp
lea ebp, [esp - 0x7a8]
sub esp, 0x828
mov eax, dword [0x101844f8]
xor eax, ebp
mov dword [ebp + 0x7a4], eax
xor eax, eax
mov dword [ebp - 0x80], 0x410
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x100684e9
mov eax, dword [ebp - 0x80]
dec eax
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCharacters
jmp 0x10068509
push str.USERNAME
call fcn.10002a0e
pop ecx
test eax, eax
je 0x10068510
push 0x8000100
push eax
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCString
add esp, 0xc
test eax, eax
jne 0x10068522
push 0x10138aa2
call sym.CoreFoundation.dll___CFStringMakeConstantString
push eax
call sym.CoreFoundation.dll_CFRetain
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7a4]
xor ecx, ebp
call fcn.1000234c
add ebp, 0x7a8
leave
ret

Function at 0x100021cb
Capabilities:
Create directory

Disassembly:
jmp 0x10068ee2
push esi
push edi
push 0
push dword [esp + 0x10]
call fcn.1006839c
mov edi, eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
mov eax, esi
pop edi
pop esi
ret
Function at 0x10002617
Capabilities:
Get session user name

Disassembly:
jmp 0x1006855e
jmp sym.CoreFoundation.dll_CFCopyUserName
Function at 0x100028d3
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x1007fe20
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x101844f8]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
mov esi, dword [ebp + 0x90]
push edi
xor edi, edi
lea ebx, [esi + 0xc]
push ebx
call sym.CoreFoundation.dll___CFSpinLock
test byte [esi + 4], 0x10
pop ecx
mov dword [ebp - 0x80], 0x100
je 0x1007fe9c
cmp dword [esi + 0x20], edi
jne 0x1007fea1
cmp dword [esi + 0x14], 0xffffffff
je 0x1007fe9c
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1007fe9c
cmp dword [ebp - 0x80], edi
jle 0x1007fe9c
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
push esi
call sym.CoreFoundation.dll_CFGetAllocator
pop ecx
push eax
call sym.CoreFoundation.dll_CFDataCreate
add esp, 0xc
mov dword [esi + 0x20], eax
cmp dword [esi + 0x20], edi
je 0x1007feac
push dword [esi + 0x20]
call sym.CoreFoundation.dll_CFRetain
pop ecx
mov edi, eax
push ebx
call sym.CoreFoundation.dll___CFSpinUnlock
pop ecx
mov ecx, dword [ebp + 0x84]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000234c
add ebp, 0x88
leave
ret

Function at 0x10002a0e
Capabilities:
Query environment variable

Disassembly:
jmp 0x1007a776
push esi
xor esi, esi
mov eax, dword [esi*8 + 0x10178f70]
test eax, eax
je 0x1007a794
push eax
push dword [esp + 0xc]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x1007a7a1
inc esi
cmp esi, 0x1a
jb 0x1007a779
pop esi
jmp dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov eax, dword [esi*8 + 0x10178f74]
pop esi
ret
Function at 0x10002abd
Capabilities:
Get disk information

Disassembly:
jmp 0x10067e50
sub esp, 0x220
mov eax, dword [0x101844f8]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
mov dword [esp + 0x10], ebp
push esi
push edi
test ebp, ebp
je 0x10067ff0
push ebp
call sym.CoreFoundation.dll_CFStringGetLength
mov dword [esp + 0x14], eax
pop ecx
test eax, eax
je 0x10067ff0
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test esi, esi
je 0x10067ff0
lea ecx, [esi*2 + 2]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov edi, eax
push edi
push esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x10067fe8
cmp eax, esi
jg 0x10067fe8
mov esi, dword [esp + 0x10]
lea eax, [esi*2 + 2]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push eax
push esi
push ebx
push ebp
mov dword [esp + 0x24], eax
call sym.CoreFoundation.dll_CFStringGetCharacters
mov eax, dword [esp + 0x24]
xor ecx, ecx
push eax
mov word [eax + esi*2], cx
call sub.api_ms_win_crt_string_l1_1_0.dll__wcslwr
add esp, 0x18
mov ebp, edi
cmp word [edi], bx
je 0x10067fd3
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll__wcslwr
movzx eax, byte [ebp]
push eax
call fcn.100022de
pop ecx
pop ecx
test al, al
jne 0x10067f9b
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
push ebx
mov edi, eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push ebx
push 0x208
lea eax, [esp + 0x3c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
test esi, esi
je 0x10067f9b
lea eax, [esp + 0x24]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll__wcslwr
push dword [esp + 0x14]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 0xc
test eax, eax
je 0x10067fb6
cmp word [esp + 0x24], bx
jne 0x10067f9b
push ebx
push str.NONAME
call sym.CoreFoundation.dll___CFStringMakeConstantString
pop ecx
push eax
push dword [esp + 0x20]
call sym.CoreFoundation.dll_CFStringCompare
add esp, 0xc
test eax, eax
je 0x10067fb6
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
lea ebp, [ebp + eax*2]
add ebp, 2
cmp word [ebp], bx
jne 0x10067f0c
jmp 0x10067fcf
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
push eax
push ebp
push dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
call sym.CoreFoundation.dll_CFStringCreateWithCharacters
add esp, 0x10
mov ebx, eax
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push edi
call esi
push dword [esp + 0x14]
call esi
pop ecx
pop ecx
mov eax, ebx
jmp 0x10067ff2
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000234c
add esp, 0x220
ret