joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100aaa7
Capabilities:
Initialize winsock library

Disassembly:
push 0x1e0
push 0x1016208
call fcn.01009684
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
call esi
mov dword [0x101d2e0], eax
push ebx
push ebx
push ebx
push ebx
call esi
mov dword [0x101d2e4], eax
push ebx
push ebx
push ebx
push ebx
call esi
mov dword [0x101d2e8], eax
mov dword [0x101d300], ebx
mov byte [0x101f65c], bl
mov byte [0x101f68c], bl
mov byte [0x101d2c0], bl
mov byte [0x101f590], bl
mov byte [0x101f680], bl
mov dword [0x101f660], ebx
mov byte [0x101f668], bl
mov dword [0x101d2d4], ebx
xor eax, eax
mov edi, 0x101f670
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x3c
push ebx
mov esi, 0x101f620
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x1ac]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100acf2
mov dword [ebp - 0x1d4], 0x200
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c8], ebx
mov eax, dword [0x101f664]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c0], ebx
mov dword [ebp - 0x1bc], ebx
mov dword [ebp - 0x1b8], ebx
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1d0], 0x100a8aa
mov dword [ebp - 0x1b0], str.IrmonClass
lea eax, [ebp - 0x1d4]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0x101f638
push 0x1009ccb
push 0x1009ce6
push esi
call fcn.0100c905
test eax, eax
je 0x100acf2
mov byte [0x101f68c], bl
push esi
call fcn.01009c36
cmp byte [0x101f68c], bl
jne 0x100acc5
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
push 2
push 0x5ff
push 0xffffffffffffffff
push 0x101d2e0
push 3
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
sub eax, ebx
je 0x100acb2
dec eax
je 0x100ac9d
dec eax
je 0x100ac79
sub eax, 0xbe
je 0x100acb9
jmp 0x100ac5c
cmp dword [ebp - 0x1ec], 0x12
je 0x100ac70
lea eax, [ebp - 0x1f0]
push eax
push dword [0x101f63c]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x100ac5c
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1f0]
push eax
call edi
test eax, eax
jne 0x100ac22
jmp 0x100acb9
mov byte [0x101f68c], 1
jmp 0x100acc5
cmp byte [0x101f590], bl
je 0x100ac89
push esi
call fcn.0100a235
jmp 0x100acb9
cmp byte [0x101f65c], bl
je 0x100acb9
push ebx
push ebx
push ebx
push ebx
push esi
call fcn.01009e04
jmp 0x100acb9
cmp byte [0x101d2c0], bl
je 0x100acb9
push dword [0x101d2e4]
call fcn.0100ba26
jmp 0x100acb9
mov byte [0x101f68c], 1
cmp byte [0x101f68c], bl
je 0x100abed
cmp byte [0x101d2c0], bl
je 0x100acd3
push esi
call fcn.0100a834
push dword [0x101f638]
call fcn.0100c76a
test eax, eax
jne 0x100ace8
mov byte [0x101f68c], bl
push ebx
push ebx
push ebx
push ebx
push esi
call fcn.01009e04
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x100ad19
call fcn.010096cc
ret 8
Function at 0x100adee
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x100ae5e
push edi
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x10]
call edi
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
je 0x100ae33
push eax
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [esi + 0xc]
call edi
mov eax, dword [esi + 0x14]
pop edi
cmp eax, 0xffffffff
je 0x100ae43
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x1002764
call sub.ntdll.dll_DbgPrint
pop ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebp
ret 4

Function at 0x100b699
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x1018344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [ebp - 0x108]
push ecx
xor ecx, ecx
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push eax
push dword [0x101c34c]
mov dword [ebp - 0x110], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100b77f
cmp dword [ebp - 0x10c], 1
jne 0x100b773
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push 1
push dword [0x1018390]
push dword [ebp - 0x108]
call ebx
push esi
mov esi, 0x100
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.01009d34
push dword [0x10183ac]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0100b653
push dword [ebp - 0x110]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0100b653
lea eax, [ebp - 0x104]
push eax
call edi
push eax
lea eax, [ebp - 0x104]
push eax
push 1
push dword [0x1018394]
push dword [ebp - 0x108]
call ebx
pop edi
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010093a5
leave
ret 0xc
Function at 0x100b794
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1018344]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x88]
push eax
push 0x20019
xor edi, edi
push edi
push dword [0x10183a4]
mov dword [ebp - 0x88], edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100b8bb
push esi
push 0x82
push edi
mov esi, 0x101d120
push esi
mov dword [ebp - 0x8c], 0x80
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
push esi
lea eax, [ebp - 0x90]
push eax
push edi
push dword [0x10183a8]
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 5
push dword [0x1018374]
call fcn.0100b50c
push 6
push dword [0x1018378]
call fcn.0100b50c
push 7
push dword [0x101837c]
call fcn.0100b50c
push 0x40
lea eax, [ebp - 0x84]
push eax
push 8
push dword [0x101f664]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100b8ba
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x84]
push eax
push 1
push dword [0x1018380]
push dword [0x101c34c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [0x1018398]
push dword [0x1018384]
push esi
call fcn.0100b699
push dword [0x101839c]
push dword [0x1018388]
push esi
call fcn.0100b699
push dword [0x10183a0]
push dword [0x101838c]
push esi
call fcn.0100b699
pop esi
cmp dword [ebp - 0x88], edi
pop edi
je 0x100b8d0
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010093a5
leave
ret
Function at 0x100b8e1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x1018344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x188], ecx
call fcn.01009d34
push 0x1001e90
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.0100b653
push dword [0x1018390]
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0100b653
lea eax, [ebp - 0x18c]
push eax
push 0x20019
xor ebx, ebx
push ebx
lea eax, [ebp - 0x104]
push eax
push dword [0x101c34c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ba10
push dword [ebp - 0x188]
push ebx
push edi
call sub.msvcrt.dll_memset
sub dword [ebp - 0x188], 2
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
push edi
lea eax, [ebp - 0x190]
push eax
push ebx
push ebx
push dword [ebp - 0x18c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ba04
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
test eax, eax
jle 0x100b9be
cmp word [edi + ebx*2], 0x5c
je 0x100ba04
push edi
inc ebx
call esi
cmp ebx, eax
jl 0x100b9af
push edi
call esi
test eax, eax
je 0x100ba04
push edi
push 0x80
lea eax, [ebp - 0x184]
push eax
call fcn.01009d34
push 0x101d120
push dword [ebp + 0x10]
push edi
call fcn.01009d34
push dword [0x10183ac]
push dword [ebp + 0x10]
push edi
call fcn.0100b653
lea eax, [ebp - 0x184]
push eax
push dword [ebp + 0x10]
push edi
call fcn.0100b653
push dword [ebp - 0x18c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010093a5
leave
ret 0xc
Function at 0x100bf5a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x20]
push 0x1002d30
call sub.ntdll.dll_DbgPrint
mov edi, dword [ebp + 0x24]
mov eax, dword [ebp + 0x28]
xor ebx, ebx
mov dword [edi], ebx
pop ecx
mov dword [eax], ebx
pop ecx
cmp dword [0x101cebc], ebx
je 0x100bf8f
mov dword [edi], 0x45b
jmp 0x100c0b6
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x100bfa6
cmp word [eax], bx
je 0x100bfa6
mov dword [edi], 5
jmp 0x100c0b6
push esi
push 0x10ab0
call sub.MFC42u.dll_operatornew
pop ecx
cmp eax, ebx
je 0x100bfc1
mov ecx, eax
call fcn.0100cce1
mov esi, eax
jmp 0x100bfc3
xor esi, esi
mov dword [ebp + 0x24], esi
cmp esi, ebx
je 0x100c0af
push 0xffffffffffffffff
push 1
push 2
push dword [ebp + 0x1c]
mov ecx, esi
push dword [ebp + 0x18]
call fcn.0100cd95
mov ecx, esi
test eax, eax
je 0x100c0a8
push dword [ebp + 0x28]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push edi
push dword [ebp + 0x20]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], ebx
mov dword [esi + 0xc], eax
call fcn.0100debc
cmp dword [edi], 0xd
jne 0x100c06b
mov eax, dword [ebp + 0x28]
cmp dword [eax], 1
jne 0x100c06b
push 0x10ab0
call sub.MFC42u.dll_operatornew
pop ecx
test eax, eax
je 0x100c02f
mov ecx, eax
call fcn.0100cce1
mov esi, eax
jmp 0x100c031
xor esi, esi
mov dword [ebp + 0x24], esi
test esi, esi
je 0x100c0af
push 0xffffffffffffffff
push 1
push 1
push dword [ebp + 0x1c]
mov ecx, esi
push dword [ebp + 0x18]
call fcn.0100cd95
mov ecx, esi
test eax, eax
je 0x100c0a8
push dword [ebp + 0x28]
mov eax, dword [ebp + 0xc]
push edi
push dword [ebp + 0x20]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], ebx
mov dword [esi + 0xc], eax
call fcn.0100debc
cmp dword [edi], 0
je 0x100c098
push 0x1002d1c
lea ecx, [ebp + 0x28]
call fcn.01014b29
push dword [edi]
lea ecx, [ebp + 0x28]
push 0xc0ff2001
push 2
call fcn.01014be3
lea ecx, [ebp + 0x28]
call fcn.01014b4d
jmp 0x100c0b5
push dword [ebp + 0x24]
push dword [0x101ce94]
call fcn.0100cb1c
jmp 0x100c0b5
push 1
call fcn.0100bf0c
mov dword [edi], 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x24
Function at 0x100c35b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x218
mov eax, 0x1015632
call fcn.0100942d
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
mov dword [ebp - 0x220], 1
mov byte [ebp - 0x219], bl
mov edi, 0x20019
cmp dword [0x101ce64], ebx
jne 0x100c3a3
push 0x101ce64
push edi
push ebx
push 0x1002c7c
push dword [0x101ce6c]
call esi
cmp dword [0x101ce60], ebx
jne 0x100c3bf
push 0x101ce60
push edi
push ebx
push 0x1001840
push dword [0x101ce6c]
call esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push ebx
push ebx
push 0x1002c28
push dword [0x101ce60]
mov dword [ebp - 0x220], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [0x101ce6c], ebx
jne 0x100c3fa
mov dword [0x101ceb8], ebx
jmp 0x100c416
cmp eax, ebx
jne 0x100c40c
mov dword [0x101ceb8], ebx
cmp byte [ebp - 0x219], bl
je 0x100c416
mov dword [0x101ceb8], 1
mov edi, 0x20a
push edi
push ebx
mov esi, 0x101cc48
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push esi
push ebx
push ebx
push 0x1002bd0
push dword [0x101ce60]
mov dword [ebp - 0x220], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c47c
push ebx
lea eax, [ebp - 0x218]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, ebx
je 0x100c47c
cmp eax, 0x104
jae 0x100c47c
lea eax, [ebp - 0x218]
push eax
jmp 0x100c481
push 0x101c838
push edi
push esi
call fcn.010050b7
push esi
call fcn.0100dfdf
test eax, eax
je 0x100c49e
push 0x1001e90
push edi
push esi
call fcn.01004458
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push ebx
push ebx
push 0x1002c0c
push dword [0x101ce64]
xor esi, esi
inc esi
mov dword [ebp - 0x220], esi
call edi
test eax, eax
jne 0x100c4dc
mov dword [0x10183bc], ebx
cmp byte [ebp - 0x219], bl
je 0x100c4e2
mov dword [0x10183bc], esi
push dword [0x10183bc]
push dword [0x101ce8c]
call dword [0x101ce70]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x219]
push eax
push ebx
push ebx
push 0x1002bf8
push dword [0x101ce64]
mov dword [ebp - 0x220], esi
call edi
test eax, eax
je 0x100c522
mov byte [ebp - 0x219], 1
movzx eax, byte [ebp - 0x219]
push eax
push dword [0x101ce8c]
call dword [0x101ce90]
call fcn.0100bc42
push esi
push dword [0x101ce5c]
push 4
push esi
push dword [0x101ce68]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov esi, eax
cmp esi, ebx
je 0x100c58c
push 0x1002d1c
lea ecx, [ebp - 0x224]
call fcn.01014b29
push esi
push 0xc0ff200d
push 2
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], ebx
call fcn.01014be3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.01014b4d
call fcn.010094bf
ret
Function at 0x100c7fb
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x101ce6c
mov esi, 0x20019
push esi
xor ebx, ebx
push ebx
push ebx
push 0x80000001
call edi
test eax, eax
je 0x100c82f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100c8fb
lea eax, [ebp - 4]
push eax
push 0x101ce68
push ebx
push esi
push ebx
push ebx
push ebx
push 0x1002cb8
push dword [0x101ce6c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100c824
push 0x101cea4
push esi
push ebx
push 0x1002c3c
push dword [0x101ce6c]
call edi
push ebx
push ebx
call fcn.0100c597
push 0x10027ac
call fcn.0100e8e1
mov dword [0x101ce98], eax
cmp eax, ebx
je 0x100c8a1
push eax
push dword [0x101ce94]
call fcn.0100cb1c
test eax, eax
jne 0x100c8a1
mov ecx, dword [0x101ce98]
call fcn.0100c1ec
mov dword [0x101ce98], ebx
push 0x10027a4
call fcn.0100e8e1
mov dword [0x101ce9c], eax
cmp eax, ebx
je 0x100c8dd
push eax
push dword [0x101ce94]
call fcn.0100cb1c
test eax, eax
jne 0x100c8d8
mov ecx, dword [0x101ce9c]
call fcn.0100c1ec
xor eax, eax
mov dword [0x101ce9c], eax
jmp 0x100c8dd
mov eax, dword [0x101ce9c]
cmp dword [0x101ce98], ebx
jne 0x100c8f9
cmp eax, ebx
jne 0x100c8f9
push 0x1002d50
call sub.ntdll.dll_DbgPrint
pop ecx
or eax, 0xffffffff
jmp 0x100c8fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100c905
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push 0x2c
xor eax, eax
push edi
mov esi, 0x101ce74
push esi
mov dword [ebp - 4], edi
mov word [0x101c568], ax
mov word [0x101c838], ax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [0x101ce8c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [0x101ce90], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 0x14]
push 0x104
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x101ca40
push 0x191
push dword [0x101f664]
mov dword [0x101cebc], edi
mov dword [0x101ce70], eax
call esi
test eax, eax
je 0x100ca17
push 0x64
push 0x101c770
push 0x105
push dword [0x101f664]
call esi
test eax, eax
je 0x100ca17
call fcn.0100ca81
mov dword [0x101ce94], eax
cmp eax, edi
je 0x100ca17
push 0x18
call sub.MFC42u.dll_operatornew
pop ecx
cmp eax, edi
je 0x100c9bf
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.0100bdc7
jmp 0x100c9c1
xor eax, eax
mov dword [0x101ce58], eax
cmp eax, edi
je 0x100ca17
cmp dword [ebp - 4], edi
jne 0x100ca17
push 0x101c838
push edi
push edi
push 0x10
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x100ca17
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x101ce5c], eax
cmp eax, edi
je 0x100ca17
call fcn.01010ecd
mov dword [0x101cea0], eax
cmp eax, edi
je 0x100ca17
call fcn.0100c7fb
test eax, eax
je 0x100ca77
mov dword [0x101cebc], 1
push 0x1002d1c
lea ecx, [ebp + 8]
call fcn.01014b29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xc0ff2005
push 2
lea ecx, [ebp + 8]
call fcn.01014be3
mov eax, dword [0x101ce94]
cmp eax, edi
je 0x100ca49
push eax
call fcn.0100cc65
mov ecx, dword [0x101ce58]
cmp ecx, edi
je 0x100ca5a
push 1
call fcn.0100bf32
cmp dword [0x101ce5c], edi
je 0x100ca67
call fcn.0100bd12
lea ecx, [ebp + 8]
call fcn.01014b4d
xor eax, eax
pop edi
pop esi
leave
ret 0x10
xor eax, eax
inc eax
jmp 0x100ca71
Function at 0x100cd95
Capabilities:
Set socket configuration

Disassembly:
push 0x14
mov eax, 0x1015687
call fcn.010093f2
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x54], eax
lea eax, [esi + 0x10]
push eax
mov dword [ebp - 0x1c], 0x1f4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ebx, dword [ebp + 0xc]
xor edi, edi
cmp ebx, edi
jbe 0x100ce35
cmp dword [ebp + 8], edi
je 0x100ce35
xor ecx, ecx
push 2
pop edx
mov eax, ebx
mul edx
seto cl
mov dword [esi + 0x38], 1
mov dword [ebp - 4], edi
neg ecx
or ecx, eax
push ecx
call sub.MFC42u.dll_operatornew
pop ecx
mov dword [esi + 0x44], eax
cmp eax, edi
jne 0x100ce0e
push 0x1016324
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x1002d84
call sub.msvcrt.dll__CxxThrowException
or dword [ebp - 4], 0xffffffff
lea ecx, [ebx + ebx]
push ecx
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x100ce3b
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x10a38], edi
cmp dword [ebp + 0x14], edi
je 0x100ce71
push edi
push 1
push 0x1a
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x40], eax
cmp eax, edi
je 0x100ce9f
push 4
lea ecx, [ebp - 0x1c]
push ecx
push 0x1006
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
jmp 0x100ce75
or dword [esi + 0x40], 0xffffffff
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x4c], eax
cmp eax, edi
je 0x100ce9f
mov ecx, esi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x10204], 0x45454545
call fcn.0100f15f
test eax, eax
jne 0x100ced8
mov eax, dword [esi + 0x44]
cmp eax, edi
je 0x100ceb0
push eax
call sub.MFC42u.dll_operatordelete
pop ecx
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x100cec3
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
or dword [esi + 0x40], 0xffffffff
mov eax, dword [esi + 0x4c]
cmp eax, edi
je 0x100ced4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], edi
xor eax, eax
jmp 0x100cedb
xor eax, eax
inc eax
call fcn.010094a6
ret 0x14
Function at 0x100cfaa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0xff58
call fcn.010096e0
mov eax, dword [0x1018344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
movzx ecx, word [esi + 0x10a76]
mov dword [ebp - 0xff4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xff50], eax
xor ebx, ebx
sub ecx, 0x10
mov eax, 0xff40
xor edx, edx
div ecx
mov dword [ebp - 0xff48], ebx
mov dword [ebp - 0xff58], edx
cmp dword [0x101cebc], 0
jne 0x100d0a7
push 0
lea eax, [ebp - 0xff54]
push eax
mov eax, 0xff40
sub eax, dword [ebp - 0xff58]
push eax
lea eax, [ebp - 0xff44]
push eax
push dword [ebp - 0xff4c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100d0b9
mov edx, dword [ebp - 0xff54]
xor ecx, ecx
cmp edx, ecx
jne 0x100d04b
cmp dword [ebp - 0xff48], ecx
jne 0x100d0a7
lea eax, [esi + 0x10a48]
add dword [eax], edx
adc dword [eax + 4], ecx
lea eax, [esi + 0x10a58]
add dword [eax], edx
adc dword [eax + 4], ecx
mov ecx, dword [eax]
cmp ecx, dword [esi + 0x10a50]
jne 0x100d07b
mov eax, dword [eax + 4]
cmp eax, dword [esi + 0x10a54]
jne 0x100d07b
xor eax, eax
inc eax
jmp 0x100d07d
xor eax, eax
push eax
push edx
lea eax, [ebp - 0xff44]
push eax
push dword [ebp - 0xff50]
mov ecx, esi
call fcn.01010709
mov ebx, eax
mov dword [ebp - 0xff48], 1
test ebx, ebx
je 0x100cffa
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010093a5
leave
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100d0a9

Function at 0x100d0e4
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1018344]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.010093a5
leave
ret 4
Function at 0x100d138
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1018344]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp word [edi + 2], 0x3a
jne 0x100d16d
movzx eax, word [edi]
push eax
call fcn.0100d0e4
test eax, eax
jne 0x100d16d
push 0xf
pop eax
jmp 0x100d2f7
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jbe 0x100d195
push 0x52
pop eax
jmp 0x100d2f6
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x100d1a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100d2f5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100d2ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100d2ee
cmp eax, 3
jne 0x100d2f5
cmp word [ebp - 0x20a], 0x3a
push 0x5c
pop edi
push 2
pop esi
jne 0x100d1ec
lea eax, [ebp - 0x206]
jmp 0x100d2c1
cmp word [ebp - 0x20c], di
jne 0x100d2f2
cmp word [ebp - 0x20a], di
jne 0x100d2f2
lea eax, [ebp - 0x208]
mov dword [ebp - 0x210], eax
cmp word [ebp - 0x208], bx
je 0x100d2cf
movzx ecx, word [ebp - 0x208]
cmp cx, di
je 0x100d23b
add eax, esi
mov dword [ebp - 0x210], eax
movzx ecx, word [eax]
cmp cx, bx
jne 0x100d226
cmp word [eax], bx
je 0x100d2cf
add eax, esi
mov dword [ebp - 0x210], eax
movzx ecx, word [eax]
cmp cx, bx
je 0x100d2cf
cmp cx, di
je 0x100d269
add eax, esi
mov dword [ebp - 0x210], eax
movzx ecx, word [eax]
cmp cx, bx
jne 0x100d254
cmp word [eax], bx
je 0x100d2cf
jmp 0x100d2bf
cmp cx, di
je 0x100d28a
add eax, esi
mov dword [ebp - 0x210], eax
movzx ecx, word [eax]
cmp cx, bx
jne 0x100d270
cmp word [eax], di
jne 0x100d2c7
xor ecx, ecx
mov word [eax], cx
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100d2ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100d2f2
mov ecx, dword [ebp - 0x210]
mov eax, edi
mov word [ecx], ax
mov eax, dword [ebp - 0x210]
add eax, esi
mov dword [ebp - 0x210], eax
movzx ecx, word [eax]
cmp cx, bx
jne 0x100d270
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100d2ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100d2f5
xor eax, eax
jmp 0x100d2f5
push 0x52
pop eax
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.010093a5
leave
ret 4