joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102666c
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1030a60
call fcn.01026b04
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1033390
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1026481
cmp eax, esi
jne 0x1026474
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1026484
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x102645b
xor esi, esi
inc esi
mov eax, dword [0x103338c]
cmp eax, esi
jne 0x1026497
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10264d2
mov eax, dword [0x103338c]
test eax, eax
jne 0x10264cc
mov dword [0x103338c], esi
push 0x100133c
push 0x1001330
call fcn.010263d8
pop ecx
pop ecx
test eax, eax
je 0x10264d2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x102659c
mov dword [0x1033058], esi
mov eax, dword [0x103338c]
cmp eax, esi
jne 0x10264f6
push 0x100132c
push 0x1001318
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x103338c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1026503
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x103339c], ebx
je 0x1026524
push 0x103339c
call fcn.01026a79
pop ecx
test eax, eax
je 0x1026524
push ebx
push 2
push ebx
call dword [0x103339c]
push dword [0x1033040]
push dword [0x1033044]
push dword [0x103303c]
call fcn.010075a9
add esp, 0xc
mov dword [0x1033054], eax
cmp dword [0x1033048], ebx
jne 0x1026582
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1033058], ebx
jne 0x1026590
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1033054]
call fcn.01026b49
ret
call fcn.01026c27
jmp 0x1026439
Function at 0x1026eb8
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor esi, esi
push esi
push 5
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1026ee9
push 0x1003ffc
push 0x76
push 0x1003fd0
call fcn.01028938
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
mov ebx, 0xffff
mov edi, 0x80070000
jle 0x1026f01
and eax, ebx
or eax, edi
mov dword [ebp - 4], eax
cmp eax, 0x800700ea
jne 0x1026f74
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov esi, eax
test esi, esi
jne 0x1026f2b
mov dword [ebp - 4], 0x8007000e
jmp 0x1026f69
mov eax, dword [ebp - 8]
lea eax, [eax + eax + 2]
push eax
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push esi
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x1026f62
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1026f5d
and eax, ebx
or eax, edi
mov dword [ebp - 4], eax
jmp 0x1026f69
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor esi, esi
test esi, esi
je 0x1026f74
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1026f84
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x1026fb6
test byte [eax + 0x1c], 1
je 0x1026fb6
cmp byte [eax + 0x19], 4
jb 0x1026fb6
push 0x1003ed8
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov ebx, 0x1003fd0
cmp esi, edi
je 0x1026fdf
cmp dword [ebp + 0xc], edi
je 0x1026fdf
cmp dword [ebp + 0x14], edi
je 0x1026fdf
cmp dword [ebp + 0x18], edi
jne 0x1026fef
push 0x1004010
push 0x1bc
push ebx
call fcn.01028938
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [esi], edi
push dword [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
cmp eax, edi
je 0x102705a
jle 0x1027016
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x102713c
test byte [eax + 0x1c], 1
je 0x1027117
cmp byte [eax + 0x19], 2
jb 0x1027117
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x1003ed8
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e21
jmp 0x1027112
cmp dword [ebp - 8], edi
ja 0x102706f
push 0x1004004
push 0x1ca
push ebx
call fcn.01028938
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ebx, eax
cmp ebx, edi
jne 0x1027087
mov dword [ebp - 4], 0x8007000e
jmp 0x1027102
push dword [ebp - 8]
push edi
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x10270eb
jle 0x10270b6
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x1027107
test byte [eax + 0x1c], 1
je 0x1027107
cmp byte [eax + 0x19], 2
jb 0x1027107
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x1003ed8
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e21
jmp 0x1027102
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ecx], eax
mov eax, dword [0x1032370]
cmp ebx, edi
je 0x1027117
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x102713c
test byte [eax + 0x1c], 1
je 0x102713c
cmp byte [eax + 0x19], 4
jb 0x102713c
push 0x1003ed8
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x10272a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x10272da
test byte [eax + 0x1c], 1
je 0x10272da
cmp byte [eax + 0x19], 4
jb 0x10272da
push 0x1003ed8
push 0x26
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [edi], esi
cmp dword [ebp + 0xc], esi
jne 0x1027305
push 0x10040b8
push 0x2cf
push 0x1003fd0
call fcn.01028938
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], esi
je 0x1027334
cmp eax, 2
jne 0x1027334
xor esi, esi
inc esi
jmp 0x1027395
cmp eax, esi
je 0x1027376
jle 0x1027344
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x10273bf
test byte [eax + 0x1c], 1
je 0x102739a
cmp byte [eax + 0x19], 3
jb 0x102739a
push esi
push dword [ebp + 0xc]
push 0x1003ed8
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e21
jmp 0x1027395
cmp dword [ebp - 8], 4
je 0x1027383
mov esi, 0x8007065d
jmp 0x1027395
cmp dword [ebp - 4], 4
je 0x1027390
mov esi, 0x80004005
jmp 0x1027395
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x10273bf
test byte [eax + 0x1c], 1
je 0x10273bf
cmp byte [eax + 0x19], 4
jb 0x10273bf
push 0x1003ed8
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
pop edi
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x1027ff4
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1032c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x214], esi
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x1028042
test dword [eax + 0x1c], 0x200
je 0x1028042
cmp byte [eax + 0x19], 4
jb 0x1028042
push 0x1003ed8
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
xor ebx, ebx
mov dword [ebp - 0x210], ebx
cmp esi, ebx
jne 0x1028062
push 0x1004298
push 0xbd
push 0x1003fd0
call fcn.01028938
mov edi, 0x208
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
mov dword [esi], ebx
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push 0x62
call esi
cmp eax, ebx
jge 0x10280e9
cmp eax, 0xc0000023
je 0x10280e9
cmp eax, 0x80000005
je 0x10280e9
cmp eax, 0xc0000004
je 0x10280e9
or eax, 0x10000000
mov esi, eax
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x102821c
test byte [eax + 0x1c], 8
je 0x10281f4
cmp byte [eax + 0x19], 2
jb 0x10281f4
push esi
push 0x1003ed8
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010053b9
jmp 0x10281ef
push dword [ebp - 0x210]
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1028105
mov esi, 0x8007000e
jmp 0x10281df
push dword [ebp - 0x210]
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x210]
push ebx
push 0x62
call esi
test eax, eax
jge 0x102816c
or eax, 0x10000000
mov esi, eax
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x10281e4
test byte [eax + 0x1c], 8
je 0x10281e4
cmp byte [eax + 0x19], 2
jb 0x10281e4
push esi
push 0x1003ed8
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010053b9
jmp 0x10281df
movzx eax, word [ebx]
movzx ecx, ax
inc ecx
inc ecx
cmp ecx, edi
jbe 0x102817f
mov esi, 0xd0000023
jmp 0x10281df
test al, 1
je 0x1028197
push 0x1004260
push 0xee
push 0x1003fd0
call fcn.01028938
movzx eax, word [ebx]
lea ecx, [eax + 4]
cmp ecx, dword [ebp - 0x210]
jbe 0x10281ac
mov esi, 0x8000ffff
jmp 0x10281df
shr eax, 1
push eax
push dword [ebx + 4]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01006493
mov esi, eax
test esi, esi
jl 0x10281df
push 0
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a2f
mov esi, eax
mov eax, dword [0x1032370]
test ebx, ebx
je 0x10281f4
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x102821c
test dword [eax + 0x1c], 0x200
je 0x102821c
cmp byte [eax + 0x19], 4
jb 0x102821c
push 0x1003ed8
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01026693
leave
ret 4
Function at 0x1029a3a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1032c0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1029a6d
push 0x1004760
push 0x24a
push 0x100467c
call fcn.01028938
and dword [edi], 0
mov eax, dword [0x1032370]
mov ebx, 0x1032370
cmp eax, ebx
je 0x1029a9c
test byte [eax + 0x1c], 1
je 0x1029a9c
cmp byte [eax + 0x19], 4
jb 0x1029a9c
push 0x1004460
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
mov esi, 0x208
push esi
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x1004478
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01006459
mov dword [ebp - 0x418], eax
test eax, eax
jl 0x1029b27
push esi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1029b12
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1029b21
and eax, 0xffff
or eax, 0x80070000
jmp 0x1029b21
push 0
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01028a2f
mov dword [ebp - 0x418], eax
mov eax, dword [0x1032370]
pop edi
pop esi
cmp eax, ebx
pop ebx
je 0x1029b51
test byte [eax + 0x1c], 1
je 0x1029b51
cmp byte [eax + 0x19], 4
jb 0x1029b51
push 0x1004460
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
xor ecx, ebp
call fcn.01026693
leave
ret 4
Function at 0x102a579
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.01028e19
mov ebx, eax
cmp ebx, edi
jl 0x102a6a0
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x102a618
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x102a5ff
test byte [eax + 0x1c], 1
je 0x102a5ff
cmp byte [eax + 0x19], 2
jb 0x102a5ff
push esi
push dword [ebp - 4]
push 0x10047f0
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e21
mov eax, dword [0x1032370]
cmp esi, edi
jg 0x102a60a
mov ebx, esi
jmp 0x102a6a5
and esi, 0xffff
or esi, 0x80070000
jmp 0x102a603
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
push edi
lea eax, [ebp - 8]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push 0x7405c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x102a68a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x102a676
test byte [eax + 0x1c], 1
je 0x102a676
cmp byte [eax + 0x19], 2
jb 0x102a676
push esi
push dword [ebp - 4]
push 0x10047f0
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e21
cmp esi, edi
jle 0x102a686
and esi, 0xffff
or esi, 0x80070000
mov ebx, esi
jmp 0x102a695
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, dword [0x1032370]
cmp dword [ebp - 4], edi
je 0x102a6b8
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [0x1032370]
cmp ebx, edi
jge 0x102a6e8
cmp eax, 0x1032370
je 0x102a6e8
test dword [eax + 0x1c], 0x200
je 0x102a6e8
cmp byte [eax + 0x19], 2
jb 0x102a6e8
push ebx
push dword [ebp + 8]
push 0x10047f0
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e21
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x102ab4f
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1032c0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x24], eax
mov eax, dword [0x1032370]
mov esi, 0x1032370
mov ebx, 0x10047f0
cmp eax, esi
je 0x102ab96
test byte [eax + 0x1c], 1
je 0x102ab96
cmp byte [eax + 0x19], 4
jb 0x102ab96
push ebx
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
push edi
and dword [ebp - 0x20], 0
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 0x5a
mov byte [ebp - 0x19], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
pop edi
test eax, eax
jge 0x102abfa
or eax, 0x10000000
mov dword [ebp - 0x20], eax
mov eax, dword [0x1032370]
cmp eax, esi
je 0x102ac89
test byte [eax + 0x1c], 8
je 0x102ac6b
cmp byte [eax + 0x19], 2
jb 0x102ac6b
push dword [ebp - 0x20]
push ebx
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010053b9
jmp 0x102ac66
mov eax, dword [0x1032370]
cmp eax, esi
je 0x102ac25
test byte [eax + 0x1c], 1
je 0x102ac25
cmp byte [eax + 0x19], 4
jb 0x102ac25
push dword [ebp - 8]
push ebx
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010053b9
mov eax, dword [0x1032370]
cmp dword [ebp - 8], 2
jne 0x102ac2f
mov byte [ebp - 0x19], 1
cmp eax, esi
je 0x102ac5e
test byte [eax + 0x1c], 1
je 0x102ac5e
cmp byte [eax + 0x19], 4
jb 0x102ac5e
cmp byte [ebp - 0x19], 0
mov ecx, 0x10048a0
jne 0x102ac4f
mov ecx, 0x1004898
push ecx
push ebx
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007db4
mov eax, dword [ebp - 0x24]
mov cl, byte [ebp - 0x19]
mov byte [eax], cl
mov eax, dword [0x1032370]
cmp eax, esi
je 0x102ac89
test byte [eax + 0x1c], 1
je 0x102ac89
cmp byte [eax + 0x19], 4
jb 0x102ac89
push ebx
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01005393
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
pop esi
xor ecx, ebp
pop ebx
call fcn.01026693
leave
ret 4
Function at 0x102c72e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 8], ebx
jne 0x102c751
push 0x10023ec
push 0x38
push 0x1004bd8
call fcn.01028938
or dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.01028d87
mov edi, eax
cmp edi, ebx
jl 0x102c7d6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x102c7b3
lea eax, [ebp - 8]
push eax
push 0x1004bbc
push dword [ebp - 4]
call fcn.01028acc
mov edi, eax
cmp edi, ebx
jl 0x102c7d6
push ebx
push 0x4000080
push 2
push ebx
push 1
push 0x40000000
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x102c7d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x102c7c7
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, 0x80070005
jne 0x102c7d6
mov edi, 0x80780047
push dword [ebp - 4]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
call esi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
cmp dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], ebx
je 0x102c7fb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x102c809
Capabilities:
Get disk information
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp esi, edi
jne 0x102c830
push 0x10040c8
push 0xe5
push 0x1004bd8
call fcn.01028938
mov ebx, dword [ebp + 0x10]
push esi
mov byte [ebx], 0
mov dword [ebp - 4], edi
call fcn.0102b62b
mov byte [ebp + 0x13], al
lea eax, [ebp - 4]
push eax
push esi
call fcn.01028d87
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x102ca2c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x102c902
mov eax, dword [0x1032370]
mov esi, 0x1032370
mov edi, 0x1004bac
cmp eax, esi
je 0x102c899
test byte [eax + 0x1c], 1
je 0x102c899
cmp byte [eax + 0x19], 5
jb 0x102c899
push dword [ebp + 8]
push edi
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007db4
cmp byte [ebp + 0x13], 0
jne 0x102c8ab
mov dword [ebp - 8], 0x8078011a
jmp 0x102ca2c
cmp byte [ebp + 0xc], 0
je 0x102c8fa
push dword [ebp - 4]
call fcn.0102c72e
mov dword [ebp - 8], eax
test eax, eax
jge 0x102c8fa
mov eax, dword [0x1032370]
cmp eax, esi
je 0x102ca2c
test byte [eax + 0x1c], 1
je 0x102ca2c
cmp byte [eax + 0x19], 4
jb 0x102ca2c
push dword [ebp - 8]
push dword [ebp - 4]
push edi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007e21
jmp 0x102ca2c
mov byte [ebx], 1
jmp 0x102ca2c
cmp eax, 1
jne 0x102c9fe
cmp byte [ebp + 0x13], 0
jne 0x102c94a
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x102ca2c
test byte [eax + 0x1c], 1
je 0x102ca2c
cmp byte [eax + 0x19], 5
jb 0x102ca2c
push 1
push esi
push 0x1004bac
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x102ca27
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x102c9c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x102c9bf
cmp eax, 0x52e
je 0x102c9bf
cmp eax, 0x43
je 0x102c9b6
cmp eax, 0x35
je 0x102c9b6
cmp eax, 3
je 0x102c9b6
mov ecx, dword [0x1032370]
cmp ecx, 0x1032370
je 0x102ca2c
test byte [ecx + 0x1c], 1
je 0x102ca2c
cmp byte [ecx + 0x19], 4
jb 0x102ca2c
push eax
push 0x1004bac
push 0xc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010053b9
jmp 0x102ca2c
mov dword [ebp - 8], 0x80780071
jmp 0x102ca2c
mov dword [ebp - 8], 0x8078006f
jmp 0x102ca2c
mov eax, dword [0x1032370]
cmp eax, 0x1032370
je 0x102c9f5
test byte [eax + 0x1c], 1
je 0x102c9f5
cmp byte [eax + 0x19], 2
jb 0x102c9f5
push dword [ebp - 4]
push 0x1004bac
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01007db4
mov dword [ebp - 8], 0x8000ffff
jmp 0x102ca2c
mov ecx, dword [0x1032370]
cmp ecx, 0x1032370
je 0x102ca2c
test byte [ecx + 0x1c], 1
je 0x102ca2c
cmp byte [ecx + 0x19], 5
jb 0x102ca2c
push eax
push esi
push 0x1004bac
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01007e21
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x402b44
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404250
test esi, esi
jne 0x402b7a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404340
jmp 0x402b98
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402a58
mov edi, eax
test esi, esi
je 0x402b98
cmp dword [ebx], 0
je 0x402b98
dec esi
jmp 0x402b81
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403334
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4fa020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4033cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033ac
xor eax, eax
push ebp
push 0x4033a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4033e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4fa020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4fa020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040b4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x50104c], 0
je 0x404115
cmp word [0x501220], 0xd7b2
jne 0x4040dd
cmp dword [0x501228], 0
jbe 0x4040dd
mov eax, 0x50121c
call dword [0x501238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4fa06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40413c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4fa030], 0
jne 0x404131
push 0
push 0x4fa064
push 0x4fa06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret