joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ad110
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x100ad190
je 0x100ad181
cmp eax, 0x80000101
ja 0x100ad17a
je 0x100ad181
cmp eax, reloc.WS2_32.dll_connect
je 0x100ad15c
cmp eax, reloc.WS2_32.dll_getpeername
jne 0x100ad1a5
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x100ad1f2
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x100ad1f2
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call fcn.100b4e60
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x100ad1f2
cmp eax, 0x80000201
jne 0x100ad1a5
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x100ad1f2
cmp eax, 0x80000401
je 0x100ad1dd
cmp eax, 0x80000501
je 0x100ad1c5
cmp eax, 0x80000601
je 0x100ad1ad
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.100c1a28
mov dword [esp + 0xc], eax
jmp 0x100ad1ee
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.100c1a28
mov dword [esp + 0xc], eax
jmp 0x100ad1ee
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.100b5af0
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call fcn.100b4e60
add esp, 8
test esi, esi
je 0x100ad2ca
test eax, eax
je 0x100ad2ca
inc eax
push edi
push eax
call fcn.100c1a17
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100c19f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100ad26c
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100ad2c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100ad2b5
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.100c19db
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x100adc90
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100add22
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x100add14
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x100add0c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x100adcd5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x100ae750
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x100ae770
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100ae7ba
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x100ae7af
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
call fcn.100b4e60
push eax
push edi
call fcn.100b5b80
add esp, 0xc
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
pop esi
pop edi
ret
mov eax, edi
pop edi
ret

Function at 0x100ae7c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x100ae83e
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100ae83e
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
call fcn.100b4e60
add esp, 4
inc eax
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x100ae832
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret
Function at 0x100afbe0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100afc49
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.100ac950
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x100aff70
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x100aff86
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
ret
or eax, 0xffffffff
ret

Function at 0x100aff90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x100affe0
mov ecx, dword [esp + 0x19c]
push ecx
call fcn.100aff70
add esp, 4
cmp eax, 0xffffffff
je 0x100affdb
push eax
call sub.WS2_32.dll_inet_ntoa
mov esi, eax
push esi
call fcn.100b4e60
push eax
push esi
call fcn.100b5b80
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x100afff0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
sub esp, 0x294
lea eax, [esp + 0x104]
push esi
push eax
push 0x202
xor esi, esi
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x100b0041
lea ecx, [esp + 4]
push 0x104
push ecx
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x100b003c
lea edx, [esp + 4]
push edx
call fcn.100b4e60
push eax
lea eax, [esp + 0xc]
push eax
call fcn.100b5b80
add esp, 0xc
mov esi, eax
call sub.WS2_32.dll_WSACleanup
mov eax, esi
pop esi
add esp, 0x294
ret
Function at 0x100b0170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.100b5af0
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call fcn.100b4e60
add esp, 8
test ebx, ebx
je 0x100b02b2
test eax, eax
je 0x100b02b2
inc eax
push eax
call fcn.100c1a17
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100c19f0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100b01e1
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100b029f
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.100c1a17
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x100b0269
cmp eax, 0xea
jne 0x100b028b
push esi
call fcn.100c19db
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100c1a17
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x100b0234
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x100b0277
cmp eax, 2
jne 0x100b028b
push esi
call fcn.100b4e60
push eax
push esi
call fcn.100b5b80
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.100c19db
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.100c19db
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x100b02da
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x100b02e6
mov esi, dword [esp + 0x40]
test esi, esi
je 0x100b02e6
push esi
call fcn.100b4e60
push eax
push esi
call fcn.100b5b80
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100b27f0
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x114
test eax, eax
push esi
jne 0x100b2815
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x100b287e
jmp 0x100b2834
mov esi, dword [esp + 0x120]
push esi
call fcn.100b4e60
add esp, 4
test eax, eax
je 0x100b287e
mov cl, byte [esi]
mov byte [esp + 0x15], 0x3a
mov byte [esp + 0x14], cl
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x100b287e
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
imul edx, dword [esp + 4]
push 0x400
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
pop esi
add esp, 0x114
ret
or eax, 0xffffffff
pop esi
add esp, 0x114
ret

Function at 0x100b2a50
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.100c1a17
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x100b2aba
push esi
lea edi, [eax + 0x400]
call fcn.100c19db
push edi
call fcn.100c1a17
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x100b2a8a
push esi
xor edi, edi
call fcn.100b4e60
add esp, 4
test eax, eax
je 0x100b2ad5
push eax
push esi
call fcn.100b5b80
add esp, 8
mov edi, eax
push esi
call fcn.100c19db
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x100b2c80
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100b2c8e
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.100b62b0
add esp, 4
test eax, eax
jne 0x100b2ca0
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
je 0x100b2cbe
cmp ecx, 3
je 0x100b2cbe
cmp ecx, 2
jne 0x100b2ccd
mov ecx, dword [esi + 4]
call fcn.100b69e0
pop esi
ret
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
ret
Function at 0x100b2cd0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x10
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x100b2ce6
mov eax, 1
pop edi
add esp, 0x10
ret
push edi
call fcn.100b62b0
add esp, 4
test eax, eax
jne 0x100b2cfd
mov eax, 1
pop edi
add esp, 0x10
ret
mov eax, dword [edi]
push ebx
push ebp
mov ebp, 1
cmp eax, ebp
push esi
mov dword [esp + 0x10], ebp
je 0x100b2da1
cmp eax, 3
je 0x100b2da1
cmp eax, 2
jne 0x100b2e48
mov esi, dword [edi + 4]
mov ecx, esi
call fcn.100b69e0
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x100b2e48
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], 0
test eax, eax
je 0x100b2e48
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100b2e48
mov edx, dword [esi]
lea eax, [esp + 0x28]
push ebp
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebx, eax
call dword [edx + 0x18]
test ebx, ebx
je 0x100b2e48
mov al, byte [esp + 0x28]
test al, al
je 0x100b2d93
cmp al, 0x1a
jne 0x100b2e48
mov dword [esp + 0x10], ebp
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
mov esi, dword [edi + 4]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push esi
mov dword [esp + 0x24], eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100b2e48
cmp ebx, dword [esp + 0x14]
jae 0x100b2e48
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], 0
test eax, eax
je 0x100b2e48
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100b2e48
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x30]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push ebx
push esi
mov dword [esp + 0x24], eax
call ebp
cmp dword [edi], 3
jne 0x100b2e2c
mov ecx, dword [edi + 0x130]
lea eax, [edi + 0xc]
push eax
add edi, 0x2c
push ecx
push edi
lea edx, [esp + 0x34]
push 1
push edx
push ebx
call fcn.100b5680
add esp, 0x18
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100b2e48
mov al, byte [esp + 0x28]
test al, al
je 0x100b2e40
cmp al, 0x1a
jne 0x100b2e48
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x100b2e60
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x100b2e75
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
call fcn.100b62b0
add esp, 4
test eax, eax
jne 0x100b2e88
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x28]
test esi, esi
jg 0x100b2e98
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi]
xor ebx, ebx
cmp eax, 1
jne 0x100b2ef1
mov edi, dword [edi + 4]
push esi
call fcn.100c1a17
add esp, 4
mov ebp, eax
lea eax, [esp + 0x1c]
push ebx
push eax
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100b2ed3
push ebp
call fcn.100c19db
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
call fcn.100b5b40
push ebp
mov ebx, eax
call fcn.100c19db
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp eax, 2
jne 0x100b2f3c
mov edi, dword [edi + 4]
lea edx, [esi + 8]
push edx
call fcn.100ac950
mov ebx, eax
add esp, 4
lea ecx, [ebx + 8]
mov dword [ebx], 1
mov dword [ebx + 4], esi
mov eax, dword [edi]
push esi
push ecx
mov ecx, edi
call dword [eax + 0x20]
test eax, eax
jne 0x100b2f31
push ebx
call fcn.100aca10
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [ebx + 4], eax
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
cmp eax, 3
jne 0x100b2fb8
mov ebx, dword [edi + 4]
push esi
call fcn.100c1a17
add esp, 4
mov ebp, eax
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x1c]
push 0
push edx
push esi
push ebp
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100b2f85
push ebp
call fcn.100c19db
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, dword [edi + 0x130]
mov eax, dword [esp + 0x1c]
lea ecx, [edi + 0xc]
add edi, 0x2c
push ecx
push edx
push edi
mov esi, eax
push eax
mov eax, dword [esp + 0x20]
push ebp
push eax
call fcn.100b5680
push esi
push ebp
call fcn.100b5b40
push ebp
mov ebx, eax
call fcn.100c19db
add esp, 0x24
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x100b2fc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
jne 0x100b2fd3
xor eax, eax
pop ebp
add esp, 0x18
ret
push ebp
call fcn.100b62b0
add esp, 4
test eax, eax
jne 0x100b2fe5
pop ebp
add esp, 0x18
ret
mov eax, dword [ebp]
push ebx
mov ebx, 1
push esi
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x100b305f
mov eax, dword [esp + 0x2c]
mov ebp, dword [ebp + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
mov edi, ebx
jle 0x100b31b5
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x3c]
mov eax, dword [esi]
lea edx, [esp + 0x20]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push ebp
call ebx
test eax, eax
je 0x100b304b
mov eax, dword [esp + 0x2c]
inc edi
add esi, 0xc
cmp edi, eax
jl 0x100b301b
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
cmp eax, 2
jne 0x100b30a2
mov eax, dword [esp + 0x2c]
mov ebp, dword [ebp + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x100b31b5
lea esi, [esp + 0x3c]
lea edi, [eax - 1]
mov eax, dword [esi]
mov edx, dword [ebp]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, ebp
call dword [edx + 0x24]
add esi, 0xc
dec edi
jne 0x100b307e
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
cmp eax, 3
jne 0x100b31b5
mov edi, dword [esp + 0x2c]
mov edx, dword [ebp + 4]
xor ecx, ecx
cmp edi, ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
jle 0x100b30f2
lea edx, [esp + 0x3c]
lea esi, [edi - 1]
mov eax, dword [edx]
mov eax, dword [eax + 4]
test eax, eax
jle 0x100b30d6
cmp ecx, eax
jg 0x100b30d6
mov ecx, eax
add edx, 0xc
dec esi
jne 0x100b30c7
test ecx, ecx
jle 0x100b30f2
push ecx
call fcn.100c1a17
add esp, 4
mov dword [esp + 0x14], eax
mov ebx, 1
cmp edi, ebx
mov dword [esp + 0x20], ebx
jle 0x100b31a8
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
test ebx, ebx
jle 0x100b3175
mov edi, dword [esp + 0x14]
mov ecx, ebx
lea esi, [eax + 8]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 1
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 0x130]
mov esi, dword [esp + 0x14]
lea edx, [ebp + 0xc]
push edx
lea edx, [ebp + 0x2c]
push ecx
push edx
push ebx
push esi
push eax
call fcn.100b5680
mov ecx, dword [esp + 0x34]
add esp, 0x18
lea eax, [esp + 0x24]
push 0
push eax
push ebx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b3193
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
inc eax
add edx, 0xc
cmp eax, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
jl 0x100b3106
jmp 0x100b31a8
mov edx, dword [esp + 0x14]
push edx
call fcn.100c19db
add esp, 4
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
push eax
call fcn.100c19db
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x18
ret
Function at 0x100b31d0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.100b5af0
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call fcn.100b4e60
add esp, 8
test ebp, ebp
je 0x100b3299
test eax, eax
je 0x100b3299
inc eax
push ebx
push eax
call fcn.100c1a17
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100c19f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100b323b
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100b3275
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100b3288
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call fcn.100c19db
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x100b34f0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100b34fd
xor eax, eax
pop esi
ret
push esi
call fcn.100b4e60
add esp, 4
test eax, eax
jne 0x100b350c
pop esi
ret
cmp eax, 1
jne 0x100b351a
cmp byte [esi], 0x5c
jne 0x100b351a
xor eax, eax
pop esi
ret
push esi
call fcn.100b32a0
add esp, 4
test eax, eax
je 0x100b352e
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x100b3560
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x100b3640
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
call fcn.100b5af0
mov edi, dword [esp + 0x38]
xor esi, esi
push edi
mov ebp, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
call fcn.100b4e60
add esp, 8
cmp ebp, esi
je 0x100b371f
cmp eax, esi
je 0x100b371f
inc eax
push ebx
push eax
call fcn.100c1a17
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100c19f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100b36b5
mov byte [esi], 0
inc esi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100b370d
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
mov edi, 4
push esi
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100b3702
cmp dword [esp + 0x14], edi
jne 0x100b3702
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.100c19db
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
pop ebx
jne 0x100b372b
mov eax, dword [esp + 0x48]
test eax, eax
mov eax, dword [esp + 0x40]
jne 0x100b372f
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x100b3740
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.100ac900
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x100b3797
push ebx
push edi
call fcn.100aca10
push esi
mov ebx, esi
call fcn.100ac900
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x100b376e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret