joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20008db7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14c
push ebx
push esi
push edi
xor esi, esi
lea edx, [eax + 0x1c]
mov ecx, dword [edx]
mov edi, ecx
ror edi, 8
and edi, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edi, ecx
mov dword [ebp + esi*4 - 0x14c], edi
inc esi
add edx, 4
cmp esi, 0x10
jb 0x20008dcb
push pe_nt_image_headers32
lea ecx, [ebp - 0x144]
pop edx
mov esi, dword [ecx + 0x2c]
xor esi, dword [ecx + 0x18]
xor esi, dword [ecx - 8]
xor esi, dword [ecx]
add ecx, 4
dec edx
rol esi, 1
mov dword [ecx + 0x34], esi
jne 0x20008dfc
mov edi, dword [eax + 0x14]
mov edx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov ecx, dword [eax + 0x10]
and dword [ebp + 8], 0
mov dword [ebp - 4], edi
mov edi, dword [eax + 0x18]
mov dword [ebp - 0xc], edi
mov edi, esi
not edi
and edi, dword [ebp - 4]
mov dword [ebp - 8], edx
mov ebx, ecx
and ebx, esi
xor edi, ebx
rol edx, 5
add edx, edi
mov edi, dword [ebp + 8]
add edx, dword [ebp + edi*4 - 0x14c]
mov edi, dword [ebp - 0xc]
inc dword [ebp + 8]
ror esi, 2
cmp dword [ebp + 8], 0x14
lea edx, [edx + edi + 0x5a827999]
mov edi, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, esi
mov esi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
jb 0x20008e2b
mov dword [ebp + 8], 0x14
mov ebx, dword [ebp - 4]
xor ebx, ecx
mov dword [ebp - 8], edx
xor ebx, esi
rol edx, 5
add edx, ebx
mov ebx, dword [ebp + 8]
add edx, dword [ebp + ebx*4 - 0x14c]
inc dword [ebp + 8]
ror esi, 2
cmp dword [ebp + 8], 0x28
lea edx, [edx + edi + 0x6ed9eba1]
mov edi, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov ecx, esi
mov esi, dword [ebp - 8]
jb 0x20008e75
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], 0x28
mov edi, ecx
xor edi, esi
and edi, dword [ebp - 4]
mov ebx, ecx
and ebx, esi
xor edi, ebx
mov ebx, dword [ebp + 8]
add edi, dword [ebp + ebx*4 - 0x14c]
mov dword [ebp - 8], edx
rol edx, 5
add edx, dword [ebp - 0xc]
inc dword [ebp + 8]
lea edx, [edi + edx - 0x70e44324]
mov edi, dword [ebp - 4]
ror esi, 2
push 0x3c
mov dword [ebp - 0xc], edi
pop edi
cmp dword [ebp + 8], edi
mov dword [ebp - 4], ecx
mov ecx, esi
mov esi, dword [ebp - 8]
jb 0x20008eb6
mov dword [ebp + 8], edi
mov edi, dword [ebp - 4]
mov ebx, dword [ebp + 8]
xor edi, ecx
mov dword [ebp - 8], edx
xor edi, esi
add edi, dword [ebp + ebx*4 - 0x14c]
mov ebx, dword [ebp - 4]
rol edx, 5
add edx, dword [ebp - 0xc]
inc dword [ebp + 8]
ror esi, 2
cmp dword [ebp + 8], 0x50
mov dword [ebp - 4], ecx
mov ecx, esi
mov esi, dword [ebp - 8]
lea edx, [edi + edx - 0x359d3e2a]
mov dword [ebp - 0xc], ebx
jb 0x20008efc
mov edi, dword [eax + 8]
add edi, edx
mov edx, dword [eax + 0xc]
add edx, esi
mov dword [eax + 0xc], edx
mov edx, dword [eax + 0x10]
add edx, ecx
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 4]
add ecx, edx
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0x18]
mov dword [eax + 8], edi
pop edi
add ecx, ebx
pop esi
mov dword [eax + 0x18], ecx
pop ebx
leave
ret
Function at 0x20008f67
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x200096e7
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
and dword [eax], 0
and dword [eax + 4], 0
test ecx, ecx
jne 0x20009734
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
jmp 0x2000976c
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
mov dword [eax + 0xe8], ecx
ret
Function at 0x2000c288
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
lea edi, [eax + eax + 2]
call dword [sym.imp.USER32.dll_OpenClipboard]
mov esi, eax
test esi, esi
je 0x2000c2f3
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x2000c2ed
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x2000c2ed
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x2000c2ed
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
ret

Function at 0x2000c545
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push pe_nt_image_headers32
lea eax, [ebp - 0x40]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - pe_nt_image_headers32], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [ebp + 8], 0
je 0x2000c57a
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
jmp 0x2000c580
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
shrd eax, ecx, 0x14
shr ecx, 0x14
leave
ret

Function at 0x2000c686
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x20041208], esi
mov dword [ebp - 4], esi
jne 0x2000c6d3
push edi
mov ecx, esi
push 8
shl ecx, 0x18
xor edx, edx
pop edi
mov eax, edx
xor eax, ecx
add edx, edx
test eax, eax
jns 0x2000c6b3
xor edx, 0x4c10db7
add ecx, ecx
dec edi
jne 0x2000c6a3
mov dword [esi*4 + 0x20040e08], edx
inc esi
cmp esi, 0x100
jl 0x2000c699
mov dword [0x20041208], 0x4c10db7
pop edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x2000c6fc
mov ecx, dword [ebp + 8]
movzx esi, byte [ecx]
mov eax, dword [ebp - 4]
shr eax, 0x18
xor eax, esi
mov esi, dword [ebp - 4]
shl esi, 8
xor esi, dword [eax*4 + 0x20040e08]
inc ecx
dec edx
mov dword [ebp - 4], esi
jne 0x2000c6dd
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x2000ca17
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x2000caf0
cmp word [eax], di
je 0x2000caf0
push ebx
push edi
push 0x1a
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, edi
je 0x2000cae6
cmp ebx, 0xffffffff
je 0x2000cae6
push 0x228
lea eax, [ebp - 0x230]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
push ebx
mov dword [ebp - 0x234], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x2000cae6
push esi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.2000c3c4
test eax, eax
pop ecx
pop ecx
je 0x2000cacf
cmp esi, edi
je 0x2000cac5
cmp dword [ebp - 0x22c], esi
jne 0x2000cacf
cmp dword [ebp + 0x10], edi
je 0x2000cac5
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp esi, dword [ebp - 8]
jne 0x2000cacf
mov eax, dword [ebp - 0x22c]
cmp eax, edi
jne 0x2000cae2
lea eax, [ebp - 0x234]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x2000ca8a
jmp 0x2000cae5
mov dword [ebp - 4], eax
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
jmp 0x2000caff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.2000c914
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x2000ccc2
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x2a8
push esi
xor esi, esi
cmp dword [0x2002dd38], esi
jne 0x2000cd4c
push 0x206
lea eax, [ebp - 0x22e]
push esi
push eax
mov word [ebp - 0x230], si
call sub.MSVCRT.dll_memset
push 0x9e
lea eax, [ebp - 0x26]
push esi
push eax
mov word [ebp - 0x28], si
call sub.MSVCRT.dll_memset
add esp, 0x18
push 0x104
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xc
push 0x20001e40
lea eax, [ebp - 0x28]
push eax
call fcn.2000c790
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x230]
push eax
call fcn.2000733d
pop ecx
mov dword [0x2002dd38], eax
pop esi
add ebp, 0x78
leave
ret
Function at 0x2000cd52
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x2c
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x2000cd76
and word [esi], 0
inc esi
inc esi
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx ecx, word [esi]
test cx, cx
mov edi, eax
mov dword [ebp - 4], edi
je 0x2000cdf7
push ebx
cmp cx, 0x2b
sete al
inc esi
inc esi
movzx ecx, word [esi]
xor edx, edx
cmp cx, 0x41
sete dl
xor ebx, ebx
cmp cx, 0x53
sete bl
lea edx, [ebx + edx*8]
xor ebx, ebx
cmp cx, 0x48
sete bl
lea edx, [ebx + edx*2]
xor ebx, ebx
cmp cx, 0x52
sete bl
lea ecx, [ebx + edx*2]
test ecx, ecx
je 0x2000cdd6
test al, al
je 0x2000cdd2
or edi, ecx
jmp 0x2000cdd6
not ecx
and edi, ecx
inc esi
inc esi
movzx ecx, word [esi]
test cx, cx
jne 0x2000cd8d
cmp dword [ebp - 4], edi
pop ebx
je 0x2000cdf7
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
inc eax
jmp 0x2000cdf9
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x2000ce5a
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x874]
xor edi, edi
push 0x200029cc
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call esi
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x2000cf4f
cmp eax, 0xffffffff
je 0x2000cf4f
push ebx
test byte [ebp - 0x25c], 0x10
je 0x2000cf0c
lea eax, [ebp - 0x230]
push eax
call fcn.20007e6f
test eax, eax
pop ecx
jne 0x2000cf2d
push 0x206
lea eax, [ebp - 0x462]
push edi
push eax
mov word [ebp - 0x464], di
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x464]
push 0x200029c0
push eax
call esi
lea eax, [ebp - 0x464]
push eax
call fcn.2000ce5a
add esp, 0x20
jmp 0x2000cf27
push 1
push edi
push edi
push dword [ebp - 0x240]
call fcn.200257d0
mov ecx, dword [ebp - 0x23c]
xor ebx, ebx
or eax, ecx
or edx, ebx
add dword [ebp - 8], eax
adc dword [ebp - 4], edx
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x2000ceb0
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x2000cf59
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.2000c460
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x2000d078
cmp word [esi], bx
je 0x2000d078
push 0x3d
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x2000d078
mov word [eax], bx
add eax, 2
push edi
push eax
call fcn.2000c372
mov edi, eax
mov dword [esp], 0x40e
lea eax, [ebp - 0x40e]
push ebx
push eax
mov word [ebp - 0x410], bx
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0xc
push edi
call esi
cmp eax, 1
jbe 0x2000cfd4
cmp word [edi + 2], 0x3a
jne 0x2000cfdc
push edi
call esi
cmp eax, 2
jae 0x2000d009
cmp edi, ebx
je 0x2000d002
cmp word [edi], bx
je 0x2000d002
push edi
push 0x2002e1b0
lea eax, [ebp - 0x410]
push 0x200029c0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x2000d017
push 0x2002e1b0
jmp 0x2000d00a
push edi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x410]
push eax
call fcn.2000c460
lea eax, [ebp - 0x410]
push eax
call fcn.2000448d
pop ecx
pop ecx
test eax, eax
pop edi
lea eax, [ebp - 0x410]
push eax
je 0x2000d044
call fcn.2000ce5a
jmp 0x2000d049
call fcn.2000cdfd
pop ecx
push edx
push eax
lea eax, [ebp - 0x410]
push 0x200029dc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x2000d083
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x2000d5ac
Capabilities:
Get common file path
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.200256d0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
cmp edi, ebx
je 0x2000d68d
cmp word [edi], bx
je 0x2000d68d
mov bl, byte [ebp + 0xc]
cmp bl, 1
jne 0x2000d60a
push edi
push 0x20002a44
push 0x20002a2c
lea eax, [ebp - 0x1000]
push 0x20002818
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x1000]
push eax
call fcn.2000d19e
add esp, 0x18
jmp 0x2000d640
cmp bl, 2
jne 0x2000d640
push edi
push 0x20002a44
push 0x20002ad8
push 0x20002a38
lea eax, [ebp - 0x1000]
push 0x20002abc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x1000]
push eax
call fcn.2000d19e
add esp, 0x1c
push 0x3d
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x2000d668
and word [esi], 0
add esi, 2
push esi
call fcn.2000c372
push edi
mov esi, eax
call fcn.2000c372
pop ecx
pop ecx
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp bl, 1
je 0x2000d681
cmp bl, 2
jne 0x2000d686
call fcn.2000d573
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
cmp dword [ebp + 0x10], ebx
je 0x2000d681
and word [ebp - 0x2000], si
push 0xffe
lea eax, [ebp - 0x1ffe]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
lea edi, [ebx + 0x200022b0]
push dword [edi]
lea eax, [ebp - 0x2000]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x2000d75f
cmp dword [edi], 0x1a
jne 0x2000d6e8
push 0x20002a68
lea eax, [ebp - 0x2000]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x800
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x2000]
push eax
call fcn.20007e9d
lea eax, [ebp - 0x1000]
push eax
push dword [ebx + 0x200022b4]
lea eax, [ebp - 0x2000]
push 0x20002a5c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor edi, edi
add esp, 0x1c
cmp dword [ebp + 0x14], edi
je 0x2000d74d
cmp byte [ebp + 0xc], 0
jne 0x2000d74d
lea eax, [ebp - 0x1000]
push eax
call fcn.2000448d
test eax, eax
pop ecx
jne 0x2000d74d
lea eax, [ebp - 0x1000]
push eax
call fcn.2000c2f8
pop ecx
push edi
push edi
lea eax, [ebp - 0x2000]
push edi
push eax
call fcn.2000d5ac
add esp, 0x10
add ebx, 8
cmp ebx, 0x48
jb 0x2000d692
jmp 0x2000d686
Function at 0x2000d770
Capabilities:
Set environment variable

Disassembly:
sub esp, 0xa0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x9e
lea eax, [esp + 0x16]
push ebp
push eax
mov word [esp + 0x1c], bp
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add esp, 0xc
mov ebx, 0x20002b54
push dword [ebp + 0x200022b4]
lea eax, [esp + 0x14]
push ebx
push eax
call esi
push 0
push 0
lea eax, [esp + 0x24]
push 1
push eax
call fcn.2000d5ac
add esp, 0x1c
push 0
push dword [ebp + 0x200022b4]
call edi
add ebp, 8
cmp ebp, 0x48
jb 0x2000d7a5
mov ebp, 0x20002b44
push ebp
lea eax, [esp + 0x14]
push ebx
push eax
call esi
push 0
push 0
lea eax, [esp + 0x24]
push 1
push eax
call fcn.2000d5ac
add esp, 0x1c
push 0
push ebp
call edi
mov ebp, 0x20002b34
push ebp
lea eax, [esp + 0x14]
push ebx
push eax
call esi
xor esi, esi
push esi
push esi
lea eax, [esp + 0x24]
push 1
push eax
call fcn.2000d5ac
add esp, 0x1c
push esi
push ebp
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x2000ed52
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x2003f034]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
call esi
sub eax, edi
cmp eax, dword [esp + 0xc]
jb 0x2000ed6e
pop edi
pop esi
ret
Function at 0x2000f9d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x210
push edi
xor edi, edi
cmp eax, edi
je 0x2000fbb2
cmp word [eax], di
je 0x2000fbb2
push esi
push eax
mov dword [ebp - 4], edi
call fcn.2000c372
pop ecx
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x2c
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, edi
je 0x2000fa22
mov word [eax], di
add eax, 2
push eax
call fcn.200042be
pop ecx
mov dword [ebp - 4], eax
push ebx
push 0x3a
xor ebx, ebx
and dword [ebp - 8], ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
mov dword [ebp + 8], eax
je 0x2000fa4b
cmp word [esi], 0x3a
je 0x2000fbb0
sub dword [ebp + 8], 2
mov eax, dword [ebp - 8]
jmp 0x2000fa85
test esi, esi
je 0x2000fbb0
cmp word [esi], bx
je 0x2000fbb0
push 0x20002bfc
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ebx, eax
neg ebx
push 0x20002bf4
sbb ebx, ebx
push esi
neg ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x2000fb11
test ebx, ebx
jne 0x2000fa9c
test eax, eax
je 0x2000fbb0
and word [ebp - 0x210], di
push 0x206
lea eax, [ebp - 0x20e]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x210], di
lea esi, [ebp - 0x210]
je 0x2000fbb0
movzx eax, word [esi]
push eax
call fcn.2000498b
test eax, eax
pop ecx
jne 0x2000fafa
movzx eax, word [esi]
push eax
call fcn.20004969
test eax, eax
pop ecx
je 0x2000fb6b
cmp dword [ebp - 8], 0
je 0x2000fb6b
movzx eax, word [esi]
push 0
push eax
call fcn.2000f8ac
pop ecx
jmp 0x2000fb93
movzx eax, word [ecx]
push eax
call fcn.20004dce
test eax, eax
pop ecx
je 0x2000fb36
cmp dword [ebp - 4], edi
mov eax, dword [ebp + 8]
movzx eax, word [eax]
jne 0x2000fb2e
push 1
jmp 0x2000fb5a
push eax
call fcn.20005c02
jmp 0x2000fb61
mov esi, dword [ebp + 8]
movzx eax, word [esi]
push eax
call fcn.2000498b
test eax, eax
pop ecx
jne 0x2000fb55
movzx eax, word [esi]
push eax
call fcn.20004969
test eax, eax
pop ecx
je 0x2000fbb0
movzx eax, word [esi]
push 0
push eax
call fcn.2000f8ac
pop ecx
mov edi, eax
neg edi
sbb edi, edi
pop ecx
inc edi
jmp 0x2000fbb0
test ebx, ebx
je 0x2000fb9b
movzx eax, word [esi]
push eax
call fcn.20004dce
test eax, eax
pop ecx
je 0x2000fb9b
cmp dword [ebp - 4], 0
movzx eax, word [esi]
jne 0x2000fb8d
push 1
jmp 0x2000fb05
push eax
call fcn.20005c02
neg eax
sbb eax, eax
inc eax
pop ecx
or edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x2000fade
pop ebx
pop esi
mov eax, edi
pop edi
leave
ret
Function at 0x2000fc2c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
je 0x2000fc73
cmp byte [ebp + 8], 0
jne 0x2000fc73
push 0x20002bfc
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa0]
push eax
call fcn.2000f9d0
test eax, eax
pop ecx
jne 0x2000fc73
push 0x2710
call fcn.2000ed52
pop ecx
lea eax, [ebp + 0xc]
push eax
mov ebx, 0x7d0
push ebx
push esi
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0x11
mov edi, 0xffff
push edi
call esi
lea eax, [ebp + 0xc]
push eax
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x16
push edi
call esi
push 0x1f4
call fcn.2000ed52
mov dword [esp], 0x20002c04
call fcn.2000fbb7
test eax, eax
pop ecx
je 0x2000fd02
movzx eax, byte [ebp + 8]
sub eax, ebx
je 0x2000fcec
dec eax
je 0x2000fce8
dec eax
je 0x2000fcde
dec eax
je 0x2000fcd3
dec eax
jne 0x2000fcf4
push 1
push ebx
jmp 0x2000fcd7
push 1
push 1
call sub.KERNEL32.dll_SetSystemPowerState
jmp 0x2000fcf4
push ebx
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x2000fcf4
push 1
jmp 0x2000fcee
push 2
call fcn.20005c93
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
neg eax
jmp 0x2000fd05
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x200100bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
push edi
xor edi, edi
push edi
push 0x3fc
lea eax, [ebp - 0x510]
push eax
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x20010191
push 0xf003f
push 1
push edi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x20010191
push 0xfe
lea eax, [ebp - 0x112]
push edi
push eax
mov word [ebp - 0x114], di
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], edi
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x10], 0x400
push dword [ebp - 8]
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
cmp ebx, edi
jne 0x2001017c
push 0x20002c48
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x20010187
inc dword [ebp - 4]
cmp ebx, 0x103
jne 0x2001012f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
leave
ret
Function at 0x20011da3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, word [ebp + 0xc]
push esi
xor esi, esi
push edi
xor edi, edi
inc esi
cmp word [ebp + 8], di
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
jbe 0x20011eca
push ebx
push edi
call fcn.20004924
test eax, eax
pop ecx
je 0x20011eb4
push edi
call fcn.200052a9
test eax, eax
pop ecx
je 0x20011eb4
push edi
call fcn.20005197
movzx eax, ax
xor ebx, ebx
inc ebx
cmp ax, bx
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
jb 0x20011eb4
push ebx
push dword [ebp - 4]
call fcn.200055f1
test eax, eax
pop ecx
pop ecx
je 0x20011ea3
push ebx
push dword [ebp - 4]
call fcn.20005206
cmp word [ebp + 0xc], 0
pop ecx
pop ecx
movzx edi, ax
je 0x20011e7b
push dword [ebp - 8]
movzx ebx, word [ebp - 8]
call fcn.20004526
test eax, eax
pop ecx
je 0x20011e40
call fcn.20004fc9
movzx ebx, ax
test di, di
je 0x20011e59
push edi
push ebx
call fcn.20004249
test eax, eax
pop ecx
pop ecx
jne 0x20011e59
push edi
call fcn.200053af
pop ecx
movzx esi, bx
test esi, esi
je 0x20011ec9
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.200052f2
movzx esi, ax
add esp, 0xc
test esi, esi
je 0x20011ec9
inc dword [ebp - 8]
jmp 0x20011e9f
test di, di
jne 0x20011e9f
call fcn.20004fc9
movzx eax, ax
movzx esi, ax
test esi, esi
je 0x20011ec9
push eax
push ebx
push dword [ebp - 4]
call fcn.200052f2
add esp, 0xc
movzx esi, ax
test esi, esi
je 0x20011ec9
mov ebx, dword [ebp - 0xc]
inc ebx
cmp bx, word [ebp - 0x10]
mov dword [ebp - 0xc], ebx
jbe 0x20011dff
test esi, esi
je 0x20011ec9
mov edi, dword [ebp - 4]
inc edi
cmp di, word [ebp + 8]
mov dword [ebp - 4], edi
jb 0x20011dc5
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret