joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479a71
Capabilities:
Encode data using xor

Disassembly:
cmp eax, dword [ebp - 0x3c73784a]
popfd
push esp
dec ebx
inc esp
push edi
sahf
push ecx
jle 0x479a35
cmp ecx, dword [edx + 0x51]
dec edx
push ecx
fcmovbe st(0), st(1)
xchg ecx, eax
movsb byte es:[edi], byte [esi]
add al, 0xea
jmp 0x479a6d
rcl dword [ecx - 0x1415fb5c]
xor dword [ebx], esp
xor dh, ah
sbb al, 0x5e
inc ebp
int 0x57
sbb eax, dword [0xa560c1a2]
jo 0x479a22
or eax, dword [ebp + 0x47dbc5a8]
jns 0x479ac0
lcall 0xa0ef, 0x6b08f2bc
mov ch, byte [eax + 0x6d0ccdc2]
jmp dword [ebp - 0x4a685bd9]
pop ss
pop ecx
movsd dword es:[edi], dword [esi]
mov ebp, 0x918fbb7f
jg 0x479a2e
invalid
xchg ecx, eax
jae 0x479adc
jg 0x479a2e
mov ebx, 0x6573918f
invalid
xor byte [ecx + 0x16], bh
imul byte [edi - 0x187f7f62]
popfd
jge 0x479a94
jbe 0x479a72
invalid
mov eax, 0xb5cc8cd0
jg 0x479a32
adc edx, edi
in eax, dx
adc dword [ebp + 0x7424f52a], 0
invalid
movsd dword es:[edi], dword [esi]
push esi
cmc
xlatb
xchg esi, eax
aad 0x5b
jp 0x479ac7
pop es
hlt
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
dec ebx
cmp dword [eax], 0xc96e24b2
adc eax, 0x9e4a9a31
pop ebp
les ecx, [esi - 0x4347d9fc]
push esp
pop eax
push 0x248b7cc5
xor al, 0x33
movsd dword es:[edi], dword [esi]
push eax
hlt

Function at 0x4c38f1
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [eax + 0x6ab3e9cb], 0x5fb554e6
inc edx
wait
xor bl, byte [ebp + 0x1ee22d18]
jmp 0x7811c651
xchg esp, eax
mov edx, 0xea89f81a
push 0xffffffffffffffb2
xor edx, dword [eax + 0x2e33abe]
mov ch, 0x23
cmpsb byte [esi], byte es:[edi]
push ss
cli
outsb dx, byte [esi]
ja 0x4c3901
dec ebx
push ebp
xor ah, byte [ebp - 0x7ef5e07c]
jle 0x4c384b
mul byte [edx - 0x152ce795]
out 0xb7, al
mov dl, 0xa3
adc ebx, ebx
inc ecx
je 0x4c391a
stosb byte es:[edi], al
out 0x81, eax
test byte [edx + 0x3810348c], bh
xchg ebx, eax
das
inc edx
movsd dword es:[edi], dword [esi]
xchg edx, eax
pop edi
out 0xb1, eax
movsb byte es:[edi], byte [esi]
xor eax, 0x3481bb9
xchg ecx, eax
out dx, al
int3
call 0x61432c80
sub ebx, esp
cmp ah, ch
push 0xffffffffffffffcc
test al, 0x28
rol eax, cl
push es
ror byte [0xbbc5d206], 0x50
push es
jns 0x4c3898
add dl, bh
adc eax, 0xdab08fe3
xor dword [ebp + 0x28], ebp
inc edi
xor dh, byte [eax + 0x4d154312]
adc al, byte [ebx + 0x15]
dec ebp
invalid

Function at 0x5a5df2
Capabilities:
Encode data using xor

Disassembly:
pushal
sbb dword fs:[eax], ebp
loopne 0x5a5e13
add al, 0xb8
pop esi
mov edx, 0xc5a2ced2
add ebx, dword [eax + 0x798416e6]
retf 0x92b
sbb al, byte [ebx - 0x56]
xchg ecx, eax
and al, 0x9d
cmp eax, 0x54b5c096
sahf
outsd dx, dword [esi]
stosb byte es:[edi], al
cmp dl, ah
add al, 0x44
pushal
mov edi, 0x28e1d222
add dword [edx], ebp
invalid
Function at 0x631b51
Capabilities:
Encode data using xor

Disassembly:
cmp eax, dword [esi]
ret
xor ah, byte [ecx]
adc dh, ch
xor dword [ebx - 0x45c2d9ce], eax
xor dh, byte [eax + 0xd]
push 0x760cb3a5
xchg dword [ebp - 0x221038f2], esi
xor dh, byte [edi + esi*4 - 0x7bea581d]
jne 0x631be5
out dx, eax
fnsave dword [edx]
mov ah, 0xb7
jecxz 0x631b15
adc eax, 0x8737584
ret 0x1551
or dl, al
push ecx
adc eax, 0x82799546
push 0x2f3c9409
stosb byte es:[edi], al
lea edx, [esi]
fimul dword [esi]
salc
xor ebp, dword [ebx]
out 0x82, eax
inc ebp
push ebx
inc edi
salc
push esi
mov byte [0xcbb78164], al
push es
pop ds
jno 0x631b67
push ds
mov al, 0x52
daa
or esp, esp
inc edx
xor al, 0xcf
leave
push 0xcd48aac4
and al, 0xb3
lcall 0x83e1, 0xd31f8602
test eax, ecx
xor edi, esi
mov dword [0xf803b4c0], eax
jnp 0x631c1d
movsb byte es:[edi], byte [esi]
push esi
loopne 0x631be4
popal
mov dh, 0xb2
mov ebp, 0xa9880471
hlt
sti
sub edx, dword [esi]
inc ebx
neg byte [ebx - 0x4d0367cc]
mov byte [0x27b24252], al
mov cl, 0x56
sbb ah, byte [eax + esi*2 + 0x56]
lock adc byte es:[edi + 0x44], 0xf6
inc esi
inc esi
adc byte [edi + 0x6679f652], 0x90
std
dec esp
xchg esi, eax
fcmovnbe st(0), st(3)
fcom dword [edx]
out 0xd6, al
invalid
xor esi, esp
loop 0x631c00
inc edi
mov cl, 0xbd
test byte [edx + 0x52], 0x13
mov ebx, 0xbd02e8b6
stc
mov dword [0xad0a2180], eax
stosd dword es:[edi], eax
xchg byte [eax], dl
add al, 0x1e
into
retf

Function at 0x638c51
Capabilities:
Encode data using xor

Disassembly:
xor ah, ah
jle 0x638c70
add al, 0x53
add esi, 0xffffffec
or byte [edi], 0x26
jb 0x638cbb
ljmp 0x3927:0xf2e77637
dec ecx
mov edi, 0x2e96c348
invalid
Function at 0x2e013ece
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e03021f
call fcn.2e00153c
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014c10
test ax, ax
je 0x2e013f76
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e013f76
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f6d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e01784b
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e013f60
push esi
mov ecx, edi
call fcn.2e010c49
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e01784b
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e001586
ret

Function at 0x2e0149fe
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030292
call fcn.2e02e16c
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014b02
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e0148ed
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010b76
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014ac0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ab7
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e01784b
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e032941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014aa9
push esi
mov ecx, edi
call fcn.2e010c49
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e01784b
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014b02
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014af9
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e01784b
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e01784b
pop ecx
pop ecx
mov al, bl
call fcn.2e02e14a
ret 8
Function at 0x2e014b3c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e0302bf
call fcn.2e00153c
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014b76
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014bdc
lea eax, [ebp - 0x14]
mov edi, 0x2e032941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014bd3
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014bd3
inc eax
push eax
call fcn.2e01784b
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014bc5
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010c49
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e01784b
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001586
ret 8

Function at 0x2e01784b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x2e01785a
pop dword [ebp - 0x1c]
mov eax, 0x7585f823
add eax, 0xb87b8037
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xbc9b50a1
add dword [ebp - 0x2c], 0x91b6f4aa
mov dword [ebp - 0x28], 0x75efd4fe
sub dword [ebp - 0x28], 0x43bc88b9
mov dword [ebp - 0x24], 0x2c9c24bf
sub dword [ebp - 0x24], 0xe04fe091
mov dword [ebp - 0x20], 0x5d71060e
add dword [ebp - 0x20], 0xa28ef9f2
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xf2a99638
sub eax, 0xc4a67570
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x5c0ff3bf
sub dword [ebp - 0x2c], 0xe79d8a69
mov dword [ebp - 0x28], 0xba8bb265
add dword [ebp - 0x28], 0x86e0af10
mov dword [ebp - 0x24], 0xb08efa3a
sub dword [ebp - 0x24], 0x4d1f8dce
mov dword [ebp - 0x20], 0xb037aedd
sub dword [ebp - 0x20], 0xb037aedd
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x475d8519
add eax, 0xe6a59ba3
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d8bf
push 0
call eax
mov ecx, 0x399c
mov edx, eax
mov ebx, 0xceaa7e50
add ebx, 0x5f5aefb0
add ebx, dword [ebp - 0x1c]
mov edi, 0x35214809
add edi, 0x52199408
sub dword [ebp - 8], edx
mov esi, dword [ebx]
xor dword [ebp - 8], 0x94c7e4d8
add esi, edi
sub dword [ebp - 4], edx
mov dword [edx], esi
sub dword [ebp - 0x14], 0xeeabe29c
add edx, 4
add ebx, 0x75ff1aaf
sub ebx, 0x75ff1aab
loop 0x2e017976
add eax, 0xd943
mov ebx, eax
add eax, 0xcccffafb
add eax, 0x3330050a
mov ecx, 0x9a037499
add ecx, 0x93fc8b67
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x2e01e341
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030586
call fcn.2e02e16c
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e45f
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e456
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e01784b
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e449
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010c49
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e01784b
test al, al
jne 0x2e01e3fc
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e01784b
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e3ff
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e439
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e430
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e01784b
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e01784b
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e01784b
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e14a
ret
Function at 0x10007140
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x1000716d
push esi
push edi
jmp 0x10007150
movzx esi, byte [edx]
movzx esi, byte [esi + 0x10072618]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x10007150
pop edi
pop esi
ret

Function at 0x100071d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x100071f2
mov esi, 0x80
cmp esi, dword [edi]
jne 0x100071ff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1007ea04]
test eax, eax
je 0x1000720a
call eax
lea ecx, [esi*8]
push ecx
call fcn.10003dc0
mov esi, eax
mov eax, dword [0x1007ea08]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x1000722a
call eax
test esi, esi
je 0x100071f6
mov edx, dword [edi + 0xc]
push edx
call sym.sqlite3.dll_sqlite3_free
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x1007cc94]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.10067e10
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x1000730f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x100072a3
movzx edi, byte [esi]
movzx edi, byte [edi + 0x10072618]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x10007282
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x100072eb
mov esi, dword [eax]
test esi, esi
je 0x100072c1
mov edx, dword [eax + 4]
jmp 0x100072c3
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x100072eb
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x100072e3
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x10007304
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x10007304
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x100072fa
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x10007276
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0xc], 0
je 0x10007455
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, esi
test esi, esi
jle 0x1000744f
push ebx
lea esp, [esp]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10072618]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x10007430
mov edi, dword [ebp + 8]
pop ebx
xor edx, edx
div dword [edi]
jmp 0x10007457
xor edx, edx
mov eax, dword [ebp + 0xc]
push esi
push eax
mov eax, edi
call fcn.10007320
add esp, 8
pop edi
test eax, eax
je 0x10007470
mov eax, dword [eax + 8]
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10007480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x100074c9
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x100074be
nop
movzx esi, byte [ecx]
movzx esi, byte [esi + 0x10072618]
lea ebx, [eax*8]
xor esi, ebx
dec edx
xor eax, esi
inc ecx
test edx, edx
jg 0x100074a0
mov ebx, dword [ebp + 0xc]
xor edx, edx
div dword [edi]
mov esi, edx
mov dword [ebp - 4], esi
jmp 0x100074d3
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push eax
mov edx, esi
mov eax, edi
call fcn.10007320
add esp, 8
test eax, eax
je 0x10007516
mov ecx, dword [ebp + 0x10]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x10007504
mov edx, esi
mov ecx, edi
call fcn.100073c0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
je 0x100075aa
push 0x14
call fcn.10003dc0
mov esi, eax
mov eax, dword [ebp + 0x10]
add esp, 4
test esi, esi
je 0x100075ac
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], eax
inc dword [edi + 4]
mov eax, dword [edi + 4]
cmp eax, 0xa
jb 0x10007574
mov ecx, dword [edi]
add ecx, ecx
cmp eax, ecx
jbe 0x10007574
lea edx, [eax + eax]
push edx
push edi
call fcn.100071d0
add esp, 8
test eax, eax
je 0x10007574
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.10007140
xor edx, edx
div dword [edi]
mov dword [ebp - 4], edx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x10007591
mov ecx, dword [ebp - 4]
lea edx, [eax + ecx*8]
mov eax, esi
call fcn.10007170
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 8]
mov dword [esi], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x100075a0
mov dword [eax + 4], esi
mov dword [esi + 4], 0
mov dword [edi + 8], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009020
Capabilities:
Check if file exists
Check os version
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1007eabc]
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x234], ecx
mov edi, 0x114
cmp eax, ecx
jne 0x1000907c
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], edi
call esi
xor eax, eax
cmp dword [ebp - 0x108], 2
sete al
inc eax
mov dword [0x1007eabc], eax
cmp eax, 2
jne 0x10009088
call fcn.100075c0
jmp 0x1000908d
call fcn.10007760
mov ebx, eax
test ebx, ebx
jne 0x100090a7
pop edi
pop esi
lea eax, [ebx + 7]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065fcc
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1007eabc]
test eax, eax
jne 0x100090d1
lea ecx, [ebp - 0x22c]
push ecx
mov dword [ebp - 0x22c], edi
call esi
xor eax, eax
cmp dword [ebp - 0x21c], 2
sete al
inc eax
mov dword [0x1007eabc], eax
cmp eax, 2
jne 0x1000911e
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esp, [esp]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10009102
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x234], eax
cmp eax, 5
jne 0x10009162
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp eax, 5
jge 0x10009162
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100090e0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10009146
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x234], eax
cmp eax, 5
jne 0x10009162
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp eax, 5
jge 0x10009162
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10009124
push ebx
call fcn.10066401
add esp, 4
cmp esi, 0xffffffff
jne 0x1000918c
cmp dword [ebp - 0x234], 2
jne 0x1000918c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065fcc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0xa0a
pop ebx
call fcn.10065fcc
mov esp, ebp
pop ebp
ret
Function at 0x100094e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edx, [ebp - 0x110]
push edx
push 0x104
push ecx
push eax
mov dword [ebp - 0x348], 0x200
call fcn.10009340
add esp, 0x10
test eax, eax
jne 0x1000968e
mov eax, dword [0x1007eabc]
test eax, eax
jne 0x10009553
lea eax, [ebp - 0x340]
push eax
mov dword [ebp - 0x340], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x330], 2
sete al
inc eax
mov dword [0x1007eabc], eax
cmp eax, 2
jne 0x100095b1
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0xfde9
call edi
mov ebx, eax
lea edx, [ebx + ebx]
push edx
call fcn.1006643b
mov esi, eax
add esp, 4
test esi, esi
je 0x10009678
push ebx
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x110]
push eax
push 0
push 0xfde9
call edi
test eax, eax
jne 0x100095be
push esi
call fcn.10066401
add esp, 4
xor esi, esi
jmp 0x100095be
lea ebx, [ebp - 0x110]
call fcn.10007760
mov esi, eax
test esi, esi
je 0x10009678
mov eax, dword [0x1007eabc]
test eax, eax
jne 0x100095f8
lea ecx, [ebp - 0x228]
push ecx
mov dword [ebp - 0x228], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x218], 2
sete al
inc eax
mov dword [0x1007eabc], eax
cmp eax, 2
mov eax, esi
jne 0x10009636
cmp word [esi], 0
je 0x1000961b
cmp word [eax], 0x5c
je 0x10009616
add eax, 2
cmp word [eax], 0
jne 0x10009605
jmp 0x1000961b
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x344]
push eax
mov ecx, eax
push ecx
lea edx, [ebp - 0x348]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10009669
cmp byte [esi], 0
je 0x10009650
jmp 0x10009640
cmp byte [eax], 0x5c
je 0x1000964d
inc eax
cmp byte [eax], 0
jne 0x10009640
jmp 0x10009650
mov byte [eax], 0
lea ecx, [ebp - 0x344]
push ecx
mov edx, ecx
push edx
lea eax, [ebp - 0x348]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.10066401
add esp, 4
test edi, edi
jne 0x1000968e
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10065fcc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x348]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10065fcc
mov esp, ebp
pop ebp
ret
Function at 0x10009970
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
push 0x1007ec40
mov dword [0x1007ec40], eax
mov dword [0x1007ec44], eax
mov dword [0x1007ec48], eax
mov dword [0x1007ec4c], eax
mov dword [0x1007ec50], eax
mov dword [0x1007ec54], eax
mov dword [0x1007ec58], eax
mov dword [0x1007ec5c], eax
mov dword [0x1007ec60], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.10063550
test eax, eax
jne 0x10009a0b
push esi
cmp dword [0x1007cc74], eax
jne 0x100099c0
xor esi, esi
jmp 0x100099db
push 2
call dword [0x1007ccb0]
mov esi, eax
add esp, 4
test esi, esi
je 0x100099db
push esi
call dword [0x1007ccb8]
add esp, 4
mov edx, 0x1007ceb0
call fcn.10003470
mov eax, dword [0x1007ea00]
mov dword [0x1007cebc], eax
mov dword [0x1007ea00], 0x1007ceb0
test esi, esi
je 0x10009a07
push esi
call dword [0x1007ccc0]
add esp, 4
xor eax, eax
pop esi
ret
xor eax, eax
ret