joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a906
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x102e050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x80070057
test edi, edi
je 0x100a98c
test esi, esi
je 0x100a98c
push edi
call fcn.010096cc
mov ebx, eax
test ebx, ebx
je 0x100a987
lea ecx, [ebp - 0xc]
call fcn.0101ce9b
push ebx
push esi
lea eax, [ebp - 0xc]
push 0x100202c
push eax
call fcn.0101d4ed
mov ebx, eax
add esp, 0x10
test ebx, ebx
jl 0x100a97d
push 1
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100a97d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x100a97d
call fcn.01005299
mov ebx, eax
lea ecx, [ebp - 0xc]
call fcn.0101cff5
jmp 0x100a98c
mov ebx, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01007c80
leave
ret 8
Function at 0x100abed
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x102e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
push esi
push eax
call ebx
test eax, eax
jne 0x100ad77
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x20
jne 0x100ad5f
lea ecx, [ebp - 0x24]
call fcn.0101ce9b
lea ecx, [ebp - 0x1c]
call fcn.0101ce9b
lea ecx, [ebp - 0x14]
call fcn.0101ce9b
lea ecx, [ebp - 0xc]
call fcn.0101ce9b
call fcn.01005299
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.0101ec28
mov edi, eax
test edi, edi
jl 0x100ad3d
lea eax, [ebp - 0x14]
push eax
call fcn.01009545
mov edi, eax
test edi, edi
jl 0x100ad3d
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
call fcn.0101d352
mov edi, eax
test edi, edi
jl 0x100ad3d
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.0101d26a
mov edi, eax
test edi, edi
jl 0x100ad3d
push 0x1002048
lea ecx, [ebp - 0xc]
call fcn.0101d26a
mov edi, eax
test edi, edi
jl 0x100ad3d
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
call fcn.0101d26a
mov edi, eax
test edi, edi
jl 0x100ad3d
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push dword [ebp - 8]
push esi
call edi
test eax, eax
je 0x100ad08
push 4
push 0
push dword [ebp - 8]
call edi
test eax, eax
je 0x100ad08
push dword [ebp + 0x10]
push esi
push dword [ebp - 0x28]
call ebx
test eax, eax
je 0x100acff
xor edi, edi
jmp 0x100ad3d
call fcn.01005299
mov edi, eax
jmp 0x100ad3d
call fcn.01005299
mov edi, eax
test esi, esi
je 0x100ad3d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100ad18
sub eax, edx
sar eax, 1
cmp eax, 2
jbe 0x100ad3d
cmp word [esi], 0x5c
jne 0x100ad3d
cmp word [esi + 2], 0x5c
jne 0x100ad3d
mov edi, 0x80070020
lea ecx, [ebp - 0xc]
call fcn.0101cff5
lea ecx, [ebp - 0x14]
call fcn.0101cff5
lea ecx, [ebp - 0x1c]
call fcn.0101cff5
lea ecx, [ebp - 0x24]
call fcn.0101cff5
jmp 0x100ad73
call edi
cmp eax, 0x50
jne 0x100ad6c
cmp dword [ebp + 0x10], 0
jne 0x100ad77
call fcn.01005299
mov edi, eax
test edi, edi
jl 0x100ad7c
xor eax, eax
inc eax
jmp 0x100ad88
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007c80
leave
ret 0xc
Function at 0x100b82f
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
mov esi, 0x80070057
cmp dword [ebp + 8], edi
je 0x100b918
cmp dword [ebp + 0xc], edi
je 0x100b918
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x100b878
call edi
mov esi, eax
test esi, esi
jne 0x100b8ad
push ebx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], eax
call fcn.0100b24f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100b899
push 0xe
pop esi
jmp 0x100b8ad
push eax
push ebx
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x100b8ad
call edi
mov esi, eax
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
pop ebx
test esi, esi
jne 0x100b902
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x10015ec
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x100b8d9
call edi
mov esi, eax
jmp 0x100b8e2
cmp dword [ebp - 8], 0
jne 0x100b8e6
push 0x57
pop esi
test esi, esi
jne 0x100b902
mov eax, dword [ebp - 0xc]
cmp eax, 0x34
jb 0x100b8f1
push 0x34
pop eax
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
test esi, esi
jle 0x100b910
and esi, 0xffff
or esi, 0x80070000
lea ecx, [ebp - 4]
call fcn.0100b24f
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x100b9b5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call fcn.0100b24f
lea eax, [ebp - 0x10]
push eax
push 0x80000002
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp eax, ebx
jne 0x100ba61
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push 0x20019
push ebx
push 0x1002150
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x100ba61
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea ecx, [ebp - 0xc]
push ecx
push ebx
lea ecx, [ebp - 0x18]
push ecx
push ebx
mov edi, 0x1002134
push edi
push eax
call esi
cmp eax, ebx
jne 0x100ba60
push dword [ebp - 0xc]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0x14], eax
call fcn.0100b24f
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
cmp ecx, ebx
jne 0x100ba4f
push 0xe
pop eax
jmp 0x100ba60
mov eax, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
push ecx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push edi
push eax
call esi
pop edi
push eax
call fcn.010052b3
mov esi, eax
cmp esi, ebx
jl 0x100bad4
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x100baa1
cmp word [eax], bx
je 0x100baa1
mov edx, dword [ebp - 4]
push 0x24
pop ecx
mov word [edx + 2], cx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0101d352
mov esi, eax
cmp esi, ebx
jl 0x100bad4
mov ecx, dword [ebp + 0xc]
push 0x10015ec
call fcn.0101d26a
jmp 0x100baae
mov ecx, dword [ebp + 0xc]
push 0x1001a60
call fcn.0101d352
mov esi, eax
cmp esi, ebx
jl 0x100bad4
push dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
call fcn.0101d26a
mov esi, eax
cmp esi, ebx
jl 0x100bad4
mov ecx, dword [ebp + 0xc]
push 0x100211c
call fcn.0101d26a
mov esi, eax
lea ecx, [ebp - 4]
call fcn.0100b24f
lea ecx, [ebp - 8]
call fcn.0100ae9c
lea ecx, [ebp - 0x10]
call fcn.0100ae9c
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x100bc51
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.0100baf9
cmp eax, esi
mov dword [ebp - 4], eax
jl 0x100bd7b
mov eax, dword [ebp - 0xc]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push esi
push 3
push esi
push esi
mov ebx, 0x10000000
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
call edi
mov dword [ebp - 0x14], eax
cmp eax, reloc.NETAPI32.dll_NetApiBufferFree
je 0x100bd68
push esi
push esi
push 2
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call edi
mov dword [ebp - 0x10], eax
cmp eax, reloc.NETAPI32.dll_NetApiBufferFree
je 0x100bd42
mov edi, 0x10000
push edi
mov dword [ebp + 8], esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
lea ecx, [ebp + 8]
mov ebx, eax
call fcn.0100b24f
mov dword [ebp + 8], ebx
cmp ebx, esi
je 0x100bd28
push esi
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100bd14
cmp dword [ebp + 0xc], esi
je 0x100bd1c
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100bd1c
call fcn.01005299
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jl 0x100bd2f
cmp dword [ebp + 0xc], esi
jne 0x100bce5
jmp 0x100bd2f
mov dword [ebp - 4], reloc.NETAPI32.dll_NetApiBufferFree
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 8]
call fcn.0100b24f
jmp 0x100bd5d
call fcn.01005299
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push eax
push 0xc002004f
push 1
push 1
call fcn.0100d0dd
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100bd70
call fcn.01005299
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
Function at 0x100bf11
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
mov esi, 0x80070057
cmp dword [ebp + 0x10], edi
je 0x100bfc0
lea ecx, [ebp - 4]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call fcn.0100b24f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
cmp eax, edi
jne 0x100bf99
cmp dword [ebp - 0xc], 1
jne 0x100bf7f
push ebx
push dword [ebp - 8]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
lea ecx, [ebp - 4]
mov ebx, eax
call fcn.0100b24f
mov dword [ebp - 4], ebx
cmp ebx, edi
pop ebx
jne 0x100bf83
push 0xe
pop eax
jmp 0x100bf9b
push 0x57
jmp 0x100bf7c
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, edi
jle 0x100bfa5
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x100bfb8
push dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
call fcn.0101d352
mov esi, eax
lea ecx, [ebp - 4]
call fcn.0100b24f
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x100d71e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x100239c
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
and dword [ebp - 4], 0
add esi, 0x10
mov dword [ebp - 8], esi
test esi, esi
je 0x100d768
mov ecx, esi
call fcn.0101d7f5
mov dword [ebp - 4], eax
test esi, esi
je 0x100d768
xor eax, eax
cmp dword [ebp - 4], esi
sete al
test eax, eax
jne 0x100d768
lea ecx, [ebp - 8]
call fcn.0100f1c7
mov esi, dword [ebp - 8]
jmp 0x100d74b
pop esi
leave
ret
Function at 0x100e381
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x102e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x48], eax
mov edi, 0x80070057
cmp eax, esi
je 0x100e54e
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [eax], esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
push esi
push esi
push esi
push dword [ebx + 0x10]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push eax
call fcn.010052b3
lea ecx, [ebp - 0x34]
mov edi, eax
mov dword [ebp - 0x34], esi
call fcn.0100b24f
cmp edi, esi
mov dword [ebp - 0x34], esi
jl 0x100e41c
mov eax, dword [ebp - 0x44]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], eax
call fcn.0100b24f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
cmp eax, esi
jne 0x100e41c
mov edi, 0x8007000e
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x40], esi
jbe 0x100e536
cmp edi, esi
jl 0x100e536
mov eax, dword [ebp - 0x44]
push esi
push esi
push esi
inc eax
push esi
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebx + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
call fcn.010052b3
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x3c], esi
jl 0x100e47b
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push esi
push dword [ebp - 0x34]
push dword [ebx + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.010052b3
mov edi, eax
lea ecx, [ebp - 0xc]
call fcn.0101ce9b
cmp edi, esi
jl 0x100e4f7
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x3c]
mov ecx, ebx
call fcn.0100d4e1
mov edi, eax
cmp edi, esi
jl 0x100e4f7
push dword [0x102e3c0]
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100e4f7
push dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
call fcn.0100db38
mov edi, dword [ebp - 0x10]
cmp edi, esi
jl 0x100e4ef
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
mov ecx, ebx
call fcn.0100d7ea
mov edi, eax
cmp edi, esi
jl 0x100e4ef
lea ecx, [ebp - 0x30]
call fcn.0100d71e
push dword [ebx + 8]
lea ecx, [ebp - 0x30]
call fcn.0100d6a8
mov edi, eax
cmp edi, esi
je 0x100e51e
lea ecx, [ebp - 0x30]
call fcn.0100d68d
cmp dword [ebp - 0x3c], esi
je 0x100e505
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
call fcn.0101cff5
inc dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x40]
jb 0x100e428
jmp 0x100e536
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
lea ecx, [ebp - 0x30]
call fcn.0100d68d
lea ecx, [ebp - 0xc]
call fcn.0101cff5
lea ecx, [ebp - 0x34]
call fcn.0100b24f
cmp edi, esi
jl 0x100e54e
mov eax, dword [ebp - 0x48]
cmp dword [eax], esi
jne 0x100e54e
mov edi, 0x8007138f
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007c80
leave
ret 4
Function at 0x100e6b1
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
push 0xf003f
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x100e7e7
push 0xf01ff
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x100e7b0
push edi
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100e70b
mov dword [ebp + 8], ebx
jmp 0x100e714
call edi
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x100e793
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x100e751
cmp dword [ebp - 0x24], 4
jne 0x100e77d
cmp esi, ebx
je 0x100e737
cmp word [esi], bx
jne 0x100e73c
mov esi, 0x1002484
push ebx
push esi
push dword [ebp + 0xc]
push 0x40020041
push 7
push 4
call fcn.0100d069
jmp 0x100e7a4
call edi
mov dword [ebp + 8], eax
cmp esi, ebx
je 0x100e761
mov eax, esi
cmp word [esi], bx
jne 0x100e766
mov eax, 0x1002484
push eax
push 0x100245c
push dword [ebp + 8]
push 0xc0020040
push 7
push 1
call fcn.0100d0dd
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
cmp dword [ebp - 4], 6
jb 0x100e717
jmp 0x100e7a4
cmp eax, 0x424
je 0x100e7a1
cmp eax, 0x420
jne 0x100e7a4
mov dword [ebp + 8], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
jmp 0x100e7dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
cmp esi, ebx
je 0x100e7c2
cmp word [esi], bx
jne 0x100e7c7
mov esi, 0x1002484
push esi
push 0x1002444
push eax
push 0xc0020040
push 7
push 1
call fcn.0100d0dd
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100e813
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
cmp esi, ebx
je 0x100e7f9
cmp word [esi], bx
jne 0x100e7fe
mov esi, 0x1002484
push esi
push 0x1002428
push eax
push 0xc0020040
push 7
push 1
call fcn.0100d0dd
mov eax, dword [ebp + 8]
pop esi
pop ebx
leave
ret 8
Function at 0x100efd5
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor ecx, ecx
push 2
mov eax, 0x1f4
pop edx
mov esi, eax
xor edi, edi
mul edx
seto cl
mov dword [ebp - 4], edi
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x100f012
mov dword [ebp - 4], reloc.NETAPI32.dll_NetApiBufferFree
jmp 0x100f0ec
push dword [ebp + 8]
push esi
push dword [ebp - 8]
push edi
push edi
push dword [0x102e3dc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, edi
je 0x100f06d
lea ecx, [esi - 2]
cmp eax, ecx
jb 0x100f074
push dword [ebp - 8]
add esi, 0x200
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x100f066
mov dword [ebp - 4], reloc.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 4], edi
jge 0x100f012
jmp 0x100f074
mov dword [ebp - 4], reloc.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 4], edi
jl 0x100f0ec
mov esi, dword [ebp - 8]
mov dword [ebp - 4], 0x80004005
cmp word [esi], di
je 0x100f0ec
push ebx
jmp 0x100f08d
xor edi, edi
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x100f092
sub eax, edx
sar eax, 1
mov ebx, eax
xor eax, eax
lea edi, [esi + ebx*2]
mov word [edi - 2], ax
lea eax, [esi + 2]
push eax
push dword [ebp + 0xc]
call fcn.0100eead
test eax, eax
jne 0x100f0c5
lea esi, [edi + 2]
cmp word [esi], ax
jne 0x100f08b
jmp 0x100f0eb
push 0x22
pop eax
push dword [ebp + 0x14]
mov word [esi + ebx*2 - 2], ax
push dword [ebp + 0x10]
push esi
push dword [0x102e3dc]
push dword [ebp + 8]
call fcn.0100ef9d
cmp eax, 1
jne 0x100f0eb
and dword [ebp - 4], 0
pop ebx
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
leave
ret 0x10

Function at 0x100f103
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push 0
push 0
call esi
mov edi, eax
test edi, edi
je 0x100f175
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
pop ecx
test ebx, ebx
je 0x100f16e
push edi
push ebx
call esi
test eax, eax
je 0x100f15e
mov ecx, dword [ebp + 8]
push ebx
call fcn.0101d352
mov esi, eax
test esi, esi
jl 0x100f165
mov ecx, dword [ebp + 8]
push 0x10027c4
call fcn.0101d26a
jmp 0x100f163
call fcn.01005299
mov esi, eax
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x100f17c
mov esi, 0x8007000e
jmp 0x100f17c
call fcn.01005299
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1010566
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102e050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
and dword [edi], 0
mov esi, 0x104
push esi
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x10105a3
call fcn.01005299
test eax, eax
jl 0x1010605
push 0x1002808
push esi
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call fcn.010104f0
test eax, eax
jl 0x1010605
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10105c2
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [edi], eax
test eax, eax
je 0x1010600
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push esi
push eax
call fcn.0100a4de
jmp 0x1010605
mov eax, 0x8007000e
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01007c80
leave
ret 4

Function at 0x1011ca3
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x102e050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp eax, ebx
je 0x1011d55
mov eax, dword [eax + 0x20]
cmp eax, ebx
je 0x1011d55
cmp word [eax], bx
je 0x1011d55
lea ecx, [ebp - 0xc]
call fcn.0101ce9b
push dword [edi + 4]
lea ecx, [ebp - 0xc]
call fcn.0101d352
mov ebx, eax
xor edi, edi
cmp ebx, edi
jl 0x1011d44
push 0x10015ec
lea ecx, [ebp - 0xc]
call fcn.0101d26a
mov ebx, eax
cmp ebx, edi
jl 0x1011d44
push dword [esi + 0x34]
lea ecx, [ebp - 0xc]
call fcn.0101d26a
mov ebx, eax
cmp ebx, edi
jl 0x1011d44
mov eax, dword [esi + 0x3c]
push edi
push dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1011d44
call fcn.01005299
push edi
push edi
push dword [esi + 0x3c]
mov ebx, eax
push 0xc0020051
push 7
push 1
call fcn.0100d069
lea ecx, [ebp - 0xc]
call fcn.0101cff5
cmp ebx, edi
jge 0x1011d55
mov eax, dword [esi]
mov dword [eax + 0x20], edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01007c80
leave
ret 4

Function at 0x1012472
Capabilities:
Create directory

Disassembly:
mov ecx, dword [ecx + 0x1c]
push esi
xor esi, esi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10124a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10124a1
cmp eax, esi
jle 0x101249f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, esi
pop esi
ret
Function at 0x1018300
Capabilities:
Create directory

Disassembly:
mov ecx, dword [ecx + 0x24]
push esi
xor esi, esi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x101832f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x101832f
cmp eax, esi
jle 0x101832d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, esi
pop esi
ret
Function at 0x101d5db
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x102e050]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0x12
je 0x101d616
push 0x5c
pop eax
mov word [ebp - 0x28], ax
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x101d62e
call fcn.01005299
test eax, eax
jl 0x101d639
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.0101d352
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01007c80
leave
ret 8