joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100043b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x100043c8
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x100043bd
cmp dword [edi + 0x7c], ebx
je 0x100043d7
call fcn.100047a0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.10004120
add esp, 0xc
test eax, eax
je 0x100043fd
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push ebp
push 0x84
call fcn.1001d944
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x1000443f
push 0x4000
call fcn.1001d944
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
mov dword [ebp], eax
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
mov dword [ebp + 0x4c], ebx
jne 0x1000444b
push ebp
call fcn.1001d70a
add esp, 4
pop ebp
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [ebp + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [ebp + 0x64], edx
mov ecx, dword [edi]
mov dword [ebp + 0x60], ecx
mov edx, dword [edi + 0xc]
push esi
mov dword [ebp + 0x68], edx
cmp eax, ebx
mov dword [ebp + 0x18], ebx
jne 0x10004494
lea esi, [ebp + 4]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
call fcn.10003270
test eax, eax
jne 0x10004494
mov dword [ebp + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [ebp + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [ebp + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [ebp + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x100044be
mov cl, byte [edi + 0x39]
mov byte [ebp + 0x80], cl
jmp 0x100044c7
mov dl, byte [edi + 0x3f]
mov byte [ebp + 0x80], dl
mov al, byte [ebp + 0x6c]
mov esi, dword [esp + 0x20]
neg al
lea edx, [ebp + 0x70]
mov dword [edx], 0x12345678
mov dword [ebp + 0x74], 0x23456789
mov dword [ebp + 0x78], 0x34567890
sbb eax, eax
and eax, 0xc
cmp esi, ebx
mov dword [ebp + 0x7c], eax
je 0x10004503
mov cl, byte [esi]
cmp cl, bl
je 0x10004503
call fcn.10002fb0
add esi, 1
jne 0x100044f3
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [ebp + 0x3c], eax
mov dword [ebp + 8], ebx
pop esi
mov dword [edi + 0x7c], ebp
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x10004890
Capabilities:
Get common file path

Disassembly:
cmp dword [edi], 0
push esi
jne 0x1000491f
cmp dword [edi + 4], 0xffffffff
jne 0x1000491f
lea esi, [edi + 0x140]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100048b7
sub eax, edx
mov al, byte [eax + edi + 0x13f]
cmp al, 0x5c
je 0x100048e4
cmp al, 0x2f
je 0x100048e4
push 0x10129994
push 0x104
push esi
call fcn.1001da96
add esp, 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
lea esi, [esp + 0x14]
call fcn.100036d0
add esp, 8
test eax, eax
jne 0x10004906
mov eax, dword [esp + 0xc]
pop esi
ret 8
call fcn.10003aa0
mov dword [edi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop esi
ret 8
mov eax, 0x1000000
pop esi
ret 8
Function at 0x10008ff0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x30
push esi
push 0x40
mov esi, eax
push 0
push esi
mov dword [0x1013c114], 0
call fcn.10027680
add esp, 0xc
lea eax, [esp + 4]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009131
push ebx
push ebp
push edi
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x20]
push str.BuildLab
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.GetNativeSystemInfo
push str.kernel32.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.IsWow64Process
push str.kernel32.dll
mov ebp, eax
call edi
push eax
call ebx
mov edi, eax
test edi, edi
je 0x100090dd
push 0x1013c114
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [0x1013c114], 0
je 0x10009105
add esi, 0xffffffff
lea esp, [esp]
mov al, byte [esi + 1]
add esi, 1
test al, al
jne 0x100090b0
mov edx, dword [str._64_]
mov dword [esi], edx
mov al, byte [0x10129c9c]
mov byte [esi + 4], al
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
test ebp, ebp
je 0x1000909d
lea ecx, [esp + 0x1c]
push ecx
call ebp
mov ax, word [esp + 0x1c]
cmp ax, 9
je 0x100090f9
cmp ax, 6
jne 0x1000909d
mov dword [0x1013c114], 1
jmp 0x100090a6
add esi, 0xffffffff
mov al, byte [esi + 1]
add esi, 1
test al, al
jne 0x10009108
mov ecx, dword [str._32_]
mov eax, dword [esp + 0x10]
mov dword [esi], ecx
mov dl, byte [0x10129ca4]
push eax
mov byte [esi + 4], dl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret

Function at 0x10009140
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x90
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x8c], eax
push 0x40
push 0
push esi
call fcn.10027680
add esp, 0xc
lea eax, [esp]
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10009195
or eax, 0xffffffff
mov ecx, dword [esp + 0x8c]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x90
ret
push 0x7f
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.10027680
add esp, 0xc
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 4]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push str.ProcessorNameString
push edx
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10008ea0
test eax, eax
jg 0x100091f4
call fcn.10008f30
push eax
lea ecx, [esp + 0x10]
push ecx
push str._s___d_CPUs_
push 0x40
push esi
call fcn.1002093e
mov ecx, dword [esp + 0xa0]
add esp, 0x14
xor ecx, esp
xor eax, eax
call fcn.1001d3e9
add esp, 0x90
ret
Function at 0x100092b0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
push ebp
push 0x288
mov dword [esp + 0xc], 0x288
call fcn.1001d0f1
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x100093d1
lea eax, [esp + 8]
push eax
push ebp
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x10009304
push ebp
call fcn.1001d70a
mov ecx, dword [esp + 0xc]
push ecx
call fcn.1001d0f1
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10009304
lea eax, [ebp - 2]
pop ebp
add esp, 8
ret
lea edx, [esp + 8]
push edx
push ebp
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x100093c1
test ebp, ebp
push edi
mov edi, ebp
je 0x100093c0
push esi
jmp 0x10009330
xor esi, esi
cmp dword [edi + 0x190], esi
jle 0x100093b5
mov edi, edi
movzx ecx, byte [edi + esi + 0x194]
mov eax, ecx
shr eax, 4
and ecx, 0x8000000f
jns 0x1000935a
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp eax, 0xa
jge 0x10009363
add al, 0x30
jmp 0x10009365
add al, 0x37
cmp ecx, 0xa
mov byte [esp + 0xc], al
jge 0x10009373
add cl, 0x30
jmp 0x10009376
add cl, 0x37
push 2
lea eax, [esp + 0x10]
push eax
mov eax, ebx
mov byte [esp + 0x15], cl
call fcn.1000afc0
mov ecx, dword [edi + 0x190]
sub ecx, 1
cmp esi, ecx
push 1
mov eax, ebx
jge 0x100093a0
push str.:_
jmp 0x100093a5
push 0x10129d18
call fcn.1000afc0
add esi, 1
cmp esi, dword [edi + 0x190]
jl 0x10009340
mov edi, dword [edi]
test edi, edi
jne 0x10009330
pop esi
pop edi
push ebp
call fcn.100205c0
mov eax, dword [ebx + 0x14]
add esp, 4
test eax, eax
jne 0x100093d4
or eax, 0xffffffff
pop ebp
add esp, 8
ret

Function at 0x100093e0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x100], eax
push 0x40
push 0
push esi
call fcn.10027680
add esp, 0xc
push 0xff
lea eax, [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x1000943d
lea ecx, [esp]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1000943d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push 0x40
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push esi
call fcn.1001fb20
add esp, 0xc
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x104
ret
Function at 0x1000a730
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x100e6c36
mov eax, dword fs:[0]
push eax
mov eax, 0x81c4
call fcn.10033890
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x81bc], eax
push ebp
push esi
push edi
mov eax, dword [0x1012f5f0]
xor eax, esp
push eax
lea eax, [esp + 0x81d4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x81e4]
push 0x102
xor edi, edi
lea eax, [esp + 0xca]
push edi
push eax
mov word [esp + 0xd0], 0x30
call fcn.10027680
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc8]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xc4]
push 0x2e
push edx
call fcn.1001ef00
add esp, 8
cmp eax, edi
je 0x1000a99b
mov dword [eax], 0x7461642e
lea eax, [esp + 0xc4]
mov dword [esp + 0xc0], 0xf
mov dword [esp + 0xbc], edi
mov byte [esp + 0xac], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1000a7f0
sub eax, edx
push eax
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0xb0]
call fcn.1000f5f0
mov dword [esp + 0x81dc], edi
cmp dword [esp + 0xc0], 0x10
mov eax, dword [esp + 0xac]
jae 0x1000a82f
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or esi, 0xffffffff
cmp eax, esi
je 0x1000a97a
test al, 0x10
jne 0x1000a97a
cmp dword [esp + 0xc0], 0x10
mov eax, dword [esp + 0xac]
jae 0x1000a861
lea eax, [esp + 0xac]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.1000d040
mov byte [esp + 0x81dc], 1
cmp dword [esp + 0x68], edi
jne 0x1000a8b8
lea ecx, [esp + 0x6c]
mov byte [esp + 0x81dc], 0
call fcn.1000d150
lea edx, [esp + 0x6c]
push edx
mov dword [esp + 0x70], vtable.std::ios_base.0
call fcn.1001cd84
add esp, 4
lea ecx, [esp + 0xa8]
mov dword [esp + 0x81dc], esi
call fcn.1000af90
jmp 0x1000a99b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 4]
test byte [esp + ecx + 0x1c], 1
jne 0x1000a934
jmp 0x1000a8d0
lea edx, [esp + 0x1cc]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, 0x8000
call fcn.1000df90
mov esi, dword [esp + 0x18]
xor edx, edx
cmp esi, edi
jbe 0x1000a913
mov al, byte [esp + edx + 0x1cc]
mov cl, al
sar cl, 4
and cl, 0xf
shl al, 4
or al, cl
mov byte [esp + edx + 0x1cc], al
add edx, 1
cmp edx, esi
jb 0x1000a8f1
push esi
lea ecx, [esp + 0x1d0]
push ecx
mov eax, ebp
call fcn.1000afc0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
test byte [esp + eax + 0x1c], 1
je 0x1000a8d0
or esi, 0xffffffff
lea edi, [esp + 0x14]
call fcn.1000d1c0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x81dc], 0
call fcn.1000d150
lea ecx, [esp + 0x6c]
push ecx
mov dword [esp + 0x70], vtable.std::ios_base.0
call fcn.1001cd84
add esp, 4
lea ecx, [esp + 0xa8]
mov dword [esp + 0x81dc], esi
call fcn.1000af90
mov al, 1
jmp 0x1000a99d
mov dword [esp + 0x81dc], esi
cmp dword [esp + 0xc0], 0x10
jb 0x1000a99b
mov edx, dword [esp + 0xac]
push edx
call fcn.1001d705
add esp, 4
xor al, al
mov ecx, dword [esp + 0x81d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x81bc]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x81d0
ret
Function at 0x1000c360
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100e6c02
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1012f5f0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x10129ec4
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.1000dde0
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.1000f8c0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x1013c168]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov ecx, dword [esp + 0x2c]
push 0x22
mov byte [esp + 0x24], 2
call fcn.1000e640
test eax, eax
jne 0x1000c458
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x1000c451
or eax, 4
push ebx
push eax
call fcn.10005bc0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x1000d040
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100e6bb2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1012f5f0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x10129eb4
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.1000de70
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.1000f8c0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x1013c168]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov ecx, dword [esp + 0x2c]
push 0x21
mov byte [esp + 0x24], 2
call fcn.1000e640
test eax, eax
jne 0x1000d138
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x1000d131
or eax, 4
push ebx
push eax
call fcn.10005bc0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x1000f8c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x100e5feb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1012f5f0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1001c9cd
push 4
mov dword [esp + 0x20], 0
call fcn.1001dbd3
mov edi, eax
add esp, 4
test edi, edi
je 0x1000f940
call fcn.1001cc38
mov dword [edi], eax
call fcn.1001ca6c
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1001d162
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x1000f935
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.1001d183
jmp 0x1000f942
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x10013110
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
xor edi, edi
cmp byte [ebp], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edi
lea ebx, [edi + 1]
mov esi, ebp
je 0x100131b1
nop
movzx ecx, byte [esi]
push ecx
call fcn.1001fdde
add esp, 4
test eax, eax
jne 0x10013187
cmp byte [esi], 0x2e
je 0x1001318c
xor ebx, ebx
cmp edi, 3
jne 0x100131b1
test ebx, ebx
je 0x100131b1
lea edx, [esp + 0x14]
push 4
push edx
mov eax, ebp
call fcn.100195d0
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x10013197
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10013197
xor eax, eax
jmp 0x100131a3
cmp byte [esi], 0x2e
jne 0x1001318e
add edi, ebx
add esi, ebx
cmp byte [esi], 0
jne 0x10013140
jmp 0x10013157
xor eax, eax
cmp esi, 0xffffffff
setg al
lea eax, [eax + eax - 1]
xor ecx, ecx
cmp eax, 1
setge cl
mov eax, ecx
test eax, eax
jne 0x100131c6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x2c
ret
mov edi, dword [0x10138fd4]
cmp edi, fcn.1001d944
lea edx, [esp + 0x14]
mov word [esp + 0x26], 4
mov dword [esp + 0x2c], edx
jne 0x100131ee
push ebp
call fcn.100208ee
add esp, 4
jmp 0x1001322a
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100131f3
sub eax, edx
mov esi, eax
cmp esi, 0xffffffff
jae 0x10013228
add esi, 1
cmp esi, 0xffffffff
jae 0x10013228
push esi
call edi
mov edi, eax
add esp, 4
test edi, edi
je 0x10013228
push esi
push ebp
push edi
call fcn.10024b20
add esp, 0xc
mov eax, edi
jmp 0x1001322a
xor eax, eax
test eax, eax
mov dword [esp + 0x1c], eax
je 0x10013272
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push 0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
push 0
push eax
mov dword [esp + 0x40], 0
mov word [esp + 0x34], 2
mov dword [esp + 0x38], ecx
call fcn.10009c80
mov ecx, dword [esp + 0x2c]
push ecx
call dword [0x10138fdc]
add esp, 0x14
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1001d3e9
add esp, 0x2c
ret
Function at 0x10013290
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x214], eax
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov byte [esp + 0x10], 0
call fcn.10019e80
cmp eax, 3
jne 0x10013326
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001333b
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x118]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.DatabasePath
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001333b
cmp eax, 2
jne 0x10013388
push 0x104
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x10]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x10013342
mov edx, dword [str.hosts]
mov cx, word [0x1012a230]
mov dword [eax], edx
mov dl, byte [0x1012a232]
mov word [eax + 4], cx
mov byte [eax + 6], dl
mov eax, str..onion
mov ecx, esi
call fcn.1001ae90
test eax, eax
jne 0x10013388
mov eax, str..onion.
mov ecx, esi
call fcn.1001ae90
test eax, eax
je 0x100133a3
mov eax, 4
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x218
ret
push ebp
lea eax, [esp + 0x14]
push 0x1012a234
push eax
call fcn.1002141c
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10013406
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
ja 0x100133e4
lea eax, [ebp + 4]
pop ebp
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x218
ret
pop ebp
mov dword [ebx], 0
mov eax, 0xe
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x218
ret
mov ecx, dword [esp + 0x224]
push edi
push ebx
push ecx
push ebp
call fcn.1001a200
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10013484
jmp 0x10013425
mov esi, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [edx]
push esi
push eax
call fcn.10032868
add esp, 8
test eax, eax
je 0x10013484
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov eax, dword [esi]
test eax, eax
je 0x10013465
mov ecx, dword [esp + 0x10]
push ecx
push eax
call fcn.10032868
add esp, 8
test eax, eax
je 0x10013460
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x10013442
jmp 0x10013465
cmp dword [esi], 0
jne 0x10013484
mov edi, dword [ebx]
call fcn.1001af20
mov edx, dword [esp + 0x228]
push ebx
push edx
push ebp
call fcn.1001a200
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10013421
push ebp
call fcn.1001f431
add esp, 4
cmp edi, 0xd
jne 0x10013499
mov edi, 4
jmp 0x1001349d
test edi, edi
je 0x100134a3
mov dword [ebx], 0
mov ecx, dword [esp + 0x220]
mov eax, edi
pop edi
pop ebp
pop esi
xor ecx, esp
call fcn.1001d3e9
add esp, 0x218
ret