joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a660
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x218], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 7
xor eax, eax
and dword [esi], eax
pop ecx
lea edi, [ebp - 0x234]
rep stosd dword es:[edi], eax
or dword [ebp - 0x238], 0xffffffff
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x101a6f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x101a6e9
mov dword [ebp - 0x210], eax
jmp 0x101a7b8
and eax, 0xffff
or eax, 0x80070000
jmp 0x101a6de
push 0x100802c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101a58f
mov dword [ebp - 0x210], eax
test eax, eax
jl 0x101a7b8
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x101a753
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100801c
push ebx
call esi
mov dword [ebp - 0x234], eax
test eax, eax
jne 0x101a76f
push 0x1008008
push ebx
call esi
mov dword [ebp - 0x220], eax
test eax, eax
jne 0x101a791
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101a767
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
jmp 0x101a7ac
push 0x1007ff8
push ebx
call esi
mov dword [ebp - 0x230], eax
test eax, eax
je 0x101a753
push 0x1007fe8
push ebx
call esi
mov dword [ebp - 0x224], eax
jmp 0x101a74f
mov eax, dword [ebp - 0x218]
mov edi, dword [ebp - 0x214]
push 8
mov dword [eax], ebx
pop ecx
lea esi, [ebp - 0x238]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
je 0x101a7b7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.0100b8d5
leave
ret 8
Function at 0x101aadb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x20e
xor ebx, ebx
push esi
lea eax, [ebp - 0x420]
push ebx
push eax
mov dword [ebp - 0x428], ebx
call sub.msvcrt.dll_memset
push 0x20a
lea eax, [ebp - 0x210]
push ebx
push eax
mov dword [ebp - 0x430], ebx
call sub.msvcrt.dll_memset
or dword [ebp - 0x424], 0xffffffff
add esp, 0x18
push ebx
lea eax, [ebp - 0x430]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push ebx
push ebx
push 0x4d0008
push edi
mov dword [ebp - 0x42c], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x101ab78
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x101ab6c
mov edi, eax
jmp 0x101ac6a
and eax, 0xffff
or eax, 0x80070000
jmp 0x101ab65
push 0x100211c
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0100a9c9
mov edi, eax
cmp edi, ebx
jl 0x101ac6a
movzx eax, word [ebp - 0x420]
shr eax, 1
push eax
lea eax, [ebp - 0x41e]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0101aa8b
mov edi, eax
cmp edi, ebx
jl 0x101ac6a
push 0x1008048
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0101a58f
mov edi, eax
cmp edi, ebx
jl 0x101ac6a
lea eax, [ebp - 0x42c]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0101a624
mov edi, eax
cmp edi, ebx
jl 0x101ac6a
mov esi, dword [ebp - 0x42c]
cmp esi, ebx
je 0x101ac6a
lea eax, [ebp - 0x424]
push eax
push 0x11
call fcn.0101a926
mov edi, eax
cmp edi, ebx
jl 0x101ac56
xor edi, edi
lea esi, [ebp + esi*2 - 0x212]
lea eax, [edi + 0x31]
mov word [esi], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x101ac3f
inc edi
cmp di, 3
jb 0x101ac1e
jmp 0x101ac49
mov dword [ebp - 0x428], 1
xor eax, eax
cmp dword [ebp - 0x428], ebx
sete al
mov edi, eax
cmp dword [ebp - 0x424], 0xffffffff
je 0x101ac6a
push dword [ebp - 0x424]
call fcn.0101aa3e
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b8d5
leave
ret 4
Function at 0x101ac82
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x70000
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x101acdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x101accf
mov esi, eax
jmp 0x101ad7c
and eax, 0xffff
or eax, 0x80070000
jmp 0x101acc8
mov esi, dword [ebp - 0xc]
push 4
add esi, 0x1ff
push 0x3000
and esi, 0xfffffe00
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, ebx
jne 0x101ad15
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101ad69
and eax, 0xffff
or eax, 0x80070000
jmp 0x101ad69
push ebx
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101ad4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x101ad3d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80310000
jne 0x101ad6b
xor esi, esi
jmp 0x101ad6b
push ebx
push dword [ebp - 4]
push edi
call fcn.0101e6fe
xor esi, esi
cmp eax, 2
je 0x101ad6b
inc esi
cmp eax, esi
jne 0x101ad6b
push dword [ebp + 8]
call fcn.0101aadb
mov esi, eax
cmp edi, ebx
je 0x101ad7c
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x101adc6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x328], ebx
mov byte [ebp - 0x321], bl
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x330], ebx
mov dword [ebp - 0x338], 4
cmp edi, ebx
je 0x101af31
lea eax, [ebp - 0x328]
push eax
push 0x20019
push ebx
push 0x10080d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101af31
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x320]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 2
push 2
push ebx
push ebx
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], 6
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 2
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x101aee5
xor eax, eax
push 0x1fe
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push ebx
push eax
mov dword [ebp - 0x32c], ebx
xor esi, esi
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
lea eax, [ebp - 0x32c]
push eax
push ebx
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x328]
mov dword [ebp - 0x334], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
cmp eax, ebx
jne 0x101aedc
cmp dword [ebp - 0x32c], 4
je 0x101af15
cmp eax, 0x103
jne 0x101ae9f
jmp 0x101af1c
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x330]
push eax
push ebx
push edi
push dword [ebp - 0x328]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101af1c
cmp dword [ebp - 0x330], 4
jne 0x101af1c
mov byte [ebp - 0x321], 1
pop esi
cmp dword [ebp - 0x328], ebx
je 0x101af31
push dword [ebp - 0x328]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x321]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100b8d5
leave
ret 4
Function at 0x101b007
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x50], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x48], eax
test edi, edi
jne 0x101b032
xor eax, eax
jmp 0x101b1b5
call fcn.0101b294
test eax, eax
je 0x101b1ad
push ebx
push 0
push edi
call fcn.01019413
movzx ebx, ax
test ebx, ebx
je 0x101b1ac
cmp ebx, 0x7f
je 0x101b1ac
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsValidLocale]
push 2
push ebx
call esi
test eax, eax
jne 0x101b097
cmp ebx, 4
jne 0x101b07a
push 1
push 0x804
jmp 0x101b08d
cmp ebx, 0x7c04
jne 0x101b1ab
push 1
push 0x404
call esi
test eax, eax
je 0x101b1ab
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x1004
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x101b1ab
lea eax, [ebp - 0x44]
push eax
call sub.msvcrt.dll__wtoi
push 2
pop ebx
push ebx
push edi
push 0x1005db0
mov dword [ebp - 0x4c], eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0x10
test eax, eax
jne 0x101b0f6
mov esi, 0x10081b0
cmp dword [ebp - 0x48], eax
je 0x101b15c
push 0x10081a0
push dword [ebp - 0x48]
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x101b1ab
jmp 0x101b15c
push ebx
push edi
push 0x1005f58
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x101b110
mov esi, 0x1008190
jmp 0x101b15c
push ebx
push edi
push 0x1005e70
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x101b12a
mov esi, 0x1008184
jmp 0x101b15c
push ebx
push edi
push 0x1005ef0
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x101b144
mov esi, 0x1008174
jmp 0x101b15c
push ebx
push edi
push 0x1005e10
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x101b166
mov esi, 0x100815c
push esi
call fcn.0101adc6
test al, al
je 0x101b1ab
cmp dword [ebp - 0x4c], 0
je 0x101b190
push ebx
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x101b1ab
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x101b1ab
push dword [ebp - 0x70]
jmp 0x101b198
cmp dword [ebp - 0x48], 0
je 0x101b1a4
push 1
push dword [ebp - 0x48]
call fcn.0101af4c
test eax, eax
je 0x101b1ab
mov dword [ebp - 0x50], 1
pop esi
pop ebx
call fcn.0101b29d
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100b8d5
leave
ret 8
Function at 0x101c331
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
xor esi, esi
xor eax, eax
cmp dword [ebp + 0x1c], esi
push edi
setne al
mov edi, 0x80
inc eax
mov dword [ebp + 0x1c], eax
add edi, edi
test esi, esi
je 0x101c364
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [edi + edi]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x101c3af
cmp dword [ebp + 0x18], 0
je 0x101c38f
push dword [ebp + 8]
push edi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x101c3b1
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x101c39b
mov eax, 0x1002ff4
push dword [ebp + 8]
push edi
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x101c3b1
xor eax, eax
mov ecx, edi
sub ecx, dword [ebp + 0x1c]
cmp eax, ecx
jae 0x101c352
cmp dword [ebp + 0x14], 0
jne 0x101c3d9
test esi, esi
je 0x101c3e6
test eax, eax
jne 0x101c3d9
push esi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x101c3d9
xor esi, esi
test esi, esi
je 0x101c3e6
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x101c3e6
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x101ce2c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x14], 0
push esi
push edi
mov esi, 0x1009fbc
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
test eax, eax
jne 0x101ce5c
inc eax
jmp 0x101cfff
push eax
call fcn.01011199
movzx esi, ax
xor eax, eax
cmp ax, si
jne 0x101ce76
mov eax, 0x80070057
jmp 0x101cfff
lea eax, [ebp - 0x14]
push eax
call fcn.0101c8bd
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x101cffc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea ecx, [esi - 0x61]
movzx edi, si
cmp cx, 0x19
lea ecx, [edi - 0x20]
jbe 0x101cea1
mov ecx, edi
mov edx, dword [ebp - 0x14]
cmp dword [edx + ecx*4 - 0x104], 0
jne 0x101ced2
push edi
push 0x1009f18
push 0x4000000
push 0x1023a14
call fcn.0100a7e5
add esp, 0x10
mov dword [ebp - 0x10], 1
jmp 0x101cff4
lea ecx, [esi - 0x61]
cmp cx, 0x19
lea ecx, [edi - 0x20]
jbe 0x101cee0
mov ecx, edi
push ebx
xor ebx, ebx
inc ebx
add ecx, 0xffffffbf
mov edx, ebx
shl edx, cl
test eax, edx
jne 0x101cf28
add esi, 0xffffff9f
lea eax, [edi - 0x20]
cmp si, 0x19
jbe 0x101cefd
mov eax, edi
mov ecx, dword [ebp - 0x14]
and dword [ecx + eax*4 - 0x104], 0
push edi
push 0x1009e30
push 0x3000000
push 0x1023a14
call fcn.0100a7e5
add esp, 0x10
mov dword [ebp - 0x10], ebx
jmp 0x101cff3
lea eax, [esi - 0x61]
cmp ax, 0x19
lea eax, [edi - 0x20]
jbe 0x101cf36
mov eax, edi
mov ecx, dword [ebp - 0x14]
push edi
push 0x1009dc0
mov ebx, 0x4000000
lea eax, [ecx + eax*4 - 0x104]
dec dword [eax]
push ebx
push 0x1023a14
call fcn.0100a7e5
lea eax, [esi - 0x61]
add esp, 0x10
cmp ax, 0x19
lea eax, [edi - 0x20]
jbe 0x101cf69
mov eax, edi
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + eax*4 - 0x104], 0
jne 0x101cff3
push 0
lea eax, [ebp - 0xc]
push eax
push 2
mov word [ebp - 0xc], si
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
je 0x101cfa2
push edi
push 0x1009d50
push ebx
push 0x1023a14
call fcn.0100a7e5
add esp, 0x10
jmp 0x101cff3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xffff
mov esi, 0x80070000
test eax, eax
jle 0x101cfbc
and eax, ebx
or eax, esi
test eax, eax
jge 0x101cfd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101cfcc
and eax, ebx
or eax, esi
mov dword [ebp - 0x10], eax
jmp 0x101cfd8
mov dword [ebp - 0x10], 0x80004005
push dword [ebp - 0x10]
push edi
push 0x1009cc0
push 0x2000000
push 0x1023a14
call fcn.0100a7e5
add esp, 0x14
pop ebx
push dword [ebp - 0x14]
call fcn.0101c9f3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100b8d5
leave
ret 4
Function at 0x101d0cc
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0x208
mov dword [ebp - 0x18], esi
cmp eax, esi
jne 0x101d0f8
mov eax, 0x80070057
jmp 0x101d22c
push ebx
push edi
mov dword [eax], esi
mov ebx, 0xffff
mov edi, 0x80070000
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push 8
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x101d14f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x101d137
and eax, ebx
or eax, edi
test eax, eax
jge 0x101d148
call esi
test eax, eax
jle 0x101d143
and eax, ebx
or eax, edi
mov dword [ebp - 4], eax
jmp 0x101d14f
mov dword [ebp - 4], 0x80004005
xor esi, esi
cmp dword [ebp - 4], esi
jl 0x101d1f4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0xc]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esi, eax
test esi, esi
jne 0x101d17f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x101d1bc
cmp esi, dword [ebp - 0x18]
jne 0x101d1bc
cmp dword [ebp - 0x14], 0
je 0x101d1bc
test esi, esi
jne 0x101d1c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101d19e
and eax, ebx
or eax, edi
test eax, eax
jge 0x101d1b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101d1ae
and eax, ebx
or eax, edi
mov dword [ebp - 4], eax
jmp 0x101d1c3
mov dword [ebp - 4], 0x80004005
jmp 0x101d1c3
mov dword [ebp - 0x10], 1
cmp dword [ebp - 4], 0
mov dword [ebp - 0x18], esi
jl 0x101d1f4
cmp dword [ebp - 0x10], 0
je 0x101d1f4
xor esi, esi
cmp dword [ebp - 8], esi
je 0x101d1ea
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add dword [ebp - 0xc], 0x208
mov dword [ebp - 8], esi
inc dword [ebp - 0x14]
xor esi, esi
cmp dword [ebp - 4], esi
jl 0x101d211
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x101d106
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ebp - 8], esi
pop edi
pop ebx
cmp dword [ebp - 8], esi
je 0x101d229
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
Function at 0x101e87c
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push edi
push 0x63
call esi
mov ebx, eax
cmp ebx, 0xc0000023
je 0x101e8ac
cmp ebx, edi
jl 0x101e920
mov ebx, 0xc0000001
jmp 0x101e920
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x101e8cf
mov ebx, 0xc000009a
jmp 0x101e907
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 0x63
call esi
mov ebx, eax
test ebx, ebx
jl 0x101e907
movzx eax, word [edi]
mov ecx, dword [ebp + 0x10]
add eax, 2
mov dword [ecx], eax
cmp eax, dword [ebp + 0xc]
jbe 0x101e8f8
mov ebx, 0xc0000023
jmp 0x101e907
push eax
push dword [edi + 4]
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x101e920
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x101e976
Capabilities:
Get process heap flags
Get storage device properties

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1023018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], esi
call fcn.0101f780
test al, al
jne 0x101e9a1
xor eax, eax
jmp 0x101eaec
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x10200b0
push 0x102008a
push esi
call fcn.0101ef74
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
test eax, eax
jl 0x101ead1
cmp dword [ebp - 0x40], 4
jb 0x101ead1
push dword [ebp - 0x3c]
shr dword [ebp - 0x40], 1
call sub.msvcrt.dll__wcslwr
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x1020054
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
call fcn.0100b940
add esp, 0x1c
cmp eax, 3
jne 0x101ead1
cmp dword [ebp - 0x54], esi
jne 0x101ead1
cmp dword [ebp - 0x4c], esi
jne 0x101ead1
cmp dword [ebp - 0x48], esi
jne 0x101ead1
lea eax, [ebp - 0x50]
push eax
push 0x1020012
call fcn.0101f0c0
test eax, eax
jl 0x101ead1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [ebp - 0x3c]
push esi
push dword [eax + 0x18]
call ebx
mov edx, dword [ebp - 0x50]
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa
stosd dword es:[edi], eax
pop ecx
xor eax, eax
push 0x28
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.0101f68c
cmp eax, esi
pop edi
jge 0x101ea8c
cmp eax, 0xc000003a
jmp 0x101ea90
cmp dword [ebp - 0x1c], 7
jne 0x101ead1
push 0x101ffd0
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x6c]
push eax
push 0x20001
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x6c], 0x18
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
cmp dword [ebp - 0x3c], esi
je 0x101eae8
push dword [ebp - 0x3c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call ebx
mov eax, dword [ebp - 0x44]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100b8d5
leave
ret
Function at 0x101eb2a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
push 0x1020012
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20001
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
mov ebx, eax
cmp ebx, edi
jge 0x101eba6
cmp ebx, 0xc0000017
je 0x101ec3a
cmp ebx, 0xc000009a
je 0x101ec3a
mov ebx, 0xc0000452
jmp 0x101ec3a
push dword [ebp - 4]
call fcn.0101eafe
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], edi
call esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov ebx, eax
cmp ebx, 0xc0000023
je 0x101ebe3
cmp ebx, edi
jl 0x101ec3a
mov ebx, 0xc0000001
jmp 0x101ec3a
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
add ecx, 2
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x101ec0b
mov ebx, 0xc000009a
jmp 0x101ec3a
mov dword [ebp - 0x10], eax
mov ax, word [ebp - 0xc]
mov word [ebp - 0x12], ax
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov ebx, eax
cmp ebx, edi
jl 0x101ec3a
movzx ecx, word [ebp - 0x14]
mov eax, dword [ebp - 8]
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 4], edi
je 0x101ec48
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp ebx, edi
jge 0x101ec67
cmp dword [ebp - 8], edi
je 0x101ec67
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4