joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10183dd
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1034c1c]
push ebx
push esi
xor ebx, ebx
push 4
pop esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
cmp eax, ebx
je 0x1018549
cmp dword [eax + 0xc], ebx
je 0x1018549
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x20007
push ebx
push ebx
push ebx
push 0x10119e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101853b
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1011a98
push dword [ebp - 4]
call edi
cmp eax, 2
jne 0x101845c
mov dword [ebp - 8], ebx
jmp 0x101846d
cmp eax, ebx
jne 0x101853a
cmp dword [ebp - 0xc], esi
jne 0x101853a
mov eax, dword [0x1034c1c]
mov edx, dword [eax + 0xc]
mov ecx, dword [edx + 0x48]
sub ecx, dword [edx + 0x4c]
mov ebx, 0x1011a7c
mov edx, ecx
sub edx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], edx
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
mov eax, edx
imul eax, dword [ebp - 8]
add eax, ecx
lea ecx, [edx + 1]
xor edx, edx
div ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp - 4]
call edi
cmp eax, 2
jne 0x10184c5
and dword [ebp - 0x14], 0
jmp 0x10184ce
test eax, eax
jne 0x1018538
cmp dword [ebp - 0xc], esi
jne 0x1018538
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0x1011a98
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1018538
push esi
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0x1011a60
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1018538
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push 0
push 0x1011a44
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1018538
push esi
lea eax, [ebp - 0x18]
push eax
push esi
push 0
push ebx
push dword [ebp - 4]
call edi
test eax, eax
jne 0x1018538
mov dword [ebp - 0x1c], 1
xor ebx, ebx
pop edi
cmp dword [ebp - 4], ebx
je 0x1018549
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1c]
pop esi
pop ebx
leave
ret
Function at 0x1018555
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x1033f70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
xor ebx, ebx
push 0xa8
mov word [ebp - 0xb0], ax
lea eax, [ebp - 0xae]
push ebx
push eax
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xc0], edi
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb8], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbc], ebx
cmp esi, ebx
jne 0x10185bc
xor eax, eax
jmp 0x10186e9
mov dword [esi], ebx
cmp edi, ebx
je 0x10185c4
mov dword [edi], ebx
push ebx
push 0x55
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
test eax, eax
je 0x10186e3
lea eax, [ebp - 0xb0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10185ef
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0xb4]
push eax
push ebx
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xb0]
push eax
push 8
call dword [sym.imp.ntdll.dll_RtlGetSystemPreferredUILanguages]
test eax, eax
jl 0x10186e3
cmp dword [ebp - 0xb8], ebx
jne 0x1018637
mov dword [ebp - 0xb4], 1
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0xb4]
mov eax, dword [eax + 0x30]
lea ecx, [edi + ecx + 1]
add ecx, ecx
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
je 0x10186e3
lea ebx, [edi + edi + 2]
push ebx
lea eax, [ebp - 0xb0]
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp - 0xb8], 0
je 0x10186a4
lea eax, [ebp - 0xb4]
push eax
add ebx, esi
push ebx
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xb0]
push eax
push 8
call dword [sym.imp.ntdll.dll_RtlGetSystemPreferredUILanguages]
test eax, eax
jl 0x10186ce
mov eax, dword [ebp - 0xc4]
mov dword [eax], esi
mov eax, dword [ebp - 0xc0]
test eax, eax
je 0x10186c2
mov ecx, dword [ebp - 0xb4]
lea ecx, [edi + ecx + 1]
mov dword [eax], ecx
mov dword [ebp - 0xbc], 1
jmp 0x10186e3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101c23d
leave
ret 8
Function at 0x101871a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
jne 0x1018735
xor eax, eax
jmp 0x10187ad
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1018740
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, ebx
jne 0x10187b2
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 8
call edi
test eax, eax
je 0x10187a9
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
je 0x10187a9
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 8
call edi
test eax, eax
jne 0x1018821
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10187b5
sub eax, edx
sar eax, 1
add eax, 2
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x30]
add ecx, ecx
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, ebx
je 0x10187a9
mov eax, dword [ebp - 4]
lea eax, [eax + eax - 2]
push eax
push dword [ebp + 0xc]
mov edi, esi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp word [esi], bx
je 0x1018821
push 0x2c
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x1018821
xor eax, eax
mov word [edi], ax
inc edi
inc edi
cmp word [edi], bx
jne 0x1018804
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1018832
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor ebx, ebx
inc ebx
jmp 0x10187a9
Function at 0x10190fb
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x1033f70]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
or dword [ebp - 0x668], 0xffffffff
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101e3e2
test eax, eax
je 0x1019302
push ebx
push esi
call fcn.0101fc22
mov esi, eax
mov dword [ebp - 0x66c], esi
test esi, esi
je 0x10192d5
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10192d5
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10192d5
mov ebx, dword [eax + 0xc]
lea eax, [ebp - 0x20c]
push eax
push 0x1011ad8
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.01018ea1
add esp, 0x10
test eax, eax
jl 0x10192e1
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x10192e1
push 4
pop esi
mov ecx, 0x1011ad4
lea eax, [ebp - 0x638]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10191f9
test dx, dx
je 0x10191f5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10191f9
add eax, esi
add ecx, esi
test dx, dx
jne 0x10191d5
xor eax, eax
jmp 0x10191fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10192b2
mov ecx, 0x1011acc
lea eax, [ebp - 0x638]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1019235
test dx, dx
je 0x1019231
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1019235
add eax, esi
add ecx, esi
test dx, dx
jne 0x1019211
xor eax, eax
jmp 0x101923a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10192b2
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1011ac0
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.01018ea1
add esp, 0x14
test eax, eax
jl 0x10192b2
test byte [ebp - 0x664], 0x10
jne 0x101927d
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10192b2
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x638]
push 0x1011ab4
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
cmp eax, 1
jne 0x10192a6
cmp dword [ebp - 0x670], ebx
je 0x10192b2
lea eax, [ebp - 0x414]
push eax
call fcn.0101e5b8
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10191ca
mov esi, dword [ebp - 0x66c]
jmp 0x10192e1
lea eax, [ebp - 0x20c]
push eax
call fcn.0101e5b8
test esi, esi
je 0x10192eb
push esi
call fcn.0101ff94
cmp dword [ebp - 0x668], 0xffffffff
pop esi
pop ebx
je 0x1019302
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0101c23d
leave
ret
Function at 0x1019f19
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp dword [ebp + 8], eax
je 0x1019fbe
lea eax, [ebp - 4]
push eax
push 0x7fffffff
push dword [ebp + 8]
call fcn.0101904c
test eax, eax
jl 0x1019fbe
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
mov esi, dword [ebp - 4]
lea ecx, [esi + esi + 2]
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x1019fbc
push dword [ebp + 8]
inc esi
push esi
push ebx
call fcn.01018f00
test eax, eax
jl 0x1019fa7
push esi
push ebx
call sub.msvcrt.dll__wcsupr_s
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.01019ba4
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp ecx, dword [edi + 0x18]
setne al
mov dword [ebp - 8], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop esi
pop ebx
mov eax, dword [ebp - 8]
pop edi
leave
ret 4
Function at 0x101ac8d
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
jne 0x101aca5
xor eax, eax
jmp 0x101ad00
lea eax, [ebp - 4]
push eax
push 0x7fffffff
push dword [ebp + 8]
call fcn.0101904c
test eax, eax
jl 0x101aca1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
mov esi, dword [ebp - 4]
lea ecx, [esi + esi + 2]
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 8], eax
test eax, eax
je 0x101aced
push dword [ebp + 8]
inc esi
push esi
push eax
call fcn.01018f00
test eax, eax
jge 0x101acf1
xor eax, eax
jmp 0x101acff
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.0101ab8e
xor eax, eax
inc eax
pop esi
pop edi
leave
ret 4
Function at 0x101c16d
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x102d9c0
call fcn.0101c5c4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10355f0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x101bf82
cmp eax, esi
jne 0x101bf75
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x101bf85
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101bf5c
xor esi, esi
inc esi
mov eax, dword [0x10355ec]
cmp eax, esi
jne 0x101bf98
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x101bfd3
mov eax, dword [0x10355ec]
test eax, eax
jne 0x101bfcd
mov dword [0x10355ec], esi
push 0x1001298
push 0x100128c
call fcn.0101bed9
pop ecx
pop ecx
test eax, eax
je 0x101bfd3
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x101c09d
mov dword [0x1034c84], esi
mov eax, dword [0x10355ec]
cmp eax, esi
jne 0x101bff7
push 0x1001288
push 0x100127c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10355ec], 2
cmp dword [ebp - 0x1c], ebx
jne 0x101c004
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10355fc], ebx
je 0x101c025
push 0x10355fc
call fcn.0101c539
pop ecx
test eax, eax
je 0x101c025
push ebx
push 2
push ebx
call dword [0x10355fc]
push dword [0x1034c6c]
push dword [0x1034c70]
push dword [0x1034c68]
call fcn.0101b2a8
add esp, 0xc
mov dword [0x1034c80], eax
cmp dword [0x1034c74], ebx
jne 0x101c083
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1034c84], ebx
jne 0x101c091
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1034c80]
call fcn.0101c609
ret
call fcn.0101c711
jmp 0x101bf3a

Function at 0x101c921
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x1011e70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c95f
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret 4
Function at 0x101ca0b
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
xor ebx, ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
cmp dword [ebp + 8], esi
je 0x101cada
cmp dword [ebp + 0x10], esi
je 0x101cada
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 4], 0xffffffff
je 0x101cae2
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x101cae2
cmp dword [ebp - 8], esi
je 0x101ca7a
push 0x20010300
jmp 0x101cadc
mov eax, dword [ebp + 0xc]
cmp eax, esi
jne 0x101ca86
mov eax, dword [ebp - 0xc]
jmp 0x101ca8b
cmp eax, dword [ebp - 0xc]
jb 0x101ca73
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
je 0x101cae2
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp - 0xc]
mov dword [ebp + 8], esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101cae2
mov eax, dword [ebp - 0xc]
cmp dword [ebp + 8], eax
jne 0x101ca73
push esi
push eax
push ebx
call dword [ebp + 0x10]
mov edi, eax
cmp edi, esi
je 0x101cae2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x101cb0b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 4], esi
je 0x101caf6
cmp dword [ebp - 4], 0xffffffff
je 0x101caf6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
je 0x101cb09
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x101cb17
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x101cb48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x101cb44
cmp eax, 3
jne 0x101cb48
xor eax, eax
jmp 0x101cb76
cmp dword [ebp + 0xc], 0
push esi
je 0x101cb72
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0x80
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x101cb6c
xor eax, eax
jmp 0x101cb75
push dword [ebp - 0x24]
push edi
call esi
xor eax, eax
inc eax
pop esi
pop edi
leave
ret 8
Function at 0x101cc7d
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1033f70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 9
pop ecx
push 0x12
lea eax, [ebp - 0x28]
xor ebx, ebx
mov esi, 0x10123b0
lea edi, [ebp - 0x28]
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0101cc15
mov dword [ebp - 0x40], eax
cmp eax, ebx
je 0x101cd20
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x101cd0f
push ebx
xor eax, eax
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
push 8
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push 0x7405c
push esi
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x101cd08
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101c23d
leave
ret

Function at 0x101cd3a
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1033f70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 7
pop ecx
push 0xe
lea eax, [ebp - 0x20]
xor ebx, ebx
mov esi, 0x10123d4
lea edi, [ebp - 0x20]
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.0101cc15
mov esi, eax
xor ecx, ecx
cmp esi, ecx
je 0x101cd79
mov ebx, esi
xor eax, eax
mov dword [ebp - 0x28], ecx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x101cd9b
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
jmp 0x101cda1
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
test esi, esi
je 0x101cdb5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
mov edx, ebx
xor ecx, ebp
pop ebx
call fcn.0101c23d
leave
ret

Function at 0x101cdcd
Capabilities:
Get memory capacity

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x101ce2d
cmp dword [ebp - 0x34], 0
ja 0x101ce09
cmp dword [ebp - 0x38], 0x30000000
jb 0x101ce2d
call fcn.0101cc7d
cmp edx, 4
jb 0x101ce2d
ja 0x101ce19
test eax, eax
jb 0x101ce2d
call fcn.0101cd3a
test edx, edx
ja 0x101ce29
cmp eax, 0x80000000
jb 0x101ce2d
xor eax, eax
leave
ret
xor eax, eax
inc eax
leave
ret
Function at 0x101d6c1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
xor ebx, ebx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 4
cmp dword [ebp + 8], esi
je 0x101d747
cmp dword [ebp + 0x10], esi
je 0x101d747
cmp dword [ebp + 0xc], esi
jne 0x101d6f5
mov dword [ebp + 0xc], 0x10117d8
push esi
push esi
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push dword [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.0101d287
test eax, eax
je 0x101d747
cmp dword [ebp - 8], 1
je 0x101d739
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101d739
cmp dword [ebp - 0xc], 4
jne 0x101d739
xor ebx, ebx
inc ebx
cmp dword [ebp - 4], esi
je 0x101d747
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10

Function at 0x101d84a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1033f70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
cmp edi, ebx
jne 0x101d894
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x101d982
cmp eax, ebx
jne 0x101d8a2
mov dword [ebp - 0x220], 0x10117d8
push ebx
push ebx
push ebx
push 0x1011da8
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0101d287
test eax, eax
je 0x101d968
cmp dword [ebp - 0x230], 1
je 0x101d968
mov dword [ebp - 0x214], ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
mov dword [ebp - 0x22c], 0x104
push dword [ebp - 0x210]
mov dword [ebp - 0x224], 4
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x101d94e
cmp eax, ebx
jne 0x101d968
cmp dword [ebp - 0x228], 4
jne 0x101d94e
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x220]
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
je 0x101d956
inc dword [ebp - 0x214]
jmp 0x101d8d8
mov eax, dword [ebp - 0x21c]
mov dword [edi], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], ebx
je 0x101d97c
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0101c23d
leave
ret 8