joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052c71
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a0
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov dword [ebp - 0x69c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x284]
mov edi, 0x208
push edi
push 0
push eax
call fcn.100aa4a0
add esp, 0xc
lea eax, [ebp - 0x284]
mov ebx, 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 3
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100d8cdc
push edi
lea eax, [ebp - 0x694]
push 0
push eax
call fcn.100aa4a0
push edi
lea eax, [ebp - 0x48c]
push 0
push eax
call fcn.100aa4a0
xor eax, eax
push 0x64
push eax
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x6a0], eax
lea eax, [ebp - 0x7c]
push eax
call fcn.100aa4a0
add esp, 0x30
lea eax, [ebp - 0x48c]
push ebx
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x10052d61
push dword [ebp - 0x698]
lea eax, [ebp - 0x7c]
push str._08X
push eax
call fcn.10053853
add esp, 0xc
and dword [esi + 0x10], 0
lea ecx, [ebp - 0x7c]
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052d75
sub ecx, edx
lea eax, [ebp - 0x7c]
push ecx
push eax
mov ecx, esi
call fcn.10009070
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039266
leave
ret

Function at 0x10052d9b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ef0
call fcn.1003a6b0
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
lea eax, [ebp - 0x7d4]
xor esi, esi
push 0x7d0
push eax
inc esi
call fcn.1000eb10
add esp, 0x10
lea eax, [ebp - 0x2ee8]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x7d4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10052dfc
push 2
pop eax
jmp 0x10052e5c
lea eax, [ebp - 0x2eec]
mov dword [ebp - 0x2eec], 0x2710
push eax
lea eax, [ebp - 0x2ee4]
push eax
lea eax, [ebp - 0x2ef0]
push eax
push 0
push str.PnpInstanceID
push dword [ebp - 0x2ee8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10052e4e
push 4
lea eax, [ebp - 0x2ee4]
push str.pci_
push eax
call fcn.100cc448
add esp, 0xc
neg eax
sbb eax, eax
and esi, eax
push dword [ebp - 0x2ee8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10039266
leave
ret
Function at 0x10052e69
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2b5c
call fcn.1003a6b0
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x13
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2b58]
push eax
push 0x20119
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x54]
xor esi, esi
xor edi, edi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
inc edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10052ebe
push 2
pop eax
jmp 0x1005303d
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2b50]
mov dword [ebp - 0x2b50], 0x3e8
push eax
lea eax, [ebp - 0x43c]
mov ebx, esi
push eax
push esi
push dword [ebp - 0x2b58]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1005301e
lea eax, [ebp - 0x2b54]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x43c]
push eax
push dword [ebp - 0x2b58]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10052ff2
lea eax, [ebp - 0x2b50]
mov dword [ebp - 0x2b50], 0x2710
push eax
lea eax, [ebp - 0x2b4c]
push eax
lea eax, [ebp - 0x2b5c]
push eax
push 0
push str.NetCfgInstanceId
push dword [ebp - 0x2b54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10052fea
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2b4c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10052f81
test dl, dl
je 0x10052f7d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10052f81
add eax, 2
add ecx, 2
test dl, dl
jne 0x10052f61
xor eax, eax
jmp 0x10052f85
sbb eax, eax
or eax, edi
test eax, eax
jne 0x10052fea
lea eax, [ebp - 0x2b50]
mov dword [ebp - 0x2b50], 0x2710
push eax
lea eax, [ebp - 0x2b4c]
push eax
lea eax, [ebp - 0x2b5c]
push eax
push 0
push str.MatchingDeviceId
push dword [ebp - 0x2b54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10052fea
lea eax, [ebp - 0x2b4c]
push eax
push str.MatchingDeviceId:___s__n
call fcn.10053834
push 4
lea eax, [ebp - 0x2b4c]
push str.pci_
push eax
call fcn.100cc448
add esp, 0x14
test eax, eax
je 0x10053028
push dword [ebp - 0x2b54]
call esi
xor eax, eax
mov dword [ebp - 0x2b50], 0x3e8
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x2b50]
inc ebx
push eax
lea eax, [ebp - 0x43c]
push eax
push ebx
push dword [ebp - 0x2b58]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10052ef5
jmp 0x10053032
push dword [ebp - 0x2b54]
call esi
xor edi, edi
push dword [ebp - 0x2b58]
call esi
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10039266
leave
ret
Function at 0x100534cb
Capabilities:
Get common file path
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3100
call fcn.1003a6b0
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x3100], edi
call fcn.100aa4a0
push esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.100aa4a0
add esp, 0x18
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movsx eax, byte [ebp - 0x108]
push eax
push str.._c:
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1000eb10
add esp, 0x10
lea eax, [ebp - 0x20c]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10053561
mov al, 1
jmp 0x1005366a
push 0x2710
lea eax, [ebp - 0x30ec]
mov dword [ebp - 0x30fc], ebx
push ebx
push eax
call fcn.100aa4a0
push 0x3e8
lea eax, [ebp - 0x9dc]
push ebx
push eax
call fcn.100aa4a0
push 0x3e8
lea eax, [ebp - 0x5f4]
push ebx
push eax
call fcn.100aa4a0
add esp, 0x24
mov dword [ebp - 0x30f0], ebx
lea eax, [ebp - 0x30fc]
mov dword [ebp - 0x30f8], ebx
mov dword [ebp - 0x30f4], ebx
push ebx
push eax
push 0x2710
lea eax, [ebp - 0x30ec]
push eax
push 0xc
lea eax, [ebp - 0x30f8]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100535e3
mov bl, 2
jmp 0x10053661
lea eax, [ebp - 0x5f4]
push eax
push ebx
push dword [ebp - 0x30dc]
lea eax, [ebp - 0x30ec]
push eax
call fcn.10053679
lea eax, [ebp - 0x9dc]
push eax
push 1
push dword [ebp - 0x30d4]
lea eax, [ebp - 0x30ec]
push eax
call fcn.10053679
lea ecx, [ebp - 0x5f4]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10053624
sub ecx, edx
lea eax, [ebp - 0x5f4]
push ecx
push eax
mov ecx, edi
call fcn.10050ed6
lea edx, [ebp - 0x9dc]
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10053645
mov ecx, dword [ebp - 0x3100]
lea eax, [ebp - 0x9dc]
sub edx, edi
push edx
push eax
call fcn.10050ed6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039266
leave
ret
Function at 0x10053989
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x118
xor ebx, ebx
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.100aa4a0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.1005393e
mov eax, dword [ebp - 0x11c]
add esp, 0xc
cmp eax, 5
jne 0x10053a08
cmp dword [ebp - 0x118], ebx
jbe 0x10053a4e
cmp dword [ebp - 0x118], 1
setne bl
inc ebx
jmp 0x10053a4e
cmp eax, 6
jne 0x10053a33
cmp byte [ebp - 6], 1
jne 0x10053a2e
mov eax, dword [ebp - 0x118]
sub eax, ebx
je 0x10053a2a
sub eax, 1
je 0x10053a26
push 7
jmp 0x10053a30
push 5
jmp 0x10053a30
push 3
jmp 0x10053a30
push 4
pop ebx
jmp 0x10053a4e
push 0xa
pop ecx
cmp eax, ecx
jne 0x10053a4b
cmp dword [ebp - 0x114], 0x55f0
sbb ebx, ebx
add ebx, 9
jmp 0x10053a4e
cmova ebx, ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10039266
leave
ret

Function at 0x10053f2d
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.100aa4a0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jg 0x10053f90
cmp dword [ebp - 0x118], 2
jg 0x10053f90
mov al, 1
jmp 0x10053f92
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10039266
leave
ret
Function at 0x1005467b
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x3c
mov eax, 0x10249d6b
call fcn.10039bd9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x1005469e
xor al, al
jmp 0x1005475e
lea edi, [ecx + 4]
cmp dword [edi + 0x10], 0
ja 0x100546c1
lea eax, [ebp - 0x40]
push eax
call fcn.1004b53c
pop ecx
push eax
mov ecx, edi
call fcn.10009250
lea ecx, [ebp - 0x40]
call fcn.100094a0
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
and dword [ebp - 0x14], 0
push edi
call fcn.10008bc0
xor edi, edi
lea ecx, [ebp - 0x28]
push 0x1025427c
mov dword [ebp - 4], edi
call fcn.10004090
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.10004090
test ebx, ebx
je 0x10054709
push 0x102c45d8
lea ecx, [ebp - 0x28]
call fcn.10004090
push ebx
lea ecx, [ebp - 0x28]
call fcn.10004090
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x44]
push ecx
push 0xf003f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x44], edi
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10054754
test esi, esi
je 0x10054741
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1005474b
push edi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.100094a0
mov al, 1
call fcn.10039b83
ret 0xc
Function at 0x10054a3a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x102de06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [esi + 0x14], ebx
ja 0x10054a92
lea eax, [ebp - 0x1c]
push eax
call fcn.1004b53c
pop ecx
lea ecx, [esi + 4]
push eax
call fcn.10009250
lea ecx, [ebp - 0x1c]
call fcn.100094a0
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x10054a9d
mov eax, dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push 0xf013f
push ebx
push eax
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x10054ac0
xor al, al
jmp 0x10054b79
lea eax, [ebp - 0x24]
push eax
push 0xf013f
push ebx
push str.SoftWare
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x10054ae3
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10054ab9
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x10054b15
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
jmp 0x10054ab9
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10054b68
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10054b3a
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call esi
mov bl, 1
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10039266
leave
ret 0x10
Function at 0x10055f17
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x10055f47
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x10055f46
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x10055f36
pop edi
pop esi
pop ebp
ret 8

Function at 0x10056168
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x10249e2d
call fcn.10039ba5
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 0xf
mov byte [eax], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
cmp dword [ebp + 0x10], ebx
je 0x100562f3
mov eax, dword [ebp + 0x10]
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x10056239
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x102de0b0], 0x10
mov ecx, 0x102de09c
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x102de09c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.1001ad00
inc edi
cmp edi, 4
jl 0x10056201
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x100561a3
mov dword [ebp + 0x10], edi
test edi, edi
je 0x100562f0
mov eax, edi
cmp edi, esi
jge 0x1005626f
cmp eax, esi
jae 0x100562f9
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x10056257
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x100562db
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x102de0b0], 0x10
mov ecx, 0x102de09c
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x102de09c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.1001ad00
inc ebx
cmp ebx, edi
jl 0x100562ac
mov edi, dword [ebp + 0x10]
push 3
pop esi
cmp edi, esi
jge 0x100562f0
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.1001ad00
sub esi, 1
jne 0x100562e1
mov eax, dword [ebp + 8]
call fcn.10039b6e
ret
call fcn.10039f29
int3
Function at 0x1005ffd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1024a6a3
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x102de06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10008c80
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.10008c80
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.1004d7d7
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10075ad0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x10075ae8
cmp dword [ebp + 0xc], 0
jne 0x10075af2
mov eax, 1
jmp 0x10075bed
push 0
push 0x80
push 3
push 0
push 5
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10075b22
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10075bed
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x10075b4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10075bed
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jb 0x10075b61
mov eax, 8
jmp 0x10075bed
cmp dword [ebp + 0x10], 0
je 0x10075b6f
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
call fcn.10008e60
add esp, 4
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
push 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.100aa4a0
add esp, 0xc
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10075bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10075bed
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
je 0x10075be1
mov eax, 1
jmp 0x10075bed
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100761c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x100761dc
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x100761e3
mov eax, 1
jmp 0x10076245
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10076210
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10076245
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10076239
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10076245
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10076f80
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
add ecx, 2
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x64]
mov ax, word [edx]
mov word [ebp - 0x6a], ax
add dword [ebp - 0x64], 2
cmp word [ebp - 0x6a], 0
jne 0x10076f98
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0x68]
sar ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x70]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10008e60
add esp, 4
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.10003560
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100ca847
add esp, 0xc
mov byte [ebp - 9], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x1007702f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jg 0x1007709d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + eax*2]
cmp edx, 0x5c
jne 0x1007709b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dx, word [ecx + eax*2]
mov word [ebp - 0x18], dx
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov word [edx + ecx*2], ax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10077084
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x10077084
mov byte [ebp - 9], 0
jmp 0x1007709d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dx, word [ebp - 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10077026
mov eax, dword [ebp - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.100396e1
add esp, 4
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret