joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
sub esp, 0x224
mov eax, dword [0x40b0f8]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x230]
push 0x104
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
call dword [0x40bd84]
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401042
push ebx
sub eax, edx
sar eax, 1
push ebp
lea ecx, [eax - 1]
xor ebx, ebx
cmp ecx, ebx
push esi
push edi
jl 0x40108f
mov eax, 0x5c
cmp word [esp + ecx*2 + 0x24], ax
je 0x401071
sub ecx, 1
jns 0x401063
jmp 0x40108f
add ecx, ecx
mov eax, str.PotPlayer.dll
mov edx, ecx
sub edx, eax
lea edx, [esp + edx + 0x26]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x401080
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 8
call fcn.0040174a
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4010bd
lea edx, [esp + 0x24]
push edx
call dword [0x40bda0]
cmp eax, ebx
mov dword [esi], eax
setne al
mov byte [esi + 4], al
jmp 0x4010bf
xor esi, esi
mov eax, dword [esi]
mov edi, dword [0x40bd8c]
cmp eax, ebx
je 0x4010d9
push str.PreprocessCmdLineExW
push eax
call edi
mov dword [esp + 0x18], eax
jmp 0x4010dd
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
mov eax, dword [esi]
setne cl
and byte [esi + 4], cl
cmp eax, ebx
je 0x4010fb
push str.UninitPotPlayer
push eax
call edi
mov dword [esp + 0x10], eax
jmp 0x4010ff
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
mov eax, dword [esi]
setne dl
and byte [esi + 4], dl
cmp eax, ebx
je 0x40111d
push str.CreatePotPlayerExW
push eax
call edi
mov dword [esp + 0x14], eax
jmp 0x401121
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
setne al
and byte [esi + 4], al
mov eax, dword [esi]
cmp eax, ebx
je 0x40113d
push str.DestroyPotPlayer
push eax
call edi
mov ebp, eax
jmp 0x40113f
xor ebp, ebp
mov eax, dword [esi]
cmp ebp, ebx
setne cl
and byte [esi + 4], cl
cmp eax, ebx
je 0x401157
push str.RunPotPlayer
push eax
call edi
mov ebx, eax
mov eax, dword [esi]
test ebx, ebx
setne dl
and byte [esi + 4], dl
test eax, eax
je 0x401171
push str.SetPotPlayRegKeyW
push eax
call edi
mov edi, eax
jmp 0x401173
xor edi, edi
test edi, edi
setne al
and byte [esi + 4], al
je 0x4011de
mov ecx, dword [esp + 0x244]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
push 1
push ecx
push edx
push eax
call dword [esp + 0x28]
add esp, 0x10
test eax, eax
je 0x4011d8
push str.PotPlayerMini
push 0
call edi
push 0x4003
push 0
push 0
call dword [esp + 0x28]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4011d8
call ebx
push edi
call ebp
add esp, 4
call dword [esp + 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4011f2
call dword [esp + 0x10]
jmp 0x4011f2
push 0
push str.Error
push 0x408190
push 0
call dword [0x40bdac]
mov eax, dword [esi]
test eax, eax
je 0x4011ff
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call fcn.004016a4
mov ecx, dword [esp + 0x234]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004017af
add esp, 0x224
ret 0x10
Function at 0x4017af
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b0f8]
jne 0x4017b9
repz ret
jmp fcn.00401f10
Function at 0x10068e3
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10017d8
call fcn.01006b58
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x100691e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100691e
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1006936
cmp eax, 0x20b
je 0x1006923
mov dword [ebp - 0x1c], edi
jmp 0x100694a
cmp dword [ecx + 0x84], 0xe
jbe 0x100691e
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1006944
cmp dword [ecx + 0x74], 0xe
jbe 0x100691e
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100c07c], 0xffffffff
or dword [0x100c080], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100c060]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100c05c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100c084], eax
call fcn.01006b52
cmp dword [0x100c040], edi
jne 0x10069a5
push fcn.01006b52
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01006b40
push 0x100120c
push 0x1001208
call sub.msvcrt.dll__initterm
mov eax, dword [0x100c058]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x100c054]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x1001204
push 0x1001200
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01005d21
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1006a1c
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1006a51
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01006b91
ret
Function at 0x1006e55
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
and dword [ebp - 4], 0
cmp dword [0x100c064], 0
jne 0x1006e9f
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1006e95
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1006f3e
mov dword [0x100c064], 1
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + 5]
push 1
push eax
call dword [sym.imp.msvcrt.dll_calloc]
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x1006ed4
push 0x8007000e
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01007751
xor eax, eax
jmp 0x1006f3c
push esi
push edi
push dword [ebp + 8]
call fcn.0100780a
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1006efc
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x800300fd
jmp 0x1006ec5
push 2
push 4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov esi, eax
test esi, esi
je 0x1006ed0
push edi
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp + 0x10], 0
mov eax, dword [esi]
pop ecx
jne 0x1006f2e
push 0x100183c
push eax
call dword [sym.imp.msvcrt.dll_strtok]
pop ecx
pop ecx
push 0xf
push dword [ebp + 0xc]
push eax
call fcn.010078a7
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc

Function at 0x1006f5c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
push 0x3f
xor ebx, ebx
pop ecx
xor eax, eax
cmp dword [ebp + 8], ebx
lea edi, [ebp - 0x100]
mov dword [ebp - 0x104], ebx
rep stosd dword es:[edi], eax
push 0x3f
pop ecx
lea edi, [ebp - 0x200]
mov dword [ebp - 0x204], ebx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
je 0x1007036
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1007036
mov esi, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
mov edi, 0x80
push 4
mov dword [ebp - 4], edi
call esi
push ebx
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.01007dd4
test eax, eax
je 0x1007036
push dword [ebp + 8]
call fcn.01006c78
cmp eax, 1
jne 0x100700b
push ebx
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 8]
call fcn.01006e55
test eax, eax
je 0x1007039
push ebx
push 1
lea eax, [ebp - 0x204]
push eax
jmp 0x1007023
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 7
mov dword [ebp - 4], edi
call esi
push ebx
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.01007dd4
neg eax
sbb eax, eax
inc eax
jmp 0x1007039
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100724d
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push esi
push edi
push 0x7e
pop ecx
xor eax, eax
xor esi, esi
mov dword [ebp - 0x420], esi
lea edi, [ebp - 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7e
pop ecx
mov dword [ebp - 0x220], esi
xor eax, eax
lea edi, [ebp - 0x21c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
push edi
call fcn.01006f5c
cmp eax, 1
jne 0x10072ce
cmp dword [ebp + 0xc], esi
je 0x10072c7
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10072c7
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x157e
call fcn.01008316
push eax
call fcn.01007509
mov eax, esi
jmp 0x10073f9
xor eax, eax
jmp 0x10073f9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
lea eax, [ebp - 0x220]
push eax
call esi
push edi
call fcn.01006f42
cmp eax, 1
jne 0x10072f6
add edi, 4
push edi
lea eax, [ebp - 0x220]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
call fcn.01006d43
test eax, eax
jne 0x1007311
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10073f9
push ebx
mov ebx, 0x10012c4
push ebx
lea eax, [ebp - 0x420]
push eax
call esi
xor esi, esi
cmp dword [ebp + 0x14], esi
je 0x1007356
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1007356
push dword [ebp + 0x14]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x420]
push 0x100186c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x1007372
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x420]
push 0x1001840
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 8
pop ecx
xor eax, eax
push esi
push dword [ebp + 0xc]
lea edi, [ebp - 0x20]
push dword [ebp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp edi, esi
je 0x10073ba
cmp edi, 0x4b8
je 0x10073b3
call fcn.01007751
jmp 0x10073f6
call fcn.010077a1
jmp 0x10073f6
push ebx
xor edi, edi
call fcn.01007509
lea eax, [ebp - 0x220]
push eax
call fcn.01007040
cmp eax, 0x1388
jae 0x10073f6
lea eax, [ebp - 0x220]
push eax
call fcn.0100723a
push 0x157f
call fcn.01008316
push eax
call fcn.01007509
mov edi, 0x4b8
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x1007b2b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
push edi
xor eax, eax
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], ebx
jne 0x1007b69
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01007751
xor eax, eax
jmp 0x1007c21
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push 0xfffffffffffffff6
call edi
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x10], esi
jne 0x1007b84
xor eax, eax
jmp 0x1007c20
cmp esi, 3
je 0x1007b97
cmp esi, 0xffffffff
je 0x1007b97
mov dword [ebp - 0x1c], 1
jmp 0x1007baf
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
je 0x1007b7d
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
cmp dword [ebp - 0x1c], 1
push 0
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
jne 0x1007c27
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1007b7d
cmp dword [ebp - 0x14], 0
jne 0x1007c35
push dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
push dword [ebp - 0x10]
and word [eax + ecx*2], 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0x10018f4
lea eax, [ebp - 0x30]
push 0x10018ec
push eax
call ebx
add esp, 0xc
push 0
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0x30]
push eax
push 0xfffffffffffffff5
call edi
push eax
call esi
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret 8
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
test eax, eax
je 0x1007d08
mov ax, word [ebp - 4]
cmp ax, 0xd
je 0x1007be0
cmp ax, 8
jne 0x1007cc0
cmp dword [ebp - 8], 0
je 0x1007bbb
push 8
lea eax, [ebp - 0x30]
push 0x10018e4
push eax
call ebx
add esp, 0xc
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
push 0xfffffffffffffff5
call edi
push eax
call esi
push 0
lea eax, [ebp - 0x30]
push 0x10018e4
push eax
call ebx
add esp, 0xc
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
push 0xfffffffffffffff5
call edi
push eax
call esi
push 8
lea eax, [ebp - 0x30]
push 0x10018e4
push eax
call ebx
add esp, 0xc
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
push 0xfffffffffffffff5
call edi
push eax
call esi
dec dword [ebp - 8]
jmp 0x1007bbb
mov ecx, dword [ebp + 0xc]
dec ecx
cmp dword [ebp - 8], ecx
jne 0x1007ce2
push 0
lea eax, [ebp - 0xc]
push eax
push 1
push 0x10018e0
push 0xfffffffffffffff5
call edi
push eax
call esi
jmp 0x1007bbb
cmp ax, 0xa
je 0x1007bbb
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
inc dword [ebp - 8]
push 0
mov word [ecx + edx*2], ax
lea eax, [ebp - 0xc]
push eax
push 1
push 0x10012d0
jmp 0x1007cd6
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
jmp 0x1007b7d
Function at 0x1001463f
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014659
push 0x1c59
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10014671
push 0
push 0x1082
push 0
push 0
push 0x1abb
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10015ca1
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10015cbe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10015e0e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
push 2
pop eax
test eax, eax
je 0x10015d42
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10015d42
mov dword [ebp - 0x14], 1
jmp 0x10015d46
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jle 0x10015d59
mov dword [ebp - 0x4c], 1
jmp 0x10015d5d
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
sub eax, 0x4ae10e89
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx]
jge 0x10015d87
mov dword [ebp - 0x1c], 1
jmp 0x10015d8b
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [eax]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax]
jge 0x10015dac
mov eax, 0xf38e6a27
test eax, eax
je 0x10015dac
mov dword [ebp - 0x20], 1
jmp 0x10015db0
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0xfffffffc
jl 0x10015dbf
mov dword [ebp - 0x24], 1
jmp 0x10015dc3
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x24], eax
je 0x10015ddb
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x10015ddb
and dword [ebp - 0xc], 0
jmp 0x10015de2
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jle 0x10015dfd
mov dword [ebp - 0x28], 1
jmp 0x10015e01
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1001707f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100810bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10017111
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call fcn.100146d4
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
call fcn.1001764e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10017683
jmp 0x10017136
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10017136
push 0x2ea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001dce8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001dd05
push 0x1c59
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1001dd50
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001dd33
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001dd50
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017435
mov dword [eax], 0x13ec
jmp 0x1001dd28
mov esp, ebp
pop ebp
ret
Function at 0x1001ea32
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001eb82
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x1001ea96
mov dword [ebp - 0x10], 1
jmp 0x1001ea9a
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0xd1cc
jne 0x1001eaac
mov dword [ebp - 0x18], 1
jmp 0x1001eab0
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10017435
cmp esi, dword [eax]
je 0x1001eacc
mov dword [ebp - 0x14], 1
jmp 0x1001ead0
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0xc359
jl 0x1001eae2
mov dword [ebp - 0x1c], 1
jmp 0x1001eae6
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jle 0x1001eaf7
mov dword [ebp - 0x24], 1
jmp 0x1001eafb
and dword [ebp - 0x24], 0
push 0
mov ecx, dword [ebp - 0x20]
call fcn.10017435
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax]
jle 0x1001eb15
mov dword [ebp - 0x28], 1
jmp 0x1001eb19
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
sub eax, 0xbc35
je 0x1001eb34
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 0
je 0x1001eb34
mov dword [ebp - 0x2c], 1
jmp 0x1001eb38
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x2c], eax
jl 0x1001eb4b
mov dword [ebp - 0x30], 1
jmp 0x1001eb4f
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
add ecx, dword [ebp - 0x30]
imul ecx, ecx, 0x3fd9
cmp dword [eax], ecx
jne 0x1001eb71
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1001eb71
and dword [ebp - 0x34], 0
jmp 0x1001eb78
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1001eba6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001eba6
push 0
push 0x1082
push 0
push 0
push 0x1abb
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002845d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002847a
push 0x1c59
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x100284c5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100284a8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x100284c5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017435
mov dword [eax], 0x4caa5d73
jmp 0x1002849d
mov esp, ebp
pop ebp
ret