joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034cf0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
test ebx, ebx
push edi
jne 0x10034d09
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push ebx
call fcn.10036780
add esp, 4
test eax, eax
jne 0x10034d1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x34]
test edi, edi
je 0x10034d38
mov eax, dword [esp + 0x2c]
test eax, eax
jg 0x10034d38
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x10034e20
mov ebp, dword [ebx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
push esi
push esi
push ebp
call edi
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x10034d70
push 2
push esi
push esi
push ebp
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x10034d87
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
sub esi, ebx
jmp 0x10034d8b
mov esi, dword [esp + 0x2c]
push esi
call fcn.1004854e
add esp, 4
mov ebx, eax
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10034dc4
push 2
push eax
push eax
push ebp
call edi
push ebx
call fcn.10048577
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
xor edi, edi
test edx, edx
mov ecx, ebx
jbe 0x10034de0
mov al, byte [ecx]
test al, al
je 0x10034de0
cmp al, 0x1a
je 0x10034de0
inc edi
inc ecx
cmp edi, edx
jb 0x10034dd0
lea ecx, [edi + 1]
push ecx
call fcn.10032f30
mov edx, dword [esp + 0x18]
add esp, 4
mov esi, eax
push 0
lea eax, [edi + edx]
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push ebx
push esi
call fcn.1003c040
push ebx
mov byte [edi + esi], 0
call fcn.10048577
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x10034e9b
mov ebx, dword [ebx + 4]
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 0x14]
test edi, edi
mov ebp, eax
jne 0x10034e3a
or eax, 0xffffffff
jmp 0x10034e3e
mov eax, dword [esp + 0x2c]
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
mov ecx, ebx
call dword [edx + 0x30]
mov edx, dword [esp + 0x10]
xor edi, edi
test eax, eax
jbe 0x10034e6d
mov cl, byte [edx]
test cl, cl
je 0x10034e6d
cmp cl, 0x1a
je 0x10034e6d
inc edi
inc edx
cmp edi, eax
jb 0x10034e5c
lea edx, [edi + 1]
push edx
call fcn.10032f30
add esp, 4
lea ecx, [edi + ebp]
mov esi, eax
mov eax, dword [ebx]
push 0
push ecx
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [esp + 0x10]
push edi
push edx
push esi
call fcn.1003c040
add esp, 0xc
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10037030
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x1003703c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x100370cf
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x10037099
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.100370e0
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x1003706e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x10037100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x100371fd
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x10037152
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x1003717e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.100370e0
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x100371bf
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x10037141
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x100381c0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x10058984]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x100381d3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x10038214
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x10058a2c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x10038246
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1003824a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x1003823b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x10038268
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1003826c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x1003825d
xor ecx, ecx
mov eax, 0x10058994
xor ebx, ebx
mov bl, byte [ecx + 0x10058a3c]
cmp byte [esp + ebx + 0x14], 0
je 0x10038297
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x10058a54]
cmp byte [esp + ebx + 0x14], 0
je 0x100382ae
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x1003827e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x10038207
lea edx, [esp + 0x84]
push edx
call fcn.100382f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x1003a470
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x1004e4ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push esi
mov esi, dword [esp + 0x144]
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.10048819
mov eax, dword [esp + 0x148]
test eax, eax
jne 0x1003a542
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1003a4da
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.100487ef
xor eax, eax
jmp 0x1003a592
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x1003a4f5
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x1003a546
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
mov dword [esp + 0x14], pe_nt_image_headers32
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1003a546
mov ecx, dword [esp + 4]
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.1003d794
add esp, 8
test eax, eax
je 0x1003a53e
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1003a517
jmp 0x1003a546
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
test eax, eax
jne 0x1003a566
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.100487ef
xor eax, eax
jmp 0x1003a592
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x13c], 0xffffffff
call fcn.100487ef
mov eax, esi
mov ecx, dword [esp + 0x134]
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret 8
Function at 0x100253a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 4]
push ecx
xor eax, eax
push 0x20019
push eax
mov esi, 0x1001808
push esi
mov ebx, 0x80000002
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
call edi
cmp eax, 2
jne 0x100258a
lea ecx, [ebp - 4]
push ecx
push 0x20019
mov eax, 0x10017b0
push 0
push eax
push ebx
mov dword [ebp - 8], eax
call edi
test eax, eax
je 0x10025a3
push dword [ebp - 8]
push eax
call fcn.0100e412
mov dword [ebp - 0xc], 1
jmp 0x100264c
mov eax, dword [ebp - 8]
push 4
pop edi
mov cx, word [eax]
cmp cx, word [esi]
jne 0x10025cd
test cx, cx
je 0x10025c9
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x10025cd
add eax, edi
add esi, edi
test cx, cx
jne 0x10025a9
xor eax, eax
jmp 0x10025d2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10025f6
push 0x1001410
cmp byte [0x1011130], al
je 0x10025ea
push 0x4000285d
jmp 0x10025ef
push 0x4000285e
call fcn.0100e4fd
pop ecx
pop ecx
xor ebx, ebx
xor esi, esi
inc ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push dword [esi + 0x10110f8]
mov dword [ebp - 0x10], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002640
cmp dword [ebp - 0x14], ebx
jne 0x100262a
push dword [esi + 0x10110f0]
jmp 0x1002630
push dword [esi + 0x10110f4]
call fcn.0100e4fd
add esi, 0x10
pop ecx
cmp esi, 0x40
jb 0x10025fb
jmp 0x100264e
push dword [ebp - 8]
push eax
call fcn.0100e412
mov dword [ebp - 0xc], ebx
pop ecx
pop ecx
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x1002660
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x100266a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push 2
xor ebx, ebx
push ebx
push 0x1001808
mov edi, 0x80000002
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x10026c0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
push 0x1001410
cmp byte [0x1011130], bl
je 0x10026e0
push 0x4000285d
call fcn.0100e4fd
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 2
push ebx
push 0x10017b0
push edi
call esi
cmp eax, ebx
je 0x10026f0
push 0x10017b0
push eax
call fcn.0100e412
jmp 0x10026ea
push 0x4000285e
call fcn.0100e4fd
pop ecx
jmp 0x10027e1
xor esi, esi
inc esi
cmp dword [ebp + 8], esi
mov dword [ebp - 0xc], esi
jle 0x10027e9
mov edi, dword [ebp + 0xc]
add edi, 4
jmp 0x100270a
xor esi, esi
inc esi
mov eax, dword [edi]
mov dword [ebp + 0xc], ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1002712
sub eax, edx
sar eax, 1
cmp eax, 5
jne 0x10027c8
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov dword [eax], ebx
push ebx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi]
add eax, 8
push eax
call fcn.0100e2c2
mov ecx, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp word [ecx], bx
jne 0x10027d7
cmp eax, 0xffffffff
jne 0x1002761
call esi
cmp dword [eax], 0x22
je 0x10027d7
cmp dword [ebp - 0x10], 1
ja 0x10027d7
xor esi, esi
push 4
push dword [edi]
push dword [esi + 0x10110fc]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10027a7
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push dword [esi + 0x10110f8]
mov dword [ebp + 0xc], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
jne 0x10026d3
add esi, 0x10
cmp esi, 0x40
jb 0x1002769
cmp dword [ebp + 0xc], ebx
je 0x10027d7
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add edi, 4
cmp eax, dword [ebp + 8]
jl 0x1002707
jmp 0x10027e9
push 0x4000281b
call fcn.0100e4fd
mov dword [ebp - 8], esi
jmp 0x10027e8
push 0x4000281b
call fcn.0100e4fd
mov dword [ebp - 8], 1
pop ecx
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x10027fa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret 8
Function at 0x1002806
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10018d0
mov edi, 0x80000002
push edi
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x1002862
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x1001434
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002865
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x10028bb
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov byte [eax], bl
cmp dword [ebp - 4], ebx
je 0x100287b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x1001878
push edi
call esi
test eax, eax
jne 0x10028b4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x1001434
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10028bb
mov dword [ebp - 0xc], 2
cmp dword [ebp - 4], ebx
pop edi
pop esi
pop ebx
je 0x10028cc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
leave
ret 4

Function at 0x10028d8
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 2
xor edi, edi
push edi
mov esi, 0x10017b0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100291a
push 4
lea eax, [ebp + 8]
push eax
push 4
push edi
mov esi, 0x1001434
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1002926
push esi
push eax
call fcn.0100e412
xor edi, edi
pop ecx
inc edi
pop ecx
cmp dword [ebp - 4], 0
je 0x1002935
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x1002e9d
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x638], edi
mov dword [ebp - 0x634], ebx
mov byte [ebp - 0x62d], bl
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1002ed0
sub eax, edx
sar eax, 1
add eax, 4
cmp eax, 0x104
jbe 0x1002f02
push 0x400027ea
call fcn.0100e4fd
pop ecx
mov dword [ebp - 0x634], 1
jmp 0x10030fc
push esi
push 0x1001914
mov esi, 0x108
lea eax, [ebp - 0x62c]
push esi
push eax
call sub.msvcrt.dll_wcscpy_s
push edi
lea eax, [ebp - 0x62c]
push esi
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0x18
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x640], eax
cmp eax, 0xffffffff
jne 0x1002f6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e412
pop ecx
mov dword [ebp - 0x634], 1
jmp 0x10030fb
push ebx
lea ecx, [ebp - 0x644]
push ecx
push 0x10
lea ecx, [ebp - 0x654]
push ecx
push 0x10
lea ecx, [ebp - 0x664]
push ecx
xor edi, edi
push 0x9023c
inc edi
push eax
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x65c], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1002fc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10030e2
and eax, 0xffff
or eax, 0x80070000
jmp 0x10030e2
push 0x105
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10030dc
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1002fe4
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x10030dc
mov ax, word [ebp - 0x210]
mov word [ebp - 0x41c], ax
mov ax, word [ebp - 0x20e]
mov word [ebp - 0x41a], ax
xor eax, eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x639]
push eax
call fcn.01002806
mov esi, eax
cmp dword [ebp - 0x654], edi
jne 0x100303d
push 0x40002822
jmp 0x1003042
push 0x40002823
call fcn.0100e4fd
pop ecx
push esi
call fcn.01002942
mov ecx, dword [ebp - 0x638]
lea eax, [ebp - 0x41c]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1003080
cmp dx, bx
je 0x100307c
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1003080
add ecx, 4
add eax, 4
cmp dx, bx
jne 0x100305a
xor eax, eax
jmp 0x1003085
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1003090
mov byte [ebp - 0x62d], 1
cmp esi, ebx
je 0x10030cf
cmp esi, 2
jne 0x10030a1
cmp dword [ebp - 0x654], edi
jne 0x10030cf
push dword [ebp - 0x638]
cmp esi, 3
jne 0x10030c8
cmp byte [ebp - 0x62d], bl
je 0x10030c1
push 0x4000282a
call fcn.0100e4fd
pop ecx
jmp 0x10030ee
push 0x4000282b
jmp 0x10030b9
push 0x40002829
jmp 0x10030b9
push dword [ebp - 0x638]
push 0x40002828
jmp 0x10030b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e412
mov dword [ebp - 0x634], edi
pop ecx
push dword [ebp - 0x640]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x634]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100f411
leave
ret 4
Function at 0x10055d5
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0x1001f48
push edi
call dword [sym.imp.msvcrt.dll_setlocale]
mov ebx, dword [ebp + 8]
pop ecx
pop ecx
lea eax, [ebp - 0x120]
push eax
dec ebx
add esi, 4
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100564f
cmp dword [ebp - 0x11c], 5
jne 0x100564f
cmp dword [ebp - 0x118], edi
jne 0x100564f
mov dword [0x1011910], 1
call fcn.0100dd2a
test eax, eax
jne 0x100566b
push 0x400027b7
call fcn.0100e4fd
pop ecx
xor eax, eax
inc eax
jmp 0x1005702
cmp ebx, edi
jne 0x100567f
xor esi, esi
push edi
push edi
call fcn.0100e958
mov eax, esi
jmp 0x1005702
push dword [esi]
push 0x10114b0
call fcn.010055a3
mov edi, eax
test edi, edi
jne 0x10056a4
push dword [esi]
push 0x400027e7
call fcn.0100e4fd
pop ecx
xor esi, esi
pop ecx
inc esi
jmp 0x1005671
dec ebx
add esi, 4
test ebx, ebx
jne 0x10056c2
push 0x1001f44
push dword [edi + 4]
call fcn.010055a3
push esi
push ebx
call dword [eax + 4]
xor eax, eax
jmp 0x1005702
push dword [esi]
push dword [edi + 4]
call fcn.010055a3
test eax, eax
jne 0x10056f9
push dword [esi]
push 0x400027e7
call fcn.0100e4fd
pop ecx
pop ecx
push 0x1001f44
push dword [edi + 4]
call fcn.010055a3
add esi, 4
push esi
dec ebx
push ebx
call dword [eax + 4]
jmp 0x1005663
add esi, 4
push esi
dec ebx
push ebx
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f411
leave
ret
Function at 0x10063c4
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
lea edx, [ebp - 0x108]
push edx
mov dword [eax + 4], 0x44
mov eax, dword [esi]
lea edx, [ebp - 0x104]
push edx
lea edx, [eax + 4]
push edx
add eax, 0x28
push eax
push ecx
push 0
mov dword [ebp - 0x108], 0x80
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100642d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x1006495
mov eax, dword [esi]
or ecx, 0xffffffff
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov eax, dword [esi]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov eax, dword [esi]
add eax, 0x28
push eax
call dword [sym.imp.ntdll.dll_RtlLengthSid]
mov ecx, dword [esi]
mov dword [ecx + 4], eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, 7
and ecx, 0xfffffff8
add ecx, 0x28
mov dword [eax], ecx
mov eax, dword [esi]
push dword [eax + 4]
add eax, 0x28
push eax
mov eax, dword [edi]
add eax, 8
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov ecx, dword [edi]
mov dword [ecx + 4], eax
mov edi, dword [edi]
mov eax, dword [edi + 4]
add eax, 7
and eax, 0xfffffff8
add eax, 8
mov dword [edi], eax
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100f411
leave
ret 0xc

Function at 0x10077b5
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
xor ebx, ebx
push ebx
mov edi, 0x2000000
push edi
push 3
push ebx
push 3
push 0x80
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x10077fe
push 0x50
call fcn.0100e412
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x100786c
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100781b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e412
pop ecx
jmp 0x10077fa
push ebx
push edi
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp + 8]
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x100780c
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x98168
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100785b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100e412
pop ecx
jmp 0x1007862
mov dword [ebp - 4], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10091e5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
push esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10091f4
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x100926f
cmp word [ebx + 2], 0x3a
jne 0x100926f
mov esi, dword [ebp + 0xc]
push ebx
push dword [ebp + 0x10]
push esi
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1009223
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x100924a
push 0x10012dc
push dword [ebp + 0x10]
push esi
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call sub.msvcrt.dll_wcscpy_s
push 0x1002254
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call sub.msvcrt.dll_wcscat_s
add esp, 0x18
pop esi
pop ebx
pop ebp
ret 0x14
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1009211
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1009285
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
je 0x10092ac
push 0x10012dc
push dword [ebp + 0x10]
push esi
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
cmp word [ebx], 0x2e
je 0x100921e
push ebx
push dword [ebp + 0x10]
push esi
call sub.msvcrt.dll_wcscat_s
jmp 0x100921b