joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71048950
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov dword [ebp - 0x20], 0x3a0041
mov dword [ebp - 0x1c], 0x5c
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
mov ecx, 0x14
mov edx, 1
mov esi, eax
mov eax, dword [ebp + 8]
call sym._resize_table
test eax, eax
je 0x71048b2d
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x44], 0
mov ebx, 0x41
mov edi, 1
sbb eax, eax
mov dword [ebp - 0x40], 0
inc eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x4c], eax
jmp 0x710489c2
inc ebx
cmp ebx, 0x5b
je 0x71048ab8
lea ecx, [ebx - 0x41]
mov eax, edi
shl eax, cl
test eax, esi
je 0x710489b8
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], bx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
cmp eax, 5
jne 0x710489b8
mov eax, dword [ebp - 0x3c]
mov ecx, 0x14
inc eax
mov dword [ebp - 0x48], eax
mov edx, eax
mov eax, dword [ebp + 8]
call sym._resize_table
test eax, eax
je 0x71048b2d
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x40]
add edx, dword [ecx + 0x14]
lea ecx, [ebp - 0x2e]
mov dword [edx], str.IDECDROMWINE_CD_ROM_____________________________1.0_____53A2A585401.0.0
mov dword [esp], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x71062504
mov dword [esp + 4], 3
mov dword [ebp - 0x44], edx
call sym._swprintf
lea ecx, [ebp - 0x2e]
mov dword [esp], ecx
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov edx, dword [ebp - 0x44]
mov dword [edx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], str.CR_ROM
mov dword [edx + 0xc], str.Wine_CD_ROM_ATA_Device
mov dword [edx + 0x10], str.IDECDROMWINE_CD_ROM_____________________________1.0_____53A2A585401.0.0
test eax, eax
je 0x71048a99
lea eax, [ebp - 0x34]
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._eval_cond
test eax, eax
jne 0x71048ad8
mov eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x28]
je 0x71048b3f
mov eax, dword [ebp - 0x4c]
inc ebx
add dword [ebp - 0x40], 0x14
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3c], eax
cmp ebx, 0x5b
jne 0x710489c2
lea esi, [esi]
nop
test byte [0x71060048], 8
jne 0x71048b00
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x3c]
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0x44]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x44], 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._free_row_values
jmp 0x710489b8
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_cdromdrive
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x71060048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x71048ac1
mov dword [ebp - 0x44], 0xffffffff
mov eax, dword [ebp - 0x44]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x44], 1
jmp 0x71048adf
Function at 0x7104ac80
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x28]
sub esp, 0x4c
mov dword [ebp - 0x28], 0
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0
call sym._GetIpForwardTable_12
sub esp, 0xc
cmp eax, 0x7a
jne 0x7104ae56
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x7104ae56
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._GetIpForwardTable_12
mov dword [ebp - 0x2c], eax
sub esp, 0xc
test eax, eax
jne 0x7104ae4a
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp + 8]
mov ecx, 0xc
mov edx, dword [esi]
test edx, edx
mov edx, 1
cmovne edx, dword [esi]
call sym._resize_table
test eax, eax
je 0x7104ae4a
mov edi, dword [esi]
xor ebx, ebx
test edi, edi
je 0x7104ade3
cmp dword [ebp + 0xc], 1
sbb eax, eax
xor edi, edi
inc eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
lea esi, [eax + 4]
xor eax, eax
mov edi, esi
mov esi, eax
jmp 0x7104ad61
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
je 0x7104ae40
mov eax, dword [ebp - 0x34]
add dword [ebp - 0x2c], 0xc
inc esi
add edi, 0x38
inc dword [ebp - 0x30]
mov ebx, dword [ebp - 0x38]
cmp dword [eax], esi
jbe 0x7104ade0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x2c]
add ebx, dword [eax + 0x14]
mov eax, dword [edi]
bswap eax
call sym._get_ip4_string
mov dword [ebx], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [edi + 0xc]
bswap eax
call sym._get_ip4_string
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7104ad4c
lea eax, [ebp - 0x24]
mov ebx, 0xffffffff
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._eval_cond
test eax, eax
je 0x7104ad40
mov eax, dword [ebp - 0x30]
inc esi
add edi, 0x38
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._free_row_values
mov eax, dword [ebp - 0x34]
cmp dword [eax], esi
ja 0x7104ad61
lea esi, [esi]
mov edi, dword [ebp - 0x30]
test byte [0x71060048], 8
jne 0x7104ae10
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_ip4routetable
mov dword [esp + 4], 0x71060048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x7104adec
mov ebx, 1
jmp 0x7104adbf
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov ebx, 0xffffffff
jmp 0x7104adfe
Function at 0x7104cf60
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ecx, 0x24
mov edx, 1
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov esi, dword [ebp + 8]
mov eax, esi
call sym._resize_table
test eax, eax
je 0x7104d0a0
mov ebx, dword [esi + 0x14]
lea edi, [ebp - 0x58]
mov dword [ebx], str.BANK_0
mov dword [ebp - 0x58], 0x40
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov ecx, eax
sub esp, 4
mov eax, 0x40000000
test ecx, ecx
je 0x7104cfb7
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], str.Physical_Memory
mov dword [ebx + 0x10], 0x640
mov dword [ebx + 0x14], str.DIMM_0
mov dword [ebx + 0x18], 0x90008
mov dword [ebx + 0x1c], 0x7106282a
mov dword [ebx + 0x20], 0x7106282a
test eax, eax
je 0x7104d090
lea eax, [ebp - 0x5c]
mov dword [esp + 0xc], edi
mov edi, 0xffffffff
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._eval_cond
test eax, eax
jne 0x7104d048
mov eax, dword [ebp - 0x54]
or eax, dword [ebp - 0x58]
mov edi, 1
mov ebx, 1
je 0x7104d048
test byte [0x71060048], 8
jne 0x7104d063
mov dword [esi + 0xc], ebx
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0
xor ebx, ebx
mov dword [esp], esi
call sym._free_row_values
test byte [0x71060048], 8
je 0x7104d038
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_physicalmemory
mov dword [esp + 4], 0x71060048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x7104d038
xor edi, edi
mov ebx, 1
jmp 0x7104d02f
mov edi, 0xffffffff
jmp 0x7104d03b
Function at 0x7104f830
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x212]
sub esp, 0x234
mov dword [esp + 0x1c], 0x105
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetVolumeInformationW]
sub esp, 0x20
test eax, eax
jne 0x7104f8a0
mov dword [esp], str.NTFS
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x7104f8b0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebx
mov ebx, edx
sub esp, 0x70
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x3e], 0x5c005c
mov dword [ebp - 0x3a], 0x5c002e
mov dword [ebp - 0x36], 0x3a0041
mov dword [ebp - 0x48], 0x20000000
mov dword [ebp - 0x44], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExW]
movzx eax, word [esi]
sub esp, 0x10
mov word [ebp - 0x36], ax
lea eax, [ebp - 0x3e]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x7104f9a7
mov esi, eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x30]
mov dword [esp + 0x14], 0x28
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x700a0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_DeviceIoControl]
sub esp, 0x20
test eax, eax
jne 0x7104f9b8
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], edx
jmp 0x7104f99b
Function at 0x7104fa30
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x4c]
lea esi, [ebp - 0x48]
push ebx
sub esp, 0x7c
mov dword [edx], 1
mov ebx, dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x48], 0xffff
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], esi
mov dword [esp], 0x6b
call ebx
sub esp, 0x18
cmp eax, 0xc0000004
jne 0x7104fb70
mov ecx, dword [ebp - 0x4c]
mov dword [esp], ecx
mov dword [ebp - 0x5c], ecx
call dword [sym.imp.ucrtbase.dll_malloc]
mov ecx, dword [ebp - 0x5c]
test eax, eax
je 0x7104fbae
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [ebp - 0x5c], eax
mov dword [esp + 8], 4
mov dword [esp + 4], esi
mov dword [esp], 0x6b
call ebx
mov edx, dword [ebp - 0x5c]
sub esp, 0x18
test eax, eax
mov edi, eax
jne 0x7104fb60
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], 0
xor esi, esi
mov ecx, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
test ecx, ecx
jne 0x7104fb15
jmp 0x7104fbe8
inc esi
mov ebx, 1
test byte [ecx + 8], 1
cmovne edi, ebx
add eax, dword [ecx + 4]
cmp dword [ebp - 0x5c], eax
jbe 0x7104fb32
lea ecx, [edx + eax]
mov ebx, dword [ecx]
test ebx, ebx
je 0x7104fb00
cmp ebx, 3
sete bl
add eax, dword [ecx + 4]
movzx ebx, bl
add dword [ebp - 0x60], ebx
cmp dword [ebp - 0x5c], eax
ja 0x7104fb15
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x7104fb44
mov dword [eax], esi
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x60]
test edi, edi
mov dword [eax], edx
lea eax, [esi + esi]
cmovne esi, eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
lea eax, [ebp - 0x44]
mov dword [esp + 0xc], 0
mov esi, 1
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
sub esp, 0x10
test eax, eax
jne 0x7104fb54
movzx esi, byte [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
sub esp, 0x10
test eax, eax
je 0x7104fba0
mov esi, 1
jmp 0x7104fb54
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x7104fbfe
mov dword [eax], 0
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
jmp 0x7104fb54
Function at 0x71050960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
lea eax, [ebp - 0x24]
sub esp, 0x4c
mov dword [ebp - 0x24], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersion
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x710509e4
lea eax, [ebp - 0x1c]
lea edi, [ebp - 0x20]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edi
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [ebp - 0x2c], eax
call eax
sub esp, 0x18
test eax, eax
jne 0x710509e4
cmp dword [ebp - 0x1c], 1
je 0x71050a08
xor esi, esi
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x710509f9
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
lea ecx, [edx + 2]
mov dword [ebp - 0x30], eax
mov dword [esp], ecx
mov dword [ebp - 0x34], ecx
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x710509e4
mov dword [esp + 0x10], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x14], edi
mov dword [ebp - 0x20], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
call eax
sub esp, 0x18
test eax, eax
je 0x710509e6
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x710509e4

Function at 0x710513a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov edx, eax
mov ecx, 0x82
xor eax, eax
mov ebp, esp
push edi
lea edi, [ebp - 0x212]
sub esp, 0x234
rep stosd dword es:[edi], eax
xor eax, eax
mov word [edi], ax
lea edi, [ebp - 0x212]
mov dword [esp + 4], edi
mov dword [esp], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x105
call dword [sym.imp.kernel32.dll_GetVolumeInformationW]
sub esp, 0x20
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov edi, dword [ebp - 4]
leave
ret
Function at 0x710531f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov edx, dword [edi + 8]
mov esi, dword [edi + 4]
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x71053250
add esi, dword [edi + 0xc]
add esi, 0x1a
lea eax, [esi + esi]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x71053242
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov eax, dword [edi]
mov dword [esp + 8], str.SELECT__FROM__s_WHERE__s
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._swprintf.constprop.0
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + esi + 0x1e]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x71053242
xor eax, eax
mov edx, 0x53
jmp 0x71053277
movzx edx, word [eax + str.SELECT__FROM]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x71053270
cmp word [ebx], 0
mov esi, dword [edi]
mov edx, ebx
je 0x71053299
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x71053290
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [esi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x710532a0
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x710557a0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov edi, eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
mov eax, dword [ebp + 8]
sub esp, 8
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
sub esp, 8
test ebx, ebx
je 0x71055930
mov edi, dword [esi]
test edi, edi
je 0x71055918
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x28], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x24], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x20], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x7105593c
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x71055908
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x710558ce
mov eax, dword [ebp + 8]
mov edx, esi
call sym._create_registrar
test eax, eax
jne 0x71055808
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x71055932
Function at 0x71056f10
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], str.SELECT__FROM__s_WHERE__s
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], 4
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call dword [sym.imp.ucrtbase.dll___stdio_common_vswprintf]
leave
ret
Function at 0x405d74
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040603f
test bl, 8
mov dword [ebp - 8], eax
je 0x405db3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x42a2e8], eax
jmp 0x405f30
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405dcd
test eax, eax
je 0x405ede
test bl, 2
je 0x405ede
mov esi, 0x425750
push edi
push esi
call fcn.00406668
cmp dword [ebp + 8], 0
je 0x405dec
push 0x40a59c
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405df2
push edi
call fcn.00405f83
cmp word [edi], 0
jne 0x405e02
cmp word [0x425750], 0x5c
jne 0x405e0d
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ed3
cmp word [ebp - 0x22c], 0x2e
jne 0x405e57
cmp word [ebp - 0x22a], 0
je 0x405eb6
cmp word [ebp - 0x22a], 0x2e
jne 0x405e57
cmp word [ebp - 0x228], 0
je 0x405eb6
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406668
test byte [ebp - 0x258], 0x10
je 0x405e82
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405eb6
push dword [ebp + 0xc]
push edi
call fcn.00405d74
jmp 0x405eb6
push dword [ebp - 4]
push edi
call fcn.00405d2c
test eax, eax
jne 0x405eae
cmp dword [ebp - 4], eax
je 0x405ea6
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push 0
push edi
call fcn.00406428
jmp 0x405eb6
inc dword [0x42a2e8]
jmp 0x405eb6
push edi
push 0xfffffffffffffff2
call fcn.004056ca
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405e2f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405ede
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405f30
cmp dword [ebp - 8], esi
jne 0x405ef2
inc dword [0x42a2e8]
jmp 0x405f30
push edi
call fcn.0040699e
test eax, eax
je 0x405f30
push edi
call fcn.00405f37
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405d2c
test eax, eax
jne 0x405f28
cmp dword [ebp - 4], esi
je 0x405eea
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push esi
push edi
call fcn.00406428
jmp 0x405f30
push edi
push 0xffffffffffffffe5
call fcn.004056ca
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100075e9
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
dec dword [edi]
mov bh, 0x41
adc al, 0xf
mov bh, 0x71
push es