joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x518a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x518a860]
xor edx, dword [ebx*4 + 0x518ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x518a460]
add ecx, 4
xor edx, dword [eax*4 + 0x518b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x518a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x518ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x518a460]
add ecx, 4
xor eax, dword [edx*4 + 0x518b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x518a860]
xor edx, dword [ebx*4 + 0x518ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x518a460]
xor edx, dword [eax*4 + 0x518b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x518a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x518ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x518a460]
xor eax, dword [edx*4 + 0x518b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x518a860]
xor edx, dword [ebx*4 + 0x518ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x518a460]
xor edx, dword [eax*4 + 0x518b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x518a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x518ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x518a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x518b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x518a860]
xor edx, dword [ebx*4 + 0x518ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x518a460]
add ecx, 4
xor edx, dword [eax*4 + 0x518b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x518a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x518ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x518a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x518b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x518a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x518ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x518a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x518b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x518a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x16e8a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x16e8a860]
xor edx, dword [ebx*4 + 0x16e8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x16e8a460]
add ecx, 4
xor edx, dword [eax*4 + 0x16e8b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x16e8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x16e8ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x16e8a460]
add ecx, 4
xor eax, dword [edx*4 + 0x16e8b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x16e8a860]
xor edx, dword [ebx*4 + 0x16e8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x16e8a460]
xor edx, dword [eax*4 + 0x16e8b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x16e8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x16e8ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x16e8a460]
xor eax, dword [edx*4 + 0x16e8b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x16e8a860]
xor edx, dword [ebx*4 + 0x16e8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x16e8a460]
xor edx, dword [eax*4 + 0x16e8b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x16e8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x16e8ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x16e8a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x16e8b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x16e8a860]
xor edx, dword [ebx*4 + 0x16e8ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x16e8a460]
add ecx, 4
xor edx, dword [eax*4 + 0x16e8b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x16e8a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x16e8ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x16e8a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x16e8b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x16e8a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x16e8ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x16e8a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x16e8b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x16e8a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x26665029
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0xb20]
fld qword [esi + 0xb08]
push edi
fstp qword [ebp - 0x20]
fld qword [esi + 0xaf8]
mov edi, eax
mov ebx, eax
fstp qword [ebp - 0x28]
mov ecx, eax
and eax, 4
xor edx, edx
inc edx
mov dword [ebp - 0x10], eax
mov al, byte [esi + 0xa20]
and ecx, 8
and edi, edx
and ebx, 2
mov dword [ebp - 8], ecx
mov byte [ebp - 1], al
mov dword [esi + 0xf40], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
fld qword [0x266bb130]
mov dword [ebp - 0x14], eax
fld qword [0x266bb098]
fld st(1)
fucompp
fnstsw ax
test ah, 0x44
jp 0x2666509c
and dword [esi + 0xf40], 0
test edi, edi
je 0x266650b1
fld qword [0x266bb4a8]
fmul st(1)
fsubr qword [ebp - 0x20]
fstp qword [esi + 0xb08]
test ebx, ebx
je 0x266650c6
fld qword [0x266bb190]
fmul st(1)
fsubr qword [ebp - 0x28]
fstp qword [esi + 0xaf8]
cmp dword [ebp - 8], 0
je 0x266650fb
movzx eax, byte [ebp - 1]
fld qword [0x266bb240]
fadd st(1)
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
fmulp st(1)
fld st(1)
fmul qword [0x266bb0d8]
fsubp st(1)
fmul qword [0x266bb190]
call fcn.266adbb0
mov byte [esi + 0xa20], al
cmp dword [ebp - 0x10], 0
je 0x26665115
fadd qword [0x266bb240]
fmul qword [0x266bb190]
fstp qword [esi + 0xf38]
jmp 0x26665117
fstp st(0)
call fcn.26666429
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xa4]
mov eax, esi
call fcn.26666325
cmp dword [esi + 0xf40], 0
je 0x26665193
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
mov ecx, dword [0x266bf028]
cmp eax, ecx
jb 0x26665150
fldz
jmp 0x26665084
test eax, eax
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
jge 0x26665160
fadd qword [0x266bb068]
test ecx, ecx
mov dword [ebp - 0xc], ecx
fild dword [ebp - 0xc]
jge 0x26665170
fadd qword [0x266bb068]
fdivp st(1)
fsubr qword [0x266bb058]
fmul qword [0x266bb130]
fcom qword [0x266bb098]
fnstsw ax
test ah, 0x41
jne 0x26665084
fstp st(0)
jmp 0x26665149
pop edi
pop esi
pop ebx
leave
ret
Function at 0x26681ef7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x266aeca6
call fcn.266ade3c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 8], ebx
push edi
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
push str.PCSWDGraph
mov dword [esi + 0x14], str._n_n_n_n
call edi
movzx eax, ax
push 0x266b82c8
mov dword [esi + 0x18], eax
call edi
movzx eax, ax
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x48]
push eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
call fcn.2668961e
lea eax, [esi + 0x648]
push eax
mov byte [ebp - 4], 2
call fcn.2668961e
lea eax, [esi + 0xc48]
push eax
mov byte [ebp - 4], 3
call fcn.2666de3a
mov dword [esi + 0xcb0], 0xea60
mov dword [esi + 0xcb4], 1
xor eax, eax
lea edi, [esi + 0xcb8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esi + 0xcc8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esi + 0xcd8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 0xce8], ebx
mov dword [esi + 0xcec], ebx
mov dword [esi + 0xcf0], ebx
or dword [esi + 0xcf4], 0xffffffff
mov dword [esi + 0xcf8], ebx
mov dword [esi + 0xcfc], ebx
mov dword [esi + 0xd00], ebx
mov dword [esi + 0xd04], ebx
mov dword [esi + 0xd08], ebx
mov dword [esi + 0xd0c], 0xd
mov dword [esi + 0xd10], ebx
mov dword [esi + 0xd14], ebx
mov dword [esi + 0xd18], ebx
lea edx, [esi + 0xd1c]
push 0x18
xor eax, eax
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
call fcn.266820b9
lea eax, [esi + 0xd80]
call fcn.26689402
or dword [esi + 0xddc], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0xdc0], ebx
mov dword [esi + 0xdc4], ebx
mov dword [esi + 0xdc8], ebx
mov dword [esi + 0xdcc], ebx
mov dword [esi + 0xdd0], ebx
mov dword [esi + 0xdd4], ebx
mov dword [esi + 0xdd8], ebx
mov dword [esi + 0xde0], ebx
mov dword [esi + 0xe04], ebx
mov dword [esi + 0xdec], ebx
mov dword [esi + 0xde4], ebx
mov dword [esi + 0xdf0], ebx
mov dword [esi + 0xde8], ebx
mov dword [esi + 0xdfc], ebx
mov dword [esi + 0xdf4], ebx
mov dword [esi + 0xe00], ebx
mov dword [esi + 0xdf8], ebx
pop edi
mov dword [esi + 0xdb8], esi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x26684829
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x266adfad
call fcn.266ade3c
sub esp, 0x680
push ebx
push esi
push edi
mov edx, 0x82
xor eax, eax
xor ebx, ebx
mov ecx, edx
mov word [ebp - 0x274], bx
lea edi, [ebp - 0x272]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x68c], bx
lea edi, [ebp - 0x68a]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x68c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
neg esi
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push 0x266b0670
mov edi, 0x821
mov dword [ebp - 4], ebx
call fcn.266a920e
push 0x58
pop edi
push edi
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x14
mov dword [ebp - 0x68], edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x64], eax
mov eax, dword [ecx]
mov dword [ebp - 0x5c], str.Bitmap__.bmp_
call dword [eax + 0x50]
test eax, eax
je 0x266848d1
mov dword [ebp - 0x5c], 0x266b81e8
lea eax, [ebp - 0x274]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x48], 0x20a
jne 0x266848f4
mov eax, 0x266b6600
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x34], 0x880002
mov dword [ebp - 0x2c], 0x266b81e0
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
test eax, eax
je 0x266849a7
lea eax, [ebp - 0x480]
push eax
push ebx
push ebx
xor eax, eax
lea ecx, [ebp - 0x274]
call fcn.26688d87
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
lea eax, [ebp - 0x480]
push 0x266b81d4
push eax
call edi
add esp, 0x14
test eax, eax
jne 0x2668495f
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp + 8]
call fcn.26683bd7
jmp 0x266849a7
lea eax, [ebp - 0x480]
push 0x266b81c8
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x26684984
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp + 8]
call fcn.26683f00
jmp 0x266849a7
lea eax, [ebp - 0x480]
push 0x266b81bc
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x266849a7
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp + 8]
call fcn.26683d8a
pop edi
cmp esi, ebx
pop esi
pop ebx
je 0x266849bb
lea eax, [ebp - 0x68c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.266ab22a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8
Function at 0x2668f721
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x266ae20b
call fcn.266ade3c
push ebx
push esi
mov esi, dword [ebp + 8]
push 0x1e
pop edx
mov dword [esi], 0x266b845c
xor ebx, ebx
push 4
xor eax, eax
inc ebx
pop ecx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edx
mov dword [esi + 8], ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 4], 0x266bae3c
mov dword [ebp - 4], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], edx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x20], 0x266bae3c
mov eax, esi
mov byte [ebp - 4], bl
call fcn.2668f81c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x266a9cc0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp word [esi], ax
je 0x266a9e4a
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call edi
push 0xffffffffffffffff
push esi
push 0x105
lea ebx, [ebp - 0x220]
mov dword [ebp - 8], eax
call fcn.266aa76a
mov esi, ebx
call fcn.266a9e58
mov esi, dword [sym.imp.MSVCRT.dll_wcschr]
lea eax, [ebp - 0x21e]
push 0x5c
push eax
call esi
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x266a9dc1
lea eax, [ebp - 0x220]
cmp ebx, eax
jbe 0x266a9d40
cmp word [ebx - 2], 0x3a
je 0x266a9db1
lea eax, [ebp - 0x21e]
cmp ebx, eax
jne 0x266a9dbd
cmp word [ebp - 0x220], 0x5c
jne 0x266a9dbd
push 0x5c
add ebx, 2
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x266a9df6
push 0x5c
add eax, 2
push eax
jmp 0x266a9db7
and word [ebx], 0
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.266a9c9d
test eax, eax
pop ecx
pop ecx
jne 0x266a9dac
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x266a9dac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x266a9e4d
mov word [ebx], 0x5c
add ebx, 2
push 0x5c
push ebx
call esi
pop ecx
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x266a9d6e
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x266a9def
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x266a9df6
push 0
push dword [ebp + 8]
call fcn.266a9e83
test eax, eax
pop ecx
pop ecx
je 0x266a9df6
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 0xc]
push dword [ebp - 4]
mov eax, ebx
call fcn.266a9c61
test eax, eax
pop ecx
je 0x266a9e45
push 1
mov edi, 0x266b0670
mov esi, ebx
call fcn.266a8310
push dword [ebp + 8]
mov ecx, edi
push 0x6dde
call fcn.266a8525
pop ecx
pop ecx
push dword [ebp + 8]
push 1
call fcn.266a876d
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret
lea eax, [ebp - 0x220]
mov dword [ebp + 8], eax
jmp 0x266a9df6
Function at 0x266a9eb1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
mov esi, eax
call edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebx], 0xffffffff
setne al
push eax
mov eax, esi
call fcn.266a9c61
test eax, eax
pop ecx
je 0x266a9f31
push 1
mov edi, 0x266b0670
call fcn.266a8310
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebx]
mov ebx, esi
push 0x6de2
call fcn.266a8525
add esp, 0xc
push dword [ebp + 0xc]
push 1
call fcn.266a876d
mov ebx, dword [ebp + 8]
xor eax, eax
cmp dword [ebx], 0xffffffff
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x10006210
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], 0x4c6
cmp dword [0x1000b534], 0
je 0x100062f6
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov ecx, dword [0x1000b534]
cmp eax, dword [ecx + 8]
jae 0x100062f1
mov eax, dword [0x1000b534]
add eax, 0xc
imul ecx, dword [ebp - 8], 0x34
add eax, ecx
mov dword [esp], 6
call dword [eax + 8]
sub esp, 4
and eax, 2
cmp eax, 0
je 0x100062de
mov eax, dword [0x1000b534]
add eax, 0xc
imul ecx, dword [ebp - 8], 0x34
add eax, ecx
cmp dword [eax + 0x30], 0
je 0x100062b6
mov eax, dword [0x1000b534]
add eax, 0xc
imul ecx, dword [ebp - 8], 0x34
add eax, ecx
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov dword [esp + 4], ecx
call eax
sub esp, 8
mov dword [ebp - 4], eax
jmp 0x100062bd
mov dword [ebp - 4], 0x4c6
cmp dword [ebp - 4], 0
je 0x100062d4
cmp dword [ebp - 4], 0x961
jne 0x100062d9
jmp 0x100062f1
jmp 0x100062de
jmp 0x100062e3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x1000623a
jmp 0x100062f6
cmp dword [ebp - 4], 0
jne 0x100063cc
mov eax, dword [ebp + 0xc]
and eax, 1
cmp eax, 0
je 0x100063cc
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [esp], eax
mov dword [esp + 4], 0x103
call dword [sym.imp.MSVCRT.dll_iswctype]
cmp eax, 0
je 0x100063c7
mov eax, dword [ebp + 8]
movzx eax, word [eax + 2]
cmp eax, 0x3a
jne 0x100063c7
mov dword [esp], 0xf003f
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
sub esp, 8
cmp eax, 0
jne 0x100063c7
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], 0x4e
mov word [ebp - 0x1e], 0x65
mov word [ebp - 0x1c], 0x74
mov word [ebp - 0x1a], 0x77
mov word [ebp - 0x18], 0x6f
mov word [ebp - 0x16], 0x72
mov word [ebp - 0x14], 0x6b
mov word [ebp - 0x12], 0x5c
mov ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 0x10], dx
mov word [ebp - 0xe], 0
mov ecx, dword [ebp - 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
sub esp, 8
mov ecx, dword [ebp - 0xc]
mov dword [esp], ecx
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x100063cc
mov eax, dword [ebp - 4]
add esp, 0x2c
pop ebp
ret 0xc
Function at 0x100068f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
call pe_dos_header
lea ecx, str.__s___p___p__n
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 0xc], eax
call pe_dos_header
cmp dword [ebp + 8], 0
jne 0x10006958
mov dword [ebp - 0x10], 0x1e7
jmp 0x10006a67
cmp dword [ebp + 0x10], 0
jne 0x1000696e
mov dword [ebp - 0x10], 0x1e7
jmp 0x10006a62
cmp dword [ebp + 0xc], 0
jne 0x10006990
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
je 0x10006990
mov dword [ebp - 0x10], 0x1e7
jmp 0x10006a5d
mov eax, dword [ebp + 8]
cmp word [eax], 0
jne 0x100069a9
mov dword [ebp - 0x10], 0x4b0
jmp 0x10006a58
mov eax, dword [ebp + 8]
movzx eax, word [eax + 2]
cmp eax, 0x3a
jne 0x10006a4c
mov eax, dword [ebp + 8]
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
call eax
sub esp, 4
mov ecx, eax
add ecx, 0xfffffffe
sub ecx, 2
mov dword [ebp - 0x28], eax
jb 0x10006a26
jmp 0x100069e0
mov eax, dword [ebp - 0x28]
sub eax, 4
je 0x10006a02
jmp 0x100069f1
mov eax, dword [ebp - 0x28]
sub eax, 5
je 0x10006a26
jmp 0x10006a40
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movzx edx, word [edx]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.10006ab0
mov dword [ebp - 0x10], eax
jmp 0x10006a47
lea eax, str.file_is_local_n
mov dword [esp], eax
call pe_dos_header
mov dword [ebp - 0x10], 0x8ca
jmp 0x10006a47
mov dword [ebp - 0x10], 0x4b0
jmp 0x10006a53
mov dword [ebp - 0x10], 0x4b0
jmp 0x10006a58
jmp 0x10006a5d
jmp 0x10006a62
jmp 0x10006a67
cmp dword [ebp - 0x10], 0
je 0x10006a80
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, dword [ebp - 0x10]
lea ecx, str.Returning__d_n
mov dword [esp], ecx
mov dword [esp + 4], eax
call pe_dos_header
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, ecx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x10008890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x18], 0
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
cmp eax, 0
jne 0x1000897d
cmp dword [ebp - 0x14], 1
jne 0x1000897d
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp eax, 0
jne 0x10008944
mov dword [ebp - 0x10], 0
jmp 0x10008983
xor eax, eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [ebp - 0x34], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret