joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4403bb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x440458
push ebx
push esi
call fcn.00440384
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043e9dd
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x440405
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x440457
push edi
push eax
call fcn.0043e6ca
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x440425
call fcn.0043e690
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x440456
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043e9dd
add esp, 0x20
test eax, eax
jne 0x440444
push edi
call fcn.0043e690
jmp 0x44044c
push ebx
call fcn.0043e690
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4da360
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x98000]
push edi
jmp 0x4da37a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4da381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da370
mov eax, 1
add ebx, ebx
jne 0x4da393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4da3a4
jne 0x4da3c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da3c3
dec eax
add ebx, ebx
jne 0x4da3b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4da388
add ebx, ebx
jne 0x4da3bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4da415
xor ecx, ecx
sub eax, 3
jb 0x4da3db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4da44a
sar eax, 1
mov ebp, eax
jmp 0x4da3e6
add ebx, ebx
jne 0x4da3e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da3b4
inc ecx
add ebx, ebx
jne 0x4da3f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4da3b4
add ebx, ebx
jne 0x4da401
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4da3f6
jne 0x4da412
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4da3f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4da434
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4da426
jmp 0x4da376
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4da434
add edi, ecx
jmp 0x4da376
pop esi
mov edi, esi
mov ecx, 0x3726
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4da452
cmp byte [edi], 0x22
jne 0x4da452
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4da457
lea edi, [esi + 0xd6000]
mov eax, dword [edi]
or eax, eax
je 0x4da4cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x104b84]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x104cd8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4da484
mov ecx, edi
jns 0x4da4b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x104cdc]
or eax, eax
je 0x4da4c9
mov dword [ebx], eax
add ebx, 4
jmp 0x4da4a1
call dword [esi + 0x104cec]
mov ebp, dword [esi + 0x104ce0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4da503
sub esp, 0xffffff80
jmp 0x416781
Function at 0x10002c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x10], eax
push edi
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0xc], edx
jb 0x10002c6e
mov edi, dword [ebx]
jmp 0x10002c70
mov edi, ebx
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x10002c94
mov edx, eax
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10002c80
mov edx, dword [ebp - 0xc]
mov edi, dword [edx + 0x14]
mov ecx, edi
and ecx, esi
cmp dword [edx + 0x18], ecx
ja 0x10002ca9
shr edi, 1
or eax, 0xffffffff
sub eax, edi
add ecx, eax
mov esi, dword [edx + 8]
shl ecx, 3
mov dword [ebp - 8], ecx
mov esi, dword [ecx + esi]
add ecx, dword [edx + 8]
mov eax, dword [edx]
cmp dword [ecx], eax
je 0x10002cc3
mov eax, dword [ecx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x10002d60
cmp dword [ebx + 0x14], 8
lea ecx, [esi + 8]
jb 0x10002cd8
mov eax, dword [ebx]
jmp 0x10002cda
mov eax, ebx
push dword [ebx + 0x10]
push eax
push dword [ecx + 0x10]
push 0
call fcn.100035e0
test eax, eax
je 0x10002cf6
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
jmp 0x10002cb5
mov edi, esi
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 8]
mov edi, edi
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx + 8]
mov eax, dword [edx]
cmp dword [ecx + edi], eax
je 0x10002d13
mov eax, dword [ecx + edi + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x10002d3e
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
jb 0x10002d25
mov eax, dword [eax]
push ecx
push eax
push dword [ebx + 0x10]
mov ecx, ebx
push 0
call fcn.100035e0
test eax, eax
jne 0x10002d3b
mov esi, dword [esi]
jmp 0x10002d00
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x14]
cmp edi, esi
je 0x10002d60
mov eax, dword [ebp - 0x10]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx]
pop edi
pop esi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 8
Function at 0x10003360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x1000338e
mov esi, dword [edi]
jmp 0x10003390
mov esi, edi
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x100033b4
mov edi, eax
lea ecx, [ecx]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100033a0
mov edi, dword [ebp - 0xc]
mov esi, dword [ebx + 0x14]
mov ecx, esi
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x100033c9
shr esi, 1
or eax, 0xffffffff
sub eax, esi
add ecx, eax
mov esi, dword [ebx]
shl ecx, 3
mov dword [ebp - 8], ecx
add ecx, dword [ebx + 8]
mov eax, dword [ecx]
cmp esi, eax
je 0x10003415
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x10003415
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
jb 0x100033f4
mov eax, dword [eax]
push ecx
push eax
push dword [edi + 0x10]
mov ecx, edi
push 0
call fcn.100035e0
test eax, eax
je 0x10003413
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 8]
cmp esi, dword [ecx + eax]
jne 0x100033e3
jmp 0x10003415
mov esi, dword [esi]
mov eax, dword [ebx]
push edi
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push dword [eax + 4]
push eax
call fcn.10003830
mov edx, eax
mov ecx, 0x3fffffe
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jae 0x10003442
push str.list_T__too_long
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xlength_error_char_const__]
inc eax
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x1000347c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x10003495
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [edx + eax + 4], edi
jmp 0x100034ba
cmp eax, esi
jne 0x1000349d
mov dword [ecx], edi
jmp 0x100034ba
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100034ba
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [edx + eax + 4]
mov edx, dword [edx + 4]
mov dword [ecx + eax + 4], edx
mov ecx, ebx
call fcn.10003520
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100036a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x100036ce
mov esi, dword [edi]
jmp 0x100036d0
mov esi, edi
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x100036f4
mov edi, eax
lea ecx, [ecx]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100036e0
mov edi, dword [ebp - 0xc]
mov esi, dword [ebx + 0x14]
mov ecx, esi
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x10003709
shr esi, 1
or eax, 0xffffffff
sub eax, esi
add ecx, eax
mov esi, dword [ebx]
shl ecx, 3
mov dword [ebp - 8], ecx
add ecx, dword [ebx + 8]
mov eax, dword [ecx]
cmp esi, eax
je 0x10003755
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x10003755
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
jb 0x10003734
mov eax, dword [eax]
push ecx
push eax
push dword [edi + 0x10]
mov ecx, edi
push 0
call fcn.100035e0
test eax, eax
je 0x10003753
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 8]
cmp esi, dword [ecx + eax]
jne 0x10003723
jmp 0x10003755
mov esi, dword [esi]
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x1000377f
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x10003798
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [edx + eax + 4], edi
jmp 0x100037bd
cmp eax, esi
jne 0x100037a0
mov dword [ecx], edi
jmp 0x100037bd
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100037bd
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [edx + eax + 4]
mov edx, dword [edx + 4]
mov dword [ecx + eax + 4], edx
mov ecx, ebx
call fcn.10003520
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003c80
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010bc82
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CChrome.0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov dword [ebp - 0x220], esi
mov word [esi + 4], cx
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], ecx
mov word [esi + 0x1c], ax
lea edi, [esi + 0x34]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], eax
mov word [edi], ax
mov dword [esi + 0x60], 7
mov dword [esi + 0x5c], eax
mov word [esi + 0x4c], cx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov al, byte [ebp + 8]
mov byte [esi + 0x70], al
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], ecx
xor eax, eax
mov byte [ebp - 4], 5
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x21c], 0
jne 0x10003d5c
xor ecx, ecx
jmp 0x10003d74
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003d65
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call fcn.10002100
push 0x14
push 0
push 0x10118538
mov ecx, edi
call fcn.10007090
cmp eax, 0xffffffff
je 0x10003db3
mov ecx, esi
mov byte [esi + 0x71], 1
call fcn.100043f0
push 0
push 0x10118564
mov ecx, edi
call fcn.10002100
jmp 0x10003dc0
push edi
lea ecx, [esi + 0x74]
mov byte [esi + 0x71], 0
call fcn.10006e40
push 0
push 0x10118568
lea ecx, [esi + 0x4c]
call fcn.10002100
mov eax, dword [0x10157f64]
test al, 1
jne 0x10003dfa
or eax, 1
mov dword [0x10157f64], eax
mov byte [ebp - 4], 6
call fcn.10015cb0
push 0x10116320
call fcn.1010a16b
add esp, 4
mov byte [ebp - 4], 5
cmp dword [0x10157fc4], 8
mov edx, 0x10157fb0
cmovae edx, dword [0x10157fb0]
cmp word [edx], 0
jne 0x10003e17
xor eax, eax
jmp 0x10003e2f
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003e20
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esi + 4]
call fcn.10002100
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 4
Function at 0x10003ec0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010bcd1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea edi, [ecx + 0x34]
mov dword [ebp - 0x30], 0
cmp dword [edi + 0x14], 8
jb 0x10003f06
mov eax, dword [edi]
jmp 0x10003f08
mov eax, edi
mov esi, dword [ebp + 8]
push eax
push str._sGoogleChromeUser_DataDefaultLocal_State
push esi
call fcn.10040660
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.10001d60
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.10041500
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov byte [ebp - 4], 0
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
setne al
cmp dword [ebp - 0x18], 8
mov byte [ebp - 0x11], al
jb 0x10003f8c
push dword [ebp - 0x2c]
call ebx
mov al, byte [ebp - 0x11]
add esp, 4
test al, al
jne 0x10003fe6
cmp dword [edi + 0x14], 8
jb 0x10003f98
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x2c]
push str._sGoogleChromeUser_DataLocal_State
push eax
call fcn.10040660
mov edi, eax
add esp, 0xc
cmp esi, edi
je 0x10003fd8
cmp dword [esi + 0x14], 8
jb 0x10003fbd
push dword [esi]
call ebx
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
push edi
mov word [esi], ax
call fcn.10001be0
cmp dword [ebp - 0x18], 8
jb 0x10003fe6
push dword [ebp - 0x2c]
call ebx
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 4
Function at 0x10004790
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010be59
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 1
xor eax, eax
push 0xffffffffffffffff
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], 0
push eax
mov word [esi], ax
lea eax, [ebp + 0xc]
push eax
call fcn.10001d60
xor eax, eax
mov dword [ebp - 0x4c], 1
push 0xffffffffffffffff
push eax
mov word [ebp - 0x44], ax
lea ecx, [ebp - 0x44]
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], 7
push eax
mov dword [ebp - 0x34], 0
call fcn.10001d60
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.10041500
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
setne bl
cmp dword [ebp - 0x30], 8
jb 0x10004858
push dword [ebp - 0x44]
call edi
add esp, 4
test bl, bl
je 0x10004927
mov ebx, dword [ebp - 0x48]
add ebx, 4
cmp dword [ebx + 0x14], 8
jb 0x1000486e
mov ebx, dword [ebx]
call fcn.100c0790
push eax
push ebx
lea eax, [ebp - 0x2c]
push 0x10118810
push eax
call fcn.10040660
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
lea eax, [ebp + 0xc]
push 0
cmovae ecx, dword [ebp - 0x2c]
cmp dword [ebp + 0x20], 8
push ecx
cmovae eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor eax, eax
mov dword [ebp - 0x30], 7
push 0xffffffffffffffff
push eax
mov word [ebp - 0x44], ax
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x34], 0
push eax
call fcn.10001d60
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.10041500
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov byte [ebp - 4], 3
setne bl
cmp dword [ebp - 0x30], 8
jb 0x10004902
push dword [ebp - 0x44]
call edi
add esp, 4
test bl, bl
je 0x10004919
lea eax, [ebp - 0x2c]
cmp esi, eax
je 0x10004919
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.10001d60
cmp dword [ebp - 0x18], 8
jb 0x10004927
push dword [ebp - 0x2c]
call edi
add esp, 4
cmp dword [ebp + 0x20], 8
jb 0x10004935
push dword [ebp + 0xc]
call edi
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10004960
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010be90
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x30], ax
lea ecx, [ebp - 0x30]
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], 7
push eax
mov dword [ebp - 0x20], 0
call fcn.10001d60
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.10041500
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov byte [ebp - 4], 0
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
setne bl
cmp dword [ebp - 0x1c], 8
jb 0x100049f2
push dword [ebp - 0x30]
call edi
add esp, 4
test bl, bl
jne 0x10004a27
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0x10118828
push 1
push 0x9c
push 0x10118870
push 0x10118854
call fcn.100ffcc0
add esp, 0x18
xor esi, esi
jmp 0x10004ae8
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001d60
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.10004790
mov ebx, eax
add esi, 0x1c
cmp esi, ebx
je 0x10004a87
cmp dword [esi + 0x14], 8
jb 0x10004a6c
push dword [esi]
call edi
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
push ebx
mov word [esi], ax
call fcn.10001be0
cmp dword [ebp - 0x1c], 8
jb 0x10004a95
push dword [ebp - 0x30]
call edi
add esp, 4
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x14], 0
jb 0x10004aa6
mov eax, dword [esi]
jmp 0x10004aa8
mov eax, esi
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.100bc300
add esp, 8
test eax, eax
je 0x10004ae5
cmp dword [esi + 0x14], 8
jb 0x10004ac1
mov esi, dword [esi]
push eax
push esi
push 0x101188c0
push 1
push 0xa5
push 0x10118920
push str.CChrome::Open
call fcn.100ffcc0
add esp, 0x1c
xor esi, esi
jmp 0x10004ae8
mov esi, dword [ebp - 0x14]
cmp dword [ebp + 0x1c], 8
jb 0x10004af6
push dword [ebp + 8]
call edi
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100069a0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10152034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0x10
jb 0x100069c1
mov ecx, dword [eax]
jmp 0x100069c3
mov ecx, eax
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ecx
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x100069fb
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0xc]
mov ecx, esi
push dword [ebp - 8]
call fcn.10008550
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1010a06b
mov esp, ebp
pop ebp
ret 8