joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006e86
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020004]
cmp eax, 0xffffffff
je 0x1006eb3
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1006f4b
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1006f36
push 0x1001c40
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01006ad3
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.01006d63
test eax, eax
je 0x1006f41
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01005f9f
test eax, eax
je 0x1006f2f
cmp dword [ebp - 0x134], 0x50001
jne 0x1006f41
mov eax, dword [ebp - 0x130]
shr eax, 0x10
mov ecx, 0xa28
cmp ax, cx
jne 0x1006f41
xor eax, eax
inc eax
mov dword [0x1020004], eax
jmp 0x1006f4a
push 0x1001c08
jmp 0x1006f3b
push 0x1001bd0
call fcn.01005858
pop ecx
and dword [0x1020004], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x1006f5c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020008]
cmp eax, 0xffffffff
je 0x1006f89
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x100700e
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1006ff9
push 0x1001c40
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01006ad3
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.01006d63
test eax, eax
je 0x1007004
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01005f9f
test eax, eax
je 0x1006ff2
cmp dword [ebp - 0x134], 0x50002
jne 0x1007004
xor eax, eax
inc eax
mov dword [0x1020008], eax
jmp 0x100700d
push 0x1001c8c
jmp 0x1006ffe
push 0x1001c50
call fcn.01005858
pop ecx
and dword [0x1020008], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x100701f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102000c]
cmp eax, 0xffffffff
je 0x100704c
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10070d3
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10070bd
lea eax, [ebp - 0x108]
push eax
mov esi, 0x1001c40
push esi
call fcn.01006d63
test eax, eax
je 0x10070c8
push esi
push edi
lea eax, [ebp - 0x108]
push eax
call fcn.01006ad3
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01005f9f
test eax, eax
je 0x10070b6
cmp dword [ebp - 0x134], 0x60000
jb 0x10070c8
xor eax, eax
inc eax
mov dword [0x102000c], eax
jmp 0x10070d1
push 0x1001d00
jmp 0x10070c2
push 0x1001cc8
call fcn.01005858
pop ecx
and dword [0x102000c], 0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret
Function at 0x1007100
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x1007159
cmp dword [ebp - 0x94], 5
jne 0x1007159
cmp dword [ebp - 0x90], 1
jne 0x1007159
call fcn.01006f5c
test eax, eax
jne 0x1007159
call fcn.0100701f
test eax, eax
je 0x1007162
call fcn.01006e86
test eax, eax
je 0x100716e
call fcn.01006155
test eax, eax
jne 0x100716e
inc eax
jmp 0x1007170
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x1020010], eax
call fcn.0100e2ad
leave
ret

Function at 0x1007186
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020014]
cmp eax, 0xffffffff
je 0x10071b0
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1007212
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10071f4
cmp dword [ebp - 0x94], 5
jne 0x10071f4
cmp dword [ebp - 0x90], 1
jne 0x10071f4
call fcn.01006f5c
test eax, eax
jne 0x10071f4
call fcn.0100701f
test eax, eax
je 0x10071fd
call fcn.01006e86
test eax, eax
je 0x100720b
call fcn.01006155
test eax, eax
je 0x100720b
xor eax, eax
inc eax
jmp 0x100720d
xor eax, eax
mov dword [0x1020014], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x1007223
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020018]
cmp eax, 0xffffffff
je 0x100724d
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x100729b
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100727f
cmp dword [ebp - 0x94], 5
jne 0x100727f
cmp dword [ebp - 0x90], 2
je 0x1007288
call fcn.01006f5c
test eax, eax
je 0x1007294
call fcn.01006155
test eax, eax
jne 0x1007294
inc eax
jmp 0x1007296
xor eax, eax
mov dword [0x1020018], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x10072ac
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102001c]
cmp eax, 0xffffffff
je 0x10072d6
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1007326
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x1007308
cmp dword [ebp - 0x94], 5
jne 0x1007308
cmp dword [ebp - 0x90], 2
je 0x1007311
call fcn.01006f5c
test eax, eax
je 0x100731f
call fcn.01006155
test eax, eax
je 0x100731f
xor eax, eax
inc eax
jmp 0x1007321
xor eax, eax
mov dword [0x102001c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret
Function at 0x1007337
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020020]
cmp eax, 0xffffffff
je 0x1007361
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10073a6
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100739f
cmp dword [ebp - 0x94], 5
jne 0x100739f
cmp dword [ebp - 0x90], 0
jne 0x100739f
call fcn.010070e4
test eax, eax
jne 0x100739f
inc eax
jmp 0x10073a1
xor eax, eax
mov dword [0x1020020], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x1007437
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020028]
cmp eax, 0xffffffff
je 0x1007461
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10074b9
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x10074b2
cmp dword [ebp - 0x94], 4
jne 0x10074b2
cmp dword [ebp - 0x90], 0xa
jne 0x10074b2
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
je 0x10074b2
call fcn.010070e4
test eax, eax
jne 0x10074b2
inc eax
jmp 0x10074b4
xor eax, eax
mov dword [0x1020028], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x10074ca
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102002c]
cmp eax, 0xffffffff
je 0x10074f4
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x100755a
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x1007553
cmp dword [ebp - 0x94], 4
jne 0x1007553
cmp dword [ebp - 0x90], 0xa
jne 0x1007553
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
je 0x1007553
mov eax, 0x8ae
cmp word [ebp - 0x8c], ax
jb 0x1007553
call fcn.010070e4
test eax, eax
jne 0x1007553
inc eax
jmp 0x1007555
xor eax, eax
mov dword [0x102002c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret

Function at 0x100756b
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1020030]
cmp eax, 0xffffffff
je 0x1007595
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10075f6
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x10075ef
cmp dword [ebp - 0x94], 4
jne 0x10075ef
cmp dword [ebp - 0x90], 0x5a
je 0x10075e3
cmp dword [ebp - 0x90], 0xa
jne 0x10075ef
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
jne 0x10075ef
call fcn.010070e4
test eax, eax
jne 0x10075ef
inc eax
jmp 0x10075f1
xor eax, eax
mov dword [0x1020030], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100e2ad
leave
ret
Function at 0x100c456
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edx, ax
xor ecx, ecx
xor eax, eax
mov esi, 0xc0
cmp word [eax + 0x1020038], dx
je 0x100c4cd
add eax, 0xc
inc ecx
cmp eax, esi
jb 0x100c46f
and dword [ebp - 4], 0
mov eax, 0x3ff
push ebx
and edx, eax
xor ecx, ecx
push edi
mov di, word [ecx + 0x1020038]
and di, ax
cmp di, dx
je 0x100c4d8
inc dword [ebp - 4]
add ecx, 0xc
cmp ecx, esi
jb 0x100c48f
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edx, ax
xor ecx, ecx
xor eax, eax
cmp word [eax + 0x1020038], dx
je 0x100c4e6
add eax, 0xc
inc ecx
cmp eax, esi
jb 0x100c4b5
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
imul ecx, ecx, 0xc
mov eax, dword [ecx + 0x1020040]
jmp 0x100c4ca
mov eax, dword [ebp - 4]
imul eax, eax, 0xc
mov eax, dword [eax + 0x1020040]
jmp 0x100c4c8
imul ecx, ecx, 0xc
mov eax, dword [ecx + 0x1020040]
jmp 0x100c4c8

Function at 0x100c9a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push edi
xor edi, edi
cmp dword [0x10217bc], edi
je 0x100c9b9
xor eax, eax
inc eax
pop edi
ret
push 0x1003514
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10217bc], eax
cmp eax, edi
jne 0x100c9f5
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100175c
push 0x1003d5c
push 0x3a4
push 0x1003c44
call fcn.010059aa
add esp, 0x18
xor eax, eax
pop edi
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1003bd8
push eax
call esi
push 0x1003bbc
push dword [0x10217bc]
mov dword [0x10217d0], eax
call esi
push 0x1003bf4
push dword [0x10217bc]
mov dword [0x10217c8], eax
call esi
push 0x1003c30
push dword [0x10217bc]
mov dword [0x10217b8], eax
call esi
push 0x1003c08
push dword [0x10217bc]
mov dword [0x10217cc], eax
call esi
push 0x1003c1c
push dword [0x10217bc]
mov dword [0x10217c0], eax
call esi
mov dword [0x10217c4], eax
cmp dword [0x10217d0], edi
je 0x100ca94
cmp dword [0x10217c8], edi
je 0x100ca94
cmp dword [0x10217b8], edi
je 0x100ca94
cmp dword [0x10217cc], edi
je 0x100ca94
cmp dword [0x10217c0], edi
je 0x100ca94
cmp eax, edi
je 0x100ca94
xor eax, eax
inc eax
jmp 0x100caf8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call ebx
push eax
push 0x10017c0
mov edi, 0x1003d5c
push edi
push 0x3b6
mov esi, 0x1003c44
push esi
call fcn.010059aa
mov eax, dword [0x10217bc]
add esp, 0x18
test eax, eax
je 0x100caf5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x100caee
call ebx
test eax, eax
je 0x100caee
push 0
push eax
push 0x1001968
push edi
push 0x3bb
push esi
call fcn.010059aa
add esp, 0x18
and dword [0x10217bc], 0
xor eax, eax
pop ebx
pop esi
pop edi
ret
Function at 0x100cf0d
Capabilities:
Get common file path
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x41
pop esi
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
xor ebx, ebx
push eax
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x210], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100cf78
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1002320
push 0x1003f5c
push 0x21e
push 0x1003c44
call fcn.010059aa
add esp, 0x18
mov eax, esi
jmp 0x100d0ce
push 0x1003f48
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01006cba
test eax, eax
jne 0x100cfbb
lea eax, [ebp - 0x108]
push eax
push 0x1003f14
push ebx
push ebx
push 0x1003f5c
push 0x223
push 0x1003c44
call fcn.010059aa
add esp, 0x1c
jmp 0x100cf71
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x21c], eax
cmp eax, 0xffffffff
je 0x100d0c8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x100d09d
push esi
call fcn.0100e334
pop ecx
mov dword [ebp - 0x210], eax
cmp eax, ebx
je 0x100d09d
push ebx
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x210]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100d09d
push 0x1003efc
push dword [ebp - 0x210]
call fcn.0100ee70
pop ecx
pop ecx
cmp eax, ebx
je 0x100d09d
mov esi, 0x1003ef0
push esi
push eax
call fcn.0100ee70
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
cmp eax, ebx
je 0x100d09d
push edi
push esi
call fcn.0100e302
add dword [ebp - 0x214], eax
push 0x20
push dword [ebp - 0x214]
call fcn.0100eda0
add esp, 0x10
cmp eax, ebx
je 0x100d07a
mov byte [eax], bl
push dword [ebp - 0x214]
call fcn.0100eefb
pop ecx
mov ecx, eax
mov eax, 0x3ff
add ecx, eax
shr ecx, 0xa
add ecx, eax
shr ecx, 0xa
mov dword [ebp - 0x218], ecx
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x210], ebx
je 0x100d0bd
push dword [ebp - 0x210]
call fcn.0100e324
pop ecx
push 0x41
pop eax
cmp dword [ebp - 0x218], eax
jb 0x100d0ce
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e2ad
leave
ret
Function at 0x100d774
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x1020104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x62c], esi
call fcn.0100d611
push eax
push 0x10042c8
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.01006b2d
add esp, 0x10
push esi
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.01006a97
lea eax, [ebp - 0x220]
push 0x5c
push eax
call fcn.0100e2d0
xor edi, edi
pop ecx
pop ecx
cmp eax, edi
je 0x100d9f4
mov byte [eax], 0
lea eax, [ebp - 0x11c]
push eax
push edi
push 0x10042c4
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x100d817
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10042b0
push 0x1004298
push 0x4ee
jmp 0x100da05
push 0x1004294
push esi
mov dword [ebp - 0x628], edi
call fcn.0100e291
pop ecx
pop ecx
mov dword [ebp - 0x624], eax
cmp eax, edi
jne 0x100d85c
push esi
push 0x1004088
push edi
push 0x100428c
push 0x1004298
push 0x4f7
push 0x1003c44
call fcn.010059aa
add esp, 0x1c
jmp 0x100da12
lea eax, [ebp - 0x11c]
push 0x1003288
push eax
call fcn.0100e291
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x100d8ae
lea eax, [ebp - 0x11c]
push eax
push 0x1004088
push edi
push 0x100428c
push 0x1004298
push 0x4fe
push 0x1003c44
call fcn.010059aa
push dword [ebp - 0x624]
call fcn.0100de53
add esp, 0x20
jmp 0x100da12
push dword [ebp - 0x624]
mov edi, 0x400
lea eax, [ebp - 0x620]
push edi
push eax
call fcn.0100f179
add esp, 0xc
test eax, eax
je 0x100d977
mov esi, 0x1004280
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.01005ce5
test eax, eax
jne 0x100d910
call fcn.0100d611
push eax
push 0x100425c
call fcn.01005858
push esi
push ebx
call fcn.0100f025
add esp, 0x10
mov dword [ebp - 0x628], 1
jmp 0x100d953
cmp dword [ebp - 0x628], 0
jne 0x100d944
lea eax, [ebp - 0x620]
push eax
push 0x100424c
call fcn.01005ce5
test eax, eax
jne 0x100d944
push 0x1004200
call fcn.01005858
push esi
push ebx
call fcn.0100f025
add esp, 0xc
jmp 0x100d953
lea eax, [ebp - 0x620]
push ebx
push eax
call fcn.0100ded4
pop ecx
pop ecx
push dword [ebp - 0x624]
lea eax, [ebp - 0x620]
push edi
push eax
call fcn.0100f179
add esp, 0xc
test eax, eax
jne 0x100d8d6
mov esi, dword [ebp - 0x62c]
push ebx
call fcn.0100de53
push dword [ebp - 0x624]
call fcn.0100de53
pop ecx
pop ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test esi, esi
jne 0x100d9ef
push dword [ebp - 0x62c]
lea eax, [ebp - 0x11c]
push eax
push 0x10041e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10041d8
push 0x1004298
push 0x52a
push 0x1003c44
call fcn.010059aa
jmp 0x100d8a6
xor eax, eax
inc eax
jmp 0x100da14
push 0x10041c0
push edi
push edi
push 0x1004298
push 0x4e8
push 0x1003c44
call fcn.010059aa
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e2ad
leave
ret 4
Function at 0x100f6a2
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp edi, dword [esi*8 + 0x1020118]
je 0x100f6c8
inc esi
cmp esi, 0x17
mov dword [ebp - 4], esi
jb 0x100f6b6
cmp esi, 0x17
jae 0x100f822
push 3
call fcn.01015de4
cmp eax, 1
pop ecx
je 0x100f7ec
push 3
call fcn.01015de4
test eax, eax
pop ecx
jne 0x100f6fb
cmp dword [0x1020100], 1
je 0x100f7ec
cmp edi, 0xfc
je 0x100f822
push 0x1004890
mov edi, 0x314
push edi
mov esi, 0x1021858
push esi
call fcn.01015d77
add esp, 0xc
test eax, eax
je 0x100f731
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
mov byte [0x1021975], bl
push 0x104
mov ebx, 0x1021871
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100f774
push 0x1004878
push 0x2fb
push ebx
call fcn.01015d77
add esp, 0xc
test eax, eax
je 0x100f774
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.01011a5d
add esp, 0x14
push ebx
push edi
push esi
call fcn.01015cfe
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x100f792
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
push 0x1001474
push edi
push esi
call fcn.01015cfe
add esp, 0xc
test eax, eax
je 0x100f7b2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x102011c]
push edi
push esi
call fcn.01015cfe
add esp, 0xc
test eax, eax
je 0x100f7d7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.01011a5d
add esp, 0x14
push 0x12010
push 0x1004850
push esi
call fcn.01015b59
add esp, 0xc
jmp 0x100f822
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, ebx
je 0x100f822
cmp edi, 0xffffffff
je 0x100f822
mov edx, dword [esi*8 + 0x102011c]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100f80b
push ebx
lea eax, [ebp - 8]
push eax
sub ecx, esi
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1011bb7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x1011bc5
push eax
push esi
push dword [ebp + 8]
call fcn.010118ca
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1011bf3
adc byte [ebp - 0xaf73], cl
call dword [ecx - 1]
ror byte [ebx - 0x727407bb], 1
push esp
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.01011905
ljmp 0xc045
Function at 0x1011ce8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.01011915
push eax
push esi
push dword [ebp + 8]
call fcn.010118ca
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.01011915
push eax
push esi
push dword [ebp + 8]
call fcn.010118ca
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.01011905
fimul word [edx - 0x62771064]
jl 0x1011d8a
invalid
invalid

Function at 0x1012212
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.01011915
pop ecx
push eax
push dword [ebp + 0x18]
invalid
invalid

Function at 0x10127a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.01011905
shl byte [ebx], 1
in al, 0x1b
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax