joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59fe5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x5a082
push ebx
push esi
call fcn.00059fae
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00058ca0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x5a02f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5a081
push edi
push eax
call fcn.00052fe5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x5a04f
call fcn.00052fab
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x5a080
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00058ca0
add esp, 0x20
test eax, eax
jne 0x5a06e
push edi
call fcn.00052fab
jmp 0x5a076
push ebx
call fcn.00052fab
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x5c6af
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00052cc0
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5c71e
cmp esi, dword [ebp - 4]
je 0x5c719
cmp dword [ebp + 0xc], 0
je 0x5c719
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x5c6f6
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0005c201
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x5c720
xor eax, eax
inc eax
jmp 0x5c720
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x5c785
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00052cc0
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00052cc0
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x5c7fc
cmp word [ecx], dx
je 0x5c7fc
mov eax, dword [0x67634]
push edi
dec eax
push eax
push 0x67520
call fcn.0005c724
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x5c86f
cmp word [eax], dx
je 0x5c86f
mov eax, dword [edi]
test eax, eax
je 0x5c820
cmp word [eax], dx
je 0x5c820
lea eax, [ebp - 0x10]
push eax
call fcn.0005c107
jmp 0x5c829
lea eax, [ebp - 0x10]
push eax
call fcn.0005c1a2
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x5c899
mov eax, dword [0x6751c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x67210
call fcn.0005c724
add esp, 0xc
test al, al
je 0x5c899
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x5c864
cmp word [eax], di
je 0x5c864
lea eax, [ebp - 0x10]
push eax
call fcn.0005c107
pop ecx
jmp 0x5c89b
lea eax, [ebp - 0x10]
push eax
call fcn.0005c1a2
jmp 0x5c861
mov eax, dword [edi]
test eax, eax
je 0x5c886
cmp word [eax], dx
je 0x5c886
lea eax, [ebp - 0x10]
push eax
call fcn.0005c0bc
pop ecx
jmp 0x5c899
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x5c964
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0005c5a9
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5c964
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x5c964
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x5c964
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5c8f1
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0005532a
test ebx, ebx
je 0x5c95f
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0005532a
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5c964
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5c964
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0005fc07
add esp, 0x10
xor eax, eax
inc eax
jmp 0x5c966
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00046942
leave
ret
Function at 0x61900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x6192d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x6192d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x416000
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Encode data using xor
Persist via run registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x14], 0x3b200
mov dword [ebp - 0x34], 0x345c3a43
mov dword [ebp - 0x30], 0x37353034
mov dword [ebp - 0x2c], 0x2e386330
mov dword [ebp - 0x28], 0x657865
call 0x416031
pop edx
mov ecx, 0x23e
add edx, 0xf
xor byte [edx], 0xf7
inc edx
loop 0x41603a
xchg ebx, eax
or dl, al
invalid

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001090
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push esi
xor ecx, ecx
xor esi, esi
push edi
test ebx, ebx
jle 0x10001188
mov edi, dword [ebp + 8]
nop word [eax + eax]
mov al, byte [esi + edi]
cmp al, 0x3d
jne 0x100010bd
inc ecx
cmp ecx, 2
jg 0x10001104
cmp al, 0x7f
ja 0x10001104
movzx eax, al
mov al, byte [eax + 0x100242a0]
cmp al, 0x7f
je 0x10001104
cmp al, 0x40
jae 0x100010d6
test ecx, ecx
jne 0x10001104
inc esi
inc edx
cmp esi, ebx
jl 0x100010b0
test edx, edx
je 0x10001188
mov ecx, dword [ebp + 0x14]
lea eax, [edx + edx*2]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x1000110e
pop edi
pop esi
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp + 0xc], ecx
mov edi, 3
test esi, esi
jle 0x10001180
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx]
mov dl, byte [ecx + 0x100242a0]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub edi, ecx
movzx ecx, dl
mov edx, dword [ebp + 0xc]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0xc], edx
cmp edx, 4
jne 0x10001174
xor ecx, ecx
mov dword [ebp + 0xc], ecx
test edi, edi
jle 0x1000115f
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jle 0x1000116c
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jle 0x10001174
mov byte [eax], bl
inc eax
mov ecx, dword [ebp + 8]
dec esi
inc ecx
mov dword [ebp + 8], ecx
test esi, esi
jg 0x10001124
mov ecx, dword [ebp + 0x14]
sub eax, dword [ebp + 0x10]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10002110
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022a97
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x10033068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x98], 8
lea eax, [esi + 0x84]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x1000215d
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
push eax
push edi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x100022a6
xor eax, eax
mov dword [ebp - 0x814], 7
push eax
push 0x10024340
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
call fcn.10001760
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.10010540
push edi
lea eax, [ebp - 0x810]
push 0x10024344
push eax
call fcn.10001980
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [esi + 1], 0
mov ecx, esi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x100021f5
call fcn.10001f80
mov esi, eax
jmp 0x100021fc
call fcn.100020e0
mov esi, eax
lea eax, [ebp - 0x828]
cmp eax, esi
je 0x10002249
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10002224
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10001860
xor eax, eax
mov dword [ebp - 0x814], 7
push esi
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], eax
mov word [ebp - 0x828], ax
call fcn.10001280
mov eax, dword [ebp - 0x82c]
cmp eax, 8
jb 0x10002267
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.10001860
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.10012ef5
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x100022a4
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10001860
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e3bf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100022d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022ae2
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x10033068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], 0
call fcn.10010540
lea eax, [edi + 0x84]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10002353
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10002399
mov eax, dword [esi]
jmp 0x1000239b
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0x810], cx
je 0x100023c1
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100023b2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10001760
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x834], 1
jb 0x100023eb
mov eax, dword [esi]
jmp 0x100023ed
mov eax, esi
mov ecx, ebx
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10002416
test dx, dx
je 0x10002412
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10002416
add eax, 4
add ecx, 4
test dx, dx
jne 0x100023f0
xor eax, eax
jmp 0x1000241b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10002482
cmp byte [edi + 1], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x10002457
call fcn.10001f80
push eax
mov ecx, esi
call fcn.10001200
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x10002482
inc ecx
push ecx
jmp 0x10002471
call fcn.100020e0
push eax
mov ecx, esi
call fcn.10001200
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10002482
inc eax
push eax
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.10001860
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e3bf
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10007630
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x10007640
sub edi, ecx
mov edx, 2
sar edi, 1
xor ecx, ecx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000e3fd
add esp, 4
mov ebx, eax
sub eax, esi
nop
movzx ecx, word [esi]
lea esi, [esi + 2]
mov word [eax + esi - 2], cx
test cx, cx
jne 0x10007670
xor esi, esi
mov dword [ebp + 8], 1
test edi, edi
js 0x100076c9
nop dword [eax]
cmp word [ebx + esi*2], 0x5c
jne 0x100076bd
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100076b4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100076da
mov eax, 0x5c
mov word [ebx + esi*2], ax
inc esi
cmp esi, edi
jle 0x10007690
mov dword [ebp + 8], 1
push ebx
call fcn.1000e406
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
mov dword [ebp + 8], 0
call fcn.1000e406
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10007700
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10033068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push 0
call fcn.10007e70
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007740
sub ecx, edx
sar ecx, 1
je 0x10007822
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10007760
mov eax, dword [0x10024374]
push esi
mov dword [edi], eax
mov esi, ebx
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x10007776
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10007790
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
pop esi
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x100077b4
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
test eax, eax
jne 0x100077e3
lea eax, [ebp - 0x20c]
push eax
call fcn.10007630
add esp, 4
cmp word [ebp - 0x20c], 0
jne 0x100077f1
xor ecx, ecx
jmp 0x1000780f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007800
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.10001760
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000e3bf
mov esp, ebp
pop ebp
ret
Function at 0x100079c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10033068]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x10033d68]
test al, al
jne 0x10007a63
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10010540
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10007a5e
lea eax, [ebp - 0x20c]
push eax
call fcn.10015424
lea eax, [ebp - 0x20c]
push str.config_systemprofile
push eax
call fcn.100115cf
add esp, 0xc
test eax, eax
jne 0x10007a49
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.100115cf
add esp, 8
test eax, eax
je 0x10007a5e
mov al, 1
mov byte [0x10033d68], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e3bf
mov esp, ebp
pop ebp
ret
mov al, byte [0x10033d68]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e3bf
mov esp, ebp
pop ebp
ret
Function at 0x10007e70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor bl, bl
call fcn.100079c0
test al, al
je 0x10007ed1
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.10007910
add esp, 4
test al, al
je 0x10007ed1
push dword [ebp + 0xc]
push 1
push dword [ebp - 4]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x10007ed1
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
mov eax, 1
cmovne ecx, eax
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007fb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100230d0
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x10033068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
push 0
push eax
call fcn.10010540
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0x44
xor eax, eax
mov dword [ebp - 0x14], 7
add esp, 0xc
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x50], xmm0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
mov byte [ebp - 4], 1
test edi, edi
je 0x100080bd
cmp word [edi], ax
jne 0x10008041
xor ecx, ecx
jmp 0x10008055
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008046
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x40]
call fcn.10001760
cmp dword [ebp - 0x30], 0
je 0x100080bd
push 1
push 0x100248b0
lea ecx, [ebp - 0x28]
call fcn.10001760
cmp word [esi], 0
jne 0x1000807e
xor ecx, ecx
jmp 0x10008092
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008083
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10004a90
push 2
push 0x100248b4
lea ecx, [ebp - 0x28]
call fcn.10004a90
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001530
jmp 0x100080e9
cmp word [esi], 0
jne 0x100080c7
xor ecx, ecx
jmp 0x100080df
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100080d0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10001760
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.CreateRunProcess__s_
call fcn.10006b10
add esp, 8
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10008135
xor esi, esi
jmp 0x10008165
cmp byte [ebp + 0x10], 0
je 0x10008150
mov eax, dword [ebp + 0x14]
or ecx, 0xffffffff
test eax, eax
cmovg ecx, eax
push ecx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
mov esi, 1
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x1000817a
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10001860
mov ecx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp ecx, 8
jb 0x100081a3
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10001860
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e3bf
mov esp, ebp
pop ebp
ret