joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e26c
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
push edi
mov esi, str.0123456789abcdef
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
push ebx
movsd dword es:[edi], dword [esi]
push 0x8000000
push 3
movsd dword es:[edi], dword [esi]
push ebx
push 1
movsd dword es:[edi], dword [esi]
push 0x80000000
push dword [ebp + 8]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x18], esi
jne 0x40e2cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push str.Error_opening_file__s_nError:__d_n
call fcn.00414625
add esp, 0xc
jmp 0x40e33a
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40e2fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x422f34
call fcn.00414625
pop ecx
pop ecx
jmp 0x40e407
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x8004
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40e341
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CryptAcquireContext_failed:__d_n
call fcn.00414625
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x40e412
push ebx
lea eax, [ebp - 0x14]
push eax
mov edi, 0x400
push edi
lea eax, [ebp - 0x440]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x40e389
cmp dword [ebp - 0x14], ebx
je 0x40e397
push ebx
push dword [ebp - 0x14]
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40e394
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x18]
call esi
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x40e35c
jmp 0x40e397
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
mov dword [ebp - 0x10], 0x14
je 0x40e3ee
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
push 2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40e3ee
mov esi, dword [ebp + 0xc]
xor edi, edi
cmp dword [ebp - 0x10], ebx
mov byte [esi], bl
jbe 0x40e3e9
movzx eax, byte [ebp + edi - 0x40]
mov ecx, eax
shr ecx, 4
mov cl, byte [ebp + ecx - 0x2c]
and eax, 0xf
mov al, byte [ebp + eax - 0x2c]
mov byte [esi + edi*2], cl
mov byte [esi + edi*2 + 1], al
inc edi
cmp edi, dword [ebp - 0x10]
jb 0x40e3c7
mov byte [esi + 0x28], bl
jmp 0x40e3f1
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ebx, dword [ebp - 4]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e986
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push esi
push edi
call dword [0x428060]
mov edi, eax
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x422ff8
push 0x80000002
mov dword [ebp - 4], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ea54
mov byte [ebp - 0x40c], al
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x423020
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jbe 0x40ea54
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x40c]
push eax
call esi
test eax, eax
je 0x40ea54
lea eax, [ebp - 0x40c]
push eax
call esi
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.00413970
mov eax, esp
push edi
push esi
lea ecx, [ebp - 0x40c]
push ecx
push eax
call fcn.004044b6
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
xor eax, eax
push 4
pop ecx
mov edi, 0x424058
repe cmpsd dword [esi], dword es:[edi]
setne al
dec eax
and eax, 0x80004005
jmp 0x40ea59
mov eax, 0x80004005
lea esp, [ebp - 0x414]
pop edi
pop esi
leave
ret

Function at 0x40ea63
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call dword [0x428060]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
push 0x423030
mov esi, 0x80004005
push 0x80000002
mov ebx, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40eaa2
mov eax, esi
jmp 0x40eb45
mov esi, dword [ebp + 8]
push 4
pop ecx
mov edi, 0x424058
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x40eac9
push 0x423058
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40eb3a
xor ebx, ebx
jmp 0x40eb3a
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov ebx, eax
test ebx, ebx
jl 0x40eb2b
mov edi, dword [ebp - 4]
test edi, edi
jne 0x40eaeb
xor eax, eax
jmp 0x40eb10
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.00413970
mov eax, esp
push dword [ebp - 0xc]
push esi
push edi
push eax
call fcn.004044ed
push 4
push eax
push 1
push 0
push str.TransferJobID
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40eb2b
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x40eb3a
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434350
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
push edi
lea edi, [ebp - 0x1d0]
mov ecx, 0x74
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4ab0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10c], 0
push 0x103
push 0
lea eax, [ebp - 0x10b]
push eax
call fcn.004315e1
add esp, 0xc
mov esi, esp
push 0x100
mov edi, esp
call dword [0x4af3dc]
cmp edi, esp
call fcn.00431f1e
push eax
call dword [0x4af408]
cmp esi, esp
call fcn.00431f1e
mov esi, esp
push 0xf
mov edi, esp
call dword [0x4af3d4]
cmp edi, esp
call fcn.00431f1e
push eax
call dword [0x4af3d0]
cmp esi, esp
call fcn.00431f1e
mov esi, esp
push 0
mov eax, dword [0x4ac5bc]
push eax
push 1
push 4
call dword [0x4af5e8]
cmp esi, esp
call fcn.00431f1e
mov eax, dword [0x4ac5bc]
push eax
push str._c_del__q__s
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00431fdc
add esp, 0xc
mov esi, esp
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push str.cmd.exe
push str.open
push 0
call dword [0x4af5e0]
cmp esi, esp
call fcn.00431f1e
mov esi, esp
push 0
call dword [0x4af3cc]
cmp esi, esp
call fcn.00431f1e
push edx
mov ecx, ebp
push eax
lea edx, [0x434478]
call fcn.0043166d
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004311d6
add esp, 0x1d0
cmp ebp, esp
call fcn.00431f1e
mov esp, ebp
pop ebp
ret
Function at 0x4344f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea edi, [ebp - 0x114]
mov ecx, 0x45
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 0x104
call fcn.00432289
add esp, 4
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 8], eax
push 0x104
call fcn.00432289
add esp, 4
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x14], eax
mov esi, esp
push 0
push 0x26
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [0x4af5e4]
cmp esi, esp
call fcn.00431f1e
mov esi, esp
push 0x497d60
mov eax, dword [ebp - 0x14]
push eax
call dword [0x4af3e0]
cmp esi, esp
call fcn.00431f1e
mov esi, esp
push str.ttmual
mov eax, dword [ebp - 0x14]
push eax
call dword [0x4af3e0]
cmp esi, esp
call fcn.00431f1e
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00431023
add esp, 8
mov esi, esp
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0
push str.install.bat
push str.open
push 0
call dword [0x4af5e0]
cmp esi, esp
call fcn.00431f1e
mov esi, esp
push 0x497d40
mov eax, dword [ebp - 0x14]
push eax
call dword [0x4af3e0]
cmp esi, esp
call fcn.00431f1e
cmp dword [0x4ab08c], 0
je 0x434634
mov dword [ebp - 0x20], 0
mov esi, esp
lea eax, [ebp - 0x20]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [0x4af37c]
cmp esi, esp
call fcn.00431f1e
mov eax, dword [ebp - 0x14]
push eax
call fcn.004317d0
add esp, 4
mov esi, esp
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 1
push 0
push str.LongZuoms
mov edx, dword [ebp - 0x20]
push edx
call dword [0x4af378]
cmp esi, esp
call fcn.00431f1e
mov eax, dword [ebp - 8]
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf8]
push ecx
call fcn.00431695
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0xec]
push ecx
call fcn.00431695
add esp, 4
cmp dword [0x4ab088], 0
je 0x434672
call fcn.004318a7
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x43469c]
call fcn.0043166d
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x114
cmp ebp, esp
call fcn.00431f1e
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10ad4b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10ad4ba
pushal
call 0x10ad4c0
pop ebp
sub ebp, 0x10
sub ebp, 0xcad4b0
jmp 0x10ad4d6
invalid
mov eax, 0xcad4b0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b2
mov edx, 0xeed88518
xor byte [eax], dl
inc eax
dec ecx
jne 0x10ad4ed
jmp 0x10ad500
xchg ebx, eax
aad 0x93
xchg ebx, eax
xchg ecx, eax
and al, 0x18
sbb byte [eax], bl
cdq
fchs
sbb byte [eax], bl
sbb byte [ebx], bl
aad 0xa0
adc byte [eax], bl
sbb byte [eax], bl
mov byte [0x18181830], al
out dx, eax
cli
sbb edx, eax
xchg ebx, eax
cdq
adc al, 0x18
sbb byte [eax], bl
sbb ebx, ebp
dec eax
dec eax
jo 0x10ad502
push 0xe8701816
jnp 0x10ad4d5
sbb byte [ecx], bl
xor al, 0x3c
jo 0x10ad56c
mov eax, 0x1df00470
sbb byte [eax], bl
sbb cl, dh
xor byte [eax], bl
sbb byte [eax], bl
dec ebp
xchg ebx, eax
hlt
xchg ebx, eax
xchg esp, eax
cmp al, 0x1c
sbb byte [eax], bl
sbb byte [eax - 0x28], dh
push 0xe8701816
jnp 0x10ad520
sbb byte [ecx], bl
xor al, 0x3c
dec ecx
invalid
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10006d49
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10006deb
movzx eax, word [ecx]
mov dword [ebp - 0x10], eax
add eax, 0xffffffd5
xor edx, edx
test eax, 0xfffd
sete dl
movzx eax, word [ecx + edx*2]
lea esi, [eax - 1]
xor edi, edi
cmp si, 0x7e
ja 0x10006ddd
lea ebx, [ecx + edx*2]
add ebx, 2
xor edi, edi
movzx eax, ax
push eax
call fcn.1024d21e
add esp, 4
test eax, eax
je 0x10006ddd
movzx esi, word [ebx - 2]
xor ecx, ecx
cmp esi, 0x7f
ja 0x10006db3
push esi
call fcn.1024d21e
add esp, 4
add esi, 0xffffffd0
test eax, eax
cmove esi, eax
mov ecx, esi
mov eax, ecx
xor eax, 0x7fffffff
mov edx, 0xcccccccd
mul edx
shr edx, 3
cmp edi, edx
jg 0x10006def
lea eax, [edi + edi*4]
lea edi, [ecx + eax*2]
movzx eax, word [ebx]
mov ecx, eax
dec ecx
add ebx, 2
cmp cx, 0x7f
jb 0x10006d85
mov eax, edi
neg eax
cmp word [ebp - 0x10], 0x2d
cmovne eax, edi
jmp 0x10006dfe
xor eax, eax
jmp 0x10006dfe
xor eax, eax
cmp word [ebp - 0x10], 0x2d
sete al
add eax, 0x7fffffff
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100092b0
Capabilities:
Access peb ldr_data

Disassembly:
push edi
push ebx
push esi
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov ebx, dword [edi]
jmp 0x100092d9
mov eax, dword [ebx + 0x30]
call fcn.100092ec
and eax, 0x7fffffff
cmp eax, 0x450
je 0x100092e1
mov ebx, dword [ebx]
cmp ebx, edi
jne 0x100092c3
xor eax, eax
jmp 0x100092e4
mov eax, dword [ebx + 0x18]
pop ecx
pop ebx
pop edi
ret

Function at 0x1000fbd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x10443bf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x1000fc0c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push esi
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
je 0x1000fc0e
mov esi, dword [ebp - 0x10]
jmp 0x1000fc0e
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1023b4d8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret 8

Function at 0x1000fc30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x10443bf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x1000fc6c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push esi
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
je 0x1000fc6e
mov esi, dword [ebp - 0x10]
jmp 0x1000fc6e
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1023b4d8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret 8
Function at 0x4016c4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, 0x421638
cmp dword [0x46b724], 0
je 0x4016eb
push dword [0x46b724]
call dword [0x46b62c]
pop ecx
xor eax, eax
mov dword [0x46b724], eax
cmp dword [0x4656bc], 0
je 0x401746
push dword [0x46b728]
call sub.KERNEL32.dll_SetEvent
push 0x2710
push dword [0x4656bc]
call sub.KERNEL32.dll_WaitForSingleObject
test eax, eax
je 0x401733
push 0x30
push 0x46b778
push str.Abnormal_termination_of_Main_thread.
push 0
call fcn.00403d2c
push 0
push dword [0x4656bc]
call sub.KERNEL32.dll_TerminateThread
push dword [0x46b728]
call sub.KERNEL32.dll_CloseHandle
xor edx, edx
mov dword [0x4656bc], edx
cmp dword [0x46b730], 0
je 0x40178e
push dword [0x46b72c]
call sub.KERNEL32.dll_SetEvent
push 0x1f4
push dword [0x46b730]
call sub.KERNEL32.dll_WaitForSingleObject
test eax, eax
je 0x40177b
push 0
push dword [0x46b730]
call sub.KERNEL32.dll_TerminateThread
push dword [0x46b72c]
call sub.KERNEL32.dll_CloseHandle
xor ecx, ecx
mov dword [0x46b730], ecx
xor ebx, ebx
jmp 0x4017bf
cmp dword [esi + ebx*4], 0
je 0x4017be
push dword [esi + ebx*4]
mov eax, dword [ebx*4 + 0x46b444]
call eax
pop ecx
push dword [esi + ebx*4]
call sub.KERNEL32.dll_CloseHandle
xor edx, edx
mov dword [esi + ebx*4], edx
push dword [ebx*4 + 0x421624]
call sub.KERNEL32.dll_FreeLibrary
inc ebx
mov ecx, dword [0x422430]
xor eax, eax
mov al, byte [ecx + 0x29]
cmp ebx, eax
jl 0x401792
cmp dword [0x4223e4], 0
je 0x4017ea
push dword [0x4223e4]
call sub.KERNEL32.dll_FreeLibrary
xor edx, edx
mov dword [0x4223e4], edx
cmp dword [0x422718], 0
je 0x401806
push dword [0x422718]
call sub.KERNEL32.dll_FreeLibrary
xor ecx, ecx
mov dword [0x422718], ecx
pop esi
pop ebx
pop ebp
ret

Function at 0x403da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
inc dword [ebx]
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00402223
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.00402184
add esp, 0xc
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x3a0], eax
jmp 0x40418b
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.00402213
sub byte [edi + esi - 0x28], 0xff
mov ch, 0x60
cld
invalid
Function at 0x1001ea60
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025d71d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov dword [ebp - 0x10], ecx
push 0x109419b0
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x1001eaf5
push 0x109419b0
lea ecx, [ebp - 0x50]
call fcn.1001f800
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push str.NeverloseScripts_
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.100211d0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx]
call fcn.1001f750
lea ecx, [ebp - 0x38]
call fcn.10007e60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.10007e60
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.1001f3d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001eb20
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025d71d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov dword [ebp - 0x10], ecx
push 0x109418a8
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x1001ebb5
push 0x109418a8
lea ecx, [ebp - 0x50]
call fcn.1001f800
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push str.Neverlosecfg_
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x38]
push edx
call fcn.100211d0
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx]
call fcn.1001f750
lea ecx, [ebp - 0x38]
call fcn.10007e60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.10007e60
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.1001f3d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001f950
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025d35d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.10008090
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
movss xmm0, dword [0x102c4724]
movss dword [eax], xmm0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x40], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x44], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x54], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x58], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp - 0x10]
movss xmm0, dword [0x102c4724]
movss dword [eax + 0x68], xmm0
mov ecx, dword [ebp - 0x10]
movss xmm0, dword [0x102c4724]
movss dword [ecx + 0x6c], xmm0
mov edx, dword [ebp - 0x10]
movss xmm0, dword [0x102c4724]
movss dword [edx + 0x70], xmm0
mov eax, dword [ebp - 0x10]
movss xmm0, dword [0x102c4724]
movss dword [eax + 0x74], xmm0
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.1001fb30
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0xec], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0xed], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xf4
call fcn.10094150
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x4ac], 0x352
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x4b0], 0x230
mov edx, dword [ebp - 0x10]
movss xmm0, dword [0x102c4724]
movss dword [edx + 0x4b8], xmm0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x4d8], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x4dc
mov dword [ebp - 0x14], ecx
push str.None
mov ecx, dword [ebp - 0x14]
call fcn.1001f800
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10025a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025d911
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
mov ecx, 0x10661a10
call fcn.1000c9f0
push eax
mov ecx, dword [ebp - 0x14]
call fcn.10025bb0
movzx eax, al
test eax, eax
je 0x10025a9d
jmp 0x10025b93
mov ecx, 0x10661a10
call fcn.1000c9f0
push eax
mov ecx, dword [ebp - 0x14]
call fcn.10024c70
mov ecx, 0x1065d698
call fcn.101da480
mov ecx, eax
call fcn.100246c0
movzx ecx, byte [eax]
test ecx, ecx
jne 0x10025b93
mov ecx, 0x1065d698
call fcn.101da310
cmp dword [eax + 0x4d30], 0x10
jg 0x10025b93
mov edx, dword [0x1065b060]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + edx*4]
mov edx, dword [0x10941abc]
cmp edx, dword [ecx + 4]
jle 0x10025b54
push 0x10941abc
call fcn.1025b73e
add esp, 4
cmp dword [0x10941abc], 0xffffffff
jne 0x10025b54
mov dword [ebp - 4], 0
push str.B8_________3B_F0_0F_4F_F0_89_5D_FC
push 0x1028f1f0
call fcn.101e2780
add esp, 8
add eax, 1
adc edx, 0
mov dword [0x10941ac0], eax
mov dword [0x10941ac4], edx
mov dword [ebp - 4], 0xffffffff
push 0x10941abc
call fcn.1025b6f4
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
mov ecx, dword [0x10941ac0]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [0x10941ac0]
mov dword [edx], 0x11
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 4
mov edx, dword [0x10941ac0]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret