joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a728c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x6a8a24
test esi, esi
jne 0x5a72a6
xor eax, eax
jmp 0x5a7397
cmp dword [ebp], 0
jne 0x5a72b1
call fcn.005a721c
xor ebx, 0xffffffff
cmp edi, 8
jb 0x5a7371
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x5a72bd
test edi, edi
jbe 0x5a7392
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x5a7375
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5e0110
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffd48
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00415128
test al, al
je 0x5e019d
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x2b4
call fcn.0040491c
or esi, 0x100
test esi, esi
jns 0x5e014b
call fcn.00404fa8
push esi
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.00406f00
push eax
call sub.shell32.dll_SHGetFileInfoW
test eax, eax
je 0x5e019d
mov dl, 1
mov eax, dword [0x4568c8]
call fcn.00461f7c
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.00462410
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
je 0x5e019d
mov eax, dword [esp]
xor edx, edx
mov dword [esp], edx
call fcn.004050e8
mov eax, dword [esp]
add esp, 0x2b8
pop esi
pop ebx
ret
Function at 0x5e4038
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5e4066
mov eax, ebx
call fcn.005e4aec
cmp dword [ebx + 0x40], 0
je 0x5e405f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5e40d7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5e40c9
cmp dword [ebx + 8], 0
je 0x5e4088
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5e409a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5e40c9
cmp dword [ebx + 8], 0
je 0x5e407b
cmp eax, 3
je 0x5e40ad
dec eax
jne 0x5e407b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5e407b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5e407b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5e40f5
cmp dword [ebx + 0x14], 0xcc
je 0x5e40f5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005e4100
pop ebx
ret
Function at 0x680b68
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
test dl, dl
je 0x680b80
add esp, 0xfffffff0
call fcn.0040561c
mov byte [ebp - 9], dl
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x680c9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
call fcn.0040423c
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
dec ebx
test ebx, ebx
jl 0x680c84
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.004fe4c4
xor eax, eax
push ebp
push 0x680c71
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004fe4c4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
lea ebx, [eax + edx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov dword [ebx], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.004070ec
jmp 0x680c42
lea eax, [ebx + 4]
mov ecx, 1
mov edx, 1
call fcn.00407694
mov eax, dword [ebx + 4]
call fcn.004071f4
dec eax
jle 0x680c56
mov eax, dword [ebx + 4]
cmp word [eax], 0x5f
je 0x680c30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680c78
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x54]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x680ca1
lea eax, [ebp - 4]
call fcn.00406a5c
ret
Function at 0x10002a60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov ebx, edx
mov dword [ebp - 8], ecx
call esi
mov dword [ebp - 0xc], eax
mov eax, 0x3e8
cmp ebx, eax
cmovb eax, ebx
mov dword [ebp - 4], eax
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x43
mov edi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x10002b3c
cmp dword [0x10049ed8], eax
jne 0x10002b3c
mov edx, dword [0x10049ee0]
mov esi, dword [0x1004a938]
cmp edx, 2
cmove esi, eax
mov dword [0x10049ee4], esi
mov dword [0x10049ee8], eax
mov dword [0x10049ef4], 0xbb8
cmp edx, 4
je 0x10002aee
cmp edx, 1
je 0x10002aee
mov eax, dword [0x10047f1c]
mov ecx, eax
inc eax
mov dword [0x10047f1c], eax
jmp 0x10002af0
xor ecx, ecx
push esi
push ecx
push 0xbb8
push edx
push str.SetServiceStatus_state_u_Hint_u_Point_u_ControlAccepted_08X
push 0x2000000
mov dword [0x10049ef0], ecx
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLog]
add esp, 0x18
push 0x10049edc
push dword [0x10049ef8]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x10002b36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x1003bc30
call fcn.10027e60
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp edi, 0x102
jne 0x10002b62
mov eax, dword [ebp - 4]
cmp ebx, 0xffffffff
je 0x10002a86
call esi
mov ecx, dword [ebp - 0xc]
add ecx, ebx
cmp ecx, eax
mov eax, dword [ebp - 4]
ja 0x10002a86
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002b70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov dword [ebp - 4], edx
call esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, 0x3e8
cmp ebx, eax
cmovb eax, ebx
mov dword [ebp + 0xc], eax
push eax
push 0
push dword [ebp - 4]
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push 0x43
mov edi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x10002c51
cmp dword [0x10049ed8], eax
jne 0x10002c51
mov edx, dword [0x10049ee0]
mov esi, dword [0x1004a938]
cmp edx, 2
cmove esi, eax
mov dword [0x10049ee4], esi
mov dword [0x10049ee8], eax
mov dword [0x10049ef4], 0xbb8
cmp edx, 4
je 0x10002c03
cmp edx, 1
je 0x10002c03
mov eax, dword [0x10047f1c]
mov ecx, eax
inc eax
mov dword [0x10047f1c], eax
jmp 0x10002c05
xor ecx, ecx
push esi
push ecx
push 0xbb8
push edx
push str.SetServiceStatus_state_u_Hint_u_Point_u_ControlAccepted_08X
push 0x2000000
mov dword [0x10049ef0], ecx
call dword [sym.imp.isafepxy.dll_ISAFE_WriteProgramLog]
add esp, 0x18
push 0x10049edc
push dword [0x10049ef8]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x10002c4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x1003bc30
call fcn.10027e60
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp edi, 0x102
jne 0x10002c77
mov eax, dword [ebp + 0xc]
cmp ebx, 0xffffffff
je 0x10002b97
call esi
mov ecx, dword [ebp - 8]
add ecx, ebx
cmp ecx, eax
mov eax, dword [ebp + 0xc]
ja 0x10002b97
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004330
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, edx
call sub.MSVCR110.dll_memset
push 0x100368d8
push 0x10049c30
push 0x10035f44
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100043aa
mov eax, 0xe0001006
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
push 0x258
push str.MainUpdateTime
push 0x100368f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
mov dword [esi], eax
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
Function at 0x100043e0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x100044ac
test esi, esi
je 0x100044ac
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
push 0x100368d8
push 0x10049c30
push 0x10035f44
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x20
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000446e
pop edi
mov eax, 0xe0001006
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
push 0x10035cec
push edi
push 0x100368f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
and eax, 0x1fffeffa
pop edi
add eax, 0xe0001006
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0xe0001002
pop esi
call fcn.1002d28e
mov esp, ebp
pop ebp
ret

Function at 0x100049e0
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
jne 0x100049eb
xor eax, eax
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
Function at 0x10004a00
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push esi
lea eax, [ebp - 0x418]
push 0x104
push eax
mov dword [ebp - 0x66c], edx
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x10036b9c
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.iImportLib.dll_void____stdcall_SafeFindFirstFile_wchar_t_const___struct__WIN32_FIND_DATAW__]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10004c26
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x10004a80
mov ecx, 0x10036ba4
lea eax, [ebp - 0x63c]
jmp 0x10004a90
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10004ab6
test dx, dx
je 0x10004ab2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10004ab6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10004a90
xor eax, eax
jmp 0x10004abb
sbb eax, eax
or eax, 1
test eax, eax
je 0x10004bce
mov eax, 0x10036ba8
lea ecx, [ebp - 0x63c]
mov edi, edi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10004af6
test dx, dx
je 0x10004af2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10004af6
add ecx, 4
add eax, 4
test dx, dx
jne 0x10004ad0
xor eax, eax
jmp 0x10004afb
sbb eax, eax
or eax, 1
test eax, eax
je 0x10004bce
test byte [ebp - 0x668], 0x10
push esi
lea eax, [ebp - 0x210]
push 0x104
push eax
je 0x10004b8e
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x10035d40
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
mov edx, dword [ebp - 0x66c]
add esp, 0xc
lea ecx, [ebp - 0x210]
call fcn.10004a00
test eax, eax
je 0x10004c1f
push 0x90
lea eax, [ebp - 0x210]
push eax
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10004bce
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x80
push eax
call edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x668]
push eax
push ebx
call dword [sym.imp.iImportLib.dll_int___stdcall_SafeFindNextFile_void___struct__WIN32_FIND_DATAW__]
test eax, eax
jne 0x10004a80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10004a80
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x90
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
Function at 0x10004c40
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
test esi, esi
je 0x10004ea4
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push esi
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
lea ecx, [ebp - 0x210]
add esp, 0xc
lea edx, [ecx + 2]
jmp 0x10004ca0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004ca0
sub ecx, edx
sar ecx, 1
mov esi, 0x5c
jne 0x10004cfb
mov dword [ebp - 0x210], esi
cmp word [0x10048310], 0
jne 0x10004e1c
push 0x104
push 0x10048310
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov ecx, 0x10048310
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004ce2
sub ecx, edx
sar ecx, 1
jne 0x10004d2b
mov dword [0x10048310], esi
jmp 0x10004d59
cmp word [ebp + ecx*2 - 0x212], si
je 0x10004cbc
lea eax, [ecx*2 + 2]
mov word [ebp + ecx*2 - 0x210], si
cmp eax, 0x208
jae 0x10004eb3
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
jmp 0x10004cbc
cmp word [ecx*2 + 0x1004830e], si
je 0x10004d59
mov word [ecx*2 + 0x10048310], si
lea ecx, [ecx*2 + 2]
cmp ecx, 0x208
jae 0x10004eb3
xor eax, eax
mov word [ecx + 0x10048310], ax
push 0x104
push 0x10048d68
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, 0x10048d68
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004d71
sub ecx, edx
sar ecx, 1
jne 0x10004d8a
mov dword [0x10048d68], esi
jmp 0x10004db8
cmp word [ecx*2 + 0x10048d66], si
je 0x10004db8
mov word [ecx*2 + 0x10048d68], si
lea ecx, [ecx*2 + 2]
cmp ecx, 0x208
jae 0x10004eb3
xor eax, eax
mov word [ecx + 0x10048d68], ax
push 0x104
push 0x10048520
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, 0x10048520
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004dd5
sub ecx, edx
sar ecx, 1
jne 0x10004dee
mov dword [0x10048520], esi
jmp 0x10004e1c
cmp word [ecx*2 + 0x1004851e], si
je 0x10004e1c
mov word [ecx*2 + 0x10048520], si
lea ecx, [ecx*2 + 2]
cmp ecx, 0x208
jae 0x10004eb3
xor eax, eax
mov word [ecx + 0x10048520], ax
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004e25
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x10004ea2
mov esi, dword [sym.imp.MSVCR110.dll__wcsicmp]
lea eax, [ebp - 0x210]
push 0x10048310
push eax
call esi
add esp, 8
test eax, eax
je 0x10004ea2
lea eax, [ebp - 0x210]
push 0x10048d68
push eax
call esi
add esp, 8
test eax, eax
je 0x10004ea2
lea eax, [ebp - 0x210]
push 0x10048520
push eax
call esi
add esp, 8
test eax, eax
je 0x10004ea2
mov edx, 1
lea ecx, [ebp - 0x210]
call fcn.10004a00
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
call fcn.1002d604
int3
Function at 0x10004ec0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push str.proxyUpdate.exe
push 0x10049c30
push 0x10035f44
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x14
lea eax, [ebp - 0x210]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.skin2proxyUpdate
push 0x10049c30
push 0x10035f44
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x14
lea ecx, [ebp - 0x210]
call fcn.10004c40
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1002d28e
mov esp, ebp
pop ebp
ret

Function at 0x100068d0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov esi, edx
mov edi, ecx
call sub.MSVCR110.dll_memset
push str.userco.dat
push 0x10049c30
push 0x10035f44
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x20
test edi, edi
je 0x10006963
test esi, esi
je 0x10006963
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + esi]
push eax
push edi
call dword [sym.imp.iImportLib.dll_int___cdecl_elex::filepath::WriteDataFileW_void___unsigned_long_int__wchar_t_const__const_]
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x1fffeffb
pop edi
add eax, 0xe0001005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
Function at 0x10007e70
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov edi, edx
call sub.MSVCR110.dll_memset
push 0x10035f3c
push 0x10049c30
push 0x10035f44
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x20
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
call dword [sym.imp.MSVCR110.dll__time64]
push eax
call dword [sym.imp.MSVCR110.dll_srand]
mov ebx, dword [sym.imp.MSVCR110.dll_rand]
add esp, 8
mov edi, edi
call ebx
movzx esi, ax
push str.upgd
shl esi, 0x10
call ebx
movzx eax, ax
or eax, esi
push eax
lea eax, [ebp - 0x20c]
push eax
push str._s_08X_s
push 0x104
push edi
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x18
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10007ef0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
Function at 0x10008620
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10045018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov edi, edx
mov esi, ecx
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.iImportLib.dll_int___cdecl_elex::func::GetSelfBasePath_wchar_t___unsigned_long_int_]
add esp, 0x14
test eax, eax
jne 0x10008680
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d28e
mov esp, ebp
pop ebp
ret
push 0x100368d8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.iImportLib.dll_bool___cdecl_elex::filepath::IsFileExisting_wchar_t_const__]
add esp, 0x10
test al, al
je 0x1000866d
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
push esi
push 0x100368f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
mov dword [edi], eax
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1002d28e
mov esp, ebp
pop ebp
ret

Function at 0x1000b920
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
shr ecx, 2
mov eax, ecx
dec ecx
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
test eax, eax
je 0x1000b9ab
inc ecx
mov ebx, dword [esi]
add esi, 4
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x10045378]
xor edx, edi
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x10045378]
xor edx, edi
mov eax, ebx
shr ebx, 8
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x10045378]
xor edx, edi
mov eax, ebx
xor eax, edx
and eax, 0xff
shr edx, 8
mov edi, dword [eax*4 + 0x10045378]
xor edx, edi
dec ecx
jne 0x1000b946
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov ebx, dword [ebp - 0x10]
and ebx, 3
je 0x1000b9e8
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
nop
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10045378]
inc esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
dec ebx
jne 0x1000b9c0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret