joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017b8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x630
mov eax, dword [0x101df028]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x638], edi
lea eax, [edi + 8]
mov dword [edi], 0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x63c], edi
jb 0x100204da
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [edi + 0x34], 7
mov dword [edi + 0x30], ecx
cmp dword [edi + 0x34], 8
jb 0x100204f7
mov eax, dword [edi + 0x20]
jmp 0x100204fa
lea eax, [edi + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x38]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x10020514
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x50]
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ecx
cmp dword [eax + 0x14], 8
jb 0x1002052e
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 3
push ecx
mov dword [edi + 0x68], ecx
mov dword [edi + 0x6c], ecx
call fcn.10059d4c
push eax
call fcn.100652ab
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10056120
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x100205e7
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x634]
push eax
call fcn.10056120
add esp, 0xc
lea eax, [ebp - 0x634]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x100205d8
test eax, eax
je 0x100205d8
add eax, eax
cmp eax, 0x412
jae 0x100205d3
xor ecx, ecx
mov word [ebp + eax - 0x634], cx
lea eax, [ebp - 0x634]
jmp 0x100205de
call fcn.1003289b
lea eax, [ebp - 0x220]
push eax
lea ecx, [edi + 0x20]
call fcn.1001fdc0
mov eax, dword [edi + 0x30]
test eax, eax
je 0x10020613
cmp dword [edi + 0x34], 8
jb 0x100205f9
mov ecx, dword [edi + 0x20]
jmp 0x100205fc
lea ecx, [edi + 0x20]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x10020613
push 1
push 0x101d749c
lea ecx, [edi + 0x20]
call fcn.10021a60
cmp dword [edi + 0x30], 0
jne 0x10020628
push 3
push 0x101d74a0
lea ecx, [edi + 0x20]
call fcn.1001fe10
mov dword [edi + 4], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10032035
mov esp, ebp
pop ebp
ret
Function at 0x10020650
Capabilities:
Delete file

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x48], 0
je 0x1002066c
cmp dword [edi + 0x4c], 8
lea eax, [edi + 0x38]
jb 0x10020665
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x68]
test eax, eax
je 0x10020683
push eax
call fcn.10032072
add esp, 4
mov dword [edi + 0x68], 0
mov eax, dword [edi + 0x64]
lea esi, [edi + 0x50]
cmp eax, 8
jb 0x10020699
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.1001ff10
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100206af
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x38]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x100206ca
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.1001ff10
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100206e0
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
lea esi, [edi + 0x20]
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x100206fb
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.1001ff10
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10020711
mov esi, dword [esi]
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 0x1c]
cmp eax, 8
jb 0x1002072b
inc eax
lea ecx, [edi + 8]
push eax
push dword [edi + 8]
call fcn.1001ff10
mov dword [edi + 0x1c], 7
cmp dword [edi + 0x1c], 8
mov dword [edi + 0x18], 0
jb 0x1002074a
mov eax, dword [edi + 8]
xor ecx, ecx
pop edi
pop esi
mov word [eax], cx
ret
xor eax, eax
mov word [edi + 8], ax
pop edi
pop esi
ret
Function at 0x10023050
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.1003cad8
test al, al
je 0x10023071
push esp
pop esi
push esp
pop ecx
push ebp
push ecx
pop eax
pop edi
push ecx
push esi
push edx
push ecx
pop esp
push ebp
push eax
pop esp
push esp
pop esp
call fcn.1003c574
test al, al
je 0x10023096
pop ebp
push eax
push esp
push ecx
push edi
push esp
push ebx
pop edi
push esp
push ecx
pop esp
push esp
pop ebx
pop ebx
pop edi
pop edx
push esi
pop ebp
push eax
push ecx
pop esp
push esp
pop esi
pop ecx
pop ebp
pop ebx
pop edx
push edx
call fcn.1003c5b9
test al, al
je 0x100230bb
push eax
push esi
pop edx
push edx
pop edx
pop ebp
push edi
pop edi
pop esp
push ebx
push esp
pop eax
pop esi
pop eax
push ecx
push esp
push edi
push edi
push edx
push edi
push ebx
pop ebx
push edx
push ebp
push edx
push edi
push esi
push esi
call fcn.1003c757
test al, al
je 0x100230de
pop edx
push esi
pop edi
pop esi
pop edi
push esp
pop esp
pop ebp
push ebp
pop eax
push ebx
push edx
push esi
pop ebx
push edx
push edi
push eax
push ecx
pop edi
push ebp
push ebp
pop ecx
push edx
pop edi
pop esi
push ebx
call fcn.1003c5fe
test al, al
je 0x100230fd
push edi
push edi
push ebx
push eax
pop ebp
pop esi
pop edi
pop esp
pop ebp
push edx
pop edx
push edx
pop edi
pop ebp
push ebx
push esi
push edi
push eax
pop ebx
pop esp
pop ecx
pop ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
xor ecx, ecx
xor esi, esi
test ebx, ebx
jle 0x10023206
mov edi, dword [ebp + 8]
mov al, byte [esi + edi]
cmp al, 0x3d
jne 0x1002311e
inc ecx
cmp ecx, 2
jg 0x10023165
cmp al, 0x7f
ja 0x10023165
movzx eax, al
mov al, byte [eax + 0x1017f4e0]
cmp al, 0x7f
je 0x10023165
cmp al, 0x40
jae 0x10023137
test ecx, ecx
jne 0x10023165
inc esi
inc edx
cmp esi, ebx
jl 0x10023111
test edx, edx
je 0x10023206
mov ecx, dword [ebp + 0x14]
lea eax, [edx + edx*2]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x1002316f
mov dword [ecx], eax
mov eax, 0xfffffff0
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, 0xffffffee
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.1003c9c4
test al, al
je 0x10023188
push esi
push edi
push ebx
pop eax
push edi
pop ebp
push esp
push eax
pop ecx
pop edi
push ecx
pop edx
push esp
pop ebx
push esp
pop edx
xor eax, eax
xor ebx, ebx
mov dword [ebp + 0xc], eax
mov edi, 3
mov eax, dword [ebp + 0x10]
mov edx, eax
test esi, esi
jle 0x100231ff
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov cl, byte [eax + 0x1017f4e0]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub edi, eax
movzx eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [ebp + 0xc], ecx
cmp ecx, 4
jne 0x100231f0
xor eax, eax
mov dword [ebp + 0xc], eax
test edi, edi
jle 0x100231db
mov eax, ebx
shr eax, 0x10
mov byte [edx], al
inc edx
cmp edi, 1
jle 0x100231e8
mov eax, ebx
shr eax, 8
mov byte [edx], al
inc edx
cmp edi, 2
jle 0x100231f0
mov byte [edx], bl
inc edx
mov eax, dword [ebp + 8]
dec esi
inc eax
mov dword [ebp + 8], eax
test esi, esi
jg 0x100231a0
mov eax, dword [ebp + 0x10]
sub edx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10023210
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1002336e
lea ecx, [esi*8]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [esi*8]
lea eax, [ecx + ecx*2]
add eax, eax
sub edx, eax
sub edx, 2
je 0x10023254
sub edx, 2
jne 0x10023257
add ecx, 2
jmp 0x10023257
add ecx, 3
mov eax, dword [ebp + 0x14]
inc ecx
cmp dword [eax], ecx
jge 0x1002326b
mov dword [eax], ecx
mov eax, 0xfffffff0
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x55555556
imul esi
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
add eax, edx
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [eax + eax*2]
xor eax, eax
test ecx, ecx
jle 0x10023304
dec ecx
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
lea eax, [eax + eax*2]
mov dword [ebp - 8], eax
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 1]
mov eax, ecx
movzx esi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl ecx, 4
movzx eax, byte [eax + 0x1017f4a0]
mov byte [edi], al
mov eax, edx
shr eax, 4
add eax, ecx
and eax, 0x3f
movzx eax, byte [eax + 0x1017f4a0]
mov byte [edi + 1], al
mov eax, esi
shr eax, 6
and esi, 0x3f
lea eax, [eax + edx*4]
and eax, 0x3f
movzx eax, byte [eax + 0x1017f4a0]
mov byte [edi + 2], al
movzx eax, byte [esi + 0x1017f4a0]
mov byte [edi + 3], al
add edi, 4
sub dword [ebp - 4], 1
jne 0x100232a0
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
cmp eax, esi
jge 0x1002335f
movzx edx, byte [ebx]
inc eax
mov dword [ebp + 0xc], eax
cmp eax, esi
jge 0x10023319
movzx ecx, byte [ebx + 1]
jmp 0x1002331b
xor ecx, ecx
mov eax, edx
shl edx, 4
shr eax, 2
movzx eax, byte [eax + 0x1017f4a0]
mov byte [edi], al
mov eax, ecx
shr eax, 4
add eax, edx
and eax, 0x3f
movzx eax, byte [eax + 0x1017f4a0]
mov byte [edi + 1], al
cmp dword [ebp + 0xc], esi
jge 0x10023354
and ecx, 0xf
mov al, byte [ecx*4 + 0x1017f4a0]
mov byte [edi + 2], al
jmp 0x10023358
mov byte [edi + 2], 0x3d
mov byte [edi + 3], 0x3d
add edi, 4
mov ecx, dword [ebp + 0x14]
mov eax, edi
sub eax, dword [ebp + 0x10]
mov dword [ecx], eax
mov byte [edi], 0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002bb90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x1002bc9a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sub eax, 0xffffff80
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
lea esi, [ecx + 2]
sub ecx, eax
lea edx, [eax + 2]
add ecx, 0xfffffffe
lea eax, [edi - 1]
mov dword [ebp + 0x14], edx
shr eax, 3
inc eax
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop
movzx eax, byte [edx - 2]
add ecx, edx
push ecx
push ecx
push dword [ebp - 0xc]
mov byte [ecx], al
movzx eax, byte [edx - 1]
mov byte [esi - 1], al
movzx eax, byte [edx]
mov byte [esi], al
movzx eax, byte [edx + 1]
mov byte [esi + 1], al
movzx eax, byte [edx + 2]
mov byte [esi + 2], al
movzx eax, byte [edx + 3]
mov byte [esi + 3], al
movzx eax, byte [edx + 4]
mov byte [esi + 4], al
movzx eax, byte [edx + 5]
mov byte [esi + 5], al
mov edi, dword [edx - 2]
mov ebx, dword [edx + 2]
call fcn.1002ae30
mov ecx, dword [ebp + 8]
lea esi, [esi + 8]
mov edx, dword [ebp + 0x14]
add esp, 0xc
movzx eax, byte [ecx + 0x100]
mov ecx, dword [ebp - 8]
xor byte [edx + ecx], al
add edx, 8
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x14], edx
movzx eax, byte [ecx + 0x101]
xor byte [esi - 9], al
movzx eax, byte [ecx + 0x102]
xor byte [esi - 8], al
movzx eax, byte [ecx + 0x103]
xor byte [esi - 7], al
movzx eax, byte [ecx + 0x104]
xor byte [esi - 6], al
movzx eax, byte [ecx + 0x105]
xor byte [esi - 5], al
movzx eax, byte [ecx + 0x106]
xor byte [esi - 4], al
movzx eax, byte [ecx + 0x107]
xor byte [esi - 3], al
sub dword [ebp - 4], 1
mov dword [ecx + 0x100], edi
mov dword [ecx + 0x104], ebx
mov ecx, dword [ebp - 8]
jne 0x1002bbd0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10030970
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101df028]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x1a
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100309a2
sub ecx, edx
sar ecx, 1
je 0x10030a86
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x100309c1
mov eax, dword [0x101d749c]
lea edx, [ebp - 0x20c]
mov dword [edi], eax
add edx, 0xfffffffe
nop dword [eax]
mov cx, word [edx + 2]
lea edx, [edx + 2]
test cx, cx
jne 0x100309e0
mov ecx, dword [str.Something]
lea edi, [ebp - 0x20c]
mov dword [edx], ecx
add edi, 0xfffffffe
mov ecx, dword [0x10180578]
mov dword [edx + 4], ecx
mov ecx, dword [0x1018057c]
mov dword [edx + 8], ecx
mov ecx, dword [0x10180580]
mov dword [edx + 0xc], ecx
mov ecx, dword [0x10180584]
mov dword [edx + 0x10], ecx
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x10030a21
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
test eax, eax
jne 0x10030a50
lea eax, [ebp - 0x20c]
push eax
call fcn.100424db
add esp, 4
cmp word [ebp - 0x20c], 0
jne 0x10030a5e
xor ecx, ecx
jmp 0x10030a76
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030a67
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x1c]
call fcn.1001fe10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10032035
mov esp, ebp
pop ebp
ret

Function at 0x10030be0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x34
cmp dword [ecx + 0x14], 8
jb 0x10030bee
mov ecx, dword [ecx]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop ebp
ret 0xc
Function at 0x10030c10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x101df028]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 0x14]
push 0x208
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x218], 0
call fcn.10056120
add esi, 0x34
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x10030c6b
mov esi, dword [esi]
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
mov word [edi], ax
cmp word [ebp - 0x20c], ax
jne 0x10030cab
xor ecx, ecx
jmp 0x10030cc3
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030cb4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.1001fe10
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10032035
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10030cf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017cb06
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x101df028]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, ebx
call fcn.100313b0
mov ecx, ebx
call fcn.10030ef0
cmp dword [ebx + 0x30], 8
lea edi, [ebx + 0x1c]
jb 0x10030d43
mov eax, dword [edi]
jmp 0x10030d45
mov eax, edi
push str.Config
push eax
lea eax, [ebp - 0x218]
push str._s_s_
push eax
call fcn.10029df0
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10030d7f
lea eax, [ebp - 0x218]
push eax
call fcn.100424db
add esp, 4
lea eax, [ebx + 4]
lea esi, [ebx + 0x34]
cmp esi, eax
je 0x10030d95
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.10020060
push 0xa
push str.Before.ini
mov ecx, esi
call fcn.10021a60
push 0xd
push 0
push str.systemprofile
mov ecx, edi
call fcn.10022590
cmp eax, 0xffffffff
je 0x10030dcb
lea eax, [ebx + 4]
cmp edi, eax
je 0x10030dcb
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.10020060
cmp dword [esi + 0x14], 8
jb 0x10030dd3
mov esi, dword [esi]
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.1003eef2
add esp, 8
lea esi, [ebx + 0x4c]
mov edi, eax
cmp esi, edi
je 0x10030e26
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x10030dff
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.1001ff10
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10030e17
mov eax, dword [esi]
jmp 0x10030e19
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
push edi
call fcn.100219f0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x10030e4b
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.1001ff10
push 6
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.Config
mov ecx, esi
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.10021a60
push 1
push 0x101d749c
mov ecx, esi
call fcn.10021a60
push 0xa
push str.Before.ini
mov ecx, esi
call fcn.10021a60
cmp dword [esi + 0x14], 8
jb 0x10030e9c
mov eax, dword [esi]
jmp 0x10030e9e
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10030eba
cmp dword [esi + 0x14], 8
jb 0x10030eb1
mov esi, dword [esi]
push esi
call fcn.100424db
add esp, 4
mov ecx, ebx
call fcn.10031210
mov ecx, ebx
call fcn.10031550
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10032035
mov esp, ebp
pop ebp
ret 8
Function at 0x10031210
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017cb3b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x101df028]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x48], 8
lea eax, [edi + 0x34]
jb 0x1003124b
mov eax, dword [eax]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push str.College.exe
push str.b3679
push str.SVSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x1003127b
xor ecx, ecx
jmp 0x10031293
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10031284
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
lea esi, [edi + 0x64]
push eax
mov ecx, esi
call fcn.1001fe10
cmp dword [edi + 0x74], 0
je 0x100312c6
cmp dword [esi + 0x14], 8
jb 0x100312b5
mov eax, dword [esi]
jmp 0x100312b7
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10031393
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [ebp - 4], 0
jb 0x100312f6
mov eax, dword [eax]
push 0
lea ecx, [ebp - 0x224]
push ecx
push str..exe
push eax
call fcn.10042f2b
mov ebx, dword [ebp - 0x220]
mov eax, 0x2aaaaaab
mov edi, dword [ebp - 0x224]
mov ecx, ebx
sub ecx, edi
add esp, 0x10
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1003134c
cmp esi, edi
je 0x1003134c
push 0xffffffffffffffff
push 0
push edi
mov ecx, esi
call fcn.10020060
mov ebx, dword [ebp - 0x220]
mov edi, dword [ebp - 0x224]
test edi, edi
je 0x10031393
push dword [ebp - 0x228]
lea ecx, [ebp - 0x224]
push ecx
push ebx
push edi
call fcn.10026330
mov ecx, dword [ebp - 0x21c]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x224]
add esp, 0x10
sub ecx, esi
imul ecx
lea ecx, [ebp - 0x224]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.10027e30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10032035
mov esp, ebp
pop ebp
ret

Function at 0x10031550
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101df028]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.10056120
lea eax, [esi + 0x34]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10031587
mov eax, dword [eax]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.NULL
push str.e034b
push str.SVSetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x20c], 0
jne 0x100315b7
xor ecx, ecx
jmp 0x100315cf
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100315c0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x7c]
call fcn.1001fe10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10032035
mov esp, ebp
pop ebp
ret
Function at 0x10031800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x101df028]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x208], eax
call fcn.1003cad8
test al, al
je 0x1003183a
push esp
pop esi
push esp
pop ecx
push ebp
push ecx
pop eax
pop edi
push ecx
push esi
push edx
push ecx
pop esp
push ebp
push eax
pop esp
push esp
pop esp
call fcn.1003c574
test al, al
je 0x1003185f
pop ebp
push eax
push esp
push ecx
push edi
push esp
push ebx
pop edi
push esp
push ecx
pop esp
push esp
pop ebx
pop ebx
pop edi
pop edx
push esi
pop ebp
push eax
push ecx
pop esp
push esp
pop esi
pop ecx
pop ebp
pop ebx
pop edx
push edx
call fcn.1003c5b9
test al, al
je 0x10031884
push eax
push esi
pop edx
push edx
pop edx
pop ebp
push edi
pop edi
pop esp
push ebx
push esp
pop eax
pop esi
pop eax
push ecx
push esp
push edi
push edi
push edx
push edi
push ebx
pop ebx
push edx
push ebp
push edx
push edi
push esi
push esi
call fcn.1003c757
test al, al
je 0x100318a7
pop edx
push esi
pop edi
pop esi
pop edi
push esp
pop esp
pop ebp
push ebp
pop eax
push ebx
push edx
push esi
pop ebx
push edx
push edi
push eax
push ecx
pop edi
push ebp
push ebp
pop ecx
push edx
pop edi
pop esi
push ebx
call fcn.1003c5fe
test al, al
je 0x100318c6
push edi
push edi
push ebx
push eax
pop ebp
pop esi
pop edi
pop esp
pop ebp
push edx
pop edx
push edx
pop edi
pop ebp
push ebx
push esi
push edi
push eax
pop ebx
pop esp
pop ecx
pop ebx
mov eax, dword [ebp - 0x208]
push 0x100
push dword [eax]
lea eax, [ebp - 0x204]
push eax
call fcn.1006239c
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x10031750
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x101ea388], eax
test eax, eax
je 0x10031931
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 1
push 0
push 2
call fcn.10031970
push 0
push 0
push 4
call fcn.10031970
add esp, 0x18
push 0
push 0
push 0
push 0x10031a80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10032035
mov esp, ebp
pop ebp
ret 8

Function at 0x10031950
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10031a80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret
Function at 0x10035530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x101ee340], ecx
inc eax
cmp eax, 0x100
jb 0x10035532
cmp eax, 0x800
jae 0x10035603
nop
mov edx, dword [eax*4 + 0x101edf40]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x101ee340]
mov dword [eax*4 + 0x101ee340], edx
inc eax
cmp eax, 0x800
jb 0x100355e0
mov dword [0x101ea718], 0x100363a0
call fcn.100361d0
mov ecx, dword [0x101ea718]
test eax, eax
mov edx, 0x10036440
cmove ecx, edx
mov dword [0x101ea718], ecx
ret