joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c74d0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c7680
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c765f
mov dl, 1
mov eax, dword [0x483d28]
call fcn.004afc38
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.0040a3bc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c764e
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.005445e0
test al, al
je 0x5c7641
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c7690
lea eax, [ebp - 0x394]
call fcn.00425fac
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5c7641
xor eax, eax
push ebp
push 0x5c763a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c7700
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5c7621
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aebc
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c7621
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040aebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7641
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c7541
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004afb60
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7687
lea eax, [ebp - 0x3a0]
call fcn.0040a3bc
pop eax
jmp eax

Function at 0x5c8298
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5ecc10]
cmp byte [eax + 0xc5], 0
jne 0x5c830a
cmp dword [0x5ecc38], 0
jne 0x5c82ca
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x5e4c18]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5ecc38], eax
cmp dword [0x5ecc34], 0
jne 0x5c82e5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5ecc34], eax
cmp dword [0x5ecc3c], 0
jne 0x5c830a
push esp
push 0
push 0
mov eax, dword [0x5e4c14]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x5ecc3c], eax
pop edx
ret
Function at 0x5c8884
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c889b
add esp, 0xfffffff0
call fcn.00408c00
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c09d8
mov eax, dword [0x5e4c94]
cmp byte [eax], 0
jne 0x5c88c8
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x5e4ff8]
cmp word [eax + 2], 0
jne 0x5c88e2
mov eax, dword [0x5e4ff8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cad48
mov eax, dword [0x5e5134]
cmp word [eax + 2], 0
jne 0x5c88fc
mov eax, dword [0x5e5134]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cb160
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x507cc8]
call fcn.0050e844
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5cb70c
mov dl, 1
mov eax, dword [0x47ffdc]
call fcn.004085e4
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x47ffdc]
call fcn.004085e4
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x50ce38]
call fcn.00518e58
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c8aec
mov eax, dword [0x5e4e9c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00519374
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5cb9f8
mov dl, 1
mov eax, dword [0x47ffdc]
call fcn.004085e4
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5e4e9c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425dac
test eax, eax
je 0x5c8a0f
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425c04
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425d90
test eax, eax
je 0x5c8a27
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040aebc
push ebx
push 0x5ca71c
call fcn.005bcd18
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5e4c94]
cmp byte [eax], 0
jne 0x5c8a78
mov eax, ebx
call fcn.005c8cb4
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005cbda0
mov eax, ebx
call fcn.005cc8dc
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c8ae3
call fcn.00408c58
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c8fe4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5c9086
cmp dword [ebx + 0xac], 0
jne 0x5c9080
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c8f24
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c9080
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c9046
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c9080
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004aaa88
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c9055
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c93c8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5ecc10]
cmp dword [eax + 0x190], 0
je 0x5c9531
test bl, bl
jne 0x5c9484
cmp dword [esi + 0xb4], 0
jne 0x5c9479
mov eax, esi
call fcn.005cc72c
push eax
push 0x5c92c8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c944a
mov eax, dword [0x5ecc10]
cmp byte [eax + 0xeb], 0
je 0x5c944a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5c942b
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c944a
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c9433
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c9479
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004aaa88
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c9459
inc dword [esi + 0xb4]
jmp 0x5c9531
cmp dword [esi + 0xb4], 0
jle 0x5c9531
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c9531
cmp dword [esi + 0x58], 0
je 0x5c94e6
mov eax, dword [0x5ecc10]
cmp byte [eax + 0xeb], 0
je 0x5c94e6
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5c94c7
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c94e6
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c94cf
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c9515
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004aaa88
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c94f5
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b9810]
call fcn.0040d1b8
pop edi
pop esi
pop ebx
ret
Function at 0x5ca328
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5ca385
cmp byte [ebx + 0xeb], 0
jne 0x5ca385
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a554
mov eax, dword [esi]
test eax, eax
je 0x5ca372
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5ca392
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7ac
jmp 0x5ca392
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7ac
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5cbfb4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5cc025
mov eax, esi
call fcn.0053e0c8
test al, al
je 0x5cc025
mov eax, dword [ebx + 0x98]
call fcn.0053dc60
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5cc025
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5cc016
push 0
mov eax, dword [ebx + 0x98]
call fcn.0053dc60
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00533e98
jmp 0x5cc025
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005cbdc0
pop esi
pop ebx
ret
Function at 0x5d1b40
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x5d1bc6
mov eax, dword [ebx + 8]
call fcn.0053dc60
mov ecx, eax
mov dl, 1
mov eax, dword [0x54ae14]
call fcn.00537744
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.0055046c
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5d1410
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0053dc60
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0053dc60
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x5d1c48
mov eax, dword [ebx + 8]
call fcn.0053dc60
mov ecx, eax
mov dl, 1
mov eax, dword [0x54ae14]
call fcn.00537744
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.0055046c
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5d145c
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0053dc60
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0053dc60
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d1cc6
mov eax, dword [ebx + 8]
call fcn.0053dc60
mov ecx, eax
mov dl, 1
mov eax, dword [0x54b908]
call fcn.00537744
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0053dc60
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0053dc60
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x74b1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0074b140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0074b140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0074b140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0074b140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x74bbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x74bc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x75d87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x74bc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x74bc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x5b7d1d37
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x4f62ef0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x6b035e91
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x34f76fdb
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x402b08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x402b17
pop dword [ebp - 0x34]
mov eax, 0xe9f8a978
sub eax, 0xe9b87e61
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xb81547a5
add dword [ebp - 0x44], 0x963cfda6
mov dword [ebp - 0x40], 0x3a1d525b
add dword [ebp - 0x40], 0xf815f9ea
mov dword [ebp - 0x3c], 0xd9952ada
add dword [ebp - 0x3c], 0x72b71954
mov dword [ebp - 0x38], 0xd9829abb
sub dword [ebp - 0x38], 0xd9829abb
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xd86f707
sub dword [ebp - 0x44], 0x99148db1
mov dword [ebp - 0x40], 0x3e7e1287
add dword [ebp - 0x40], 0x2ee4eee
mov dword [ebp - 0x3c], 0x91ec7fd2
add dword [ebp - 0x3c], 0xd182ec9a
mov dword [ebp - 0x38], 0x52508a77
sub dword [ebp - 0x38], 0x52508a77
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xd01e8cd7
add eax, 0x30218429
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39cb9
push 0
call eax
mov ecx, 0x4db3
xor esi, esi
add esi, eax
mov edx, 0xa86c23f8
add edx, 0x57d51a08
add edx, dword [ebp - 0x34]
mov ebx, 0xdbc8ab82
add ebx, 0x49b29904
xor dword [ebp - 0x18], ecx
mov edi, dword [edx]
xor edi, ebx
xor dword [ebp - 0x10], eax
mov dword [esi], edi
sub dword [ebp - 0x30], edx
add esi, 4
add edx, 4
loop 0x402c30
add eax, 0xd5b383f9
add eax, 0x2a4da5a6
mov ebx, eax
add eax, 0xdb86be91
sub eax, 0xdb86be8c
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1000810b
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x100374d0]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10008130
xor eax, eax
jmp 0x100081f3
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x10008152
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x10008152
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x100081f3
cmp dword [esi + 0x4c], 0
push ebp
je 0x100081f0
call fcn.10007d32
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x1000817d
push dword [esi + 0x4c]
push eax
call fcn.10006b28
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x100081f0
mov byte [esp + 0x10], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100081f0
cmp eax, 1
jle 0x100081c0
cmp eax, 3
jne 0x100081f0
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x1000816f
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x1c]
sub ebp, eax
je 0x100081e0
push dword [esi + 0x4c]
push ebp
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebp, eax
jne 0x100081f0
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x18], eax
mov eax, ebx
jne 0x100081f2
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10011148
add esp, 0x30
ret 4
Function at 0x1000862f
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10008651
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x10008704
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax]
mov dword [esp + 0x10], ebx
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x10008674
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10008676
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test ebx, ebx
jl 0x100086f5
jg 0x10008689
test esi, esi
je 0x100086f5
test eax, eax
jl 0x100086c5
jg 0x10008693
test ebp, ebp
je 0x100086c5
cmp ebx, eax
jg 0x100086a3
jl 0x1000869d
cmp esi, ebp
jae 0x100086a3
mov ebp, esi
mov dword [esp + 0x20], ebx
push ebp
push ecx
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [edi + 0x2c]
add esp, 0xc
add dword [esp + 0x1c], ebp
sub esi, ebp
sbb ebx, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [edi + 0x1c]
add dword [eax], ebp
mov ebp, dword [esp + 0x1c]
test ebx, ebx
jl 0x100086f5
jg 0x100086d3
test esi, esi
je 0x100086f5
cmp dword [edi + 0x4c], 0
je 0x100086f5
mov ecx, edi
call fcn.10007d32
push dword [edi + 0x4c]
push esi
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
pop esi
pop ebp
sbb edx, ebx
pop ebx
pop edi
pop ecx
pop ecx
ret 0xc
Function at 0x1000870a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000872c
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x100087dc
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1000874f
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10008751
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100087cd
jg 0x10008764
test esi, esi
je 0x100087cd
test eax, eax
jl 0x100087a4
jg 0x1000876e
test ebp, ebp
je 0x100087a4
cmp edi, eax
jg 0x1000877e
jl 0x10008778
cmp esi, ebp
jae 0x1000877e
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100087a8
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100087cd
jg 0x100087b2
test esi, esi
je 0x100087cd
cmp dword [ebx + 0x4c], 0
je 0x100087cd
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc

Function at 0x1000b944
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x10013d6f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100374d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x214]
lea eax, [ebp]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test esi, esi
js 0x1000ba31
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000d63d
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.1000d69b
push 0x104
push eax
push dword [ebp + 0x218]
push edi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
test ecx, ecx
je 0x1000ba07
call fcn.1000d9cb
jmp 0x1000ba07
xor eax, eax
test esi, esi
setns al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10011148
add ebp, 0x20c
leave
ret
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.1000fb2e
pop ecx
pop ecx
push ebx
push esi
call fcn.1001224e
int3