joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ed40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b826d
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.10068410
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1038], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x102c], 0
call fcn.10006280
mov ecx, eax
test ecx, ecx
je 0x1000eed8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x1000
lea eax, [ebp - 0x1010]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x102c], 1
mov dword [ebp - 0x1034], 1
call fcn.1008f5e0
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1030], 0x800
push str.TK8Fj70YG_v_3_vPPg7Vdm30XuBkLQEO1THF4mZ06i_foDUuatiCLqo3UQuDlAcNYT9wv6OGo2LxfcPIj7LcA
push eax
call fcn.1003e690
add esp, 0x14
cmp dword [ebp - 0x1014], 8
lea ecx, [ebp - 0x1030]
push ecx
lea ecx, [ebp - 0x1010]
mov dword [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x1034]
push ecx
lea eax, [ebp - 0x1028]
cmovae eax, dword [ebp - 0x1028]
push str.InstallLocation
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000ee7e
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefault
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x1010]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000ee60
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.10006dc0
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x1000eeba
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000eeb0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000eee2
push edx
push ecx
call fcn.10068042
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100058e0
call fcn.10092d65
int3
Function at 0x10012a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7e4b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], edi
cmp word [0x100f83a0], 0
jne 0x10012acb
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1008f5e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.SogouExplorer
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x100f83a0
lea esi, [ebp - 0x218]
mov edx, 0x104
sub esi, ecx
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10012abe
movzx eax, word [esi + ecx]
test ax, ax
je 0x10012abe
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10012aa0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.10006280
mov ecx, eax
test ecx, ecx
je 0x10012b3b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x100f83a0
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.10005920
test al, al
jne 0x10012b1c
mov ecx, 0x100f83a0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012b00
sub ecx, edx
sar ecx, 1
push ecx
push 0x100f83a0
mov ecx, edi
call fcn.10006dc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100058e0
int3
Function at 0x10013670
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7c30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100f4384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x30], 0
je 0x100136b4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
call fcn.10012a10
mov dword [ebp - 4], 0
call fcn.10006280
mov ecx, eax
test ecx, ecx
je 0x1001380d
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov edx, dword [ebp - 0x10]
mov edi, dword [ebx + 0x40]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edx
jge 0x10013712
push 0x104
lea ecx, [ebp - 0x14]
call fcn.10006cb0
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp dword [esi - 8], 0x104
jl 0x10013817
push edi
push edx
xor eax, eax
mov dword [esi - 0xc], 0x104
push esi
mov word [esi + 0x208], ax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [esi - 8]
push esi
call fcn.10093037
add esp, 8
test eax, eax
js 0x10013817
cmp eax, dword [esi - 8]
jg 0x10013817
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], ecx
je 0x100137b7
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100137b7
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x100137b7
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x3c]
call fcn.10004ff0
lea eax, [ebx + 0x44]
mov ecx, ebx
push eax
lea eax, [ebx + 0x48]
push eax
call fcn.10012b50
lea eax, [ebx + 0x38]
push eax
push 0x11
push dword [ebx + 0x40]
push dword [ebx + 0x3c]
call fcn.100061f0
mov ecx, eax
call fcn.100158c0
mov dword [ebx + 0x30], 1
xor edi, edi
jmp 0x100137bc
mov edi, 0x80004005
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100137da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x100137f9
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100058e0
push 0x80070057
call fcn.100058e0
int3
Function at 0x10013830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x100138d1
cmp byte [esi + 0x3d], 0
je 0x100138d1
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10013887
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10013899
sub eax, 1
je 0x1001389d
sub eax, 2
je 0x100138d1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100138ba
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10097fcd
add esp, 0x10
cmp edi, eax
jne 0x10013887
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100683c1
mov esp, ebp
pop ebp
ret

Function at 0x10013a30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8900
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100f4384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100683d7
mov edi, eax
add esp, 4
test edi, edi
je 0x10013adb
push 1
mov dword [ebp - 4], 0
call fcn.10045571
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100141b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100141ec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100141ec
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100142d1
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10014214
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10014247
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10097669
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x100142d1
cmp eax, 1
jle 0x100142a4
cmp eax, 3
jne 0x100142d1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.100113f0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100142c1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10097fcd
add esp, 0x10
cmp edi, eax
jne 0x100142d1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x100141d7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100683c1
mov esp, ebp
pop ebp
ret 4
Function at 0x10014aa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10014ac4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10014b90
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x10014ae5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10014ae7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x10014b6f
jg 0x10014afa
test esi, esi
je 0x10014b6f
test ecx, ecx
jl 0x10014b3c
jg 0x10014b04
test eax, eax
je 0x10014b3c
cmp ebx, ecx
jg 0x10014b16
jl 0x10014b0e
cmp esi, eax
jae 0x10014b16
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1008eae0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10014b42
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x10014b6f
jg 0x10014b4c
test esi, esi
je 0x10014b6f
cmp dword [edi + 0x4c], 0
je 0x10014b6f
mov ecx, edi
call fcn.10013d50
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.10097939
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10014c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10014c84
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10014d40
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10014ca5
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10014ca7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10014d24
jg 0x10014cba
test esi, esi
je 0x10014d24
test ecx, ecx
jl 0x10014cfe
jg 0x10014cc4
test eax, eax
je 0x10014cfe
cmp edi, ecx
jg 0x10014cd6
jl 0x10014cce
cmp esi, eax
jae 0x10014cd6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1008eae0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10014d01
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10014d24
jg 0x10014d0b
test esi, esi
je 0x10014d24
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10014d24
push eax
push esi
push 1
push edx
call fcn.10097fcd
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10015c10
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x478], eax
test ebx, ebx
jne 0x10015c5d
xor al, al
jmp 0x10015dae
test edi, edi
je 0x10015c56
cmp dword [esi], 0
je 0x10015c6d
mov al, 1
jmp 0x10015dae
push 0x250
lea eax, [ebp - 0x46c]
push 0
push eax
call fcn.1008f5e0
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.1008f5e0
add esp, 0x18
lea eax, [ebp - 0x21c]
push edi
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10015dcc
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x10015de7
jmp 0x10015ce6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea ecx, [esi + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.10015550
push edi
lea ecx, [esi + 8]
call fcn.10015550
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x478]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x46c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x468]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x464]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x460]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x45c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x458]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x454]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x450]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x44c]
push edi
push ebx
mov dword [esi + 0x30], eax
mov dword [esi], 1
call fcn.10015b80
mov ecx, eax
call fcn.10014e70
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x10015c56
push 0
push 0
push esi
push 0x10015ee0
push 0
push 0
call fcn.10092ac7
add esp, 0x18
mov dword [esi + 0x3c], eax
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret 0x10
push 0x100e5b78
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0xffffffff
push eax
call fcn.1008ea69
push 0x100e5b78
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0xfffffffe
push eax
call fcn.1008ea69
int3
Function at 0x10019110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x48]
push esi
movups xmmword [ebp - 0x48], xmm0
mov esi, dword [ebp + 0x8c]
movups xmm0, xmmword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x90]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x4c], esi
mov dword [edi + 0x40], esi
movups xmm0, xmmword [ebp + 0x28]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp + 0x4c]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [ebp + 0x5c]
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp + 0x6c]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp + 0x7c]
movups xmmword [ebp - 0x5c], xmm0
test esi, esi
jle 0x10019294
cmp esi, 0x40
jb 0x1001927d
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x49]
add edx, edi
cmp edi, ecx
ja 0x100191b7
lea ecx, [ebp - 0x48]
cmp edx, ecx
jae 0x1001927d
lea ecx, [ebp + esi - 0x8d]
cmp edi, ecx
ja 0x100191d0
lea ecx, [ebp - 0x8c]
cmp edx, ecx
jae 0x1001927d
mov ecx, esi
push ebx
and ecx, 0x8000003f
jns 0x100191e0
dec ecx
or ecx, 0xffffffc0
inc ecx
mov ebx, esi
lea edx, [edi + 0x20]
sub ebx, ecx
mov dword [ebp - 0x98], edx
mov esi, edi
lea ecx, [ebp - 0x38]
sub esi, ecx
sub ecx, edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x7c]
sub ecx, edi
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x48]
lea ecx, [ebp - 0x38]
add edx, eax
movups xmm1, xmmword [ebp + eax - 0x8c]
add ecx, eax
pxor xmm1, xmm0
movups xmm0, xmmword [ecx]
movups xmmword [esi + ecx], xmm1
mov ecx, dword [ebp - 0x94]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x6c]
movups xmmword [edx - 0x10], xmm1
movups xmm1, xmmword [ebp + eax - 0x28]
add eax, 0x40
pxor xmm1, xmm0
movups xmm0, xmmword [edi + edx]
movups xmmword [edx], xmm1
movups xmm1, xmmword [ecx + edx]
pxor xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
mov edx, dword [ebp - 0x98]
cmp eax, ebx
jl 0x10019210
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
pop ebx
cmp eax, esi
jge 0x10019294
mov cl, byte [ebp + eax - 0x8c]
xor cl, byte [ebp + eax - 0x48]
mov byte [edi + eax], cl
inc eax
cmp eax, esi
jl 0x10019281
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100683c1
mov esp, ebp
pop ebp
ret
Function at 0x1001b5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x100f860c
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x520070
mov dword [ebp - 0x14], 0x730065
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x650076
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x1001b623
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001b623
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001b605
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x100f860c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret

Function at 0x1001b650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x100f8634
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x520070
mov dword [ebp - 0x14], 0x730065
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x650076
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x1001b6d3
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001b6d3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001b6b5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x100f8634
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret

Function at 0x1001b700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100f8660
mov dword [ebp - 0x28], 0x740055
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6c0069
mov dword [ebp - 0x20], 0x5c0073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x750067
sub esi, eax
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x680064
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x1001b77e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001b77e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001b760
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x100f8660
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret
Function at 0x1001b7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f4384]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100f868c
mov dword [ebp - 0x28], 0x740055
lea esi, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6c0069
mov dword [ebp - 0x20], 0x5c0073
mov edx, 0x13
mov dword [ebp - 0x1c], 0x750067
sub esi, eax
mov dword [ebp - 0x18], 0x720061
mov dword [ebp - 0x14], 0x680064
mov dword [ebp - 0x10], 0x2e0070
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop
lea ecx, [edx + 0x7fffffeb]
test ecx, ecx
je 0x1001b81e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001b81e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001b800
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x100f868c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100683c1
mov esp, ebp
pop ebp
ret