joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10122ee0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10167c60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100c456e
mov edi, eax
add esp, 4
test edi, edi
je 0x100596fb
push 1
mov dword [ebp - 4], 0
call fcn.10086e3d
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005d630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x8c], 0x4c0043
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x8c]
mov eax, 0x10172800
mov dword [ebp - 0x88], 0x63006f
push edi
mov dword [ebp - 0x84], 0x53006b
mov edx, 0x43
mov dword [ebp - 0x80], 0x720063
sub esi, eax
mov dword [ebp - 0x7c], 0x650065
mov dword [ebp - 0x78], 0x57006e
mov dword [ebp - 0x74], 0x64006e
mov dword [ebp - 0x70], 0x3a003a
mov dword [ebp - 0x6c], 0x6e004f
mov dword [ebp - 0x68], 0x6e0057
mov dword [ebp - 0x64], 0x430064
mov dword [ebp - 0x60], 0x650072
mov dword [ebp - 0x5c], 0x740061
mov dword [ebp - 0x58], 0x280065
mov dword [ebp - 0x54], 0x200029
mov dword [ebp - 0x50], 0x740073
mov dword [ebp - 0x4c], 0x650052
mov dword [ebp - 0x48], 0x740063
mov dword [ebp - 0x44], 0x57002e
mov dword [ebp - 0x40], 0x640069
mov dword [ebp - 0x3c], 0x680074
mov dword [ebp - 0x38], 0x290028
mov dword [ebp - 0x34], 0x25003d
mov dword [ebp - 0x30], 0x200064
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x650052
mov dword [ebp - 0x24], 0x740063
mov dword [ebp - 0x20], 0x48002e
mov dword [ebp - 0x1c], 0x690065
mov dword [ebp - 0x18], 0x680067
mov dword [ebp - 0x14], 0x280074
mov dword [ebp - 0x10], 0x3d0029
mov dword [ebp - 0xc], 0x640025
nop
lea ecx, [edx + 0x7fffffbb]
test ecx, ecx
je 0x1005d76e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1005d76e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1005d750
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret

Function at 0x1005dda0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10122c08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10167c60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.100079a0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 4], 0
call fcn.10041710
mov edi, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1005de09
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
push 0
push dword [esi]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1005e280
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012716c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10167c60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0xfc]
lea eax, [ebp - 0x10]
push eax
call fcn.1005dda0
push dword [ebp - 0x10]
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005e3b9
push 0x10174590
push 0x14
call fcn.100c490f
add esp, 8
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1005e2f3
mov ecx, eax
call fcn.10090660
jmp 0x1005e2f5
xor eax, eax
mov byte [ebp - 4], 0
mov dword [esi + 0x100], eax
test eax, eax
je 0x1005e3b9
push dword [ebp - 0x10]
mov ecx, eax
call fcn.10090ea0
mov ecx, dword [esi + 0x100]
call fcn.10090c60
test al, al
jne 0x1005e330
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor esi, esi
jmp 0x1005e3c5
push 0xb4
call fcn.100c456e
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1005e353
mov ecx, eax
call fcn.1008d460
mov edi, eax
jmp 0x1005e355
xor edi, edi
mov eax, dword [edi]
push 1
push edi
mov byte [ebp - 4], 0
call dword [eax + 0x90]
movups xmm0, xmmword [esi + 0x140]
push 0
sub esp, 0x10
mov ecx, edi
mov eax, esp
push 0x4ca
movups xmmword [eax], xmm0
lea eax, [esi + 0x24]
push eax
push dword [esi + 4]
call fcn.1008c140
mov ecx, edi
call fcn.1008da50
push 0
push dword [esi + 0x100]
mov ecx, edi
call fcn.1008da70
mov eax, dword [esi + 0x44]
push 1
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe0]
mov eax, dword [esi + 0x44]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x108]
mov ecx, esi
call fcn.1005dbd0
mov esi, 1
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1005e3e7
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005e970
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012720c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10167c60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x1005eb45
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005eb45
cmp dword [esi + 0x88], 0
je 0x1005e9f4
mov eax, dword [esi - 0x34]
push 0x4ca
push eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
test eax, eax
je 0x1005e9da
push 0
push 0
mov ecx, eax
call fcn.1008da70
mov ecx, dword [esi + 0x88]
test ecx, ecx
je 0x1005e9ea
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x88], 0
push edi
lea eax, [ebp + 8]
push eax
lea ecx, [esi - 0x78]
call fcn.1005dda0
push 0x10174590
push 0x14
mov dword [ebp - 4], 0
call fcn.100c490f
add esp, 8
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1005ea2b
mov ecx, eax
call fcn.10090660
jmp 0x1005ea2d
xor eax, eax
mov byte [ebp - 4], 0
mov dword [esi + 0x88], eax
test eax, eax
je 0x1005ea75
push dword [ebp + 8]
mov ecx, eax
call fcn.10090ea0
mov eax, dword [esi - 0x34]
push 0x4ca
push eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
test eax, eax
je 0x1005ea75
push 0
push dword [esi + 0x88]
mov ecx, eax
call fcn.1008da70
mov eax, dword [esi - 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x108]
mov ecx, dword [esi + 0xb8]
test ecx, ecx
je 0x1005eaaa
call fcn.1000bac0
mov edi, dword [esi + 0xb8]
test edi, edi
je 0x1005eaa0
mov ecx, edi
call fcn.10007ef0
push 0x34
push edi
call fcn.100c459e
add esp, 8
mov dword [esi + 0xb8], 0
push 0x10174590
push 0x34
call fcn.100c490f
add esp, 8
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x1005eacd
mov ecx, eax
call fcn.10007c60
jmp 0x1005eacf
xor eax, eax
mov byte [ebp - 4], 0
mov dword [esi + 0xb8], eax
test eax, eax
je 0x1005eb23
call fcn.10008be0
mov ecx, dword [esi + 0xb8]
push eax
push dword [esi - 0x74]
call fcn.1000b910
mov ecx, dword [esi + 0xb8]
call fcn.1000b930
push dword [ebp + 0xc]
mov ecx, dword [esi + 0xb8]
call fcn.1000b8b0
push dword [ebp + 0x10]
mov ecx, dword [esi + 0xb8]
call fcn.1000b900
mov ecx, dword [esi + 0xb8]
call fcn.1000ba70
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005eb45
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005f870
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10127388
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x18], edi
lea edi, [esi + 0x140]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
movups xmm0, xmmword [ebp - 0x20]
movups xmmword [edi], xmm0
call fcn.1002fe60
mov ecx, eax
call fcn.10022310
push 0
push ecx
test al, al
mov eax, esp
push 0
push 0
push 0
push ecx
mov dword [eax], 0
mov eax, esp
push 0
je 0x1005f905
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
movups xmmword [ebp - 0x20], xmm0
mov dword [eax], ecx
jmp 0x1005f907
mov dword [eax], edi
mov ecx, esi
call fcn.1005da90
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
call fcn.10085d82
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 1
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x21]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push eax
push 0x10013840
push 0x1016d09c
call fcn.1008615f
add esp, 0x10
test eax, eax
je 0x1005f9a7
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 2
push eax
call fcn.10085dbc
mov ecx, dword [0x1016d098]
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push 1
push 0
push str.show
call fcn.1009cb70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
call fcn.10085ddd
add esp, 4
mov byte [ebp - 4], 1
test al, al
jne 0x1005f9c4
call fcn.10086177
sub esp, 8
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.1000c170
call fcn.1000cb30
int3
Function at 0x1005fb20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov dword [ebp - 8], ecx
push edi
nop dword [eax]
mov edi, dword [ecx]
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x1005fb86
lea eax, [edi + 8]
mov esi, 0x270
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x1005fb46
mov eax, dword [edi]
jmp 0x1005fc68
cmp eax, 0x4e0
jb 0x1005fc68
mov eax, dword [edi + 0x9c4]
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x1005fba2
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x1005fbf0
mov edi, dword [ebp - 4]
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
mov ecx, dword [ebp - 8]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [ecx + 8]
ja 0x1005fb30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10061ae0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012755a
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x438], edi
lea eax, [edi + 8]
mov dword [edi], vtable.CSmartLogger.0
push eax
mov dword [edi + 4], vtable._BaseModule::CCriticalSection.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov byte [ebp - 4], 1
call fcn.100088b0
mov ecx, eax
test ecx, ecx
je 0x10061c7c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x2c], eax
push 0x10135aac
push 0
mov byte [ebp - 4], 2
mov dword [edi + 0x30], 1
call fcn.100fc642
push 0x208
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.100e67c0
add esp, 0x14
lea eax, [ebp - 0x224]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x360033
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x18], 0x770030
push eax
mov dword [ebp - 0x14], 0x70
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x208
lea eax, [ebp - 0x42c]
push 0
push eax
call fcn.100e67c0
add esp, 0xc
lea ecx, [ebp - 0x42d]
call fcn.10061e80
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x42d]
mov dword [0x101728c4], eax
call fcn.10061f60
push eax
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x224]
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10061c40
sub edx, ecx
lea eax, [ebp - 0x224]
sar edx, 1
lea ecx, [edi + 0x2c]
push edx
push eax
call fcn.1000b940
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10008520
int3
Function at 0x10062840
Capabilities:
Check if file exists
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push esi
lea esi, [ecx + 0x2c]
mov ecx, dword [eax]
mov eax, dword [esi]
push edi
lea edx, [ecx - 0x10]
lea edi, [eax - 0x10]
cmp edx, edi
je 0x100628a4
cmp dword [edi + 0xc], 0
push ebx
lea ebx, [edi + 0xc]
jl 0x10062896
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x10062896
push edx
call fcn.10008570
add esp, 4
mov dword [ebp + 8], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x1006288f
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
jmp 0x100628a3
push dword [ecx - 0xc]
push ecx
mov ecx, esi
call fcn.1000b940
mov eax, dword [esi]
pop ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1006290a
mov eax, dword [esi]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
cmp dword [eax - 0xc], 0
je 0x1006290a
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100628f1
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
jl 0x1006290a
jg 0x10062902
cmp dword [ebp - 8], 0x40000000
jbe 0x1006290a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100649e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101277bb
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x220], edi
mov eax, dword [ebp + 8]
xor esi, esi
push str.CPopupChecker::IsPopupEnabled
mov dword [ebp - 0x22c], eax
lea ebx, [esi + 1]
call fcn.10061520
push 0x118
lea eax, [ebp - 0x128]
mov dword [ebp - 0x12c], 0x11c
push esi
push eax
call fcn.100e67c0
add esp, 0x10
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10064a6b
cmp byte [ebp - 0x12], bl
je 0x10064a6b
lea esi, [ebx + 7]
jmp 0x10064c2f
mov ecx, edi
call fcn.10063780
test eax, eax
je 0x10064b12
cmp eax, 0x20
je 0x10064c2a
cmp eax, 1
jne 0x10064a92
mov esi, 0x100
jmp 0x10064c2f
cmp eax, 4
jne 0x10064aa1
mov esi, 0x400
jmp 0x10064c2f
cmp eax, 8
jne 0x10064ab0
mov esi, 0x800
jmp 0x10064c2f
cmp eax, 0x10
jne 0x10064abc
mov esi, eax
jmp 0x10064c2f
cmp eax, 0x40
jne 0x10064acb
mov esi, 0x1000
jmp 0x10064c2f
cmp eax, 0x80
jne 0x10064adc
mov esi, 0x2000
jmp 0x10064c2f
cmp eax, 0x100
jne 0x10064aed
mov esi, 0x4000
jmp 0x10064c2f
cmp eax, 2
jne 0x10064afb
mov esi, 0x200
xor ebx, ebx
jmp 0x10064b12
cmp eax, 0x400
mov ecx, 0x10000
cmove esi, ecx
xor ebx, ebx
test esi, esi
jne 0x10064c31
mov ecx, edi
call fcn.10063980
test eax, eax
jne 0x10064c2a
mov eax, dword [edi + 0x10]
add edi, 0xc
cmp dword [edi], eax
jne 0x10064b3e
mov ecx, dword [ebp - 0x220]
push edi
call fcn.10063e10
mov eax, dword [edi + 4]
cmp dword [edi], eax
je 0x10064b4f
push edi
call fcn.10017980
add esp, 4
test eax, eax
jne 0x10064c2a
call fcn.10064330
test eax, eax
je 0x10064b6f
push str.FullScreen::IsHaveFullScreen__
call fcn.10061520
add esp, 4
mov esi, 0x10
jmp 0x10064c2f
mov ecx, dword [ebp - 0x220]
call fcn.10063870
test eax, eax
je 0x10064b88
mov esi, 0x20
jmp 0x10064c2f
test esi, esi
jne 0x10064c31
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100e67c0
add esp, 0xc
lea eax, [ebp - 0x218]
push esi
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x219]
call fcn.10063d30
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x228]
call fcn.10071d90
lea eax, [ebp - 0x224]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x224], esi
push eax
lea ecx, [ebp - 0x228]
call fcn.100727e0
test eax, eax
je 0x10064c18
xor ebx, ebx
lea ecx, [ebp - 0x228]
cmp dword [ebp - 0x224], ebx
sete bl
call fcn.10071da0
jmp 0x10064c31
lea ecx, [ebp - 0x228]
mov ebx, 1
call fcn.10071da0
jmp 0x10064c31
mov esi, 2
xor ebx, ebx
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x10064c3d
mov dword [eax], esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret 4
Function at 0x100699e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10127bc8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10167c60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.1006ca30
push dword [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.10074f00
add esp, 4
test eax, eax
je 0x10069a39
push 5
push 0
push dword [ebp + 8]
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x10]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10069a5b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100724f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10128c4b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x10167c60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
jne 0x100726ab
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.100e67c0
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push dword [0x1016e968]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [0x10172eb4]
test al, 1
jne 0x1007257e
or eax, 1
mov dword [0x10172eb0], 0
mov dword [0x10172eb4], eax
mov byte [ebp - 0x229], 0
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 0
push eax
call fcn.10085d82
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 1
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x229]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x240]
push eax
push 0x100718b0
push 0x10172eb0
call fcn.1008615f
add esp, 0x10
test eax, eax
je 0x100726c6
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 2
push eax
call fcn.10085dbc
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x228]
push 0x10172eb8
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100726ab
lea eax, [ebp - 0x228]
push eax
call fcn.1009bdb0
add esp, 4
test eax, eax
je 0x100726ab
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x100726ab
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x4c746547
push eax
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x1c], 0x78456175
mov dword [ebp - 0x18], 0x69616c70
mov word [ebp - 0x14], 0x6e
call fcn.10040eb0
push dword [ebp - 0x230]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x230]
mov edi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x10072699
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x100726ab
call edi
mov dword [esi], eax
test eax, eax
je 0x100726ab
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c495f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 3
push eax
call fcn.10085ddd
add esp, 4
mov byte [ebp - 4], 1
test al, al
jne 0x100726e6
call fcn.10086177
sub esp, 8
lea eax, [ebp - 0x238]
mov ecx, esp
push eax
call fcn.1000c170
call fcn.1000cb30
int3