joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b3ee3
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100df778
push 0x10078870
mov eax, dword fs:[0]
push eax
push ecx
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100eb3e0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 0x14]
add eax, 5
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100b3a76
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push dword [eax + 0x210]
call fcn.100b3a76
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x100b400f
cmp dword [ebp - 0x28], 0
je 0x100b400f
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
cmp eax, 0xe9
jne 0x100b400f
push dword [ebp + 0x18]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
push eax
call fcn.100715cf
add esp, 0xc
test eax, eax
jne 0x100b400f
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call fcn.100715cf
add esp, 0xc
test eax, eax
je 0x100b400f
and dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x40
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100b400f
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x100b3ffc
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], 0xfffffffe
jmp 0x100b402a
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100b44d9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.10073a50
add esp, 0xc
push 0x11c
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.10073a50
add esp, 0xc
mov dword [ebp - 0x228], 0x11c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100b455e
mov dword [ebp - 0x228], 0x114
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100b455e
xor eax, eax
jmp 0x100b4579
cmp dword [ebp - 0x224], 6
jne 0x100b4577
cmp dword [ebp - 0x220], 1
jb 0x100b4577
xor eax, eax
inc eax
jmp 0x100b4579
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10070dd1
leave
ret

Function at 0x100b4585
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.10073a50
add esp, 0xc
push 0x11c
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.10073a50
add esp, 0xc
mov dword [ebp - 0x228], 0x11c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100b460a
mov dword [ebp - 0x228], 0x114
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100b460a
xor eax, eax
jmp 0x100b4625
cmp dword [ebp - 0x224], 6
jne 0x100b4623
cmp dword [ebp - 0x220], 0
jne 0x100b4623
xor eax, eax
inc eax
jmp 0x100b4625
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10070dd1
leave
ret

Function at 0x100b4631
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x100b4651
xor eax, eax
jmp 0x100b4706
and dword [ebp - 8], 0
call fcn.100b44d2
neg eax
sbb eax, eax
and eax, 0x200
add eax, 0x20019
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
push dword [ebp + 8]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100b4704
cmp dword [ebp - 8], 0
je 0x100b4704
and word [ebp - 0x220], 0
push 0x20a
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.10073a50
add esp, 0xc
mov dword [ebp - 0xc], 0x20b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100b46f7
push 0x103
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0x10]
call fcn.100740c3
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x100b4706
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100b4706
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100b474a
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbd34
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x228]
call fcn.10010322
and dword [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.10004773
and word [ebp - 0x224], 0
push 0x20a
push 0
lea eax, [ebp - 0x222]
push eax
call fcn.10073a50
add esp, 0xc
push 1
push 0x23
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.10003b3f
lea ecx, [ebp - 0x228]
call fcn.1001042d
test eax, eax
jle 0x100b4831
lea eax, [ebp - 0x228]
push eax
call fcn.100b4712
pop ecx
push str.TencentQMDownload_
lea ecx, [ebp - 0x228]
call fcn.10009d23
lea ecx, [ebp - 0x228]
call fcn.1002ffe8
push eax
call fcn.10009cf9
pop ecx
test eax, eax
jne 0x100b4831
push 0
lea ecx, [ebp - 0x228]
call fcn.1002ffe8
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 8]
call fcn.10003aa2
mov eax, dword [ebp - 0x22c]
or eax, 1
mov dword [ebp - 0x22c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.100103c0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070dd1
leave
ret

Function at 0x100b4878
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
mov eax, dword [0x10107888]
and eax, 1
jne 0x100b48be
mov eax, dword [0x10107888]
or eax, 1
mov dword [0x10107888], eax
mov ecx, 0x10107884
call fcn.10010322
push 0x100c2ece
call fcn.1007133b
pop ecx
mov ecx, 0x10107884
call fcn.10003a8c
movzx eax, al
test eax, eax
je 0x100b4948
and word [ebp - 0x218], 0
push 0x20a
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10073a50
add esp, 0xc
push 0x208
lea eax, [ebp - 0x218]
push eax
push 0x100d396c
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x10107884
call fcn.10003b3f
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100b4948
push 0
mov ecx, 0x10107884
call fcn.1002ffe8
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push 0x10107884
mov ecx, dword [ebp + 8]
call fcn.10003aa2
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100b4a04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 3
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x18], 1
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x100d3c88
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100b4a61
jmp 0x100b4bb4
push dword [ebp + 8]
push 0x100d3cd8
push 0x103
lea eax, [ebp - 0x128]
push eax
call fcn.10007d3f
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100b4aa6
jmp 0x100b4bab
mov dword [ebp - 0x18], 4
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100d3ce8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100b4ade
jmp 0x100b4ba2
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0x103
push 0x104
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.10073a50
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100d3cf8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100b4b29
jmp 0x100b4ba2
cmp dword [ebp - 0x10], 1
jne 0x100b4b59
push 0x100d3c84
call fcn.10070d30
pop ecx
push eax
push 0x100d3d08
lea eax, [ebp - 0x128]
push eax
call fcn.10072c4f
add esp, 0xc
test eax, eax
jne 0x100b4b59
and dword [ebp - 8], 0
jmp 0x100b4ba2
cmp dword [ebp - 0x10], 1
jne 0x100b4b8c
push 0x100d3d0c
call fcn.10070d30
pop ecx
push eax
push 0x100d3d10
lea eax, [ebp - 0x128]
push eax
call fcn.10072c4f
add esp, 0xc
test eax, eax
je 0x100b4b8c
mov dword [ebp - 8], 2
jmp 0x100b4ba2
cmp dword [ebp - 0x10], 2
jne 0x100b4b9b
mov dword [ebp - 8], 1
jmp 0x100b4ba2
mov dword [ebp - 8], 3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100b4f82
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x20], eax
and dword [ebp - 8], 0
jmp 0x100b4fb2
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100b4fd0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x100b4fab
mov dword [ebp - 0x1c], 0xe3779b90
and dword [ebp - 8], 0
jmp 0x100b4fe4
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x100b503f
mov eax, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x61c88647
mov dword [ebp - 0x1c], eax
jmp 0x100b4fdd
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
leave
ret
Function at 0x100b505e
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [ebp - 0x20], eax
and dword [ebp - 8], 0
jmp 0x100b508e
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100b50ac
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x18], eax
jmp 0x100b5087
and dword [ebp - 0x1c], 0
and dword [ebp - 8], 0
jmp 0x100b50bd
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x100b5114
mov eax, dword [ebp - 0x1c]
sub eax, 0x61c88647
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
shl eax, 4
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 0x20]
shr ecx, 5
add ecx, dword [ebp - 0x14]
xor eax, ecx
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x1c]
xor eax, ecx
mov ecx, dword [ebp - 4]
shr ecx, 5
add ecx, dword [ebp - 0xc]
xor eax, ecx
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
jmp 0x100b50b6
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
leave
ret
Function at 0x100b8738
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bce0f
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x2c]
call fcn.100016b4
and dword [ebp - 4], 0
mov byte [ebp - 0x2d], 0
push 0x208
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.10073a50
add esp, 0xc
push 1
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0xfffffff7
add eax, 0x23
push eax
lea eax, [ebp - 0x23c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100b8852
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x258]
call fcn.100016dd
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x264], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2c]
call fcn.10001776
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x258]
call fcn.1000174b
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100b8814
push 0x100d3d2c
lea ecx, [ebp - 0x2c]
call fcn.10004c4b
jmp 0x100b8821
push 0x100d3d54
lea ecx, [ebp - 0x2c]
call fcn.10004c4b
lea eax, [ebp - 0x2c]
push eax
call fcn.100b73b6
pop ecx
movzx eax, al
test eax, eax
jne 0x100b8841
lea eax, [ebp - 0x2c]
push eax
call fcn.100b82ed
pop ecx
mov byte [ebp - 0x2d], al
jmp 0x100b8845
mov byte [ebp - 0x2d], 1
push 0x100d3d78
lea ecx, [ebp - 0x2c]
call fcn.10004c4b
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.10001713
mov eax, dword [ebp - 0x25c]
or eax, 1
mov dword [ebp - 0x25c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1000174b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100b8893
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bce3f
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
mov byte [ebp - 0x31], 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.100b8738
pop ecx
pop ecx
and dword [ebp - 4], 0
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x30]
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100b8930
push 1
lea eax, [ebp - 0x50]
push eax
call fcn.100b8738
pop ecx
pop ecx
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x50]
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x50]
call fcn.1000174b
cmp dword [ebp - 0x10], 0xffffffff
je 0x100b8961
push 0
lea eax, [ebp - 0x54]
push eax
push 0x10
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100b8958
cmp dword [ebp - 0x54], 0x10
jne 0x100b8958
mov byte [ebp - 0x31], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x31]
mov byte [ebp - 0x55], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000174b
mov al, byte [ebp - 0x55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10070dd1
leave
ret 4
Function at 0x100b898f
Capabilities:
Copy file
Delete file
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bce6c
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov byte [ebp - 0x31], 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.100b8738
pop ecx
pop ecx
and dword [ebp - 4], 0
or dword [ebp - 0x10], 0xffffffff
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x30]
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x100b8a83
push 1
lea eax, [ebp - 0x50]
push eax
call fcn.100b8738
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
call fcn.100b601a
pop ecx
movzx eax, al
test eax, eax
jne 0x100b8a5a
lea eax, [ebp - 0x50]
push eax
call fcn.100b601a
pop ecx
movzx eax, al
test eax, eax
je 0x100b8a5a
push 0
lea ecx, [ebp - 0x30]
call fcn.10004cd2
push eax
lea ecx, [ebp - 0x50]
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100b8a5a
lea ecx, [ebp - 0x50]
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea ecx, [ebp - 0x50]
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x50]
call fcn.1000174b
cmp dword [ebp - 0x10], 0xffffffff
je 0x100b8ad1
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x10
jb 0x100b8ac8
cmp dword [ebp - 0x54], 0xffffffff
je 0x100b8ac8
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x54]
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b8ac8
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x54]
jne 0x100b8ac8
mov byte [ebp - 0x31], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x31]
mov byte [ebp - 0x59], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000174b
mov al, byte [ebp - 0x59]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10070dd1
leave
ret 4
Function at 0x100b915a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
mov eax, dword [0x10107870]
and eax, 1
jne 0x100b91a0
mov eax, dword [0x10107870]
or eax, 1
mov dword [0x10107870], eax
mov ecx, 0x1010786c
call fcn.10010322
push 0x100c2ebf
call fcn.1007133b
pop ecx
mov ecx, 0x1010786c
call fcn.10003a8c
movzx eax, al
test eax, eax
je 0x100b91f3
and word [ebp - 0x218], 0
push 0x20a
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10073a50
add esp, 0xc
push 1
push 0x24
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x1010786c
call fcn.10003b3f
push 0x1010786c
mov ecx, dword [ebp + 8]
call fcn.10003aa2
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10070dd1
leave
ret

Function at 0x100b921e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100eb3e0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x21c], 0
mov eax, dword [0x10107878]
and eax, 1
jne 0x100b9264
mov eax, dword [0x10107878]
or eax, 1
mov dword [0x10107878], eax
mov ecx, 0x10107874
call fcn.10010322
push 0x100c2eb0
call fcn.1007133b
pop ecx
mov ecx, 0x10107874
call fcn.10003a8c
movzx eax, al
test eax, eax
je 0x100b92b7
and word [ebp - 0x218], 0
push 0x20a
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10073a50
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x10107874
call fcn.10003b3f
push 0x10107874
mov ecx, dword [ebp + 8]
call fcn.10003aa2
mov eax, dword [ebp - 0x21c]
or eax, 1
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10070dd1
leave
ret
Function at 0x100b96dd
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.1000189b
movzx eax, al
test eax, eax
jne 0x100b970c
push 4
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x74
call fcn.10004cd2
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
leave
ret 4
Function at 0x104c1794
Capabilities:
Encode data using xor

Disassembly:
jmp 0x104c179e
pushal
call 0x104c17a4
pop ebp
sub ebp, 0x10
sub ebp, 0x4c1794
mov al, byte [esp + 0x28]
cmp al, 1
je 0x104c17c8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x104c17d1
mov eax, 0x4c1794
add eax, ebp
add eax, 0x63
mov ecx, 0x5ed
mov edx, 0xa0b9ae3a
xor byte [eax], dl
inc eax
dec ecx
jne 0x104c17e8
jmp 0x104c17fb
mov cl, 0xf7
mov cl, 0xb3
push es
cmp bh, byte [edx]
cmp bh, byte [ebx + 0x3a3ac2fb]
cmp bh, byte [ecx]
test dword [edx + 0x3a3a3a3c], 0x3a3a1280
cmp cl, ch
fdivr dword [ecx]
mov cl, 0xbb
cmp bh, byte ss:[edx]
cmp bh, byte [ecx]
push dword [edi - 0x4c39e1a2]
push ds
push 0x52
xchg esp, eax
xor al, 0x3a
push edx
not byte [edx + 7]
cmp bh, byte [ebx]
push ss
push ds
push edx
nop
push esp
cmp esi, esi
sar byte [edi], cl
cmp bh, byte [edx]
cmp dl, bl
adc byte [edx], bh
cmp bh, byte [edx]
outsd dx, dword [esi]
mov bh, 0x56
push ds
cmp dh, byte [ecx + 0x3a3a32bf]
cmp dh, byte [ecx + 0x3a3a36af]
cmp dh, byte [ecx + 0x3a3a2ab7]
cmp bh, bl
sar dword [eax], cl
or edi, dword [eax]
mov ecx, 0x35733ef8
mov edi, 0xc5c5c5ce
clc
cmp dh, byte ss:[ecx + 0x3a3e1eb6]
cmp bh, byte [edx]
push edx
xchg esp, eax
xor al, 0x3a
push edx
not byte [edx + 7]
cmp bh, byte [ebx]
push ss
push ds
imul edx, edx, 0x3f
cmp bh, byte [edx]
cmp dl, bl
jno 0x104c18c4
cmp bh, byte [edx]
mov bh, 0x5e
push ds
invalid
je 0x104c18fa
cmp bh, byte [edx]
xor eax, 0x3a3a72b2
cmp bl, byte [ecx + esi*4 + 0x26]
jb 0x104c1900
cmp bh, byte [edx]
pop esp
mov cl, 0x26
add edi, dword [edx - 0x41ca2d3f]
and byte [edx], bh
cmp bh, byte [edx]
mov edx, 0xbe35d3c1
sub edi, dword [edx]
cmp bh, byte [edx]
pop esp
mov ebx, 0x351fc5c1
mov esi, 0x3a3a3a2f
jnp 0x104c18be
test ch, 0xc5
lds edx, [ebx]
jbe 0x104c18f5
cmp edi, dword [ecx - 0x2d46c005]
rol dword ds:[edi + 0x13c5c5c5], cl
outsb dx, byte [esi]
aas
mov ecx, 0x87d33ed2
invalid
xchg ebp, eax
invalid
add edi, dword [eax]
mov ecx, 0xd0b93cfb
mov ecx, 0x91d33fd2
invalid