joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10072260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x100722fb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100722b2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100722b2
cmp esi, ebx
jge 0x100722b2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x100722f5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x100722f5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007230d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072530
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x10072558
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072572
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10055c84
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076450
leave
ret 4

Function at 0x10072740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072776
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100727d5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10055c84
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10055c84
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10055c84
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076450
leave
ret 0x10
Function at 0x100727f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007281c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1007284d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1007284b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10055c84
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1007284d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076450
leave
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10004f88
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005707a
call fcn.100567e0
sub esp, 0x20
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x10005045
mov dword [ebp - 0x14], 0x20
cmp dword [ebp - 0x14], 0x3d3
jle 0x10004fde
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10071338
xor eax, esi
cdq
push edx
push eax
call fcn.100060aa
inc edi
cmp edi, 0x2f11
jl 0x10004fbb
inc esi
cmp esi, 0x342a
jl 0x10004fb9
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0xffffffa3
jge 0x10004ff7
mov edx, str.byobuxgnx_pthip_wjdbgci_igjp_aehdcrewd_rsi_kapbx_hwref_sqmsn_wcnz_xhiyokmp_kmkl
mov ecx, 0x10071338
call fcn.1000aac1
mov edi, dword [ebp + 0x1c]
lea ecx, [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0x14]
push dword [ebp + 8]
imul edx, dword [edi], 0x18
add edx, dword [esi]
call fcn.10001afc
pop ecx
imul ecx, dword [edi], 0x18
push eax
add ecx, dword [esi]
call fcn.1000621f
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10007153
jmp 0x1000505f
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x1000505a
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 1
jl 0x10005050
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000db23
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x100574af
call fcn.100567e0
sub esp, 0x20
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
je 0x1000dbf7
push 0
push 0x490
push 0x2b72
push 0x150
lea eax, [ebp - 0x14]
xor esi, esi
push eax
inc esi
lea ecx, [ebp - 0x20]
push 0x537b
mov dword [ebp - 0x14], esi
xor dl, dl
mov dword [ebp - 0x20], 0x4c8d3c89
push esi
call fcn.1000e1dc
mov dword [ebp - 0x14], esi
add esp, 0x1c
mov dword [ebp - 0x18], 0x2e6e
cmp dword [ebp - 0x18], 0x31c6
jle 0x1000dbbc
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10071338
cdq
push edx
push eax
call fcn.100060aa
inc edi
cmp edi, 0x929
jl 0x1000db97
inc esi
cmp esi, 0x606b
jl 0x1000db95
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2b81
jge 0x1000dbd8
mov edx, str.lexagitmz_wpriul_pxpenl_nwztxu_yubvrxv_cazqffv_qucugkwq
mov ecx, 0x10071338
call fcn.1000aac1
jmp 0x1000dc8b
mov dword [ebp - 0x1c], 0x1451
cmp dword [ebp - 0x1c], 0x17c8
jle 0x1000dc63
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
and dword [ebp - 0x24], 0
lea ecx, [ebx + edi]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
shl esi, cl
mov eax, esi
mov ecx, 0x10071338
and eax, edi
cdq
push edx
push eax
call fcn.100060aa
inc edi
cmp edi, 0x2c63
jl 0x1000dc22
mov esi, dword [ebp - 0x14]
inc ebx
mov edi, dword [ebp - 0x18]
cmp ebx, 0x6c71
jl 0x1000dc13
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1615
jl 0x1000dc11
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x75e1
jl 0x1000dc0c
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x10bd
jge 0x1000dc82
mov edx, str.eevdff_apbnnpzs_dzted_iozzrrvj_jziy_fsiexlgb_ytmadfr_vggszbhs_jeweplyp_resg_fzqg_vcquh_mgsfcbq_dhzocljt
mov ecx, 0x10071338
call fcn.1000aac1
mov eax, dword [ebp - 0x28]
push 0xb
pop ecx
mov word [eax], cx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e3bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov byte [ebp - 4], dl
mov dword [ebp - 0xc], 0x4fe
cmp dword [ebp - 0xc], 0x66e
push esi
push edi
jle 0x1000e426
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
xor eax, ebx
lea ecx, [ebp - 0x24]
cdq
push edx
push eax
call fcn.10001a99
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e3f8
mov eax, dword [eax]
push eax
call fcn.1004027d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.10006cfe
inc ebx
cmp ebx, 0x4afa
jl 0x1000e3de
inc edi
cmp edi, 0x6ddc
jl 0x1000e3dc
inc esi
cmp esi, 0x4901
jl 0x1000e3da
cmp byte [ebp - 4], 0
je 0x1000e439
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1000e466
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x1000e461
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x1000e45f
push 0
push 0x8c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
dec dword [esi]
cmp dword [esi], 0xfffffff0
jne 0x1000e444
cmp dword [ebp - 0xc], 0x2bb
jge 0x1000e47a
push str.rngokdddo_ooghdhlw_icl
call fcn.1004027d
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011027
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005765e
call fcn.100567e0
sub esp, 0x40
push ebx
push esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x20], 0x6627
cmp dword [ebp - 0x20], 0x6790
push edi
mov dword [ebp - 0x10], esp
jle 0x1001109e
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x1c], 0x5308
xor edi, edi
mov eax, ebx
lea ecx, [ebp - 0x4c]
xor eax, edi
cdq
push edx
push eax
call fcn.10001a99
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10011073
mov eax, dword [eax]
push eax
call fcn.1004027d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.10006cfe
inc edi
cmp edi, 0x1234
jl 0x1001105a
dec ebx
dec dword [ebp - 0x1c]
jne 0x10011058
inc esi
cmp esi, 0x73ed
jl 0x1001104f
cmp dword [ebp - 0x20], 0x626b
jge 0x100110b2
push str.mpvxbfi_tlciwcpr_agqykh
call fcn.1004027d
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x10011234
mov dword [ebp - 0x24], 0x1472
mov esi, 0x10071338
cmp dword [ebp - 0x24], 0x174a
jle 0x10011111
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], 0x7e1
mov eax, edi
mov ecx, esi
cdq
push edx
push eax
call fcn.100060aa
add edi, ebx
dec dword [ebp - 0x20]
jne 0x100110e6
mov edi, dword [ebp - 0x1c]
dec ebx
cmp ebx, 0xffffaa8c
jg 0x100110dc
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0xd87
jl 0x100110da
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x10dc
jge 0x1001114e
mov edx, str.gmewr_vtgqaq_ylw_iobwg_bis_lekmwj
mov ecx, esi
call fcn.1000aac1
jmp 0x1001114e
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2c], 0x3eb
cmp dword [ebp - 0x2c], 0x73f
jle 0x100111d9
xor edi, edi
mov dword [ebp - 0x28], edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor eax, eax
mov dword [ebp - 0x1c], edi
mov ecx, ebx
mov dword [ebp - 0x24], eax
sar edi, cl
mov dword [ebp - 0x1c], edi
mov ecx, eax
mov dword [ebp - 0x30], edi
xor ebx, ebx
shl edi, cl
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, esi
cdq
push edx
push eax
call fcn.100060aa
inc ebx
cmp ebx, 0x58c5
jl 0x10011184
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x4b0d
jl 0x1001117b
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x28]
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x5dab
jl 0x1001116c
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x143
jl 0x10011167
push 0x23ed
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100111fc
mov edi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0x114768c0
inc dword [edx]
cmp dword [edx], 3
jl 0x100111ea
mov dword [ebp - 4], 4
cmp dword [ebp - 0x2c], 0x39c
jge 0x10011218
mov edx, str.pohjqdqh_zurmboivh_ckieksms_yklqp_upkkmume_zqesabt_morls_tvcmh_dvbyvs
mov ecx, esi
call fcn.1000aac1
jmp 0x10011245
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x10011245
xor cl, cl
call fcn.1001220e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012ab6
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], 0x51df
cmp dword [esp + 0x14], 0x558f
push 0
pop ebx
jle 0x10012b1e
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x18]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a99
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10012af9
mov eax, dword [eax]
push eax
call fcn.1004027d
pop ecx
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.10006cfe
inc edi
cmp edi, 0x7aa0
jl 0x10012adf
inc esi
cmp esi, 0x59c4
jl 0x10012add
cmp byte [esp + 0x10], 0
push ebx
push ebx
je 0x10012b2f
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x10012b37
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
cmp dword [esp + 0x14], 0x4fc9
jge 0x10012b4c
push str.fxgrfzx_xxtyeadiq_pgggt_ztemryruy_esia_ewdqi_vxhaasmac_xzkotf_opw
call fcn.1004027d
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100137c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100137d7
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100137f9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10442de4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10443170
jl 0x10013807
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10443414
jl 0x10013847
mov ecx, dword [0x10444160]
xor ecx, dword [0x10442de4]
and ecx, edi
xor ecx, dword [0x10444160]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10442de0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10443414]
mov dword [0x104437a0], eax
pop esi
ret

Function at 0x10013d74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x2c], 0
je 0x10013da2
cmp byte [ebp + 0xc], 0
je 0x10013d90
mov eax, dword [ebp + 0x1c]
movzx ecx, byte [eax]
mov eax, dword [ebp + 0x18]
add dword [eax], ecx
pop ebp
ret
mov eax, dword [ecx]
xor ecx, ecx
inc ecx
sub ecx, eax
mov eax, dword [ebp + 8]
mov dword [edx], ecx
mov ecx, dword [edx]
mov dword [eax], ecx
pop ebp
ret
cmp byte [ebp + 0x28], 0
je 0x10013dbb
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [eax + ecx*4], 4
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 0x20]
xor ebx, ebx
mov dword [esi], ebx
jmp 0x10013dde
mov byte [ebp + 0x2f], bl
cmp byte [ebp + 0x2f], bl
je 0x10013ddc
push ebx
push 0x8c4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
dec dword [esi]
cmp dword [esi], 0xfffffff0
jne 0x10013dc6
pop esi
pop ebx
pop ebp
ret
Function at 0x100150e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001512e
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001510f
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x1001512c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001512c
push 0
push 0x8c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10015155
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 0
push 0x1e9a
push 0x7123
push dword [ebp - 0xc]
push 0x258c
push 0x2e6d
call fcn.10025a23
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x100151ec
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057827
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001530e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], 0x5a29
mov dword [ebp - 0x3c], str.cxofa_pflni_nckalbwe_oujdshf_frnemg_txwunop_rplcal_pmxiayntc_vwmgvr_hobntijcr_butytwz_sjj_eqqdgrz
cmp dword [ebp - 0x2c], 0x5d4e
jle 0x100152af
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
and dword [ebp - 0x18], 0
jmp 0x10015254
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2461
jge 0x100152af
and dword [ebp - 0x1c], 0
jmp 0x1001526a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5c2d
jge 0x100152ad
and dword [ebp - 0x20], 0
jmp 0x10015280
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x570
jge 0x100152ab
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x10071338
call fcn.100060aa
jmp 0x10015279
jmp 0x10015263
jmp 0x1001524d
push dword [ebp - 0x34]
push 0x5fbb
push 0xf81
push dword [ebp - 0x38]
push 1
call fcn.1001541c
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x5740
jge 0x100152e3
mov edx, dword [ebp - 0x3c]
mov ecx, 0x10071338
call fcn.1000aac1
jmp 0x100152ff
or dword [ebp - 4], 0xffffffff
jmp 0x10015309
jmp 0x1001540b
lea eax, [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x100153ef
mov dword [ebp - 0x30], 0x26f5
mov dword [ebp - 0x44], str.scdrz_hkwkcavp_uiclcmm_xauzlelgb_fet
cmp dword [ebp - 0x30], 0x287e
jle 0x10015396
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
and dword [ebp - 0x24], 0
jmp 0x10015354
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1ce6
jge 0x10015396
and dword [ebp - 0x28], 0
jmp 0x1001536a
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x5d1d
jge 0x10015394
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sar eax, cl
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0x10071338
call fcn.100060aa
jmp 0x10015363
jmp 0x1001534d
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100153aa
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0x2655
jge 0x100153c7
mov edx, dword [ebp - 0x44]
mov ecx, 0x10071338
call fcn.1000aac1
jmp 0x100153e3
or dword [ebp - 4], 0xffffffff
jmp 0x100153ed
jmp 0x1001540b
push 1
push 0x16af
push 0x2608
push 0x24da
push 0xd08
call dword [sym.imp.USER32.dll_SetScrollRange]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015afc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005783b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10015c7b
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10015c65
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x10015b78
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x10015c63
mov dword [ebp - 0x28], 0x1f8b
mov dword [ebp - 0x44], str.ejqslpv_jpufkics_bunujfl
cmp dword [ebp - 0x28], 0x20e2
jle 0x10015c0b
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and dword [ebp - 0x1c], 0
jmp 0x10015bb0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2942
jge 0x10015c0b
and dword [ebp - 0x20], 0
jmp 0x10015bc6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xc18
jge 0x10015c09
and dword [ebp - 0x24], 0
jmp 0x10015bdc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x99f
jge 0x10015c07
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x10071338
call fcn.100060aa
jmp 0x10015bd5
jmp 0x10015bbf
jmp 0x10015ba9
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.10006458
mov dword [eax], 0x20fe
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x1e30
jge 0x10015c38
mov edx, dword [ebp - 0x44]
mov ecx, 0x10071338
call fcn.1000aac1
jmp 0x10015c54
or dword [ebp - 4], 0xffffffff
jmp 0x10015c5e
jmp 0x10015b6d
jmp 0x10015c79
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10015c79
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
jmp 0x10015caf
lea eax, [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x10015c9e
mov byte [ebp - 0x12], 0
push 0
lea eax, [ebp - 0x12]
push eax
call fcn.10017de7
pop ecx
pop ecx
jmp 0x10015caf
push 0
push 0x8c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028552
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp byte [ebp + 0x14], 0
push esi
mov byte [esp + 0xc], dl
mov esi, ecx
je 0x100285b0
xor ecx, ecx
cmp byte [ebp + 0xc], cl
je 0x1002857a
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x100285db
mov dword [esi], ecx
cmp dword [esi], 0xffffffef
jle 0x100285db
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], ecx
jmp 0x1002859a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x14], 0x74dd0324
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1002858a
mov eax, dword [esp + 0x14]
mov dword [edx], eax
dec dword [esi]
cmp dword [esi], 0xffffffef
jg 0x10028584
jmp 0x100285db
test dl, dl
je 0x100285c8
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100285db
xor ecx, ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x100285db
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x100285db
push ecx
call fcn.1002964d
pop ecx
pop esi
mov esp, ebp
pop ebp
ret