joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011eb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10074068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test dl, dl
je 0x10011ef0
call fcn.10011dd0
test al, al
je 0x10011ef0
mov al, 1
jmp 0x10012020
lea ecx, [ebp - 0x28]
call fcn.10012e70
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x10011fe6
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10011fe6
push 0x10068e60
mov edx, esi
lea ecx, [ebp - 0x40]
call fcn.10007fc0
add esp, 4
push 0x10068e4c
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.10008090
add esp, 4
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x10011f89
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10011f7f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001203b
push edx
push ecx
call fcn.10036da6
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
push ecx
lea edx, [ebp - 0x58]
mov dword [ebp - 0x2c], 7
lea ecx, [ebp - 0x28]
mov word [ebp - 0x40], ax
call fcn.10011820
mov edx, dword [ebp - 0x44]
add esp, 4
mov bl, al
cmp edx, 8
jb 0x10011fe8
mov ecx, dword [ebp - 0x58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10011fda
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10012040
push edx
push ecx
call fcn.10036da6
add esp, 8
jmp 0x10011fe8
xor bl, bl
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1001201e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10012014
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10012045
push edx
push ecx
call fcn.10036da6
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10036d72
mov esp, ebp
pop ebp
ret
call fcn.1003be19
call fcn.1003be19
call fcn.1003be19
int3
Function at 0x10012110
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10074068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
mov eax, dword [0x100777ec]
push esi
push edi
test al, 1
jne 0x10012165
or eax, 1
mov dword [0x10077800], 0
mov dword [0x100777ec], eax
xor eax, eax
push 0x1005a0d0
mov dword [0x10077804], 7
mov word [0x100777f0], ax
call fcn.10037102
add esp, 4
cmp dword [0x10077800], 0
jne 0x10012332
push ecx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
lea ecx, [ebp - 0x1c]
call fcn.10022b50
add esp, 8
mov ecx, 0x100777f0
call fcn.1000bcd0
movups xmm0, xmmword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
movups xmmword [0x100777f0], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [0x10077800], xmm0
test ecx, ecx
je 0x100122e8
cmp dword [ebp - 8], 8
mov eax, 0x100777f0
cmovae eax, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x100121d7
push 0x5c
mov ecx, 0x100777f0
call fcn.1000cbd0
mov edx, dword [0x10077804]
mov eax, edx
mov ecx, dword [0x10077800]
sub eax, ecx
cmp eax, 6
jb 0x1001221f
cmp edx, 8
lea edi, [ecx + 6]
mov esi, 0x100777f0
mov dword [0x10077800], edi
cmovae esi, dword [0x100777f0]
push 0xc
push 0x10068e74
lea eax, [esi + ecx*2]
push eax
call fcn.10038950
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x10012239
push 6
push 0x10068e74
mov byte [ebp - 0x20], 0
mov ecx, 0x100777f0
push dword [ebp - 0x20]
push 6
call fcn.10008860
mov ecx, dword [0x10077800]
mov edx, dword [0x10077804]
cmp ecx, edx
jae 0x10012269
lea eax, [ecx + 1]
cmp edx, 8
mov dword [0x10077800], eax
mov eax, 0x100777f0
cmovae eax, dword [0x100777f0]
mov dword [eax + ecx*2], 0x5c
jmp 0x1001227d
push 0x5c
mov byte [ebp - 0x20], 0
push dword [ebp - 0x20]
push ecx
mov ecx, 0x100777f0
call fcn.1000cdf0
mov edx, dword [0x10077804]
mov eax, edx
mov ecx, dword [0x10077800]
sub eax, ecx
cmp eax, 0xd
jb 0x100122c5
cmp edx, 8
lea edi, [ecx + 0xd]
mov esi, 0x100777f0
mov dword [0x10077800], edi
cmovae esi, dword [0x100777f0]
push 0x1a
push 0x10068e84
lea eax, [esi + ecx*2]
push eax
call fcn.10038950
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x100122df
push 0xd
push 0x10068e84
mov byte [ebp - 0x20], 0
mov ecx, 0x100777f0
push dword [ebp - 0x20]
push 0xd
call fcn.10008860
cmp dword [0x10077800], 0
jne 0x100122f9
push 0x13
push str.C:UploaderSettings
mov ecx, 0x100777f0
call fcn.1000b7d0
cmp dword [0x10077804], 8
mov eax, 0x100777f0
cmovae eax, dword [0x100777f0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10012332
cmp dword [0x10077804], 8
mov ecx, 0x100777f0
cmovae ecx, dword [0x100777f0]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x100777f0
mov ecx, ebx
call fcn.100041b0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10036d72
mov esp, ebp
pop ebp
ret
Function at 0x10012360
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10077808]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
test al, 1
jne 0x100123a3
or eax, 1
mov dword [0x1007781c], 0
push 0x1005a130
mov dword [0x10077808], eax
mov dword [0x10077820], 0xf
mov byte [0x1007780c], 0
call fcn.10037102
add esp, 4
cmp dword [0x1007781c], 0
jne case.0x100123dd.26
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
mov ecx, 0x1007780c
push 0x10068a4c
movzx esi, ax
call fcn.1000bb50
lea eax, [esi - 0x19]
pop esi
cmp eax, 0x26
ja case.0x100123dd.26
movzx eax, byte [eax + 0x10012424]
jmp dword [eax*4 + 0x10012414]
push 0x10068a6c
jmp 0x100123f7
push 0x10068adc
jmp 0x100123f7
push 0x10068ab4
mov ecx, 0x1007780c
call fcn.1000bb50
push 0x1007780c
mov ecx, edi
call fcn.1000a910
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10012a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057da0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10074068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov ebx, ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.10012980
mov edi, dword [ebp - 0x24]
add esp, 4
test edi, edi
je 0x10012b54
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10012b54
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x10012a96
cmp eax, 2
jne 0x10012b54
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
je 0x10012b54
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.1000cb20
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x24]
push eax
push esi
push ebx
call fcn.10014930
test eax, eax
jne 0x10012b24
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012ad7
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x18]
push esi
call fcn.1000b7d0
test esi, esi
je 0x10012b20
mov ecx, dword [ebp - 0x28]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x10012b16
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10012b75
push ecx
push esi
call fcn.10036da6
add esp, 8
mov bl, 1
jmp 0x10012b56
test esi, esi
je 0x10012b54
mov ecx, dword [ebp - 0x28]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x10012b4a
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10012b7a
push ecx
push esi
call fcn.10036da6
add esp, 8
xor bl, bl
test edi, edi
je 0x10012b61
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1003be19
call fcn.1003be19
int3
Function at 0x100148a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x100148bf
cmp dword [edi], 2
jae 0x100148bf
pop edi
mov eax, 0x7a
pop esi
pop ebp
ret 0xc
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push str.ExternalDirs
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10014929
cmp dword [ebp + 0x10], 7
jne 0x10014924
mov ecx, dword [ebp + 0xc]
test esi, esi
je 0x10014918
test cl, 1
jne 0x10014924
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x10014924
cmp word [esi + eax*2 - 2], 0
jne 0x10014924
cmp eax, 1
jbe 0x10014918
cmp word [esi + eax*2 - 4], 0
jne 0x10014924
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
mov eax, 0xd
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10014930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100149a1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x1001496f
cmp eax, 2
jne 0x1001498b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1001499b
test ecx, ecx
je 0x10014996
test cl, 1
jne 0x1001498b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x1001499b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1001e280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058706
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x10074068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x438], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x420], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x428], esi
test esi, esi
jne 0x1001e323
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x428], eax
test esi, esi
jne 0x1001e323
call fcn.1001b900
mov edi, eax
jmp 0x1001e43e
push dword [ebp - 0x424]
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1001e342
call fcn.1001b900
jmp 0x1001e431
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x1001e360
call fcn.1001b900
jmp 0x1001e431
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x42c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x1001e381
mov edi, 0x8007000e
jmp 0x1001e433
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x1001e480
jb 0x1001e39f
cmp eax, 0xffffffff
ja 0x1001e480
cmp eax, 0x400
jbe 0x1001e3b4
push eax
lea ecx, [ebp - 0x420]
call fcn.1001c950
jmp 0x1001e3da
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], eax
jmp 0x1001e3da
mov dword [ebp - 4], 1
cmp dword [ebp - 0x420], 0
jne 0x1001e3f1
mov edi, 0x8007000e
jmp 0x1001e433
push edi
push dword [ebp - 0x420]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1001e411
call fcn.1001b900
jmp 0x1001e431
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x434]
push dword [ebp - 0x420]
call fcn.1001e0e0
mov edi, eax
test esi, esi
je 0x1001e43e
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x1001e460
lea ecx, [ebp - 0x420]
call fcn.1001c930
nop word [eax + eax]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10036d72
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.1000bee0
int3
Function at 0x10021d80
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058ae0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10074068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
push dword [ebx + 0x18]
lea eax, [ebx + 0x18]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x10021ddc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 4], 0xffffffff
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
cmp esi, edi
je 0x10021e69
cmp dword [esi - 4], 8
lea eax, [esi - 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
jb 0x10021dfe
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [ebp - 0x2c]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
cmp eax, 0xffffffff
je 0x10021e3b
test al, 0x10
jne 0x10021e3b
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x10021e34
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, edi
je 0x10021e66
nop
cmp dword [esi - 4], 8
lea eax, [esi - 0x18]
jb 0x10021e4b
mov eax, dword [eax]
mov esi, ebx
add ebx, 0xffffffe8
mov ecx, ebx
cmp dword [ecx + 0x14], 8
jb 0x10021e5a
mov ecx, dword [ecx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp ebx, edi
jne 0x10021e40
mov ebx, dword [ebp - 0x34]
mov esi, dword [ebx + 8]
cmp dword [esi + 0x14], 8
jb 0x10021e74
mov esi, dword [esi]
mov edx, esi
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10021e90
sub edx, ecx
lea ecx, [ebp - 0x28]
sar edx, 1
push edx
push esi
call fcn.1000b7d0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.10021f20
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10021eee
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10021ee4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10021f13
push edx
push ecx
call fcn.10036da6
add esp, 8
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10036d72
mov esp, ebp
pop ebp
ret
call fcn.1003be19
int3
Function at 0x10021f20
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x10074068]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
push esi
cmp dword [eax + 0x14], 8
jb 0x10021f40
mov eax, dword [eax]
push ecx
push 4
push ecx
lea esi, [ecx + 4]
push 0xc0000000
push eax
mov ecx, esi
call fcn.10022830
push 2
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x10021ffe
push str._r_n_r_n
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
call fcn.1000bb50
mov edx, dword [esp + 0x20]
lea eax, [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp edx, 0x10
cmovae eax, ecx
cmp dword [esp + 0x1c], 0
je 0x10021fd4
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push dword [esp + 0x24]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
cmp edx, 0x10
jb 0x10021ffe
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10021ff4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10022010
push edx
push ecx
call fcn.10036da6
add esp, 8
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.10036d72
mov esp, ebp
pop ebp
ret 4
call fcn.1003be19
int3
Function at 0x10022b50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058c22
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x10074068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x224], esi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
push str.shell32.dll
mov dword [ebp - 0x228], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x10022c3f
push str.SHGetKnownFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10022c38
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push ecx
push 0
push 0x1000
push 0x1005b390
call eax
test eax, eax
js 0x10022c38
mov edx, dword [ebp - 0x220]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x224], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10022c10
sub ecx, dword [ebp - 0x224]
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.1000b7d0
push dword [ebp - 0x220]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esi + 0x10], 0
jne 0x10022cc8
test ebx, ebx
je 0x10022c8e
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push dword [ebx]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10022c8e
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10022c70
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000b7d0
cmp dword [esi + 0x10], 0
jne 0x10022cc8
push str.APPDATA
call fcn.100426dd
mov edx, eax
add esp, 4
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10022cb0
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.1000b7d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10036d72
mov esp, ebp
pop ebp
ret

Function at 0x1004f215
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004eb83

Function at 0x1004f220
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004edbe
Function at 0x10053dd4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10053b3d
jp 0x10053e33
pop ebp
sbb ecx, dword [ebp - 0x17af57bb]
pop edi
std
invalid
dec ebp
or al, 0x88
pop ebp
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10053b3d
dec ebx
jae 0x10053eaf
add cl, byte [ebp - 0x17af3fbb]
invalid
inc ebp
ljmp 0x45c6

Function at 0x10053ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10053b4d
push eax
push esi
push dword [ebp + 8]
call fcn.10053b02
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10053b4d
push eax
push esi
push dword [ebp + 8]
call fcn.10053b02
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10053b4d
push eax
push esi
push dword [ebp + 8]
call fcn.10053b02
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10053b3d
mov ebx, 0x88e66313
popfd
jl 0x10053fc2
invalid
invalid
Function at 0x10054270
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10054214
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10054232
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10054290
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
invalid
je 0x10054277
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10054280
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1005428a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1005426c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100541f6
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
add bl, byte [ecx + 0xf]
mov dh, 4
pop es
sub eax, ecx
je 0x100542dd
dec eax
je 0x100542d4
sub eax, 3
je 0x100542cb
mov dword [ebp - 4], 0x40
jmp 0x100542fa
mov dword [ebp - 4], 4
jmp 0x100542e0
mov dword [ebp - 4], 0x20
jmp 0x100542e0
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1005432c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x100542ac
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10053b3d
mov byte [eax + 0x75ffc1b9], bl
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x10054338
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret