joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007a8e1
Capabilities:
Accept command line arguments

Disassembly:
push 0x1c
mov eax, 0x100b1799
call fcn.100a4ea8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002e64e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002ec9b
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.1008e3f5
test esi, esi
je 0x1007a924
push 4
jmp 0x1007a949
lea ecx, [ebp - 0x28]
call fcn.1002ea4c
test al, al
je 0x1007a934
push 2
jmp 0x1007a949
push 0
push 0x100070f8
lea ecx, [ebp - 0x24]
call fcn.1002e1ff
test al, al
je 0x1007a94c
push 3
pop esi
jmp 0x1007a94f
xor esi, esi
inc esi
lea ecx, [ebp - 0x28]
call fcn.1002e9d0
mov eax, esi
call fcn.100a4e71
ret

Function at 0x1007ae08
Capabilities:
Accept command line arguments

Disassembly:
push 0x30
mov eax, 0x100b27e5
call fcn.100a4ea8
mov ebx, edx
mov dword [ebp - 0x20], ebx
mov edi, ecx
mov dword [ebp - 0x1c], edi
and dword [ebp - 0x24], 0
lea ecx, [ebp - 0x18]
call fcn.1004067f
and dword [ebp - 4], 0
push dword [ebp - 0x18]
movzx eax, bx
mov ebx, dword [ebp + 8]
push eax
push 0x1001c388
push 2
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.1002e198
add esp, 0x14
mov esi, esp
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008e35d
add eax, 0x10
lea ecx, [ebp - 0x14]
mov edx, ebx
mov dword [esi], eax
call fcn.10035968
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1002e64e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x3c]
call fcn.1002ecbc
mov byte [ebp - 4], 3
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push ebx
cmp dword [eax - 0xc], 0
je 0x1007aec8
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1003fda5
push ebx
push dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.10040708
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1007aed2
push dword [ebp - 0x20]
mov ecx, edi
call fcn.10040708
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
lea ecx, [ebp - 0x3c]
call fcn.1002e9d0
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov eax, edi
call fcn.100a4e71
ret 4
Function at 0x1007af03
Capabilities:
Accept command line arguments

Disassembly:
push 0x38
mov eax, 0x100b2861
call fcn.100a4ea8
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
and dword [ebp - 0x20], 0
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call fcn.1008e1f3
push eax
mov ecx, ebx
call fcn.1008df96
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x44]
call fcn.1002e64e
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x44]
call fcn.1002ec33
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.1008e3f5
test esi, esi
je 0x1007b03d
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x44]
call fcn.1002ec33
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x18]
push dword [eax]
call fcn.1006f372
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008e35d
lea esi, [eax + 0x10]
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0x1c]
call fcn.1008df96
lea edx, [ebp - 0x1c]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
call fcn.1002fded
mov edi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push edi
call fcn.1006f372
mov byte [ebp - 4], 9
push dword [ebx]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x1007b016
lea ecx, [ebp - 0x24]
call fcn.10030691
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xa
call fcn.1006f1e0
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
push dword [ebp - 0x14]
mov ecx, ebx
call fcn.1006e80f
jmp 0x1007b021
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1006f1e0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
lea ecx, [edi - 0x10]
call fcn.1008e3f5
mov byte [ebp - 4], 2
lea ecx, [esi - 0x10]
jmp 0x1007b05b
lea ecx, [ebp - 0x28]
call fcn.10030691
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xb
call fcn.1006f1e0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
push dword [ebp + 8]
mov ecx, ebx
call fcn.1006e80f
lea ecx, [ebp - 0x44]
call fcn.1002e9d0
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov eax, ebx
call fcn.100a4e71
ret 4
Function at 0x1007b6e3
Capabilities:
Accept command line arguments

Disassembly:
push 0x168
mov eax, 0x100b29a0
call fcn.100a4ea8
mov edi, ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 0x24], 0
push ecx
mov ecx, esp
push edx
call fcn.1006f372
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.10035968
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1002e64e
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x3c]
call fcn.1002ecbc
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push dword [ebp + 8]
cmp dword [eax - 0xc], 0
jne 0x1007b754
mov ecx, edi
call fcn.1004f9c2
jmp 0x1007b7da
lea ecx, [ebp - 0x174]
call fcn.1004f9c2
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x118]
call fcn.1004e262
mov esi, eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x118]
call fcn.1003ea33
push ecx
push dword [ebp + 8]
lea edx, [ebp - 0x10]
mov byte [ebp - 4], 5
push esi
push eax
lea ecx, [ebp - 0x18]
call fcn.1003fcd2
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
push dword [ebp + 0xc]
lea edx, [ebp - 0x18]
mov ecx, edi
push dword [ebp + 8]
call fcn.1004f9c2
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x174]
call fcn.1004f642
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
lea ecx, [ebp - 0x3c]
call fcn.1002e9d0
push dword [ebp - 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
call fcn.100a4e71
ret 8
Function at 0x10080873
Capabilities:
Check if file exists

Disassembly:
push 0x60
mov eax, 0x100b3341
call fcn.100a4edc
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x58]
call fcn.10030691
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
push 0x1001cd3c
call fcn.1006e80f
mov dword [ebp - 0x54], 0x1001cd50
xor esi, esi
mov dword [ebp - 0x50], 0x1001cd64
mov dword [ebp - 0x4c], 0x1001cd78
mov dword [ebp - 0x48], 0x1001cd8c
mov dword [ebp - 0x44], 0x1001cda0
mov dword [ebp - 0x40], 0x1001cdb4
mov dword [ebp - 0x3c], 0x1001cdd0
mov dword [ebp - 0x38], 0x1001cdf4
mov dword [ebp - 0x34], 0x1001ce0c
mov dword [ebp - 0x30], 0x1001ce24
mov dword [ebp - 0x2c], 0x1001ce3c
mov dword [ebp - 0x28], 0x1001ce54
mov dword [ebp - 0x24], 0x1001ce6c
mov dword [ebp - 0x20], 0x1001ce84
mov dword [ebp - 0x1c], 0x1001ce9c
mov dword [ebp - 0x18], 0x1001ceb4
mov dword [ebp - 0x14], 0x1001cecc
push dword [ebp + esi*4 - 0x54]
lea ecx, [ebp - 0x58]
call fcn.1006e80f
push dword [ebp - 0x58]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1008094e
lea ecx, [ebp - 0x58]
call fcn.1006e6ff
inc esi
cmp esi, 0x11
jb 0x10080914
mov ecx, dword [ebp - 0x58]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
call fcn.100a4e86
ret 4
lea ecx, [ebp - 0x5c]
call fcn.1008e2b0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.1006e350
push eax
lea ecx, [ebp - 0x60]
call fcn.1008e3d0
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x5c]
push 0x1001cee8
push eax
call fcn.1008dbf3
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.1002dff0
mov edx, dword [edi]
lea ecx, [ebp - 0x5c]
call fcn.1006e348
mov esi, dword [edx + 4]
mov ecx, esi
push eax
push 0
call dword [0x100cf608]
mov ecx, edi
call esi
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.100330f2
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.100416c0
push 0x100c4c08
lea eax, [ebp - 0x64]
push eax
call fcn.1009378c
int3
Function at 0x100809d5
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0x100b3376
call fcn.100a4ea8
mov dword [ebp - 0x18], ecx
push 0x1001cf28
push 0x1001cf40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10080a06
xor eax, eax
jmp 0x10080b1e
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100cf608]
mov ecx, edi
call esi
mov ebx, dword [ebp + 0x14]
push 0x1001cf50
push 0
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100cf608]
mov ecx, ebx
call esi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
and dword [ebp - 0x14], 0
push ecx
push dword [ebp + 0xc]
mov eax, dword [edi]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x100cf608]
mov ecx, edi
call esi
mov dword [ebp - 0x10], eax
test eax, eax
jns 0x10080a94
push ebx
push ecx
mov ecx, esp
push 0x1001cfa8
call fcn.1006f372
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
call fcn.100845e3
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push 0x1001cfe0
push 0
push ebx
push eax
call fcn.1002e198
mov eax, dword [ebp - 0x10]
add esp, 0x14
jmp 0x10080b1e
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
and dword [ebp - 4], 0
mov eax, dword [esi]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100cf608]
mov ecx, esi
call edi
push ecx
mov ecx, esp
push 0x1001d064
call fcn.1006f372
mov edi, dword [ebp - 0x18]
push 7
mov ecx, dword [edi + 0x40]
call fcn.1006d0d7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x34]
call fcn.1002e64e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x18], 0x13ec
call fcn.1002ea25
push ebx
push 0
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 4]
call fcn.100665cf
lea ecx, [ebp - 0x34]
call fcn.1002e9d0
mov dword [ebp - 4], 2
mov eax, dword [esi]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x100cf608]
mov ecx, esi
call edi
mov eax, dword [ebp - 0x18]
call fcn.100a4e71
ret 0x10

Function at 0x10080bd0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x10080bee
xor eax, eax
push eax
push eax
push esi
push 0x10088070
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x10], eax
pop esi
ret
Function at 0x100822d6
Capabilities:
Delete file
Get common file path

Disassembly:
push 0x18
mov eax, 0x100b36ed
call fcn.100a4ea8
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebx + 8]
sub ecx, 0x10
call fcn.1008e35d
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.1006e6ff
push ecx
mov ecx, dword [ebx + 8]
mov esi, esp
sub ecx, 0x10
mov dword [ebp - 0x24], esi
call fcn.1008e35d
add eax, 0x10
mov dword [esi], eax
call fcn.1003001d
mov dword [ebp - 0x14], eax
test eax, eax
jns 0x10082383
mov edi, dword [ebp - 0x10]
lea ecx, [edi - 0x10]
call fcn.1008e35d
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
mov edx, 0x1001d08c
lea ecx, [ebp - 0x1c]
call fcn.1006e932
mov byte [ebp - 4], 2
mov ebx, dword [ebx + 0x18]
push dword [eax]
push 0
mov edx, dword [ebx]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x100cf608]
mov ecx, ebx
call esi
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
jmp 0x1008245c
add ebx, 0xc
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ebx
mov edx, 0x105
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edx
or eax, ecx
jge 0x100823a7
push edx
mov ecx, ebx
call fcn.1008de52
push dword [ebx]
mov edi, dword [ebp - 0x10]
push 0
push 0x1001d0c8
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1008242d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jle 0x100823d9
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x14], ebx
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0x18]
call fcn.1008df96
push ebx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push 0x1001d0d0
push eax
call fcn.1008dbf3
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov esi, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x20], eax
push esi
push 0
mov eax, dword [eax]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x100cf608]
mov ecx, dword [ebp - 0x20]
call ebx
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 0
call fcn.1008e3f5
mov ebx, dword [ebp - 0x24]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.1008db88
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x14], 0
je 0x1008245c
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x1000b094
mov ecx, esi
call fcn.1008dd1a
push eax
push esi
mov ecx, ebx
call fcn.10073b09
lea ecx, [edi - 0x10]
call fcn.1008e3f5
mov eax, dword [ebp - 0x14]
call fcn.100a4e71
ret
Function at 0x1008271f
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0xc]
mov dword [esi], 0x10015e88
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1008273e
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0xc]
sub ecx, 0x10
call fcn.1008e3f5
mov ecx, dword [esi + 8]
sub ecx, 0x10
pop esi
jmp fcn.1008e3f5

Function at 0x10083a7c
Capabilities:
Accept command line arguments

Disassembly:
push 0x24
mov eax, 0x100b392f
call fcn.100a4ea8
mov esi, ecx
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x30]
call fcn.1002e64e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
call fcn.1002ec9b
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov ebx, dword [eax - 0xc]
call fcn.1008e3f5
mov ecx, dword [esi + 0xc]
sub ecx, 0x10
call fcn.1008e35d
lea edi, [eax + 0x10]
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.1008e35d
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.1006f0b1
neg eax
lea ecx, [esi - 0x10]
sbb al, al
inc al
mov dword [ebp - 0x10], eax
call fcn.1008e3f5
lea ecx, [edi - 0x10]
call fcn.1008e3f5
test ebx, ebx
jne 0x10083b21
cmp byte [ebp - 0x10], bl
jne 0x10083b21
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x15], bl
je 0x10083b21
cmp byte [eax + 0x14], bl
je 0x10083b21
inc ebx
jmp 0x10083b23
xor bl, bl
lea ecx, [ebp - 0x30]
call fcn.1002e9d0
mov al, bl
call fcn.100a4e71
ret

Function at 0x100845e3
Capabilities:
Accept command line arguments

Disassembly:
push 0x1c
mov eax, 0x100b3aa3
call fcn.100a4ea8
mov ebx, ecx
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
mov eax, dword [esi]
cmp eax, 0x80004004
jne 0x10084606
mov eax, 0x80070642
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002e64e
mov byte [ebp - 4], 1
push dword [esi]
push ecx
mov esi, esp
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0xc]
lea ecx, [edi - 0x10]
call fcn.1008e35d
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [ebx + 0x40]
call fcn.10088f2e
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 0x13ed
call fcn.1002ea25
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push 0
push ecx
push eax
lea ecx, [ebx + 4]
call fcn.100665cf
lea ecx, [ebp - 0x28]
call fcn.1002e9d0
lea ecx, [edi - 0x10]
call fcn.1008e3f5
call fcn.100a4e71
ret 0xc
Function at 0x100880a5
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push 0x14
mov eax, 0x100b3fb4
call fcn.100a4ea8
mov ebx, ecx
mov dword [ebp - 0x20], ebx
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0x14]
call fcn.1008df96
and dword [ebp - 4], 0
call fcn.1008e1f3
push eax
lea ecx, [ebp - 0x10]
call fcn.1008df96
lea eax, [ebx + 0x2c]
mov byte [ebp - 4], 1
mov ecx, dword [eax]
sub ecx, 0x10
mov dword [ebp - 0x18], eax
call fcn.1008e35d
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.1006e6ff
mov ebx, dword [ebx + 0xc]
mov edi, dword [ebp - 0x1c]
cmp ebx, 0xffff
jae 0x1008819b
push ebx
push edi
lea eax, [ebp - 0x10]
push 0x1001e5ec
push eax
call fcn.1008dbf3
mov esi, dword [ebp - 0x10]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10088151
mov eax, dword [ebp - 0x20]
push esi
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1008815a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1008815a
cmp eax, 0xb7
jne 0x1008815f
inc ebx
cmp ebx, 0xffff
jb 0x1008810e
mov ebx, dword [ebp - 0x18]
jmp 0x100881a1
push eax
lea eax, [ebp - 0x14]
push 0x1001e610
push eax
call fcn.1008dbf3
mov eax, dword [ebp - 0x20]
add esp, 0xc
mov ebx, dword [eax + 8]
push dword [ebp - 0x14]
push 0
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100cf608]
mov ecx, ebx
call esi
mov ebx, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push ebx
call fcn.1006f1e0
jmp 0x1008819e
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100881e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebx]
lea eax, [ebp - 0x14]
push 0x1001e688
push eax
call fcn.1008dbf3
mov eax, dword [ebp - 0x20]
add esp, 0x10
mov eax, dword [eax + 8]
push dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
push 0
mov eax, dword [eax]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [0x100cf608]
mov ecx, dword [ebp - 0x20]
call ebx
lea ecx, [edi - 0x10]
call fcn.1008e3f5
lea ecx, [esi - 0x10]
call fcn.1008e3f5
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.1008e3f5
call fcn.100a4e71
ret
Function at 0x100891c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100c5014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100cf608]
mov ecx, edi
call esi
test eax, eax
jns 0x100891f7
xor al, al
jmp 0x100892bb
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x100cf608]
mov ecx, edi
call esi
test eax, eax
js 0x100891f0
mov eax, dword [edi]
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x100cf608]
mov ecx, edi
call esi
test eax, eax
js 0x100891f0
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
push 0
push eax
call fcn.100935b0
push esi
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.100935b0
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1001e944
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov eax, dword [edi]
lea ecx, [ebp - 0x414]
push ecx
push 0x1001e94c
push dword [edi + 0x24b8]
mov esi, dword [eax + 0x44]
mov ecx, esi
call dword [0x100cf608]
mov ecx, edi
call esi
test eax, eax
js 0x100891f0
mov eax, dword [edi]
push dword [edi + 0x24b8]
mov esi, dword [eax + 0x38]
mov ecx, esi
call dword [0x100cf608]
mov ecx, edi
call esi
test eax, eax
setns al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100906e8
mov esp, ebp
pop ebp
ret
Function at 0x1008a470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10089c04
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10089bb9
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
invalid
movsd dword es:[edi], dword [esi]
invalid
cld
invalid

Function at 0x1008aad5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10089bd2
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
Function at 0x1008b4a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cdq
mov byte [ebp - 0x73c], 0xb1
mov byte [ebp - 0x73b], 0x94
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
mov byte [ebp - 0x735], 0xbc
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.10089c04
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10089bb9
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
invalid

Function at 0x1008c375
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1008c3cf
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1008c3c1
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1008c3bd
cmp esi, ecx
jae 0x1008c3c1
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1008c3ab
cmp esi, ecx
jb 0x1008c3c5
xor eax, eax
jmp 0x1008c3ce
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1009334e
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10002838
push 0x10002830
push 0x10002838
push 0
call fcn.100932ce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10093380
push dword [ebp + 8]
mov ecx, esi
call fcn.100911ed
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x100933c2
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1000285c
push 0x10002854
push 0x1000285c
push 2
call fcn.100932ce
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x100933f3
mov ecx, esi
call fcn.100911ed
call esi
jmp 0x100933f9
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x100933fc
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10002870
push 0x10002868
push 0x10002870
push 3
call fcn.100932ce
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x10093430
mov ecx, esi
call fcn.100911ed
call esi
jmp 0x10093436
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x1009dff3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009dcb3
Function at 0x54d066
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0xddaf2555
mov word [esp], sp
pushfd
pushal
lea esp, [esp + 0x28]
jmp 0x5a5de7