joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100011b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 0
call fcn.10007160
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x10001204
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x100011d3
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10001330
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push 0x10021e68
call fcn.10003630
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov edi, eax
push 0x10021e50
push edi
call esi
push 0x10021e38
push edi
mov dword [0x10023c60], eax
call esi
push 0x10021e24
push edi
mov dword [0x10023c64], eax
call esi
push 0x10021e14
push edi
mov dword [0x10023c68], eax
call esi
push 0x10021e0c
mov dword [0x100239b4], eax
call fcn.10003630
add esp, 4
mov edi, eax
push str.LhfGWbLJBaGLDm_.xt
push edi
call esi
push str.T_No
push edi
mov dword [0x10023c5c], eax
call esi
pop edi
mov dword [0x10023b9c], eax
pop esi
ret
Function at 0x100013b0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
mov esi, dword [esp + 0x144]
xor ebx, ebx
push edi
push ebx
push ebx
mov byte [esi], 0x66
call fcn.10011560
mov byte [0x10024454], al
add esp, 8
mov byte [esi + 0xda], al
lea eax, [esi + 4]
push eax
mov dword [eax], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esi + 0xa8]
push 0x32
push eax
call dword [0x1002296c]
call fcn.100047b0
mov dword [esi + 0xa0], eax
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dx, word [esp + 0x34]
mov word [esi + 0xe0], dx
mov eax, dword [0x10023c5c]
cmp eax, ebx
jne 0x1000143b
call fcn.10001330
lea eax, [esp + 0x44]
push eax
push 0x100
call dword [0x10023c60]
mov al, byte [esp + 0x44]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp al, bl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
lea edi, [esp + 0x44]
je 0x100014d7
cmp byte [edi], 0x42
jle 0x100014cc
lea ecx, [esp + 0x18]
push ebx
lea edx, [esp + 0x14]
push ecx
push edx
push edi
call dword [0x10023c68]
test eax, eax
je 0x100014cc
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0x14
call fcn.10018db0
mov edx, dword [esi + 0xec]
mov ecx, 0x14
add edx, eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0xec], edx
mov edx, dword [esp + 0x14]
call fcn.10018db0
add dword [esi + 0xf0], eax
push edi
call ebp
lea edi, [edi + eax + 1]
cmp byte [edi], bl
jne 0x10001479
lea edi, [esi + 0x248]
mov byte [esi + 0xdb], 0xaa
push edi
call fcn.10012200
add esp, 4
test eax, eax
jne 0x100014fa
push edi
call fcn.10008720
add esp, 4
push edi
call ebp
cmp eax, 5
jge 0x1000150b
push edi
call sym.danim.dll_class_CRImage____stdcall_CRClip_class_CRImage___class_CRMatte__
add esp, 4
mov byte [esi + 0x25c], 0x46
mov eax, dword [0x100200bc]
add eax, 0x1e0
push 0x13
add esi, 0x25d
push eax
push esi
call sub.MSVCRT.dll_strncpy
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret

Function at 0x10001550
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push esi
push edi
call fcn.10013110
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
or esi, 0xffffffff
test ecx, ecx
jbe 0x10001589
push ebx
mov edx, esi
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
shr esi, 8
mov edx, dword [edx*4 + 0x100233c8]
xor esi, edx
inc eax
dec ecx
jne 0x1000156a
pop ebx
mov edi, dword [esp + 0x20]
test edi, edi
je 0x100015c8
mov ecx, esi
xor eax, eax
not ecx
mov dword [esp + 9], eax
push ecx
lea edx, [esp + 0xc]
mov dword [esp + 0x11], eax
push 0x10020e3c
push edx
mov byte [esp + 0x14], 0
mov byte [esp + 0x1d], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
not eax
pop esi
add esp, 0xc
ret
Function at 0x10002690
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1f4
call dword [0x10023ba4]
test eax, eax
jne 0x100026e8
mov al, byte [0x10023144]
push edi
mov byte [esp + 4], al
mov ecx, 0x7c
xor eax, eax
lea edi, [esp + 5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 4]
push 0x1f4
push ecx
stosb byte es:[edi], al
call dword [0x10023940]
lea edx, [esp + 4]
push edx
push 0x10020ea0
call dword [0x10023c90]
test eax, eax
pop edi
jne 0x100026e8
xor al, al
add esp, 0x1f4
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
add esp, 0x1f4
ret

Function at 0x10002aa0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push 0x1002113c
call fcn.10003630
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov esi, eax
push 0x1002112c
push esi
call edi
push 0x10021120
push esi
mov dword [0x10023be4], eax
call edi
push 0x10021114
push esi
mov dword [0x10023be8], eax
call edi
push str.rIYGQw_RdGGYCAjJDP__G56ZQA_I
push esi
mov dword [0x10023bec], eax
call edi
push 0x100210e8
push esi
mov dword [0x10023bf0], eax
call edi
push 0x100210d0
push esi
mov dword [0x10023bf4], eax
call edi
push 0x100210b8
push esi
mov dword [0x10023bf8], eax
call edi
push 0x100210ac
push esi
mov dword [0x10023bfc], eax
call edi
push 0x100210a0
push esi
mov dword [0x10023c08], eax
call edi
push 0x1002108c
push esi
mov dword [0x10023c04], eax
call edi
push 0x10021074
push esi
mov dword [0x10023c0c], eax
call edi
push 0x10021064
push esi
mov dword [0x10023c10], eax
call edi
push 0x10021058
push esi
mov dword [0x10023c14], eax
call edi
push 0x1002104c
push esi
mov dword [0x10023c18], eax
call edi
push 0x10021040
push esi
mov dword [0x10023c1c], eax
call edi
push 0x10021030
push esi
mov dword [0x10023c20], eax
call edi
push 0x10021024
push esi
mov dword [0x10023c2c], eax
call edi
push 0x1002100c
push esi
mov dword [0x10023c28], eax
call edi
push 0x10020ff4
mov dword [0x10023c30], eax
push esi
call edi
push 0x10020fe4
push esi
mov dword [0x10023c34], eax
call edi
push 0x10020fd4
push esi
mov dword [0x10023c38], eax
call edi
push 0x10020fc0
push esi
mov dword [0x10023c3c], eax
call edi
push 0x10020fac
push esi
mov dword [0x10023c00], eax
call edi
push 0x10020f98
push esi
mov dword [0x10023c24], eax
call edi
push 0x10020f84
push esi
mov dword [0x10023bdc], eax
call edi
pop edi
mov dword [0x10023be0], eax
pop esi
ret
Function at 0x10002d70
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push 0x1002214c
call fcn.10003630
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov edi, eax
push 0x10022130
push edi
call esi
push 0x10022120
push edi
mov dword [0x100239b0], eax
call esi
push 0x10022114
mov dword [0x10023b68], eax
call fcn.10003630
add esp, 4
mov edi, eax
push 0x10022100
push edi
call esi
push 0x100220e8
push edi
mov dword [0x100238e0], eax
call esi
push 0x100220dc
mov dword [0x10023b78], eax
call fcn.10003630
add esp, 4
mov edi, eax
push 0x100220c0
push edi
call esi
push 0x100220b0
push edi
mov dword [0x10023980], eax
call esi
push 0x1002209c
push edi
mov dword [0x10023c74], eax
call esi
push 0x10022090
mov dword [0x10023aa8], eax
call fcn.10003630
add esp, 4
mov edi, eax
push 0x10022080
push edi
call esi
push 0x10022074
push edi
mov dword [0x10023900], eax
call esi
push 0x10022068
mov dword [0x10023af4], eax
call fcn.10003630
add esp, 4
mov edi, eax
push 0x10022060
push edi
call esi
push 0x10022048
push edi
mov dword [0x10023a2c], eax
call esi
push 0x10022034
push edi
mov dword [0x10023ae0], eax
call esi
push 0x10022020
push edi
mov dword [0x10023ad8], eax
call esi
push 0x10022014
push edi
mov dword [0x10023a74], eax
call esi
push 0x10022004
mov dword [0x10023934], eax
push edi
call esi
push str.yiZVbHVP__cMEO_IbLEURF3456s_U_OYy__AB
push edi
mov dword [0x100239c0], eax
call esi
push 0x10021fe8
push edi
mov dword [0x10023a70], eax
call esi
push 0x10021fdc
mov dword [0x10023b28], eax
call fcn.10003630
add esp, 4
mov edi, eax
push 0x10021fcc
push edi
call esi
push 0x10021fb8
push edi
mov dword [0x10023cb4], eax
call esi
push 0x10021fa4
push edi
mov dword [0x10023a18], eax
call esi
push 0x10021f90
push edi
mov dword [0x10023af0], eax
call esi
push 0x10021f88
mov dword [0x10023b74], eax
call fcn.10003630
add esp, 4
push 0x10021f74
push eax
call esi
pop edi
mov dword [0x10023b8c], eax
pop esi
ret
Function at 0x10002fe0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x11c]
lea edx, [esp + 0x18]
push ecx
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x18]
push 0x10020e40
push eax
call ebp
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [0x100200bc]
lea esi, [esp + eax + 0x18]
add edx, 0x10
push edx
push esi
call edi
push esi
push esi
call fcn.10001fb0
add esp, 8
push 0x100224b0
push esi
call ebp
push 0
push 0x80
push 4
push 0
push 0
lea eax, [esp + 0x2c]
push 2
push eax
call dword [0x10023a10]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10003112
mov esi, dword [0x100200bc]
mov ecx, 0x17e
lea edi, [esp + 0x220]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCRT.dll_srand
add esp, 4
call sub.MSVCRT.dll_rand
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0x1001a268]
call sub.MSVCRT.dll__ftol
test al, al
je 0x100030a1
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x100030c2
lea ecx, [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x228]
push 0x5f8
push edx
push ebx
call dword [0x10023c94]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x11c]
push 0x100224a0
push eax
call ebp
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
push edx
call fcn.100090d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret

Function at 0x10003c50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x10003c60
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x10003c7c
cmp al, 0x2b
jne 0x10003c7c
mov al, 1
ret
xor al, al
ret
Function at 0x10003ce0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [0x100200bc]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push esi
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x10]
push 0x10020c40
push edx
call sym.danim.dll_class_CRNumber____stdcall_CRAdd_class_CRNumber___class_CRNumber__
add esp, 8
lea eax, [esp + 0x10]
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push eax
call dword [0x10023a10]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10003d9b
push edi
push esi
push ebx
call dword [0x10023aec]
mov edi, eax
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x10023a90]
xor eax, eax
test edi, edi
jbe 0x10003d73
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x10003d65
push edi
push esi
mov ecx, ebp
call fcn.1000ebd0
push esi
mov edi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x10006600
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x12c
lea eax, [esp + 0x28]
push ebp
push esi
push edi
push 0x10023f0c
push eax
lea esi, [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x34]
push 0x104
lea edx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov al, byte [esp + 0x34]
test al, al
je 0x10006653
mov al, byte [esi]
cmp al, 0x3a
je 0x10006648
cmp al, 0x5c
je 0x10006648
cmp al, 0x2f
jne 0x1000664b
mov byte [esi], 0x5f
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1000663a
lea eax, [esp + 0x34]
push 0x100223b0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x20]
mov ebp, 0x1001a2bc
mov dword [esp + 0x18], ecx
push edx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x20], 0
call fcn.10015320
mov dword [esp + 0x10], eax
lea edx, [esp + 0x34]
neg eax
sbb eax, eax
lea ecx, [esp + 0x14]
push edx
push 0x594
and eax, ecx
push 0
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x10023cf8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x10023cf8]
test eax, eax
je 0x100066f0
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
mov dword [0x10023cf4], edi
jne 0x10006718
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
test eax, eax
je 0x1000670c
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x12c
ret
cmp esi, 0xb7
je 0x10006729
mov ecx, 0x165
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
test eax, eax
je 0x10006745
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x12c
ret
Function at 0x10007ca0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x25c
push ebx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x5d]
mov byte [esp + 0x5c], bl
push 0x10023f0c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x160]
push ecx
push ebx
push 0x10020c6c
push edx
call fcn.1000f970
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [esp + 0x268]
lea eax, [esp + 0x5c]
push eax
push ecx
call fcn.10006970
add esp, 8
test al, al
jne 0x10007d15
pop edi
pop ebx
add esp, 0x25c
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x5c]
rep stosd dword es:[edi], eax
push 0x1002447c
push edx
lea eax, [esp + 0x168]
push 0x10020c58
push eax
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x30], 0x10020c48
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
lea eax, [esp + 0x160]
push ecx
push edx
push ebx
push ebx
push 0x200
push ebx
push ebx
push ebx
lea ecx, [esp + 0x7c]
push eax
push ecx
call dword [0x10023bcc]
test eax, eax
je 0x10007d95
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
mov bl, 1
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
pop esi
mov al, bl
pop edi
pop ebx
add esp, 0x25c
ret

Function at 0x10007db0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x550
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x560]
push 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x45c]
push 0x100223e8
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x110]
lea edx, [esp + 0x458]
push ecx
push edx
call dword [0x10023ba0]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10007e30
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x550
ret 4
cmp byte [esp + 0x13c], 0x2e
je 0x10007ea0
test byte [esp + 0x110], 0x10
je 0x10007e74
lea eax, [esp + 0x13c]
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x258]
push 0x10020f2c
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x250]
mov ecx, ebp
push eax
call fcn.10007db0
jmp 0x10007ea0
lea ecx, [esp + 0x13c]
lea edx, [esp + 0xc]
push ecx
push edx
lea eax, [esp + 0x35c]
push 0x10020f2c
push eax
call esi
lea ecx, [esp + 0x364]
push ecx
call fcn.100133a0
add esp, 0x14
lea edx, [esp + 0x110]
push edx
push edi
call dword [0x100239f0]
test eax, eax
jne 0x10007e30
push edi
call dword [0x10023b24]
lea eax, [esp + 0xc]
push eax
call sym.danim.dll_class_CRPoint2____stdcall_CRAdd_class_CRPoint2___class_CRVector2__
add esp, 4
neg eax
sbb eax, eax
pop edi
pop esi
pop ebp
neg eax
add esp, 0x550
ret 4
Function at 0x10009710
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10019393
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.100064b0
xor ebx, ebx
push 0x10c
mov dword [esp + 0x18], ebx
mov dword [esi], 0x1001a2f4
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x10009777
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.10003690
jmp 0x10009779
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x1000f5c0
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.10009c80
push 1
push ebx
push ebx
push esi
push 0x10013cb0
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.10009c80
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x100098e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x110]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 8]
lea edx, [esp + 8]
push ecx
push edx
call fcn.10001fb0
add esp, 8
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10020e40
push esi
call edi
lea eax, [esp + 8]
push eax
push esi
call edi
mov ecx, dword [esp + 0x114]
push ecx
push esi
call edi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x10009c80
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dl, byte [esp + 0x2c]
push 0
push 0
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov byte [esp + 0x18], dl
call dword [0x10023938]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x10009cb9
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x18]
push esi
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0x1000f890
push edx
push eax
call sub.MSVCRT.dll__beginthreadex
mov ecx, dword [esp + 0x28]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push ecx
call dword [0x100238f8]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x1000a5e0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push 0x10020f1c
call fcn.10003630
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
mov esi, eax
push 0x10021438
push esi
call edi
push 0x10021428
push esi
mov dword [0x10023adc], eax
call edi
push 0x10021414
push esi
mov dword [0x10023bb4], eax
call edi
push 0x10021404
push esi
mov dword [0x10023a08], eax
call edi
push str.Nf_bmaguuBwpag
push esi
mov dword [0x10023954], eax
call edi
push 0x100213d8
push esi
mov dword [0x10023c98], eax
call edi
push 0x100213c4
push esi
mov dword [0x100239cc], eax
call edi
push 0x100213b0
push esi
mov dword [0x10023b10], eax
call edi
push 0x10021398
push esi
mov dword [0x10023b20], eax
call edi
push 0x1002138c
push esi
mov dword [0x1002395c], eax
call edi
push 0x1002137c
push esi
mov dword [0x10023914], eax
call edi
push 0x1002136c
push esi
mov dword [0x10023acc], eax
call edi
push 0x10021354
push esi
mov dword [0x10023974], eax
call edi
push 0x10021338
push esi
mov dword [0x100239d8], eax
call edi
push 0x10021324
push esi
mov dword [0x10023b1c], eax
call edi
push 0x1002130c
push esi
mov dword [0x10023a7c], eax
call edi
push str.Rxyytym
push esi
mov dword [0x100239c4], eax
call edi
push 0x100212d0
push esi
mov dword [0x100238f4], eax
call edi
pop edi
mov dword [0x10023b5c], eax
pop esi
ret
Function at 0x1000a9f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
mov eax, dword [0x100231b4]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x1000aa36
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100231b8]
cmp eax, 0x493e0
jae 0x1000aa36
push 0x10023150
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000aa36
mov eax, dword [0x100231b4]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [0x1002314c]
mov ebp, 0xa
cmp eax, ebp
jae 0x1000aa8f
mov esi, dword [0x10022968]
push edi
call esi
cmp eax, ebx
je 0x1000aa5e
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebp
mov ecx, dword [eax]
pop ebx
mov eax, dword [ecx]
pop ecx
ret
push 0x10020c28
call esi
test eax, eax
jne 0x1000ab3e
push 0x10020c1c
call esi
test eax, eax
jne 0x1000ab3e
mov eax, dword [0x1002314c]
inc eax
cmp eax, ebp
mov dword [0x1002314c], eax
jb 0x1000ab34
push 0x10020c10
call dword [0x10023bd8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x10020c04
push esi
call ebx
push str.WzfDrvh
push esi
mov ebp, eax
call ebx
push 0x28
mov ebx, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea edx, [esp + 0x18]
mov esi, eax
push 0
push edx
push esi
push 8
push 1
push edi
mov dword [esi], 5
mov dword [esi + 4], 0x39866ca
mov dword [esi + 8], 0x36660ca
mov dword [esi + 0xc], 0x44a063ca
mov dword [esi + 0x10], 0x44e065ca
mov dword [esi + 0x14], 0x444b60ca
call ebp
test eax, eax
jne 0x1000ab2b
mov eax, dword [esp + 0x18]
push 1
push eax
mov ebp, dword [eax + 0x18]
mov dword [esp + 0x18], ebp
call ebx
push edi
push 0x10023150
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [0x100231b4], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100231b8], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [0x1002314c], ebx
pop ebp
pop ebx
pop ecx
ret