joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ad84
Capabilities:
Check if file exists

Disassembly:
push 0x464
mov eax, 0x10069c9a
call fcn.1002f984
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x46c], esi
and dword [ebp - 0x470], 0
cmp dword [ebx + 0x10], 0xc8
jbe 0x1000adb7
push 0x1007c8e4
jmp 0x1000aec5
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10047f90
add esp, 0xc
lea eax, [ebp - 0x420]
mov edx, str.cachekvstore
xor ecx, ecx
push 0x208
push eax
call fcn.10018c88
mov edx, ebx
lea ecx, [ebp - 0x450]
call fcn.1000133e
cmp dword [eax + 0x14], 8
jb 0x1000adfa
mov eax, dword [eax]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea eax, [ebp - 0x420]
push eax
call edi
push 0
push 1
lea ecx, [ebp - 0x450]
call fcn.10005895
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000aebc
lea ecx, [ebp - 0x438]
call fcn.1000ad46
and dword [ebp - 4], 0
cmp dword [ebp - 0x428], 0
je 0x1000aea9
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
push 0x208
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push str.cachekvstore
lea eax, [ebp - 0x420]
push eax
call edi
mov edx, ebx
lea ecx, [ebp - 0x468]
call fcn.1000133e
cmp dword [eax + 0x14], 8
jb 0x1000ae90
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x420]
push eax
call edi
push 0
push 1
lea ecx, [ebp - 0x468]
call fcn.10005895
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
push 0
push 1
call fcn.10005895
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
call fcn.100054a2
mov eax, esi
call fcn.1002f93f
ret
Function at 0x1000bd8f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
lea eax, [ebp - 0x418]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.10047f90
mov ecx, dword [0x10090850]
lea eax, [ebp - 0x418]
add esp, 0xc
mov edx, str..cachekvstorepostore
push 0x104
push eax
call fcn.10018c88
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x43c]
push eax
push ebx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1000bf0d
mov ecx, 0x10090af4
lea edx, [ebp - 0x428]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000be20
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
je 0x1000bf0d
mov eax, dword [ebp - 0x428]
mov dword [0x10090af4], eax
mov eax, dword [ebp - 0x424]
mov dword [0x10090af8], eax
call fcn.1000bf1e
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.10047f90
mov ecx, dword [0x10090850]
lea eax, [ebp - 0x210]
add esp, 0xc
mov edx, str..cache_temppostore
push 0x104
push eax
call fcn.10018c88
push ecx
push ecx
lea ecx, [ebp - 0x210]
call fcn.1001887a
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1000be9b
push str.copy_postore_failed
call fcn.1001b594
pop ecx
jmp 0x1000bf0d
push 0x290
call fcn.1002f16b
xor ecx, ecx
mov dword [ebp - 0x440], eax
push ebx
mov dword [eax], ebx
mov word [eax + 4], cx
lea ecx, [ebp - 0x210]
push ecx
mov byte [eax + 0x20c], bl
mov ecx, eax
mov dword [0x10090af0], eax
call fcn.1000aaf4
test al, al
jne 0x1000beff
push ecx
mov ecx, dword [0x10090af0]
lea eax, [ebp - 0x210]
push str.F0868486888E43D2CFA376BA08F74F3C
push eax
call fcn.1000aaf4
test al, al
jne 0x1000beff
push str.open_postore_failed
call fcn.1001b594
pop ecx
call fcn.1000bf1e
jmp 0x1000bf0d
push 1
call fcn.1000b66d
push 1
call fcn.1000b9fc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f15a
mov esp, ebp
pop ebp
ret
Function at 0x1001024a
Capabilities:
Delete registry key

Disassembly:
push 0x4c
mov eax, 0x1006a9c7
call fcn.1002f984
mov esi, ecx
mov edi, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
lea eax, [esi + 4]
mov dword [ebp - 4], edx
cmp dword [eax + 0x10], edx
jne 0x10010299
add esi, 0x1c
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x10010348
push 0xffffffffffffffff
push edx
push esi
mov ecx, eax
call fcn.10005965
jmp 0x1001033f
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x100102ab
push 0xffffffffffffffff
push edx
push eax
call fcn.10005965
xor edx, edx
cmp byte [0x1008d940], 0
je 0x1001033f
add esi, 0x1c
mov byte [0x1008d940], dl
cmp dword [esi + 0x14], 8
jb 0x100102cb
mov eax, dword [esi]
jmp 0x100102cd
mov eax, esi
push eax
push str.SoftwareprojonepodlpqmBarrier_
lea eax, [ebp - 0x40]
push 0x1007e2dc
push eax
call fcn.10019fc2
add esp, 0x10
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae edx, dword [ebp - 0x40]
call fcn.1001a3a2
test al, al
je 0x10010313
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
jb 0x10010326
mov esi, dword [esi]
push eax
push esi
call fcn.1001a3d5
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
call fcn.10005895
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1001034b
lea eax, [ebp - 0x28]
push eax
push str.SoftwareprojonepodlpqmBarrier_
lea eax, [ebp - 0x58]
push 0x1007e2dc
push eax
call fcn.10019fc2
add esp, 0x10
cmp dword [ebx + 0x14], 8
jb 0x1001036a
mov ebx, dword [ebx]
cmp dword [edi + 0x14], 8
jb 0x10010372
mov edi, dword [edi]
cmp dword [ebp - 0x44], 8
lea edx, [ebp - 0x58]
push ecx
cmovae edx, dword [ebp - 0x58]
push ebx
push edi
call fcn.1001a219
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.10005895
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10005895
call fcn.1002f93f
ret 8

Function at 0x100105c0
Capabilities:
Create thread

Disassembly:
cmp dword [0x1008d944], 0
je 0x10010602
push esi
xor esi, esi
mov dword [0x1008d944], esi
call fcn.1000d928
push esi
push str.QQ_Mon_Start__d
push str.qqdbg
call fcn.1002b6a8
add esp, 0xc
push esi
push esi
push esi
push 0x100108e5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x10017f45
Capabilities:
Check for foreground window switch

Disassembly:
push 0x244
mov eax, 0x1006b834
call fcn.1002f984
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
call fcn.10010ee9
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100180ce
mov edx, esi
lea ecx, [ebp - 0x230]
call fcn.1001a589
mov byte [ebp - 4], 1
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], ebx
cmovae eax, dword [ebp - 0x230]
test eax, eax
je 0x100180bd
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 1
push eax
mov ecx, 0x10090b1c
call fcn.10010d9c
cmp dword [eax + 0x14], 8
jb 0x10017fdd
mov eax, dword [eax]
test eax, eax
je 0x100180bd
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 1
push eax
mov ecx, 0x10090b1c
call fcn.10010d9c
mov ecx, eax
cmp dword [ecx + 0x14], 8
jb 0x1001800a
mov ecx, dword [ecx]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push ecx
cmovae eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100180bd
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x238], 0
je 0x100180bd
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x240]
call fcn.10010904
test eax, eax
jne 0x100180bd
push dword [ebp - 0x238]
push str.wx_instance_found:__d
push str.wxdbg
call fcn.1002b6a8
add esp, 0xc
lea eax, [ebp - 0x238]
push dword [ebp - 0x234]
push eax
push ecx
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x240]
call fcn.100117de
push 0x2c
call fcn.1002f16b
pop ecx
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 2
mov ecx, eax
push dword [ebp - 0x238]
call fcn.10015d4f
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10015de4
push ebx
push 1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], bl
call fcn.10005895
mov eax, dword [ebp - 0x240]
mov esi, dword [eax]
mov dword [ebp - 0x234], esi
cmp esi, eax
je 0x10018157
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.10047f90
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x218]
add esp, 0xc
push 0x104
call fcn.10019a20
test eax, eax
jne 0x1001813e
push dword [esi + 0x10]
push str.wx_instance_exit__clear_it:__d
push str.wxdbg
call fcn.1002b6a8
add esp, 0xc
lea eax, [ebp - 0x248]
lea ecx, [ebp - 0x240]
push esi
push eax
call fcn.10010985
mov esi, dword [eax]
mov dword [ebp - 0x234], esi
jmp 0x1001814f
lea ecx, [ebp - 0x234]
call fcn.10005335
mov esi, dword [ebp - 0x234]
cmp esi, dword [ebp - 0x240]
jne 0x100180e0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10017f70
Function at 0x10018682
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8c
mov eax, dword [0x1008d00c]
xor eax, esp
mov dword [esp + 0xa88], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
test edi, edi
je 0x10018861
test ebx, ebx
jne 0x100186d1
test eax, eax
je 0x10018861
movzx eax, word [edi + 2]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, 0x3a
je 0x10018721
cmp eax, 0x5c
je 0x10018721
push 0x410
lea eax, [esp + 0x684]
push 0
push eax
call fcn.10047f90
add esp, 0xc
lea eax, [esp + 0x680]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
lea eax, [esp + 0x684]
push eax
call esi
lea edi, [esp + 0x680]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10018861
test al, 0x10
je 0x10018861
push edi
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1007ebe8
lea eax, [esp + 0x47c]
push eax
call esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x10018861
xor esi, esi
inc esi
push 0x1007ebec
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10018837
push 0x1007ebf0
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x10018837
cmp dword [esp + 0x20], 0xffffffff
je 0x10018837
push edi
lea eax, [esp + 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x274]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [esp + 0x20], 0x10
je 0x10018821
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100187fc
push dword [esp + 0x10]
lea ecx, [esp + 0x274]
push ecx
call eax
test eax, eax
je 0x10018850
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x10018837
push dword [esp + 0x10]
mov edx, ecx
lea ecx, [esp + 0x274]
push eax
push dword [esp + 0x1c]
push ebx
call fcn.10018682
cmp eax, 2
jmp 0x10018835
test ebx, ebx
je 0x10018837
push dword [esp + 0x14]
lea eax, [esp + 0x274]
push eax
call ebx
test eax, eax
je 0x10018850
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001877a
jmp 0x10018853
push 2
pop esi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x10018863
xor eax, eax
mov ecx, dword [esp + 0xa94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002f15a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001887a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x1001896d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x1001896d
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.10047f90
add esp, 0xc
lea edx, [ebp - 0x210]
mov ecx, esi
call fcn.10018ff9
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100188ee
shr eax, 4
not eax
and eax, 1
jmp 0x1001896f
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x418]
call fcn.10018981
test eax, eax
je 0x1001896d
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x10000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x10018946
cmp eax, 0xffffffff
je 0x10018946
xor ebx, ebx
inc ebx
xor ecx, ecx
test bl, bl
setne cl
mov dword [ebp - 0x41c], ecx
cmp eax, 0xffffffff
je 0x10018969
test eax, eax
je 0x10018969
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x41c]
mov eax, ecx
jmp 0x1001896f
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f15a
mov esp, ebp
pop ebp
ret 8
Function at 0x10018d44
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x10018d6f
push ecx
push ecx
mov ecx, ebx
call fcn.1001887a
test eax, eax
je 0x10018def
push esi
push edi
xor edi, edi
push edi
push edi
push 2
push edi
push edi
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x10018dcf
cmp esi, 0xffffffff
je 0x10018dcf
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10018db4
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x10018db4
inc edi
jmp 0x10018ddb
cmp dword [ebp - 8], edi
jne 0x10018ddb
mov eax, esi
or esi, 0xffffffff
cmp eax, esi
je 0x10018dd4
test eax, eax
je 0x10018dd4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10018dd4
cmp dword [ebp - 8], edi
jne 0x10018ddb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, 0xffffffff
je 0x10018deb
test esi, esi
je 0x10018deb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10018f89
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x108]
push edi
xor esi, esi
push esi
push eax
call fcn.10047f90
add esp, 0xc
lea ecx, [ebp - 0x108]
mov edx, edi
call fcn.10018ef7
mov edx, 0x179b06cc
movzx ecx, byte [ebp + esi - 0x108]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1007ecd8]
inc esi
cmp esi, 0x24
jl 0x10018fc8
mov ecx, dword [ebp - 4]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.1002f15a
mov esp, ebp
pop ebp
ret
Function at 0x100190a1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x1001916c
test ebx, ebx
je 0x1001916c
mov edi, str.deviceMup_
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, esi
jne 0x100190f2
push ecx
push ecx
push ebx
push 0x1007ec74
mov edx, edi
mov ecx, esi
call fcn.10019e28
xor eax, eax
inc eax
jmp 0x1001916e
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x218], eax
xor edi, edi
xor edx, edx
mov ecx, edi
inc edx
shl edx, cl
test eax, edx
je 0x10019166
and dword [ebp - 8], 0
lea eax, [edi + 0x61]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
push 0x208
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.10047f90
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x104
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x10019160
push 0
lea edx, [ebp - 0x214]
mov ecx, esi
call fcn.10019f2e
test eax, eax
jne 0x10019181
mov eax, dword [ebp - 0x218]
inc edi
cmp edi, 0x1a
jl 0x10019100
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f15a
mov esp, ebp
pop ebp
ret 4
push ecx
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x214]
jmp 0x100190e6

Function at 0x100197e9
Capabilities:
Enumerate process modules

Disassembly:
push 0x430
mov eax, 0x1006b947
call fcn.1002f984
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x434]
push 0x424
push 0
push eax
call fcn.10047f90
add esp, 0xc
mov dword [ebp - 0x438], 0x428
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x43c], esi
and dword [ebp - 4], 0
test esi, esi
je 0x1001986e
cmp esi, 0xffffffff
je 0x1001987e
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x1001986a
push edi
lea eax, [ebp - 0x438]
push eax
call fcn.10019a77
test eax, eax
je 0x1001986e
lea eax, [ebp - 0x438]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1001984b
cmp esi, 0xffffffff
je 0x1001987e
test esi, esi
je 0x1001987e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1002f93f
ret 4
Function at 0x10019886
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1006b97a
call fcn.1002f984
mov edi, edx
mov dword [ebp - 0x240], edi
xor esi, esi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 4], esi
test ebx, ebx
je 0x10019930
cmp ebx, 0xffffffff
je 0x10019940
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push esi
push eax
call fcn.10047f90
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x1001990d
push dword [edi + 8]
lea eax, [ebp - 0x23c]
push eax
call dword [edi]
test eax, eax
jne 0x10019913
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x100198ef
jmp 0x10019930
mov eax, dword [ebp - 0x240]
lea esi, [ebp - 0x23c]
mov edi, dword [edi + 4]
mov ecx, 0x8b
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0xc], 1
cmp ebx, 0xffffffff
je 0x10019940
test ebx, ebx
je 0x10019940
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1002f93f
ret

Function at 0x10019986
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
test ebx, ebx
jne 0x100199a4
xor eax, eax
jmp 0x10019a0f
push esi
push edi
push ecx
xor edi, edi
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100199fb
cmp esi, 0xffffffff
je 0x10019a0b
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.10047f90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100199fb
push ecx
mov edx, ebx
lea ecx, [ebp - 0x20c]
call fcn.100190a1
inc edi
cmp esi, 0xffffffff
je 0x10019a0b
test esi, esi
je 0x10019a0b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1002f15a
mov esp, ebp
pop ebp
ret 4
Function at 0x1001a25a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x818
mov eax, 0x1006bac4
call fcn.1002f984
mov edi, ecx
mov dword [ebp - 0x818], edi
mov eax, dword [ebp + 0xc]
xor edx, edx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x820], edx
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x824], edi
mov dword [ebp - 0x81c], eax
mov dword [edi + 0x10], edx
jb 0x1001a29f
mov eax, dword [edi]
jmp 0x1001a2a1
mov eax, edi
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], edx
mov ebx, edx
mov dword [ebp - 0x820], 1
test esi, esi
je 0x1001a39a
push 0x800
push edx
lea eax, [ebp - 0x810]
push eax
call fcn.10047f90
add esp, 0xc
lea eax, [ebp - 0x814]
xor ecx, ecx
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x818], ecx
push eax
push ecx
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 0x81c]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x818], 1
je 0x1001a317
cmp dword [ebp - 0x818], 2
jne 0x1001a39a
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x1001a39a
cmp eax, 0x800
jbe 0x1001a352
add eax, 2
push eax
call fcn.10049468
mov ebx, eax
mov eax, dword [ebp - 0x814]
add eax, 2
push eax
push 0
push ebx
call fcn.10047f90
add esp, 0x10
lea eax, [ebp - 0x814]
push eax
push ebx
jmp 0x1001a360
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x810]
push eax
push 0
push dword [ebp - 0x81c]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test ebx, ebx
lea esi, [ebp - 0x810]
cmovne esi, ebx
push esi
call fcn.100011d2
pop ecx
push eax
push esi
mov ecx, edi
call fcn.100058ec
test ebx, ebx
je 0x1001a39a
push ebx
call fcn.10049208
pop ecx
mov eax, edi
call fcn.1002f93f
ret

Function at 0x1001b6f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor edx, edx
lea eax, [ebp - 4]
push eax
push edx
push edx
push ecx
push edx
push edx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001b722
push dword [ebp + 8]
push dword [ebp - 4]
push str.thread__d_created:__s
call fcn.1001b1c9
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1001c4b6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1008d00c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x20c]
push esi
push 0x208
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x210], esi
call fcn.10047f90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.100054a2
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002f15a
mov esp, ebp
pop ebp
ret