joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100056aa
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x184]
sub esp, 0x204
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0x180], eax
push ebx
push esi
push edi
push str.SpeedNet
push 0x80
xor ebx, ebx
push ebx
push 4
push ebx
push 0xffffffffffffffff
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x10005707
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
push edi
je 0x10005701
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100057de
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x231
cmp byte [esi], bl
je 0x100057de
push 0x1ff
lea eax, [ebp - 0x7f]
push ebx
push eax
mov byte [ebp - 0x80], bl
call fcn.10042a90
lea edx, [ebp - 0x80]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10005731
lea edi, [ebp - 0x80]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000573f
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, str.dialer.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x80]
push eax
movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
jne 0x100057a7
mov esi, 0x200
push esi
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.10042a90
add esp, 0xc
push esi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x80], 0
je 0x100057de
lea edi, [ebp - 0x80]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1000578b
mov esi, 0x10064278
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x80]
push eax
movsd dword es:[edi], dword [esi]
call ebx
mov esi, eax
test esi, esi
je 0x100057b7
push str.dlraddorgrtentry
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100057c7
push str._dlr_add_org_rtentry__YAHKK_Z
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100057d3
push 0xffffffffffffffff
push dword [ebp + 0x18c]
call eax
pop ecx
pop ecx
test esi, esi
je 0x100057de
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp + 0x180]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10042977
add ebp, 0x184
leave
ret 4
Function at 0x10006476
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
and dword [ebp + 8], 0
push edi
mov edi, dword [eax + 4]
mov dword [ebp - 8], edi
mov edi, dword [eax]
mov dword [ebp + 0xc], edi
mov edi, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], eax
sub dword [ebp + 8], 0x61d79937
dec dword [ebp - 4]
mov eax, edx
shl eax, 4
add eax, dword [ebp + 0xc]
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, edx
xor eax, edi
add ecx, eax
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0xc]
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 0x10]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, ecx
xor eax, edi
add edx, eax
cmp dword [ebp - 4], 0
jg 0x100064ab
pop edi
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
leave
ret 8

Function at 0x100064fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi]
mov ecx, dword [esi + 4]
push edi
mov edi, dword [eax + 0xc]
mov dword [ebp - 8], edi
mov edi, dword [eax + 8]
mov dword [ebp + 0xc], edi
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 4], 0x20
mov dword [ebp + 8], 0xc50cd920
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], eax
dec dword [ebp - 4]
mov eax, edx
shl eax, 4
add eax, dword [ebp + 0xc]
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, edx
xor eax, edi
sub ecx, eax
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0xc]
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 0x10]
xor eax, edi
mov edi, dword [ebp + 8]
add dword [ebp + 8], 0x61d79937
add edi, ecx
xor eax, edi
sub edx, eax
cmp dword [ebp - 4], 0
jg 0x10006534
pop edi
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
leave
ret 8
Function at 0x10006df1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.10042a90
add esp, 0xc
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x204], 0
je 0x10006e7a
push esi
push edi
lea edi, [ebp - 0x204]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10006e45
mov esi, str._netfe32.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x204]
push 0x10063f1c
push eax
movsb byte es:[edi], byte [esi]
call fcn.100435d9
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
je 0x10006e7a
push eax
call fcn.1004338d
pop ecx
mov al, 1
jmp 0x10006e7c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10042977
leave
ret
Function at 0x10010b18
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 5
stosb byte es:[edi], al
pop ecx
lea eax, [ebp - 0x24]
push 0x100643b4
mov esi, str.c:log_server_1.txt
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.100435d9
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
jne 0x10010b5e
xor al, al
jmp 0x10010b71
push eax
call fcn.1004338d
pop ecx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10042977
leave
ret

Function at 0x10010ba4
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xa8]
sub esp, 0x128
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0xa4], eax
mov eax, dword [ebp + 0xb0]
push ebx
push esi
mov esi, dword [ebp + 0xb4]
lea ecx, [ebp + 0x8c]
push ecx
push eax
call fcn.10010b7d
pop ecx
pop ecx
lea eax, [ebp - 0x7c]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetServicesWinSock2_speednet_sph
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10010c5d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
lea eax, [ebp + 0x8c]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10010c5d
push dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x10010c5d
cmp byte [esi], bl
jne 0x10010c4f
cmp byte [ebp - 0x78], bl
je 0x10010c4f
lea eax, [ebp - 0x78]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10010c45
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x10010c5f
xor eax, eax
mov ecx, dword [ebp + 0xa4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10042977
add ebp, 0xa8
leave
ret
Function at 0x10012abe
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x388]
sub esp, 0x408
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0x384], eax
mov eax, dword [ebp + 0x390]
push ebx
push esi
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10012ae6
sub eax, edx
mov esi, 0x1ff
cmp eax, esi
ja 0x10012bb6
push esi
lea eax, [ebp + 0x185]
push ebx
push eax
mov byte [ebp + 0x184], bl
call fcn.10042a90
mov eax, dword [ebp + 0x390]
lea ecx, [ebp + 0x184]
add esp, 0xc
sub ecx, eax
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
cmp dl, bl
jne 0x10012b21
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call fcn.10042a90
lea eax, [ebp + 0x184]
push 0x5c
push eax
call fcn.100447f0
add esp, 0x14
cmp eax, ebx
je 0x10012bb6
push edi
mov byte [eax + 1], bl
mov edi, 0x1006581c
lea eax, [ebp + 0x184]
push edi
push eax
call fcn.10043620
mov dword [ebp - 0x80], ebx
jmp 0x10012bad
push 0x200
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.10042a90
lea ecx, [ebp + 0x184]
mov eax, esi
sub eax, ecx
push eax
mov eax, ecx
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.10043ac0
add esp, 0x18
cmp dword [ebp - 0x80], ebx
je 0x10012ba2
push ebx
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
inc esi
push esi
call fcn.10043620
inc dword [ebp - 0x80]
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x10012b69
pop edi
mov ecx, dword [ebp + 0x384]
pop esi
xor ecx, ebp
pop ebx
call fcn.10042977
add ebp, 0x388
leave
ret
Function at 0x10012bcd
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
pop ecx
mov edi, str.SYSTEM32
mov esi, ebx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x10012c12
push eax
push 0x25
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebx + 8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012bf8
mov edi, dword [ebp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012c05
jmp 0x10012d63
push 7
pop ecx
mov edi, str.WINDOWS
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x10012c5b
cmp byte [0x10081084], al
push eax
je 0x10012c2f
push 0x25
jmp 0x10012c31
push 0x24
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebx + 7]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012c41
mov edi, dword [ebp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012c4e
jmp 0x10012d63
push 5
pop ecx
mov edi, str.CROOT
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x10012ca7
cmp byte [0x10081084], al
je 0x10012c82
push eax
push 0x25
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x10012c88
mov dword [ebx], 0x5c3a63
lea eax, [ebx + 5]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012c8d
mov edi, dword [ebp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012c9a
jmp 0x10012d63
mov ecx, dword [ebx]
mov eax, str.USER
cmp ecx, dword [eax]
jne 0x10012d1f
cmp byte [0x10081084], 0
je 0x10012cc1
push 0
push 0x25
jmp 0x10012cd9
push str.360rp.exe
push 0x10080e60
call fcn.10043620
test eax, eax
pop ecx
pop ecx
jne 0x10012ce6
push eax
push 0x1a
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x10012d03
cmp byte [0x10081090], 0
je 0x10012d03
mov edx, dword [ebp + 0xc]
mov eax, 0x10081090
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10012cf9
lea eax, [ebx + 4]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012d08
mov edi, dword [ebp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012d15
jmp 0x10012d63
push 3
pop ecx
mov edi, str.PROGRAMFILES
mov esi, ebx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x10012d7c
cmp byte [0x10081084], al
push eax
je 0x10012d3c
push 0x25
jmp 0x10012d3e
push 0x26
push dword [ebp + 0xc]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebx + 0xc]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012d4e
mov edi, dword [ebp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10012d5b
push dword [ebp + 0xc]
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10012abe
pop ecx
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
pop edi
pop esi
setne al
pop ebx
pop ebp
ret
Function at 0x10014450
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.10042a90
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x100144a6
cmp dword [ebp - 0x94], 6
jb 0x100144a6
mov al, 1
jmp 0x100144a8
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10042977
leave
ret

Function at 0x10014698
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.10043e70
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100146bc
sub eax, edx
cmp eax, 0x400
jbe 0x100146d3
xor al, al
jmp 0x10014768
push 0x100664cc
push esi
call fcn.10043620
test eax, eax
pop ecx
pop ecx
je 0x100146ee
mov dword [eax], 0x6d74682e
mov byte [eax + 4], 0
push 0xfff
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call fcn.10042a90
push edi
lea eax, [ebp - 0x1004]
push str.__DOCTYPE_HTML_PUBLIC_____W3C__DTD_HTML_4.0_Transitional__EN___HTML__HEAD__TITLE_
push eax
call fcn.100436a6
push 0x100643b4
push esi
call fcn.100435d9
mov edi, eax
add esp, 0x20
test edi, edi
je 0x100146cc
lea eax, [ebp - 0x1004]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10014737
push ebx
sub eax, edx
mov esi, eax
push edi
xor ebx, ebx
push esi
inc ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.10043fb5
add esp, 0x10
cmp eax, esi
je 0x1001475e
xor bl, bl
push edi
call fcn.1004338d
pop ecx
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10042977
leave
ret
Function at 0x10014f88
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0xac]
sub esp, 0x12c
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0xa8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x80], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebx, ebx
push ebx
push 2
mov edi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x10014fca
xor al, al
jmp 0x1001500a
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32First
jmp 0x10014ff9
lea eax, [ebp - 0x5c]
push 0x1006679c
push eax
call fcn.10044925
test eax, eax
pop ecx
pop ecx
jne 0x10014fef
cmp dword [ebp - 0x78], edi
jne 0x10014fff
lea eax, [ebp - 0x80]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10014fd6
jmp 0x10015001
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp + 0xa8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10042977
add ebp, 0xac
leave
ret

Function at 0x10015022
Capabilities:
Create directory
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x1ff
lea eax, [ebp - 0x223]
push ebx
push eax
mov byte [ebp - 0x224], bl
call fcn.10042a90
add esp, 0xc
push ebx
push 0x25
lea eax, [ebp - 0x224]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebp - 0x224], bl
jne 0x10015073
xor al, al
jmp 0x10015117
push edi
lea edi, [ebp - 0x224]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1001507b
push esi
mov esi, str.hardpolMyIEData_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
lea eax, [ebp - 0x224]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea edi, [ebp - 0x224]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100150a5
mov esi, str.sys.db
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x224]
push 0x100643b4
push eax
movsb byte es:[edi], byte [esi]
call fcn.100435d9
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x100150fc
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0x24], bl
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push 0x20
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push 1
push eax
call fcn.10043fb5
add esp, 0x10
cmp eax, 0x20
push esi
je 0x10015100
call fcn.1004338d
pop ecx
xor al, al
jmp 0x10015115
call fcn.1004338d
pop ecx
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10042977
leave
ret
Function at 0x10015343
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x1ff
lea eax, [ebp - 0x203]
push ebx
push eax
mov byte [ebp - 0x204], bl
call fcn.10042a90
add esp, 0xc
push ebx
push 0x25
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebp - 0x204], bl
je 0x100153e7
push esi
push edi
lea edi, [ebp - 0x204]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10015396
mov esi, str.hardpolMyIEData_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x204]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100153b1
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0xc]
mov esi, str.main.ini
movsd dword es:[edi], dword [esi]
push 0x10081064
push str.2023
movsd dword es:[edi], dword [esi]
push 0x10066874
push str.SYSTEM
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10042977
leave
ret
Function at 0x1001551e
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1204
call fcn.10043e70
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x10080e60
call fcn.100153f4
test al, al
pop ecx
je 0x1001554b
xor al, al
jmp 0x100156a8
push ebx
push 0x954
xor ebx, ebx
push ebx
push 0x10080450
call fcn.10042a90
push 0x1ff
lea eax, [ebp - 0x203]
push ebx
push eax
mov byte [ebp - 0x204], bl
call fcn.10042a90
add esp, 0x18
push ebx
push 0x25
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebp - 0x204], bl
jne 0x10015599
xor al, al
jmp 0x100156a7
push edi
lea edi, [ebp - 0x204]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100155a1
push esi
mov esi, str.hardpolMyIEData_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x204]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100155bd
mov esi, str.brudo.dat
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x204]
push 0x10063f1c
push eax
movsw word es:[edi], word [esi]
call fcn.100435d9
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x1001566c
mov esi, 0xfff
push esi
lea eax, [ebp - 0x1203]
push ebx
push eax
mov byte [ebp - 0x1204], bl
call fcn.10042a90
push edi
push esi
lea eax, [ebp - 0x1204]
push 1
push eax
call fcn.10043294
add esp, 0x1c
cmp eax, 0x958
push edi
je 0x10015627
call fcn.1004338d
pop ecx
jmp 0x1001566c
call fcn.1004338d
pop ecx
lea esi, [ebp - 0x1204]
mov edi, 0x12b
push str.helloworld2422fa4d
push esi
mov ecx, 0x10081520
call fcn.100064fc
add esi, 8
dec edi
jne 0x10015638
xor ecx, ecx
xor eax, eax
movsx edx, byte [ebp + eax - 0x1204]
add ecx, edx
inc eax
cmp eax, 0x954
jl 0x10015652
cmp ecx, dword [ebp - 0x8b0]
je 0x10015670
xor al, al
jmp 0x100156a5
mov ecx, 0x255
lea esi, [ebp - 0x1204]
mov edi, 0x10080450
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.10043e25
cmp dword [0x10080454], eax
pop ecx
jbe 0x10015696
mov dword [0x10080454], eax
cmp dword [0x10080450], eax
jbe 0x100156a3
mov dword [0x10080450], eax
mov al, 1
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10042977
leave
ret
Function at 0x100156b4
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1188]
mov eax, 0x1208
call fcn.10043e70
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0x1184], eax
push ebx
xor ebx, ebx
push 0x1ff
lea eax, [ebp + 0xf85]
push ebx
push eax
mov byte [ebp + 0xf84], bl
call fcn.10042a90
add esp, 0xc
push ebx
push 0x25
lea eax, [ebp + 0xf84]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
cmp byte [ebp + 0xf84], bl
jne 0x10015711
xor al, al
jmp 0x100157fc
push edi
lea edi, [ebp + 0xf84]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10015719
push esi
mov esi, str.hardpolMyIEData_
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp + 0xf84]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10015735
mov esi, str.brudo.dat
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0xf84]
push 0x100643b4
push eax
movsw word es:[edi], word [esi]
call fcn.100435d9
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x80], eax
je 0x100157ee
push 0xfff
lea eax, [ebp - 0x7b]
push ebx
push eax
call fcn.10042a90
mov ecx, 0x255
mov esi, 0x10080450
lea edi, [ebp - 0x7c]
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
xor eax, eax
xor ecx, ecx
movsx edx, byte [ebp + ecx - 0x7c]
add eax, edx
inc ecx
cmp ecx, 0x954
jb 0x10015789
mov dword [ebp + 0x8d8], eax
lea esi, [ebp - 0x7c]
mov edi, 0x12b
push str.helloworld2422fa4d
push esi
mov ecx, 0x10081520
call fcn.10006476
add esi, 8
dec edi
jne 0x100157a7
push dword [ebp - 0x80]
mov esi, 0x958
push esi
lea eax, [ebp - 0x7c]
push 1
push eax
call fcn.10043fb5
add esp, 0x10
cmp eax, esi
push dword [ebp - 0x80]
je 0x100157f2
call fcn.1004338d
pop ecx
lea eax, [ebp + 0xf84]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
jmp 0x100157fa
call fcn.1004338d
pop ecx
mov al, 1
pop esi
pop edi
mov ecx, dword [ebp + 0x1184]
xor ecx, ebp
pop ebx
call fcn.10042977
add ebp, 0x1188
leave
ret