joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x118]
mov edx, dword [ebp + 8]
add eax, dword [edx - 0x11c]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x120]
jl 0x7221d
mov eax, dword [ebp + 8]
cmp byte [eax - 0x121], 0
je 0x72182
mov dword [ebp - 4], 0xffffffff
jmp 0x722a2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x128]
mov edx, dword [ebp + 8]
mov al, byte [edx + eax - 0x113]
mov edx, dword [ebp + 8]
mov byte [edx - 0x111], al
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x128]
mov edx, dword [ebp + 8]
mov al, byte [edx + eax - 0x112]
mov edx, dword [ebp + 8]
mov byte [edx - 0x110], al
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffef1
call fcn.000720e8
pop ecx
xor al, 1
mov edx, dword [ebp + 8]
mov byte [edx - 0x121], al
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
add eax, 2
mov edx, dword [ebp + 8]
mov dword [edx - 0x128], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x118]
mov edx, dword [ebp + 8]
sub eax, dword [edx - 0x120]
add eax, 0x10
mov edx, dword [ebp + 8]
mov dword [edx - 0x118], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x128]
shl eax, 3
mov edx, dword [ebp + 8]
mov dword [edx - 0x120], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x118]
mov edx, eax
shr edx, 3
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx - 0x111]
mov dword [ebp - 8], edx
and eax, 7
movzx edx, word [eax*2 + 0xa3d28]
mov ebx, 1
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 0x11c]
dec ecx
test ecx, ecx
jl 0x72290
inc ecx
test dword [ebp - 8], edx
jle 0x72268
or dword [ebp - 4], ebx
add edx, edx
add ebx, ebx
inc eax
cmp eax, 8
jl 0x7228d
xor eax, eax
mov edx, 1
inc dword [ebp - 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0xc]
movzx esi, byte [esi + edi - 0x111]
mov dword [ebp - 8], esi
dec ecx
jne 0x72260
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x11c]
mov edx, dword [ebp + 8]
add dword [edx - 0x118], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x76680
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x76855
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [esi + 0x2c], 0
jne 0x7683c
mov eax, dword [esi + 0x24]
call fcn.00013df4
test eax, eax
jne 0x766d5
mov eax, dword [esi + 0x28]
call fcn.00013df4
test eax, eax
jne 0x766d5
mov eax, esi
call fcn.000768f4
jmp 0x7683c
cmp dword [esi + 0x94], 0
jne 0x7670c
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x24]
call fcn.00018b60
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0xa68d8]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x94], eax
cmp dword [esi + 0x98], 0
jne 0x76743
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x28]
call fcn.00018b60
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0xa68d8]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.00076934
mov ebx, eax
test bl, bl
jne 0x767f1
mov eax, dword [esi + 0x24]
call fcn.00013df4
test eax, eax
jne 0x7677b
mov eax, dword [esi + 0xb0]
call fcn.00013df4
test eax, eax
je 0x767f1
mov eax, dword [esi + 0xb0]
call fcn.00013df4
test eax, eax
je 0x7679d
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0xb0]
call fcn.00018b60
jmp 0x767c9
push dword [esi + 0x24]
push 0x76870
push dword [esi + 0x28]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00013eb4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00018b60
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x767f1
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.00076934
mov ebx, eax
test bl, bl
jne 0x767fe
mov eax, esi
call fcn.000768f4
jmp 0x7683c
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x7680d
mov dword [esi + 0x9c], eax
jmp 0x76817
mov dword [esi + 0x9c], 1
mov eax, esi
call fcn.000769ac
test al, al
je 0x7683c
mov eax, esi
mov bx, 0xffef
call fcn.0001311c
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00076ae4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7685c
lea eax, [ebp - 0x108]
call fcn.00013b78
ret

Function at 0x7b7ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, 0xa693c
mov edx, dword [esi]
mov eax, ebx
call fcn.00078dec
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00016e50
call fcn.00016e54
mov edx, dword [esi + 8]
call fcn.00078dec
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
Function at 0x7b8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00013fa8
xor eax, eax
push ebp
push 0x7b989
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
cmp dword [ebp + 8], 0
je 0x7b973
mov eax, dword [ebp + 8]
call fcn.0007b834
mov al, byte [ebp - 1]
dec eax
test al, al
jb 0x7b936
inc eax
mov byte [ebp - 4], al
mov bl, 0
call fcn.0007b7cc
xor edx, edx
mov dl, bl
xor ecx, ecx
mov cl, byte [ebp - 1]
add edx, ecx
xor al, byte [esi + edx]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
call fcn.0007b7ec
xor eax, eax
mov al, bl
mov dl, byte [ebp - 3]
mov byte [esi + eax], dl
inc ebx
dec byte [ebp - 4]
jne 0x7b908
xor eax, eax
mov al, byte [ebp - 1]
mov bl, byte [esi + eax - 1]
and di, 8
cmp di, 8
je 0x7b960
mov eax, dword [ebp + 0x10]
call fcn.00016e50
call fcn.00016e54
cmp bl, al
jne 0x7b973
mov byte [ebp - 2], 1
jmp 0x7b973
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
jne 0x7b973
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7b990
lea eax, [ebp + 8]
call fcn.00013b78
ret

Function at 0x7b9d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, eax
movzx eax, word [0xa69ac]
cmp eax, dword [0xa69b0]
jl 0x7ba5c
push 0xa69b0
mov eax, dword [edi + 0x2c6]
mov edx, 0x8000
call fcn.00078e2c
mov ecx, eax
mov edx, dword [0xa69a4]
lea eax, [edi + 0x29]
call fcn.000156a8
call fcn.000128f8
test eax, eax
je 0x7ba1d
xor eax, eax
mov dword [0xa69b0], eax
cmp byte [0xa69c4], 0
je 0x7ba53
mov esi, dword [0xa69b0]
dec esi
test esi, esi
jl 0x7ba53
inc esi
xor ebx, ebx
call fcn.0007b7cc
mov edx, dword [0xa69a4]
xor byte [edx + ebx], al
mov eax, dword [0xa69a4]
mov al, byte [eax + ebx]
call fcn.0007b7ec
inc ebx
dec esi
jne 0x7ba34
mov word [0xa69ac], 0
cmp dword [0xa69b0], 0
jne 0x7ba7b
xor eax, eax
mov dword [edi + 0x2c6], eax
mov word [0xa69ac], 0
or eax, 0xffffffff
jmp 0x7ba93
movzx eax, word [0xa69ac]
mov edx, dword [0xa69a4]
movzx eax, byte [edx + eax]
inc word [0xa69ac]
pop edi
pop esi
pop ebx
ret
Function at 0x82414
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x82442
mov eax, ebx
call fcn.00082eb8
cmp dword [ebx + 0x3c], 0
je 0x8243b
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x824b3
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x824a5
cmp dword [ebx + 8], 0
je 0x82464
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x82476
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x824a5
cmp dword [ebx + 8], 0
je 0x82457
cmp eax, 3
je 0x82489
dec eax
jne 0x82457
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x82457
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x82457
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x824d1
cmp dword [ebx + 0x10], 0xcc
je 0x824d1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.000824dc
pop ebx
ret

Function at 0x94b14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00013fa8
xor eax, eax
push ebp
push 0x94b9f
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x94b82
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00013fb8
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x94b62
test al, 0x10
jne 0x94b66
xor eax, eax
jmp 0x94b68
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x94b89
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x95b60
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
push 0x4008
push 0x160
lea eax, [esp + 8]
push eax
push 0x20000
mov eax, dword [ebx + 0x30]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [esp + 4]
mov eax, ebx
call fcn.00068980
mov edx, 0x20000000
mov eax, ebx
call fcn.00095dd8
test al, al
je 0x95bbb
push 0x400a
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, dword [ebx + 0x30]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [esp + 4]
mov eax, ebx
call fcn.000689b4
mov eax, ebx
call fcn.000687d0
cmp byte [eax + 0x30a], 0
je 0x95bf1
mov edx, 0x20000
mov eax, ebx
call fcn.00095dd8
test al, al
je 0x95bf1
xor edx, edx
mov eax, ebx
call fcn.000689e8
jmp 0x95c29
mov eax, ebx
call fcn.000687d0
cmp byte [eax + 0x30b], 0
je 0x95c1f
mov edx, 0x10000
mov eax, ebx
call fcn.00095dd8
test al, al
je 0x95c1f
mov edx, 1
mov eax, ebx
call fcn.000689e8
jmp 0x95c29
or edx, 0xffffffff
mov eax, ebx
call fcn.000689e8
add esp, 0x160
pop ebx
ret
Function at 0x9727c
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffe9c
mov ebx, eax
push esp
push 0
mov eax, ebx
call fcn.00097640
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
push 0x4009
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov dword [ebx + 0x32c], eax
mov eax, esp
call fcn.00094e48
cmp byte [ebx + 0x2e4], 0
je 0x972da
mov eax, ebx
call fcn.00042a7c
xor ecx, ecx
mov edx, dword [ebx + 0x32c]
call fcn.0002d4b0
add esp, 0x164
pop ebx
ret
Function at 0x99774
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x99989
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x3ac]
mov edx, dword [eax + 8]
mov eax, dword [ebx + 0x2e4]
call fcn.0003cd48
mov eax, dword [ebx + 0x3ac]
mov edx, dword [eax + 0x14]
mov eax, dword [ebx + 0x2e8]
call fcn.0003cd48
mov eax, dword [ebx + 0x3ac]
mov edx, dword [eax + 0x18]
mov eax, dword [ebx + 0x2ec]
call fcn.0003cd48
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x3ac]
mov eax, dword [eax + 0xc]
call fcn.0001821c
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x2f0]
call fcn.0003cd48
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x3ac]
mov eax, dword [eax + 0x10]
call fcn.0001821c
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x2f4]
call fcn.0003cd48
push 0
push 0x100000
mov eax, dword [ebx + 0x2c4]
mov al, byte [eax + 0x250]
sub al, 0x41
inc eax
call fcn.00018974
call fcn.00015e7e
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0001821c
lea eax, [ebp - 8]
mov edx, 0x999a0
call fcn.00013dfc
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x2cc]
call fcn.0003cd48
mov dl, 1
mov eax, dword [0x1d258]
call fcn.00012f18
mov esi, eax
mov eax, dword [ebx + 0x3ac]
mov eax, dword [eax + 0x30]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor ecx, ecx
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebx + 0x390]
mov eax, dword [eax + 0x22c]
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, esi
call fcn.00012f48
mov eax, dword [ebx + 0x390]
call fcn.0003d1f4
push 0
mov eax, dword [ebx + 0x3ac]
mov ecx, dword [eax + 0x24]
mov eax, dword [ebx + 0x3a4]
mov edx, dword [eax + 0x10]
mov eax, dword [ebx + 0x3e8]
call fcn.000a0cc0
cmp al, 0x2a
jne 0x998e6
mov eax, dword [ebx + 0x318]
mov eax, dword [eax + 0x118]
call fcn.00028ecc
mov edx, eax
mov eax, dword [ebx + 0x324]
call fcn.0005f97c
jmp 0x99904
mov eax, dword [ebx + 0x31c]
mov eax, dword [eax + 0x118]
call fcn.00028ecc
mov edx, eax
mov eax, dword [ebx + 0x324]
call fcn.0005f97c
mov eax, dword [ebx + 0x3ac]
mov eax, dword [eax + 0xc]
cmp eax, dword [ebp - 4]
jle CreateDIBitmap
mov eax, dword [ebx + 0x2cc]
mov eax, dword [eax + 0x58]
mov edx, 0xff
call fcn.00025cbc
xor edx, edx
mov eax, dword [ebx + 0x324]
mov ecx, dword [eax]
call dword [ecx + 0x60]
jmp 0x9996c
mov eax, dword [ebx + 0x2cc]
mov eax, dword [eax + 0x58]
xor edx, edx
call fcn.00025cbc
mov eax, dword [ebx + 0x340]
cmp byte [eax + 0x47], 0
je 0x9995f
xor edx, edx
mov eax, dword [ebx + 0x324]
mov ecx, dword [eax]
call dword [ecx + 0x60]
jmp 0x9996c
mov dl, 1
mov eax, dword [ebx + 0x324]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, ebx
call CreateBrushIndirect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x99990
lea eax, [ebp - 8]
call fcn.00013b78
ret
Function at 0x9b314
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor eax, eax
mov dword [ebp - 8], eax
mov esi, 0xa6a2d
xor eax, eax
push ebp
push 0x9b54f
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x9b33b
call fcn.0009b260
mov al, byte [esi]
sub al, 0xa
je 0x9b336
sub al, 0x16
je 0x9b336
mov al, byte [esi]
test al, al
je 0x9b355
add al, 0xdf
sub al, 0x5e
jae 0x9b52f
xor eax, eax
mov al, byte [esi]
cmp eax, 0x29
jg 0x9b38d
je 0x9b50a
sub eax, 1
jb 0x9b526
sub eax, 0x21
je 0x9b443
sub eax, 2
je 0x9b4c2
sub eax, 4
je 0x9b4fc
jmp 0x9b539
sub eax, 0x2e
je 0x9b518
sub eax, 0xf
je 0x9b4ee
add eax, 0xffffffdc
sub eax, 0x1a
jae 0x9b539
lea eax, [ebp - 4]
mov dl, byte [esi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 4]
mov eax, 0xa6a30
mov cl, 0x10
call fcn.00012b24
mov ebx, 1
call fcn.0009b260
jmp 0x9b3f6
cmp ebx, 0x10
jge 0x9b3f1
lea eax, [ebp - 4]
mov dl, byte [esi]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 4]
mov eax, 0xa6a30
mov cl, 0x10
call fcn.00012ad8
inc ebx
call fcn.0009b260
mov al, byte [esi]
add al, 0x9f
sub al, 0x1a
jb 0x9b3d1
mov byte [0xa6a2c], 0
jmp 0x9b40d
inc byte [0xa6a2c]
xor eax, eax
mov al, byte [0xa6a2c]
mov edx, eax
shl eax, 4
add eax, edx
add eax, 0xa4894
mov edx, 0xa6a30
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00012bd8
je 0x9b539
cmp byte [0xa6a2c], 0xe
jne 0x9b407
jmp 0x9b539
call fcn.0009b260
mov eax, 0xa6a44
call fcn.00013b78
xor ebx, ebx
jmp 0x9b491
cmp ebx, 0xc8
jge 0x9b482
cmp byte [esi], 0x7e
jne 0x9b468
call fcn.0009b260
lea eax, [ebp - 8]
mov dl, byte [esi]
call fcn.00013d1c
mov edx, dword [ebp - 8]
mov eax, 0xa6a44
call fcn.00013dfc
inc ebx
jmp 0x9b48c
mov eax, 1
call fcn.0009b25c
call fcn.0009b260
mov al, byte [esi]
add al, 0xe0
sub al, 0x5f
jae 0x9b4a3
cmp byte [esi], 0x22
jne 0x9b456
cmp byte [esi], 0x7e
je 0x9b456
cmp byte [esi], 0x22
jne 0x9b4af
call fcn.0009b260
jmp 0x9b4b9
mov eax, 1
call fcn.0009b25c
mov byte [0xa6a2c], 0x10
jmp 0x9b539
call fcn.0009b260
mov al, byte [esi]
add al, 0x9f
sub al, 0x1a
jb 0x9b4d9
mov eax, 2
call fcn.0009b25c
mov al, byte [esi]
mov byte [0xa6a48], al
mov byte [0xa6a2c], 0x12
call fcn.0009b260
jmp 0x9b539
call fcn.0009b260
mov byte [0xa6a2c], 0xf
jmp 0x9b539
call fcn.0009b260
mov byte [0xa6a2c], 0x13
jmp 0x9b539
call fcn.0009b260
mov byte [0xa6a2c], 0x14
jmp 0x9b539
call fcn.0009b260
mov byte [0xa6a2c], 0x11
jmp 0x9b539
mov byte [0xa6a2c], 0x15
jmp 0x9b539
mov eax, 3
call fcn.0009b25c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9b556
lea eax, [ebp - 8]
call fcn.00013b78
ret
Function at 0x9c3f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00013fa8
mov eax, dword [ebp - 8]
call fcn.00013fa8
mov eax, dword [ebp + 8]
call fcn.00013fa8
xor eax, eax
push ebp
push 0x9c549
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0xa6a4c], ebx
call fcn.0009b55c
mov bl, 0x61
xor edx, edx
mov eax, ebx
call fcn.0009b1f8
inc ebx
cmp bl, 0x7b
jne 0x9c445
mov edx, dword [ebp - 8]
mov al, 0x73
call fcn.0009b1f8
mov edx, dword [ebp + 8]
mov al, 0x64
call fcn.0009b1f8
mov edx, dword [ebp - 4]
mov al, 0x6d
call fcn.0009b1f8
mov eax, 0x64
call fcn.00018cbc
mov ebx, eax
push 0x50
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00012d4c
mov edx, 0x9c558
lea eax, [ebp - 0x110]
call fcn.00012ab0
lea edx, [ebp - 0x110]
lea eax, [ebp - 0xc]
call fcn.00013d98
push 0x50
push ebx
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00012d4c
mov edx, 0x9c558
lea eax, [ebp - 0x110]
call fcn.00012ab0
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10]
call fcn.00013d98
mov eax, ebx
call fcn.00018d08
mov edx, dword [ebp - 0xc]
mov al, 0x77
call fcn.0009b1f8
mov edx, dword [ebp - 0x10]
mov al, 0x78
call fcn.0009b1f8
mov eax, 0x9c564
call fcn.0009b164
call fcn.0009b314
call fcn.0009b580
cmp byte [0xa6a2c], 0x15
je 0x9c526
mov eax, 4
call fcn.0009b57c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9c550
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00013b9c
lea eax, [ebp + 8]
call fcn.00013b78
ret
Function at 0xf06000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xf0600a
jmp 0xf0800f
jmp fcn.00a960b0
Function at 0x10015839
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10015867
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10015865
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10015889
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10015889
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov esp, ebp
pop ebp
ret

Function at 0x100159b2
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10015a9f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.10018b0a
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 0x2c]
call fcn.10018b0a
mov eax, dword [eax]
neg eax
je 0x10015a68
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.10018b0a
mov esi, eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.10018b0a
mov esi, dword [esi]
add esi, dword [eax]
push 1
mov ecx, dword [ebp - 4]
call fcn.10018b0a
cmp esi, dword [eax]
jne 0x10015a77
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
jne 0x10015a77
mov eax, 0x2542
test eax, eax
jne 0x10015a77
and dword [ebp - 0xc], 0
jmp 0x10015a7e
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x40c9
jg 0x10015a90
mov dword [ebp - 0x34], 1
jmp 0x10015a94
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0xffffffff
jmp 0x10015aa7
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e839
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001e926
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.10018b0a
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
push 0
mov ecx, dword [ebp - 0x2c]
call fcn.10018b0a
mov eax, dword [eax]
neg eax
je 0x1001e8ef
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.10018b0a
mov esi, eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.10018b0a
mov esi, dword [esi]
add esi, dword [eax]
push 1
mov ecx, dword [ebp - 4]
call fcn.10018b0a
cmp esi, dword [eax]
jne 0x1001e8fe
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
jne 0x1001e8fe
mov eax, 0x2542
test eax, eax
jne 0x1001e8fe
and dword [ebp - 0xc], 0
jmp 0x1001e905
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x40c9
jg 0x1001e917
mov dword [ebp - 0x34], 1
jmp 0x1001e91b
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x38]
mov dword [eax], 0xffffffff
jmp 0x1001e92e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001ed16
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001ed67
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001ed52
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x17
je 0x1001ed65
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xc4ab274b
jmp 0x1001ed47
jmp 0x1001ed85
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001ed85
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret