joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439c7d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
cmp ah, ah
jmp 0x439c8d
je 0x439c93
push esp
dec edi
invalid
inc esp
jmp fcn.00439c9f

Function at 0x4d711f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop ecx
jmp 0x4d7128
cmp cl, cl
jmp 0x4d7134
je 0x4d713e
out 0x9d, eax
wait
fild word [ebx + 0x4e905c1]
add byte [eax], al
add dl, bl
call 0xea463617
add eax, 0xb2000000
stc
mov cl, 0xe0
invalid
add ecx, 5
jmp 0x4d714a
clc
jmp 0x4d7155
jae 0x4d715f
sar byte [esi + eax*8 - 0x162e0049], 1
push ss
add byte [eax], al
add byte [eax - 0x6241213], ch
call ecx
jmp 0x4d717c
stc
jmp 0x4d7173
jb 0x4d7191
shr byte [edx - 0x1636c75d], 1
add al, 0
add byte [eax], al
fst st(7)
mov bl, 0xa8
cmp cl, cl
jmp 0x4d7187
je 0x4d716a
mov dh, 0xe3
lodsb al, byte [esi]
mov dl, 0xff
invalid
inc esp
jmp 0x4d719b
add esp, 3
jmp 0x4d71a6
inc esp
jmp 0x4d71b0
stc
jmp 0x4d71ba
jb 0x4d71c5
xchg ebx, eax
xchg esi, eax
out 0xd8, eax
fdivr qword [eax]
in eax, dx
cmp ch, ch
jmp 0x4d71d1
je 0x4d71db
int 0xd2
sal byte [edx + 0x3e9c4ff], cl
add byte [eax], al
add byte [edi - 0x16075c18], ch
add eax, 0xfe000000
mov bh, 0xb9
xchg ebp, eax
cwde
inc esp
jmp 0x4d71e5
clc
jmp 0x4d71f0
jae 0x4d71fb
ret 0xadc3
add esp, 3
jmp 0x4d7208
clc
jmp 0x4d7212
jae 0x4d721d
xchg ebp, eax
mov ebp, 0x8dbda6cb
and al, 0xff
lea esp, [esp - 1]
jmp 0x4d7229
clc
jmp 0x4d7234
jae 0x4d723d
rcl esi, cl
ficomp dword [ecx + 0x66]
popfd
pop ecx
popf
jmp 0x4d7249
jmp 0x4d7251
mov byte [ebp - 0xd], 0x57
mov byte [ebp - 0xc], 0
jmp 0x4d7260
push eax
jmp 0x4d726b
lahf
jmp 0x4d7270
stc
jb 0x4d727a
invalid
call 0x4d7285
lds esi, [0x4bf9c785]
inc esp
jmp 0x4d7293
inc esp
jmp 0x4d729e
inc esp
inc esp
clc
jae 0x4d72ac
mov dl, 0xd7
adc esp, dword [esi - 0x52]
cmp dword [ecx], edi
jmp 0x4d72b2
jmp 0x4d72ba
sahf
mov eax, dword [esp]
jmp 0x4d72c5
lea esp, [esp + 4]
mov dword [ebp - 4], 0
jmp 0x4d72d8
jmp 0x4d72e0
lea esp, [esp - 8]
mov dword [esp], eax
lahf
push ebx
call fcn.004d72fe
int3

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..retplne
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6b183cea
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..reloc
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5ab63b09
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1001ee10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
movdqa xmm1, xmmword [0x1008f810]
test eax, eax
jle 0x1001eefe
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x1c]
push esi
push edi
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], eax
xor esi, esi
test dl, 0xf
je 0x1001ee6c
sub ecx, edx
mov eax, edx
mov dword [ebp - 4], ecx
jmp 0x1001ee4b
mov ecx, dword [ebp - 4]
cmp esi, dword [ebp + 8]
jge 0x1001ee6c
mov ecx, dword [ecx + eax]
mov edi, ecx
rol edi, 0x10
xor edi, ecx
and edi, 0xff00ff
xor edi, ecx
mov dword [eax], edi
add eax, 4
inc esi
test al, 0xf
jne 0x1001ee48
lea edi, [esi + 3]
cmp edi, dword [ebp + 8]
jge 0x1001eeb4
mov ecx, dword [ebp + 0xc]
lea eax, [edx + esi*4]
sub ecx, edx
lea esp, [esp]
movdqu xmm0, xmmword [ecx + eax]
movdqa xmm2, xmm1
pandn xmm2, xmm0
pand xmm0, xmm1
pshuflw xmm0, xmm0, 0xb1
pshufhw xmm0, xmm0, 0xb1
por xmm2, xmm0
movdqa xmmword [eax], xmm2
add edi, 4
add esi, 4
add eax, 0x10
cmp edi, dword [ebp + 8]
jl 0x1001ee80
mov edx, dword [ebp + 0x1c]
cmp esi, dword [ebp + 8]
jge 0x1001eee4
mov edi, dword [ebp + 8]
lea ecx, [edx + esi*4]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 0x1c]
sub edi, esi
mov eax, dword [edx + ecx]
mov esi, eax
rol esi, 0x10
xor esi, eax
and esi, 0xff00ff
xor esi, eax
mov dword [ecx], esi
add ecx, 4
dec edi
jne 0x1001eec7
mov edx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp + 0x10]
add edx, dword [ebp + 0x18]
dec dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x1c], edx
jne 0x1001ee38
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x1001f140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0x7789f7d9
cmp eax, 0x4d
ja case.0x1001f157.2005530584
movzx eax, byte [eax + 0x1001f188]
jmp dword [eax*4 + 0x1001f180]
mov ecx, dword [0x100a8030]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x6c]
call eax
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x1001f2f0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x100a8030]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax]
test esi, esi
je 0x1001f337
mov ecx, esi
call fcn.100290e0
test al, al
je 0x1001f33b
call sym.libGLESv2.dll_Ordinal_147
test eax, eax
je 0x1001f337
mov ecx, eax
call fcn.10029c00
push 0xa7
push str.error
push str.trace:__s__d_:__t__Error_generated:_out_of_memory_n_n
push 1
call fcn.10031e90
add esp, 0x10
xor eax, eax
pop esi
ret
mov eax, esi
pop esi
ret
Function at 0x10021e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x10021edb
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
add esi, 2
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp + 0xc], esi
xor edi, edi
test eax, eax
jle 0x10021ec7
lea esp, [esp]
movzx eax, word [ecx + edi*2]
mov bl, al
add bl, bl
add bl, bl
mov dl, al
shr dl, 2
and dl, 7
add bl, bl
or dl, bl
mov byte [esi - 2], dl
mov bl, al
shr bl, 3
mov edx, eax
shr edx, 9
xor dl, bl
and dl, 3
mov ebx, eax
shr ebx, 3
xor dl, bl
mov byte [esi - 1], dl
mov edx, eax
mov ebx, eax
shr edx, 0xd
shr ebx, 8
xor dl, bl
shr eax, 8
and dl, 7
xor dl, al
mov eax, dword [ebp + 8]
mov byte [esi], dl
mov byte [esi + 1], 0xff
inc edi
add esi, 4
cmp edi, eax
jl 0x10021e70
mov esi, dword [ebp + 0xc]
add esi, dword [ebp + 0x18]
add ecx, dword [ebp + 0x10]
dec dword [ebp + 0x14]
mov dword [ebp + 0xc], esi
jne 0x10021e63
pop edi
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x10022040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x10022099
mov edx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x1c], eax
lea esp, [esp]
test esi, esi
jle 0x10022085
mov ecx, edi
sub edx, edi
mov eax, dword [edx + ecx]
mov ebx, eax
rol ebx, 0x10
xor ebx, eax
and ebx, 0xff00ff
xor ebx, eax
mov dword [ecx], ebx
add ecx, 4
dec esi
jne 0x10022068
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 0x10]
add edi, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
mov dword [ebp + 0xc], edx
jne 0x10022060
pop edi
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x100220a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x10022138
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
add esi, 2
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], eax
xor edi, edi
cmp dword [ebp + 8], edi
jle 0x10022124
lea ebx, [ebx]
mov edx, dword [ebp + 0xc]
movzx eax, word [edx + edi*2]
mov cx, ax
shr cx, 4
mov dl, cl
xor dl, al
and dl, 0xf
xor dl, al
mov byte [esi - 2], dl
mov bl, cl
mov dx, ax
shr dx, 8
xor bl, dl
and bl, 0xf
xor bl, cl
mov ecx, eax
shr ecx, 0xc
xor cl, dl
and cl, 0xf
xor cl, dl
mov dl, al
and dl, 0xf
shl al, 4
or dl, al
mov byte [esi - 1], bl
mov byte [esi], cl
mov byte [esi + 1], dl
inc edi
add esi, 4
cmp edi, dword [ebp + 8]
jl 0x100220d0
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
add esi, dword [ebp + 0x18]
add dword [ebp + 0xc], eax
dec dword [ebp + 0x1c]
mov dword [ebp + 0x14], esi
jne 0x100220c3
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x10022140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x100221de
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
add esi, 2
push edi
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], eax
xor edi, edi
cmp dword [ebp + 8], edi
jle 0x100221ca
lea ebx, [ebx]
mov edx, dword [ebp + 0xc]
movzx eax, word [edx + edi*2]
mov dl, al
add dl, dl
mov cx, ax
shr cx, 3
add dl, dl
xor dl, cl
mov bl, al
add bl, bl
add bl, bl
and dl, 7
xor dl, bl
mov byte [esi - 2], dl
mov dx, ax
mov bl, cl
shr dx, 8
xor bl, dl
and bl, 7
xor bl, cl
mov ecx, eax
shr ecx, 0xd
xor cl, dl
and cl, 7
and al, 1
xor cl, dl
neg al
sbb al, al
mov byte [esi - 1], bl
mov byte [esi], cl
mov byte [esi + 1], al
inc edi
add esi, 4
cmp edi, dword [ebp + 8]
jl 0x10022170
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
add esi, dword [ebp + 0x18]
add dword [ebp + 0xc], edx
dec dword [ebp + 0x1c]
mov dword [ebp + 0x14], esi
jne 0x10022163
pop edi
pop esi
pop ebx
pop ebp
ret 0x18

Function at 0x10028290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0x100888f4
push eax
call fcn.10071534
mov esi, eax
add esp, 8
test esi, esi
jne 0x100282d0
push 0x41e
push str.writeFile
push 0x41e
push str.writeFile
push str.err:__s__d_:__t__Unreachable_reached:__s__d__n_n
push eax
call fcn.10031e90
add esp, 0x18
pop esi
pop ebp
ret
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
push ecx
push 1
push edx
call fcn.100713fe
push esi
call fcn.10071233
add esp, 0x14
pop esi
pop ebp
ret

Function at 0x10028400
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100a8458]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x10028471
push 0x40b
push str.getTempPath
push 0x40b
push str.getTempPath
push str.err:__s__d_:__t__Unreachable_reached:__s__d__n_n
push eax
call fcn.10031e90
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
add esp, 0x18
mov byte [esi], 0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007053a
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0x10090254
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x100284d0
push 0x412
push str.getTempPath
push 0x412
push str.getTempPath
push str.err:__s__d_:__t__Unreachable_reached:__s__d__n_n
push eax
call fcn.10031e90
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
add esp, 0x18
mov byte [esi], 0
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007053a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100284f0
sub eax, edx
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.10004c30
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1007053a
mov esp, ebp
pop ebp
ret
Function at 0x100403e0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x100a8038]
cmp eax, 0xffffffff
jne 0x100403ed
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100403fb
mov al, 1
ret
call fcn.100427b0
call fcn.10042720
test al, al
je 0x100403ea
mov eax, dword [0x100a8038]
push 1
push eax
call fcn.10044330
add esp, 8
test al, al
setne al
ret

Function at 0x10040420
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp dword [0x100a8038], 0xffffffff
je 0x1004042c
mov al, 1
ret
call fcn.10044320
mov dword [0x100a8038], eax
cmp eax, 0xffffffff
jne 0x1004043e
xor al, al
ret
call fcn.10042810
test al, al
je 0x1004043b
call fcn.100426d0
test al, al
je 0x1004043b
jmp fcn.100403e0

Function at 0x10040460
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x100a8038]
cmp eax, 0xffffffff
jne 0x1004046d
mov al, 1
ret
push ebx
push eax
mov bl, 1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100404a1
mov eax, dword [0x100a8038]
push 0
push eax
call fcn.10044330
add esp, 8
test al, al
jne 0x10040491
xor bl, bl
call fcn.10042770
test al, al
jne 0x1004049c
xor bl, bl
call fcn.100427f0
call fcn.100426f0
test al, al
jne 0x100404ac
xor bl, bl
call fcn.10042830
mov ecx, dword [0x100a8038]
push ecx
call fcn.10044360
add esp, 4
mov al, bl
mov dword [0x100a8038], 0xffffffff
pop ebx
ret

Function at 0x10042720
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x100a803c]
cmp eax, 0xffffffff
jne 0x1004272d
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x1004272a
push 4
call fcn.100705fb
add esp, 4
test eax, eax
je 0x1004272a
mov dword [eax], 0
push eax
mov dword [eax], 0
mov eax, dword [0x100a803c]
push eax
call fcn.10044330
add esp, 8
mov al, 1
ret

Function at 0x10042770
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x100a803c]
cmp eax, 0xffffffff
jne 0x1004277d
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10042791
push eax
call fcn.1006fd35
add esp, 4
mov al, 1
ret

Function at 0x100427b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x100a8040]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100427ee
push 4
call fcn.100705fb
add esp, 4
test eax, eax
je 0x100427d6
mov dword [eax], 0
jmp 0x100427d8
xor eax, eax
mov dword [eax], 0
mov ecx, dword [0x100a8040]
push eax
push ecx
call fcn.10044330
add esp, 8
ret
Function at 0x100606a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005a8b0
Function at 0x1007053a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a8458]
jne 0x10070544
repz ret
jmp fcn.100756e9

Function at 0x10081e4d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100a8458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10077ca4
and dword [ebp - 0x14], 0
cmp dword [0x100aaacc], 0
mov dword [ebp - 0x18], eax
jne 0x10081f00
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10081fa8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10081fa8
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100aaacc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100aaad0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100aaad4], eax
call edi
push eax
call esi
mov dword [0x100aaadc], eax
test eax, eax
je 0x10081f00
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100aaad8], eax
mov eax, dword [0x100aaad8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10081f59
cmp dword [0x100aaadc], ecx
je 0x10081f59
push eax
call esi
push dword [0x100aaadc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10081f59
test ebx, ebx
je 0x10081f59
call edi
test eax, eax
je 0x10081f50
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10081f50
test byte [ebp - 8], 1
jne 0x10081f59
or dword [ebp + 0x10], 0x200000
jmp 0x10081f8c
mov eax, dword [0x100aaad0]
cmp eax, dword [ebp - 0x18]
je 0x10081f8c
push eax
call esi
test eax, eax
je 0x10081f8c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10081f8c
mov eax, dword [0x100aaad4]
cmp eax, dword [ebp - 0x18]
je 0x10081f8c
push eax
call esi
test eax, eax
je 0x10081f8c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100aaacc]
call esi
test eax, eax
je 0x10081fa8
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10081faa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007053a
leave
ret
Function at 0x100066c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push eax
add esp, 4
jmp 0x100064d8
and ecx, 0x178b9
and ecx, 0x5ed0
sub ecx, 0x14067
pop ecx
push esi
or esi, 0x124b0
add dword [eax], eax
add esi, 0x573
jmp 0x100064ff
pop esi
mov edx, dword [ebp - 0xcb0]
mov ax, word [edx]
mov word [ebp - 0x103e], ax
mov ecx, dword [ebp - 0xcb0]
add ecx, 2
mov dword [ebp - 0xcb0], ecx
mov dx, word [ebp - 0x103e]
mov word [ebp - 0x218], dx
mov eax, dword [ebp - 0xcb4]
mov cx, word [eax]
mov word [ebp - 0x1040], cx
mov edx, dword [ebp - 0xcb4]
add edx, 2
mov dword [ebp - 0xcb4], edx
mov ax, word [ebp - 0x1040]
mov word [ebp - 0x34], ax
push ebx
push ecx
add esp, 4
or ebx, 0x1345b
jmp 0x1000656a
and ebx, 0x10051
pop ebx
push eax
push ecx
add esp, 4
add eax, 0xb2de
xor eax, 0x127ac
xor eax, 0x8e04
pop eax
movzx ecx, word [ebp - 0x34]
test ecx, ecx
jne 0x100065a6
movzx edx, word [ebp - 0x218]
movzx eax, word [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x160c], edx
jmp 0x10006600
movzx ecx, word [ebp - 0x218]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
je 0x100064ce
movzx eax, word [ebp - 0x218]
xor eax, 0x20
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x100064ce
movzx edx, word [ebp - 0x218]
movzx eax, word [ebp - 0x34]
cmp edx, eax
jge 0x100065ea
mov dword [ebp - 0x1608], 0xffffffff
jmp 0x100065f4
mov dword [ebp - 0x1608], 1
mov ecx, dword [ebp - 0x1608]
mov dword [ebp - 0x160c], ecx
cmp dword [ebp - 0x160c], 0
jne 0x10006649
push edi
push edx
add esp, 4
xor edi, 0x13a8d
add edi, 0xd20a
xor edi, 0x1789e
pop edi
push edi
or edi, 0x381c
jmp 0x1000662e
and edi, 0x11f6b
xor edi, 0x17073
pop edi
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x2d4], edx
jmp 0x100066b1
push ebx
and ebx, 0x168f4
sub ebx, 0x1192a
call 0x10006666
add byte [eax], bh
xor edi, dword [eax + edx*2]
inc ebp
aas
cmp eax, 0xc4833333
add al, 0xe8
or dword [eax], eax
add byte [eax], al
add byte [edi], dh
cmp al, 0x49
push eax
aas
inc ebp
cmp eax, dword ss:[ebx - 0x74a4fb3c]
test eax, esi
cli
invalid
push ebx
push esi
add esp, 4
call 0x100066c2
add byte [edi], bh
cmp byte [esi + ecx*2 + 0x3f], al
inc esi
add esp, 4
jmp 0x100066ca
sub ebx, 0x105b4
add ebx, 0x1036b
pop ebx
push edi
push ebx
add esp, 4
add edi, 0xcdbc
pop edi
mov ecx, dword [ebp - 0x2d4]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x324], edx
push edx
xor edx, 0x163f9
or edx, 0x11f5
add edx, 0xbe6c
and edx, 0x138d0
pop edx
push edx
push ebx
add esp, 4
xor edx, 0x16b1e
xor edx, 0x3f11
add edx, 0xd1c7
pop edx
mov dword [ebp - 0x774], 0
invalid
invalid
Function at 0x10033ac0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10190010
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x101f62b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1004c140
push str.Remove_the_ADCRef_file_created_by_ACCC
push 0x101b03e4
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
xor eax, eax
mov dword [ebp - 0x18], 0
add esp, 0xc
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edx, [ebp - 0x28]
mov dword [ebp - 4], eax
lea ecx, [eax + 0x21]
call fcn.100456b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10033b53
call fcn.1004c140
push str.Failed_to_find_ADCRefs_Folder_location_for_ACCC.
jmp 0x10033c33
push 0xa
xor eax, eax
mov dword [ebp - 0x30], 0
push str.ACC.adcref
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.10001e80
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100fd0e0
mov byte [ebp - 4], 0
add esp, 0xc
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x10033bca
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10033bc0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10033cc6
push edx
push ecx
call fcn.1015cb05
add esp, 8
xor bl, bl
call fcn.1004c140
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10033c02
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
mov cl, 1
setne bl
jmp 0x10033c04
xor cl, cl
xor edx, edx
movzx eax, bl
test cl, cl
cmove eax, edx
test al, al
je 0x10033c4f
sub esp, 8
lea ecx, [ebp - 0x28]
push edx
push 1
mov dl, 1
call fcn.10109de0
add esp, 0x10
test al, al
jne 0x10033c4f
call fcn.1004c140
push str.Failed_to_remove_ADC.adcref.
mov ecx, dword [eax]
push 0x101b03e4
push eax
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
xor bl, bl
jmp 0x10033c73
call fcn.1004c140
push str.ADCRefs_Folders_deleted_successfully
push 0x101b03e4
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
mov bl, 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10033ca9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10033c9f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10033ccb
push edx
push ecx
call fcn.1015cb05
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015c7a5
mov esp, ebp
pop ebp
ret
call fcn.10168635
call fcn.10168635
int3
Function at 0x1004d411
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x1004d421
mov eax, dword [eax]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1004d464
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1004d448
mov al, 1
mov byte [esi + 0x20], al
pop esi
pop ebx
ret
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov byte [esi + 0x20], bl
pop esi
mov al, bl
pop ebx
ret