joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00409011
push eax
push esi
push dword [ebp + 8]
call fcn.00408fc6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00409011
push eax
push esi
push dword [ebp + 8]
call fcn.00408fc6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00409001
dec ecx
inc esi
dec ebx
mov esi, 0xff7c9d88
invalid

Function at 0x409660
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x4096b5
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4096b0
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x40969a
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4096a2
cmp edx, ebx
jne 0x4097f0
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x409671
add eax, dword [eax + 4]
jmp 0x40965e
mov dword [ebp + 0xc], ebx
jmp 0x4096c0
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4096d8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4096f6
movzx eax, ax
lea eax, [eax + eax*4]
invalid
invalid

Function at 0x4098c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ecx - 0x6737b]
inc edi
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
Function at 0x409900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00409011
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00408fc6
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
add dh, al
test dword [eax], ebx
cld
invalid
jmp [ecx - 0x3e67a3a]
invalid
dec dword [ebx - 0x3e57a3a]
invalid
call [edx - 0x3e47a3a]
invalid
jmp dword [ebx - 0x3e37a3a]
invalid
inc dword [ecx - 0x3e27a3a]
invalid
dec dword [edx - 0x3e17a3a]
invalid
call [ebx - 0x3e07a3a]
invalid
inc dword [edx - 0x3df7a3a]
invalid
dec dword [ebx - 0x3de7a3a]
invalid
jmp dword [esi - 0x3dd7a3a]
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
invalid
invalid
scasd eax, dword es:[edi]
Function at 0x10001120
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push esi
xor ecx, ecx
xor esi, esi
push edi
test ebx, ebx
jle 0x10001218
mov edi, dword [ebp + 8]
nop word [eax + eax]
mov al, byte [esi + edi]
cmp al, 0x3d
jne 0x1000114d
inc ecx
cmp ecx, 2
jg 0x10001194
cmp al, 0x7f
ja 0x10001194
movzx eax, al
mov al, byte [eax + 0x1002b2f0]
cmp al, 0x7f
je 0x10001194
cmp al, 0x40
jae 0x10001166
test ecx, ecx
jne 0x10001194
inc esi
inc edx
cmp esi, ebx
jl 0x10001140
test edx, edx
je 0x10001218
mov ecx, dword [ebp + 0x14]
lea eax, [edx + edx*2]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x1000119e
pop edi
pop esi
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp + 0xc], ecx
mov edi, 3
test esi, esi
jle 0x10001210
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx]
mov dl, byte [ecx + 0x1002b2f0]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub edi, ecx
movzx ecx, dl
mov edx, dword [ebp + 0xc]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0xc], edx
cmp edx, 4
jne 0x10001204
xor ecx, ecx
mov dword [ebp + 0xc], ecx
test edi, edi
jle 0x100011ef
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jle 0x100011fc
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jle 0x10001204
mov byte [eax], bl
inc eax
mov ecx, dword [ebp + 8]
dec esi
inc ecx
mov dword [ebp + 8], ecx
test esi, esi
jg 0x100011b4
mov ecx, dword [ebp + 0x14]
sub eax, dword [ebp + 0x10]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10001220
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x10001261
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.10002480
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10003540
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029677
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x1003b0ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x9c], 8
lea eax, [esi + 0x88]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x1000358d
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
push eax
push edi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x100036d6
xor eax, eax
mov dword [ebp - 0x814], 7
push eax
push 0x1002b428
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
call fcn.10002b40
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.100152f0
push edi
lea eax, [ebp - 0x810]
push 0x1002b454
push eax
call fcn.10002d60
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [esi + 5], 0
mov ecx, esi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x10003625
call fcn.100033b0
mov esi, eax
jmp 0x1000362c
call fcn.10003510
mov esi, eax
lea eax, [ebp - 0x828]
cmp eax, esi
je 0x10003679
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10003654
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10002c40
xor eax, eax
mov dword [ebp - 0x814], 7
push esi
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], eax
mov word [ebp - 0x828], ax
call fcn.10002660
mov eax, dword [ebp - 0x82c]
cmp eax, 8
jb 0x10003697
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.10002c40
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.100173f2
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x100036d4
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10002c40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100124da
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003700
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100296c2
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x1003b0ac]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], 0
call fcn.100152f0
lea eax, [edi + 0x88]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10003783
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x100037c9
mov eax, dword [esi]
jmp 0x100037cb
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0x810], cx
je 0x100037f1
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100037e2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10002b40
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x834], 1
jb 0x1000381b
mov eax, dword [esi]
jmp 0x1000381d
mov eax, esi
mov ecx, ebx
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003846
test dx, dx
je 0x10003842
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003846
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003820
xor eax, eax
jmp 0x1000384b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100038b2
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x10003887
call fcn.100033b0
push eax
mov ecx, esi
call fcn.100025b0
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x100038b2
inc ecx
push ecx
jmp 0x100038a1
call fcn.10003510
push eax
mov ecx, esi
call fcn.100025b0
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x100038b2
inc eax
push eax
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.10002c40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100124da
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10004b00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x1003b0ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.100152f0
lea eax, [esi + 0x28]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10004b37
mov eax, dword [eax]
push str.CfgPath
push eax
lea eax, [ebp - 0x20c]
push 0x1002b4f0
push eax
call fcn.10002d60
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004b71
lea eax, [ebp - 0x20c]
push eax
call fcn.10009de0
add esp, 4
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.100152f0
push str.Use.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push str._s_s
push eax
call fcn.10002d60
add esp, 0x1c
cmp word [ebp - 0x414], 0
jne 0x10004bb2
xor ecx, ecx
jmp 0x10004bcf
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004bc0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
push eax
lea ecx, [esi + 0x88]
call fcn.10002b40
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.100152f0
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push str._s_s
push eax
call fcn.10002d60
add esp, 0x1c
cmp word [ebp - 0x61c], 0
jne 0x10004c23
xor ecx, ecx
jmp 0x10004c3f
lea ecx, [ebp - 0x61c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004c30
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x61c]
push eax
lea ecx, [esi + 0xa0]
call fcn.10002b40
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.100152f0
lea eax, [ebp - 0xa44]
push str.CCYSPath
push eax
call fcn.1000a230
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x10004c81
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x1002b53c
push eax
call fcn.10002d60
mov eax, dword [ebp - 0xa30]
add esp, 0xc
cmp eax, 8
jb 0x10004cb4
inc eax
lea ecx, [ebp - 0xa44]
push eax
push dword [ebp - 0xa44]
call fcn.10002c40
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004cd4
lea eax, [ebp - 0x824]
push eax
call fcn.10009de0
add esp, 4
push 0x208
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.100152f0
push str.UseCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push str._s_s
push eax
call fcn.10002d60
add esp, 0x1c
cmp word [ebp - 0xa2c], 0
jne 0x10004d15
xor ecx, ecx
jmp 0x10004d2f
lea ecx, [ebp - 0xa2c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004d20
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [esi + 0xb8]
call fcn.10002b40
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100124da
mov esp, ebp
pop ebp
ret
Function at 0x10009a70
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.10012510
mov eax, dword [0x1003b0ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
call fcn.100199df
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.1001a103
add esp, 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push eax
push dword [edi]
mov eax, dword [edi + 0x10]
push dword [edi + 4]
inc eax
push dword [edi + 8]
push dword [edi + 0xc]
push eax
mov eax, dword [edi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.10009920
add esp, 0x28
xor edi, edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, 1
push 0x1002b8d4
push ebx
cmovne edi, ecx
call fcn.10019e62
mov esi, eax
add esp, 8
test esi, esi
je 0x10009ba0
test edi, edi
jne 0x10009b36
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push 1
push eax
call fcn.100168f0
add esp, 0x10
lea eax, [ebp - 0x1004]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10009b40
sub eax, edx
sar eax, 1
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.100168f0
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.100168f0
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.100168f0
push esi
call fcn.10016638
add esp, 0x34
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100124da
mov esp, ebp
pop ebp
ret

Function at 0x10009de0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x10009df0
sub edi, ecx
mov edx, 2
sar edi, 1
xor ecx, ecx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001253d
add esp, 4
mov ebx, eax
sub eax, esi
nop
movzx ecx, word [esi]
lea esi, [esi + 2]
mov word [eax + esi - 2], cx
test cx, cx
jne 0x10009e20
xor esi, esi
mov dword [ebp + 8], 1
test edi, edi
js 0x10009e79
nop dword [eax]
cmp word [ebx + esi*2], 0x5c
jne 0x10009e6d
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10009e64
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10009e8a
mov eax, 0x5c
mov word [ebx + esi*2], ax
inc esi
cmp esi, edi
jle 0x10009e40
mov dword [ebp + 8], 1
push ebx
call fcn.100124d5
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
mov dword [ebp + 8], 0
call fcn.100124d5
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10009eb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1003b0ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push 0
call fcn.1000a620
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10009ef0
sub ecx, edx
sar ecx, 1
je 0x10009fd2
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10009f10
mov eax, dword [0x1002b45c]
push esi
mov dword [edi], eax
mov esi, ebx
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x10009f26
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10009f40
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
pop esi
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x10009f64
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
test eax, eax
jne 0x10009f93
lea eax, [ebp - 0x20c]
push eax
call fcn.10009de0
add esp, 4
cmp word [ebp - 0x20c], 0
jne 0x10009fa1
xor ecx, ecx
jmp 0x10009fbf
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10009fb0
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.10002b40
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100124da
mov esp, ebp
pop ebp
ret

Function at 0x1000a170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1003b0ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x1003c078]
test al, al
jne 0x1000a213
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100152f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000a20e
lea eax, [ebp - 0x20c]
push eax
call fcn.10019bb5
lea eax, [ebp - 0x20c]
push str.config_systemprofile
push eax
call fcn.1001559d
add esp, 0xc
test eax, eax
jne 0x1000a1f9
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.1001559d
add esp, 8
test eax, eax
je 0x1000a20e
mov al, 1
mov byte [0x1003c078], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100124da
mov esp, ebp
pop ebp
ret
mov al, byte [0x1003c078]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100124da
mov esp, ebp
pop ebp
ret
Function at 0x1000a620
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor bl, bl
call fcn.1000a170
test al, al
je 0x1000a681
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.1000a0c0
add esp, 4
test al, al
je 0x1000a681
push dword [ebp + 0xc]
push 1
push dword [ebp - 4]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1000a681
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
mov eax, 1
cmovne ecx, eax
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a9a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2068
call fcn.10012510
mov eax, dword [0x1003b0ac]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1000abae
push 0x2000
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x2010], 0
push 0
push eax
mov dword [ebp - 0x2008], 0
call fcn.100152f0
push edi
push esi
lea eax, [ebp - 0x2004]
push str.__s___s
push eax
call fcn.10002d60
push str.EXPLORER.EXE
call fcn.1000ae60
add esp, 0x20
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000ab6b
lea eax, [ebp - 0x2010]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000ab6b
lea eax, [ebp - 0x2008]
push eax
push 1
push 1
push 0
push 0xf01ff
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1000ab6b
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000aab8
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000aab1
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x1000ab6b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
lea eax, [ebp - 0x2068]
push 0
push eax
call fcn.100152f0
add esp, 0xc
mov dword [ebp - 0x2068], 0x44
mov eax, 5
mov dword [ebp - 0x2060], str.WinSta0Default
mov word [ebp - 0x2038], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x203c], 1
push 0
push dword [ebp - 0x2008]
movups xmmword [ebp - 0x2024], xmm0
push eax
mov dword [ebp - 0x200c], 0
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x1000ab6b
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2068]
push eax
push 0
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2004]
push 0x430
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1000ab6b
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x1000ab6b
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, dword [ebp - 0x2008]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000ab83
cmp eax, 0xffffffff
je 0x1000ab83
push eax
call esi
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x1000ab95
cmp eax, 0xffffffff
je 0x1000ab95
push eax
call esi
test edi, edi
jne 0x1000ab9c
push edi
call esi
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100124da
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push edi
push esi
call fcn.1000a760
mov ecx, dword [ebp - 4]
add esp, 0x14
test eax, eax
setne al
xor ecx, ebp
pop edi
pop esi
call fcn.100124da
mov esp, ebp
pop ebp
ret