joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434714
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405334
xor eax, eax
push ebp
push 0x43495a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00404f2c
mov byte [ebp - 0xd], 0
test ebx, ebx
je 0x434932
cmp dword [0x4608e8], 0
jne 0x434779
call fcn.0043569c
cmp dword [0x4608e8], 0
je 0x434932
xor eax, eax
push ebp
push 0x434928
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x434917
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x434974
call fcn.00404f70
mov edx, dword [ebp - 4]
mov eax, 0x434984
call fcn.00405490
mov esi, eax
test esi, esi
jle 0x4347d8
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004053ac
lea eax, [ebp - 4]
mov ecx, esi
mov edx, 1
call fcn.004053ec
cmp dword [ebp - 4], 0
jne 0x4347f8
mov dl, 1
mov eax, ebx
call fcn.00424f1c
xor edx, edx
push edx
push eax
lea edx, [ebp - 4]
mov eax, 8
call fcn.004094ac
push 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x4608e8]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0042e9d0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00404f2c
mov eax, dword [0x4608e8]
cmp byte [eax + 0x13], 0
je 0x434864
push 0x434990
push dword [ebp - 4]
push 0x4349a4
push ebx
push 0x4349a4
mov eax, dword [ebp - 0xc]
push dword [eax]
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00405248
mov eax, dword [ebp - 0x1c]
call fcn.00405344
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x4348b1
mov eax, dword [ebp - 0xc]
mov edx, ebx
call fcn.00404f2c
mov eax, dword [0x4608e8]
cmp byte [eax + 0x11], 0
je 0x43489b
push dword [ebp - 4]
push 0x4349b0
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00405248
mov byte [ebp - 0xd], 0
call fcn.004048fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x434932
mov byte [ebp - 0xd], 1
mov eax, dword [0x4608e8]
cmp byte [eax + 0x11], 0
je 0x4348da
push dword [ebp - 4]
push 0x4349bc
mov eax, dword [ebp - 0xc]
push dword [eax]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00405248
lea eax, [ebp - 8]
call fcn.00404ed8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43491e
mov eax, dword [0x4608e8]
cmp dword [eax + 0x16], 0
je 0x434916
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ebx, dword [0x4608e8]
call dword [ebx + 0x16]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.00404f2c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434961
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404efc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404efc
ret
Function at 0x435520
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x435616
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x43562c
call fcn.00404f70
push 5
lea eax, [ebp - 0xe]
push eax
push 0x59
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
sete bl
test bl, bl
je 0x435586
push 5
lea eax, [ebp - 9]
push eax
push 0x5a
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
cmp eax, 3
je 0x43558a
xor eax, eax
jmp 0x43558c
mov al, 1
mov ebx, eax
test bl, bl
je 0x4355a7
lea eax, [ebp - 4]
lea edx, [ebp - 0xe]
call fcn.004050d0
mov eax, esi
lea edx, [ebp - 9]
call fcn.004050d0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00408ba8
mov eax, dword [ebp - 0x14]
mov edx, 0x435638
call fcn.004052dc
jne 0x4355e9
lea edx, [ebp - 0x18]
mov eax, dword [esi]
call fcn.00408ba8
mov eax, dword [ebp - 0x18]
mov edx, 0x435644
call fcn.004052dc
jne 0x4355e9
mov eax, edi
mov edx, dword [0x4608ec]
call fcn.00404f2c
jmp 0x4355f3
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404f2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43561d
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404efc
lea eax, [ebp - 4]
call fcn.00404ed8
ret

Function at 0x443b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405334
xor eax, eax
push ebp
push 0x443b84
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00405344
push eax
mov eax, esi
call fcn.00405344
push eax
mov eax, ebx
call fcn.00405344
push eax
push 0x443b94
push edi
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443b8b
lea eax, [ebp + 8]
call fcn.00404ed8
ret

Function at 0x443b9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405334
xor eax, eax
push ebp
push 0x443c39
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov eax, 0x443c4c
mov dword [ebp - 0x30], eax
mov eax, ebx
call fcn.00405344
mov dword [ebp - 0x2c], eax
mov eax, esi
call fcn.00405344
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edi
mov eax, dword [ebp + 8]
call fcn.00405344
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x443c23
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443c40
lea eax, [ebp + 8]
call fcn.00404ed8
ret
Function at 0x443c54
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00405334
xor eax, eax
push ebp
push 0x443cb8
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.00405344
push eax
mov eax, esi
call fcn.00405344
push eax
mov eax, ebx
call fcn.00405344
push eax
push 0x443cc8
push edi
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443cbf
lea eax, [ebp + 8]
call fcn.00404ed8
ret

Function at 0x444230
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405334
xor eax, eax
push ebp
push 0x4442e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x4442bb
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040913c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404f70
cmp dword [ebp - 4], 0
jne 0x44428f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4442c5
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405344
push eax
push 0x4442f8
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4442c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4442ea
lea eax, [ebp - 0xc]
call fcn.00404ed8
lea eax, [ebp - 4]
call fcn.00404ed8
ret
Function at 0x44a6b4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x44a74c
call sub.user32.dll_RegisterWindowMessageA
mov edi, eax
mov dl, 1
mov eax, dword [0x416044]
call fcn.0040406c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x44a73b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push fcn.0044a580
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x44a725
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00416cd4
mov edx, dword [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push edx
push edi
push eax
call sub.user32.dll_PostMessageA
inc esi
dec ebx
jne 0x44a708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a742
mov eax, dword [ebp - 0xc]
call fcn.0040409c
ret

Function at 0x44a7b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dl, 1
call fcn.00424f1c
mov dword [ebp - 8], eax
push 0x44a8a8
call sub.user32.dll_RegisterWindowMessageA
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x416044]
call fcn.0040406c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a898
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
call fcn.0044a760
mov ebx, eax
test ebx, ebx
je 0x44a807
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.0044a580
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x44a81e
mov eax, dword [ebp - 4]
push eax
push fcn.0044a580
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x44a85d
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00416cd4
mov ebx, eax
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44a859
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_PostMessageA
call fcn.004048fc
jmp 0x44a89f
inc edi
dec esi
jne 0x44a82c
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jle 0x44a882
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00416cd4
mov ebx, eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a89f
mov eax, dword [ebp - 4]
call fcn.0040409c
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4128de
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b3ff
and dword [ebp - 0x14], 0
cmp dword [0x816184], 0
mov dword [ebp - 0x18], eax
jne 0x412991
push 0x403e40
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412a39
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e34
push ebx
call edi
test eax, eax
je 0x412a39
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e24
push ebx
mov dword [0x816184], eax
call edi
push eax
call esi
push 0x403e10
push ebx
mov dword [0x816188], eax
call edi
push eax
call esi
push 0x403df4
push ebx
mov dword [0x81618c], eax
call edi
push eax
call esi
mov dword [0x816194], eax
test eax, eax
je 0x412991
push 0x403ddc
push ebx
call edi
push eax
call esi
mov dword [0x816190], eax
mov eax, dword [0x816190]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4129ea
cmp dword [0x816194], ecx
je 0x4129ea
push eax
call esi
push dword [0x816194]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4129ea
test ebx, ebx
je 0x4129ea
call edi
test eax, eax
je 0x4129e1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4129e1
test byte [ebp - 8], 1
jne 0x4129ea
or dword [ebp + 0x10], 0x200000
jmp 0x412a1d
mov eax, dword [0x816188]
cmp eax, dword [ebp - 0x18]
je 0x412a1d
push eax
call esi
test eax, eax
je 0x412a1d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412a1d
mov eax, dword [0x81618c]
cmp eax, dword [ebp - 0x18]
je 0x412a1d
push eax
call esi
test eax, eax
je 0x412a1d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x816184]
call esi
test eax, eax
je 0x412a39
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412a3b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040935b
leave
ret
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6be26a86
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x103869e8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10006ff0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3b98
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10126008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.10007360
mov ecx, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 4], 0
lea edx, [edi + 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edx
mov word [edi + 0xc], 0
mov eax, dword [ecx]
xor ecx, ecx
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 1
lea esi, [edx + 0x18]
mov dword [esi], ecx
xor eax, eax
lea ecx, [esi + 4]
mov dword [ebp + 0xc], esi
mov dword [ecx + 0x10], 0
push eax
mov dword [ecx + 0x14], 7
push 0x100fd780
mov word [ecx], ax
call fcn.10006990
mov word [esi + 0x1c], 0
xor eax, eax
mov byte [esi + 0x1e], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100108c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x10126008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp dword [ebp + 8], 8
mov dword [ebp - 4], 1
jne 0x1001093e
lea eax, [ecx + 0x1c]
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x1001093e
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x10010932
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10006990
lea ecx, [ebp - 0x28]
call fcn.1003c180
test al, al
je 0x100109eb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xorps xmm0, xmm0
lea ecx, [ebp - 0x48]
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x38], xmm0
call fcn.10043420
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x64]
push 0x4c
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
push str.GlobalRCAVE9F9AB9A_97A8_4316_9FBE_3E0AD28D4026_RTPROTECT_SETTINGSTATUSEVENT
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
call fcn.10006990
push ecx
push 0
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x48]
call fcn.10043580
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.10006900
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x100109d9
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.10043480
mov byte [ebp - 0x49], 1
jmp 0x100109ef
mov byte [ebp - 0x49], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xc
call fcn.10006900
mov al, byte [ebp - 0x49]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f1763
mov esp, ebp
pop ebp
ret 4
Function at 0x10025c70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f6db7
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10126008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x38
mov dword [ebx], vtable.RC::RCBrowserProtectLogDbItemFactory.0
call fcn.100f1774
mov edi, eax
mov dword [ebp - 0x10], edi
push 0x38
push 0
push edi
mov dword [ebp - 4], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov ecx, edi
push dword [ebp + 8]
call fcn.100067b0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10006c00
mov dword [esi], eax
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 7
push 7
mov word [edi + 0x20], ax
push str.info_id
mov dword [ebx + 4], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10006990
push 1
push ecx
push 1
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
mov ecx, dword [ebx + 4]
push eax
push 0
call fcn.10033930
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10006900
push 8
xor eax, eax
mov dword [ebp - 0x18], 0
push str.log_type
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10006990
push 0
push ecx
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 3
mov ecx, dword [ebx + 4]
push eax
push 0
call fcn.10033930
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10006900
push 8
xor eax, eax
mov dword [ebp - 0x18], 0
push str.log_time
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10006990
mov dword [ebp - 4], 4
push 0
push ecx
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x28]
push 0
push eax
push 1
call fcn.10033930
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10006900
push 0xc
xor eax, eax
mov dword [ebp - 0x18], 0
push str.program_path
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10006990
push 0
push ecx
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 5
mov ecx, dword [ebx + 4]
push eax
push 2
call fcn.10033930
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10006900
push 0xb
xor eax, eax
mov dword [ebp - 0x18], 0
push str.target_path
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10006990
push 0
push ecx
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 6
mov ecx, dword [ebx + 4]
push eax
push 2
call fcn.10033930
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10006900
push 9
xor eax, eax
mov dword [ebp - 0x18], 0
push str.oper_type
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10006990
push 0
push ecx
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 7
mov ecx, dword [ebx + 4]
push eax
push 0
call fcn.10033930
lea ecx, [ebp - 0x28]
call fcn.10006900
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4