joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509c0c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x509cb8
cmp dword [ebx + 0x98], 0
jne 0x509cb2
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x509b44
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x509cb2
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x509c78
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x509cb2
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00444968
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x509c87
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x509ed8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5a3300]
cmp dword [eax + 0x178], 0
je 0x50a03d
test bl, bl
jne 0x509f8b
cmp dword [esi + 0xa0], 0
jne 0x509f80
mov eax, esi
call fcn.0050cdd4
push eax
push 0x509de4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x509f51
mov eax, dword [0x5a3300]
cmp byte [eax + 0xd7], 0
je 0x509f51
mov eax, dword [esi + 0xdc]
call fcn.00408990
mov edi, eax
cmp edi, 0
jl 0x509f51
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x509f3a
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x509f80
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00444968
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x509f60
inc dword [esi + 0xa0]
jmp 0x50a03d
cmp dword [esi + 0xa0], 0
jle 0x50a03d
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x50a03d
cmp dword [esi + 0x48], 0
je 0x509fe8
mov eax, dword [0x5a3300]
cmp byte [eax + 0xd7], 0
je 0x509fe8
mov eax, dword [esi + 0xdc]
call fcn.00408990
mov edi, eax
cmp edi, 0
jl 0x509fe8
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x509fd1
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x50a017
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00444968
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x509ff7
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x4fbfd0]
call fcn.00408b3c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x50ac90
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb0], 0
je 0x50acfb
cmp byte [ebx + 0xd7], 0
jne 0x50acfb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x178]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406dc0
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x50ace8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x50ad08
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00407018
jmp 0x50ad08
mov eax, esi
mov edx, dword [ebx + 0x90]
call fcn.00407018
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x50c540
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x50c5ae
mov eax, esi
call fcn.0048e6bc
test al, al
je 0x50c5ae
mov eax, dword [ebx + 0x88]
call fcn.0048e308
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x50c5ae
mov eax, dword [ebx + 0x88]
mov edx, dword [eax]
call dword [edx + 0x108]
test al, al
je 0x50c5a2
push 0
mov eax, dword [ebx + 0x88]
call fcn.0048e308
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x88]
call fcn.00485124
jmp 0x50c5ae
mov cl, 1
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.0050c378
pop esi
pop ebx
ret
Function at 0x510d08
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x510d82
mov eax, dword [ebx + 8]
call fcn.0048e308
mov ecx, eax
mov dl, 1
mov eax, dword [0x49a154]
call fcn.0048872c
mov esi, eax
mov dword [ebx + 0x8c], esi
xor edx, edx
mov eax, esi
call fcn.0049e7ec
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x510600
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0048e308
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0048e308
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x510df8
mov eax, dword [ebx + 8]
call fcn.0048e308
mov ecx, eax
mov dl, 1
mov eax, dword [0x49a154]
call fcn.0048872c
mov esi, eax
mov dword [ebx + 0x9c], esi
mov dl, 1
mov eax, esi
call fcn.0049e7ec
mov dword [esi + 0x2a4], ebx
mov dword [esi + 0x2a0], 0x51064c
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0048e308
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0048e308
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x510e64
mov eax, dword [ebx + 8]
call fcn.0048e308
mov ecx, eax
mov dl, 1
mov eax, dword [0x49ab90]
call fcn.0048872c
mov esi, eax
mov dword [ebx + 0x94], esi
mov eax, esi
mov byte [eax + 0x278], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0048e308
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0048e308
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x525ec8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x525ff0
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00525db4
mov eax, dword [esi]
call fcn.00408988
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x418b70]
call fcn.00408b3c
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00404780
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00404780
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00408988
mov dword [ebp - 0xc], eax
mov eax, dword [0x59dbb0]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.00514f9c
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00404b00
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00408988
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.00514f78
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.00514d30
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.00514f94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525ff7
lea eax, [ebp - 4]
mov edx, dword [0x418b70]
call fcn.00408b48
ret

Function at 0x551eb8
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.00407968
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x551edd
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.004077ec
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x551efc
mov eax, ebx
mov edx, dword [esp]
call fcn.00407968
pop ecx
pop edx
pop ebx
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7d5e00fa
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x31c42e5e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x5a0463
Capabilities:
Parse pe header

Disassembly:
call 0x5a0463
rol byte [edi - 0x4972dbcc], 1
invalid
jne 0x5a0beb
jmp 0x5a05cd
push ebx
jmp 0x5a08b4
call dword [0x5a0244]
js 0x5a04c4
jns 0x5a04c4
dec esi
pop edi
jb 0x5a0c0d
jmp 0x5a07f8
push esp
jmp 0x5a0998
adc dl, dl
jmp 0x5a0ab1
pushal
jmp 0x5a054f
mov dword [0x5a0240], 1
jmp 0x5a0735
jne 0x5a0ab1
jmp 0x5a0c59
jmp 0x5a04c4
ret
push ebp
jmp 0x5a09b2
add dl, dl
jmp 0x5a066a
push edi
jmp 0x5a045d
jmp 0x5a0a52
sub esp, 0xc
jmp 0x5a0bde
call 0x5a099f
push ecx
mov ecx, 0x8d242c87
lodsd eax, dword [esi]
test dword [eax], eax
add byte [eax], al
xchg dword [esp], ebp
jmp 0x5a0943
push esi
jmp 0x5a08cf
inc esi
jmp 0x5a0567
call 0x5a0a58
xchg dword cs:[esp], eax
lea eax, [eax - 0x4db]
xchg dword [esp], eax
jmp 0x5a057c
ret
push eax
jmp 0x5a04ff
cmp dword [0x5a0240], 0
jmp 0x5a0477
mov eax, dword [esp + 0x10]
jmp 0x5a0b1e
call 0x5a0c14
fcom dword [esi - 0x72dbc379]
mov edi, 0xfffffd5c
xchg dword [esp], edi
jmp 0x5a08bd
mov dl, byte [esi]
jmp 0x5a09ee
Function at 0x402390
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.00404120
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x808], ecx
mov edx, dword [ebp - 0x808]
push edx
mov eax, dword [ebp + 8]
push eax
push 0x400
lea ecx, [ebp - 0x804]
push ecx
call fcn.00402800
mov dword [ebp - 0x808], 0
push 0x41569c
push 0x400
lea edx, [ebp - 0x804]
push edx
call fcn.004027a0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040351b
mov esp, ebp
pop ebp
ret

Function at 0x402420
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
push str.WmGpLaunch
mov eax, dword [ebp + 8]
push eax
call fcn.00402650
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x402470
push str.WmGpLaunch
mov edx, dword [ebp + 8]
push edx
push 0x41576c
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402c50
add esp, 0x14
mov al, 1
jmp 0x4025a5
push 0x208
push 0
lea edx, [ebp - 0x20c]
push edx
call fcn.00404120
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.00404120
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push str._s.
lea edx, [ebp - 0x20c]
push edx
call fcn.00402160
add esp, 0xc
push 0x250
push 0
lea eax, [ebp - 0x664]
push eax
call fcn.00404120
add esp, 0xc
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0xffffffff
je 0x402573
mov eax, dword [ebp - 0x664]
and eax, 0x10
je 0x402547
lea ecx, [ebp - 0x638]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00402650
add esp, 8
movzx eax, al
test eax, eax
je 0x402547
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x638]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_s
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00402c50
add esp, 0x14
mov al, 1
jmp 0x4025a5
lea eax, [ebp - 0x664]
push eax
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40256e
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x402573
jmp 0x4024e4
push 0x415804
mov eax, dword [ebp + 8]
push eax
call fcn.00402650
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4025a3
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406e76
add esp, 0xc
mov al, 1
jmp 0x4025a5
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040351b
mov esp, ebp
pop ebp
ret
Function at 0x402650
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x40267d
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
movzx eax, word [edx + ecx]
cmp eax, 0x2e
jne 0x402684
xor al, al
jmp 0x40278c
push 0x208
push 0
lea ecx, [ebp - 0x28c]
push ecx
call fcn.00404120
add esp, 0xc
mov edx, 2
imul eax, edx, 0
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax]
test edx, edx
jne 0x4026c7
mov eax, dword [ebp + 8]
push eax
push str._sConfigConfig.ini
lea ecx, [ebp - 0x28c]
push ecx
call fcn.00402160
add esp, 0xc
jmp 0x4026e3
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s_sConfigConfig.ini
lea ecx, [ebp - 0x28c]
push ecx
call fcn.00402160
add esp, 0x10
mov dword [ebp - 0x290], 0xffffffff
push 0x80
push 0
lea edx, [ebp - 0x84]
push edx
call fcn.00404120
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
push 0x40
lea ecx, [ebp - 0x84]
push ecx
push 0x415728
push str.Patcher
push 0x41573c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x28c]
push edx
push 0xffffffffffffffff
push str.GameID
push str.GENERAL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x290], eax
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x84]
test edx, edx
je 0x402764
cmp dword [ebp - 0x290], 0xffffffff
jne 0x402768
xor al, al
jmp 0x40278c
mov eax, dword [ebp - 0x290]
push eax
lea ecx, [ebp - 0x28c]
push ecx
lea edx, [ebp - 0x84]
push edx
push str._WmglLauncher__Find_Patcher___s__in_dir__s___gid___d
call fcn.00402390
add esp, 0x10
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040351b
mov esp, ebp
pop ebp
ret
Function at 0x10001350
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [0x1001b25c]
test eax, eax
je 0x100013c6
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [0x1001b24c]
test eax, eax
je 0x100013c6
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x100013c6
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x100013b4
mov edx, esi
cmp edi, ebx
jb 0x100013be
add edx, ebx
cmp edi, edx
jbe 0x100013d0
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x100013a6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x10002e40
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10019d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x1001b8b4
mov edi, dword [0x1001b190]
lea eax, [esi + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0
call edi
lea ecx, [esi + 0x10]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov edi, dword [0x1001b16c]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x2c]
mov edi, dword [0x1001b158]
push ecx
call edi
mov edx, dword [esi + 0x30]
push edx
call edi
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x10002eb7
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.1000d030
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10005540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.1000bba0
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x10005594
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x10005563
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10006470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
add edx, 0x14
mov edx, dword [edx]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x100064b1
mov esi, dword [edx + 0x28]
mov edi, dword [ebp + 8]
mov bx, word [esi]
mov bh, byte [edi]
cmp bl, 0x5a
jg 0x100064a5
cmp bl, 0x41
jl 0x100064a5
add bl, 0x20
cmp bl, bh
jne 0x10006484
inc esi
inc esi
inc edi
test bx, bx
jne 0x10006493
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006770
Capabilities:
Create directory

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x10006783
xor eax, eax
pop esi
add esp, 8
ret
push ebp
push edi
push str.zart7wp
call dword [0x1001b258]
push str.ZvFvtiodioDngkld
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [0x1001b134]
mov edi, dword [0x1001b1b0]
push esi
push 0
push 0x451
mov ebp, eax
call edi
test eax, eax
mov dword [esp + 0x18], eax
jne 0x100067e3
push esi
push eax
push 0x450
call edi
test eax, eax
mov dword [esp + 0x18], eax
je 0x10006875
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x10006854
lea ecx, [esp + 0xc]
push ecx
push 0xf01ff
push eax
call dword [0x1001b094]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 1
push 3
push 0
push 0x2000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
add esi, 4
push 0x19d
push esi
push 0
push edx
call fcn.10019b9e
call dword [0x1001b180]
push 0x1a1
push esi
push esi
call dword [0x1001b2b0]
mov eax, dword [esp + 0xc]
push eax
call dword [0x1001b158]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10006875
test ebp, ebp
je 0x10006875
push 1
push 0
lea ecx, [esp + 0x20]
push 0x1f0fff
push ecx
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
call ebp
mov eax, dword [esp + 0x18]
push 0
push eax
call dword [0x1001b1ac]
mov edx, dword [esp + 0x18]
mov esi, eax
push edx
call dword [0x1001b158]
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 8
ret
Function at 0x100068a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x410
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [esp + 0x418]
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push 3
push 0
push ecx
push 0x80000002
call dword [0x1001b060]
test eax, eax
je 0x100068e6
xor al, al
pop edi
add esp, 0x410
ret
push ebx
push ebp
lea edx, [esp + 0x10]
push esi
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x42c]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], 0x400
mov byte [esp + 0x2b], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x10006a08
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x42c]
test eax, eax
lea esi, [esp + 0x20]
jbe 0x10006966
mov ebx, dword [0x1001b320]
push ebp
push esi
call ebx
add esp, 8
test eax, eax
je 0x1000699e
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
mov eax, dword [esp + 0x14]
dec ecx
lea esi, [esi + ecx + 1]
mov ecx, esi
sub ecx, edx
cmp ecx, eax
jb 0x1000693b
cmp dword [esp + 0x430], 1
jne 0x10006a70
lea esi, [esp + eax + 0x1f]
push ebp
push esi
call dword [0x1001b140]
mov edi, dword [0x1001b12c]
push esi
call edi
push esi
mov byte [eax + esi + 1], 0
call edi
mov edx, dword [esp + 0x14]
lea ecx, [edx + eax + 1]
jmp 0x10006a48
mov eax, dword [esp + 0x430]
test eax, eax
jne 0x10006a70
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
or edx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x14]
mov edi, esi
not ecx
dec ecx
sub edx, ecx
or ecx, 0xffffffff
add eax, edx
mov dword [esp + 0x14], eax
sub eax, esi
lea eax, [esp + eax + 0x21]
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + esi + 1]
push ecx
push esi
call dword [0x1001b364]
mov ecx, dword [esp + 0x20]
add esp, 0xc
cmp ecx, 3
jae 0x10006a4c
mov ecx, dword [esp + 0x428]
mov edx, dword [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
jmp 0x10006a69
cmp dword [esp + 0x430], 1
jne 0x10006a70
mov edi, dword [esp + 0x42c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
inc ecx
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x42c]
push eax
push 7
push 0
push ecx
push edx
call dword [0x1001b06c]
test eax, eax
sete byte [esp + 0x13]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov al, byte [esp + 0x13]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x410
ret