joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d538
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062b77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001d6d2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001d6ba
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x2c], 0x1777
mov dword [ebp - 0x3c], str.bevgrll_ftbfezj_qrfw_nplci
cmp dword [ebp - 0x2c], 0x19fe
jle 0x1001d63d
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
and dword [ebp - 0x20], 0
jmp 0x1001d5c0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7339
jge 0x1001d63d
and dword [ebp - 0x24], 0
jmp 0x1001d5d6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5c7c
jge 0x1001d638
and dword [ebp - 0x18], 0
jmp 0x1001d5ec
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5a0b
jge 0x1001d636
and dword [ebp - 0x1c], 0
jmp 0x1001d602
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2cca
jge 0x1001d634
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
or eax, ecx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0x1007d818
call fcn.1000513b
jmp 0x1001d5fb
jmp 0x1001d5e5
jmp 0x1001d5cf
jmp 0x1001d5b9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x16c0
jge 0x1001d65d
mov edx, dword [ebp - 0x3c]
mov ecx, 0x1007d818
call fcn.100077d7
jmp 0x1001d679
or dword [ebp - 4], 0xffffffff
jmp 0x1001d683
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
jmp 0x1001d6a5
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [ebp - 0x28]
cmp dword [eax], 3
jg 0x1001d6b8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0x90a23371
jmp 0x1001d69a
jmp 0x1001d6d0
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1001d6d0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1001d6ea
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 1
push 0x682e
call fcn.1001736c
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001eb40
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001ebf3
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001ebbd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001ebbb
push 0x2d6f
push 0x1765
push 0x2b5e
push 1
push 0x2c13
push 0x769
push 0x2ffa
push 0x5489
push 0x7af1
push 0x4345
push 0x5e54
push 0x4083
push 0x3c38
push 1
push 0x3635
call fcn.1001d09a
add esp, 0x3c
jmp 0x1001ebf1
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1001ebf1
push 0
push 0x13aa
push 0x56e
push 0x792
push 0x212b
push 0xf66
push 0x2703
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x1001ec46
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0xc]
push 0x2e97
push 0
push 0x438e
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.1001d7b3
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x10023a85
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
je 0x10023ac4
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push eax
push ecx
mov edx, 0x7b3d
mov ecx, 0x73d0
call fcn.1002479d
pop ecx
pop ecx
jmp 0x10023b91
mov dword [esp + 0x1c], 0x4ef1
cmp dword [esp + 0x1c], 0x5019
jle 0x10023b5a
xor edi, edi
xor ebx, ebx
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x18], 0x3a5d
mov dword [esp + 0x14], ecx
lea eax, [ebx + edi]
sar eax, cl
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10023b09
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.100058e2
mov ecx, dword [esp + 0x14]
add ecx, esi
dec dword [esp + 0x18]
mov dword [esp + 0x14], ecx
jne 0x10023aee
inc esi
cmp esi, 0x7661
jl 0x10023ae0
inc ebx
cmp ebx, 0x4dc6
jl 0x10023ade
inc edi
cmp edi, 0x70e0
jl 0x10023adc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x1c], 0x4b79
jge 0x10023b6f
push str.coyzg_gvzeb_yau_bal_eqstjlo_obs_utaxy_kvwdfi_rtrj_fapzizxa_oauklpyz_lryptp_uooyty
call fcn.100497ec
pop ecx
mov esi, dword [ebp + 8]
jmp 0x10023b8b
mov ecx, dword [ebx]
lea eax, [ecx + 2]
mov dword [ebx], eax
call fcn.10023879
movzx eax, ax
mov ecx, edi
push eax
call fcn.100141fc
mov eax, dword [ebx]
cmp eax, dword [esi]
jb 0x10023b74
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002549b
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov dword [ebp - 4], 0x397a
mov eax, ecx
cmp dword [ebp - 4], 0x3b2a
push esi
push edi
mov dword [ebp - 8], eax
jle 0x100254fd
xor esi, esi
xor edi, edi
mov ebx, 0x4e92
mov eax, edi
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100254d9
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.100058e2
add edi, esi
dec ebx
jne 0x100254c2
inc esi
cmp esi, 0x61f4
jl 0x100254bb
mov eax, dword [ebp - 8]
cmp byte [ebp + 0x14], 0
je 0x1002550c
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [ecx], eax
jmp 0x10025539
cmp byte [eax], 0
je 0x10025539
push 0
push 0x13aa
push 0x56e
push 0x792
push 0x212b
push 0xf66
push 0x2703
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [ebp - 4], 0x37a8
jge 0x1002554d
push str.pzmu_fmu_hlk_ovsi_kbjreexfa_jbgewnmzt
call fcn.100497ec
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027a74
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x10062e0f
call fcn.10061878
sub esp, 0xc
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x18], esi
je 0x10027be5
test dl, dl
je 0x10027bc0
mov dword [ebp + 0x18], 0x70fd
cmp dword [ebp + 0x18], 0x7441
jle 0x10027adb
xor ebx, ebx
xor esi, esi
mov eax, esi
mov ecx, 0x1007d818
and eax, ebx
cdq
push edx
push eax
call fcn.1000513b
inc esi
cmp esi, 0x263b
jl 0x10027ab5
inc ebx
cmp ebx, 0x7641
jl 0x10027ab3
mov esi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0x6f4f
jge 0x10027b16
mov edx, str.ughckj_fwp_timfj_xxtp_oyntqj_eyexmuv_owgron_mwhsw
mov ecx, 0x1007d818
call fcn.100077d7
jmp 0x10027b16
or dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x18], 0x6587
cmp dword [ebp + 0x18], 0x684f
jle 0x10027b61
xor ebx, ebx
xor esi, esi
mov eax, esi
mov ecx, 0x1007d818
and eax, ebx
cdq
push edx
push eax
call fcn.1000513b
inc esi
cmp esi, 0x57fd
jl 0x10027b2e
inc ebx
cmp ebx, 0x38d1
jl 0x10027b2c
push 0
push 0x1697
call dword [sym.imp.USER32.dll_MapDialogRect]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], 2
cmp dword [ebp + 0x18], 0x61c5
jge 0x10027b9f
mov edx, str.lzacxzuot_nblcem_tutbgg_jismbeq_maj_sfqfu_gvns_pieak_xwwayu
mov ecx, 0x1007d818
call fcn.100077d7
jmp 0x10027b9f
mov dword [esi], 0
cmp dword [esi], 0
jl 0x10027c0c
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
cmp dword [eax + ecx*4], 0
jne 0x10027c0c
dec dword [esi]
cmp dword [esi], 0
jge 0x10027bad
jmp 0x10027c0c
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10027c0c
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x10027bd1
jmp 0x10027c0c
cmp byte [ebp + 0x14], 0
je 0x10027bfd
mov byte [ebp + 0x1b], 0
cmp byte [ebp + 0x1b], 0
je 0x10027c0c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10027c0c
push 0x314
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10027ca4
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 8], 0
push esi
je 0x10027ccb
cmp byte [edx], 0
je 0x10027cf1
push 0
push 0xc73
push 0
push 0x1532
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x10027cf1
mov esi, dword [ebp + 0x10]
mov dword [esi], 0xa
jmp 0x10027cec
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10027cea
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc dword [esi]
cmp dword [esi], 0x11
jl 0x10027cd6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10027cf6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
mov byte [esp + 4], dl
mov bl, cl
mov dword [esp + 0x14], 0x7007
cmp dword [esp + 0x14], 0x7206
push esi
push edi
jle 0x10027d7a
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10027d3a
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.100058e2
inc edi
cmp edi, 0x4a1d
jl 0x10027d1e
inc esi
cmp esi, 0x252d
jl 0x10027d1c
push 0x244a
push 0x1f43
push 0x5fb
push 0xefc
call dword [sym.imp.USER32.dll_CheckRadioButton]
test bl, bl
je 0x10027dbb
cmp byte [esp + 0xc], 0
je 0x10027d9d
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10027e84
xor cl, cl
call fcn.100281eb
jmp 0x10027e84
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10027e84
push 0x59a
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10027e84
mov dword [esp + 0x18], 0x5f20
cmp dword [esp + 0x18], 0x5f3d
jle 0x10027e4a
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esp + 0x10], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
lea ecx, [esp + 0x38]
or eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10027e02
mov eax, dword [eax]
push eax
call fcn.100497ec
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.100058e2
inc esi
cmp esi, 0x4213
jl 0x10027de4
inc ebx
cmp ebx, 0x2486
jl 0x10027de2
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x7297
jl 0x10027dd9
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x270f
jl 0x10027dd3
cmp dword [esp + 0x18], 0x5dc6
jge 0x10027e5f
push str.wxijhxldg_duaszyji_yglc_nnslgefm_lpthmcm_exwkooxxg_lzlhcx_ibmqrwqwp_algqafcnk_ytz_amdt_ofqpara
call fcn.100497ec
pop ecx
cmp byte [ebp + 0x10], 0
je 0x10027e7c
push 0x1992
xor eax, eax
push eax
push eax
push 0x22b5
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x10027e84
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [esp + 0x1c], 0x6ef2
jge 0x10027e99
push str.hni_ipoup_kwam_mxdrfxw_xuivujdug_wlwvr_qxoxe
call fcn.100497ec
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d7f9
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002d825
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.1002dc54
add esp, 0xc
jmp 0x1002d8a1
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002d86d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xc7555b7c
mov eax, dword [ebp - 0x28]
mov dword [eax], 0xc7555b7c
jmp 0x1002d8a1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002d8a1
push 0
push 0x13aa
push 0x56e
push 0x792
push 0x212b
push 0xf66
push 0x2703
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret

Function at 0x1002e98c
Capabilities:
Compare security identifiers
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002e9e0
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002e9b6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1002e9de
push 0
push 0x13aa
push 0x56e
push 0x792
push 0x212b
push 0xf66
push 0x2703
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x1002e9fc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call fcn.1002e127
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100331ce
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
movzx eax, byte [ebp + 0x3c]
test eax, eax
je 0x100332e7
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100332d8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10033288
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff8
jl 0x100332d6
mov dword [ebp - 0x54], 0x86992f1e
mov dword [ebp - 0x48], 0xfffffff9
push dword [ebp - 0x44]
push 0
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x4c]
push 0x71bc
push dword [ebp - 0x50]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 4]
push dword [ebp - 0x60]
push 0x6d33
push 0x3247
call fcn.100357aa
add esp, 0x34
jmp 0x1003327d
jmp 0x100332e5
push 0x59a
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10033335
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x64], eax
push dword [ebp - 0x64]
push 0x65ee
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push 1
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
call fcn.10030635
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x1003335b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063194
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100334e4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100334c0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x28], 0x4a1a
mov dword [ebp - 0x34], str.jpwkcqa_vqhpsccfk_eyd_see_amnzbyrar_wuokflxc_gulnvv_exl_jsxwuuh_qxv_qcs_cqw
cmp dword [ebp - 0x28], 0x4a9b
jle 0x1003346d
and dword [ebp - 0x18], 0
jmp 0x100333d5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x49cf
jge 0x1003346d
and dword [ebp - 0x1c], 0
jmp 0x100333ef
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2dc0
jge 0x10033468
and dword [ebp - 0x20], 0
jmp 0x10033405
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x45bc
jge 0x10033466
and dword [ebp - 0x24], 0
jmp 0x1003341b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x6f90
jge 0x10033464
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1000511b
push eax
call fcn.100497ec
pop ecx
lea ecx, [ebp - 0x74]
call fcn.10005111
jmp 0x10033414
jmp 0x100333fe
jmp 0x100333e8
jmp 0x100333ce
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10033482
push 0x59a
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x46a7
jge 0x10033498
push dword [ebp - 0x34]
call fcn.100497ec
pop ecx
jmp 0x100334b4
or dword [ebp - 4], 0xffffffff
jmp 0x100334be
jmp 0x100334e2
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100334fe
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
mov cl, 1
call fcn.1002d782
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40129f
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b5c0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5c4]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], eax
call fcn.00401298
mov ebx, dword [ebp - 0x10]
mov eax, dword [0x41b5c8]
add ebx, 0x23f
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5cc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov ecx, dword [0xae34e4]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132c
push 0x418300
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebp - 4]
mov ecx, dword [0xae34e4]
add eax, dword [ebp - 0x28]
mov edx, 0xedeb2e40
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
mov eax, dword [0xae34e0]
cmove eax, edx
xor edx, edx
mov dword [0xae34e0], eax
cmp ecx, 0x3eb
mov eax, dword [0xae3438]
cmove eax, edx
mov dword [0xae3438], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], edx
mov dword [0xae34dc], 0xf4ea3dee
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
mov dword [ebp - 0x18], esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
nop
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 4]
add ebx, 0x61c88647
shr edx, cl
add edx, dword [ebp - 0x34]
mov dword [ebp - 0xc], edx
xor edx, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x10], ebx
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
jne 0x4012fa
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret