joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007b4a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10182f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 0
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x210], ebx
call fcn.10118ce0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1007b500
push esi
mov ecx, 0x18
mov esi, str.360ChromeChromeUser_DataDefault360Bookmarks
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
pop esi
cmp word [ebp - 0x20c], ax
jne 0x1007b53c
xor ecx, ecx
jmp 0x1007b554
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1007b545
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.100734f0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.101149a0
mov esp, ebp
pop ebp
ret
Function at 0x1007c460
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x278
mov eax, dword [0x10182f40]
xor eax, esp
mov dword [esp + 0x274], eax
push esi
push edi
push 0x32
lea eax, [esp + 0x24c]
mov dword [esp + 0x10], 0
mov edi, ecx
mov esi, edx
push 0
push eax
mov dword [esp + 0x14], edi
call fcn.10118ce0
push esi
lea eax, [esp + 0x258]
push str..PhysicalDrive_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [esp + 0x248]
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1007c50d
push 0
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], 0
push 0x1016d9aa
mov byte [edi], 0
call fcn.1006f560
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
push 0x228
lea eax, [esp + 0x14]
mov dword [esp + 0x240], 0
push 0
push eax
mov dword [esp + 0x24c], 0
mov dword [esp + 0x250], 0x380
call fcn.10118ce0
add esp, 0xc
mov dword [esp + 8], 0
lea eax, [esp + 8]
push 0
push eax
push 0x228
lea eax, [esp + 0x1c]
push eax
push 0xc
lea eax, [esp + 0x250]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
test eax, eax
jne 0x1007c583
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1016d9aa
jmp 0x1007c59e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x28]
cmp eax, 0x228
lea eax, [esp + eax + 0x10]
jb 0x1007c59d
mov eax, 0x1016d9aa
push eax
mov ecx, edi
call fcn.1006f290
mov ecx, dword [esp + 0x27c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret

Function at 0x100861b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013e066
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10182f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.101149b1
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10116177
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10087100
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013e51b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x10182f40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x12c], edx
mov edi, ecx
mov dword [ebp - 0x128], edi
xor ebx, ebx
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
push ebx
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push ebx
lea eax, [ebp - 0x124]
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push eax
call esi
test eax, eax
jne 0x100871a4
push 8
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push eax
lea eax, [ebp - 0x124]
push eax
call esi
test eax, eax
je 0x100871d2
lea eax, [ebp - 0x128]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push 0
test eax, eax
jne 0x100871eb
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
jmp 0x100872a1
push dword [ebp + 8]
push dword [ebp - 0x12c]
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10087273
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 0x12c], 0x104
push 0
push eax
call fcn.10118ce0
add esp, 0xc
lea eax, [ebp - 0x12c]
push 0
push eax
lea eax, [ebp - 0x114]
push eax
push 2
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x10087273
xor esi, esi
cmp dword [ebp - 0x12c], esi
jbe 0x10087273
lea eax, [ebp - 0x114]
add eax, esi
lea ecx, [ebp - 0x120]
push eax
call fcn.10077580
inc esi
cmp esi, dword [ebp - 0x12c]
jb 0x10087250
mov ebx, dword [ebp - 0x120]
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x11c]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x118]
mov dword [edi], ebx
mov dword [edi + 8], eax
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
call fcn.10077680
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
Function at 0x100872f0
Capabilities:
Get hostname
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013e572
mov eax, dword fs:[0]
push eax
sub esp, 0x3ac
mov eax, dword [0x10182f40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3ac], esi
mov dword [ebp - 0x3b0], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x3b8], esi
mov dword [esi + 0x10], 0
jb 0x1008735b
mov eax, dword [esi]
jmp 0x1008735d
mov eax, esi
mov byte [eax], 0
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x3b0], 1
call fcn.10118ce0
push 0x208
lea eax, [ebp - 0x31c]
push 0
push eax
call fcn.10118ce0
add esp, 0x18
mov dword [ebp - 0x3a4], 0x80
lea eax, [ebp - 0x3b4]
mov dword [ebp - 0x3a8], 0x44
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x3b4], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x1008747e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10087492
mov eax, dword [ebp - 0x3a4]
cmp eax, 0x80
jbe 0x10087492
push eax
call fcn.1011cfc7
add esp, 4
mov edi, eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x3a4]
push eax
push edi
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x10087473
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
push edi
call fcn.1011cd46
add esp, 4
jmp 0x10087492
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
mov edx, dword [ebp - 0x3a0]
test edx, edx
je 0x100874ce
cmp byte [edx], 0
jne 0x100874a5
xor ecx, ecx
jmp 0x100874b9
mov ecx, edx
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100874b0
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.1006f560
push dword [ebp - 0x3a0]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
Function at 0x100874f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10182f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, ecx
mov dword [ebp - 0xb], eax
push esi
push 5
lea eax, [ebp - 0xc]
mov byte [ebp - 0xc], 0x31
push 1
push eax
call fcn.101212e9
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push esi
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push 1
push eax
call fcn.101212e9
mov eax, dword [ebp + 0x1c]
add esp, 0x20
pop esi
cmp eax, 0x10
jb 0x1008754b
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.1006d540
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
Function at 0x10087560
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x10182f40]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov al, byte [esi + 8]
test al, al
jne 0x100875aa
push edi
push 1
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push 1
push eax
call fcn.101212e9
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
cmp al, 5
jne 0x100875e3
mov byte [esp + 0x18], 1
call fcn.10081330
push edi
test al, al
lea eax, [esp + 0x1c]
push 2
push 1
push eax
setne byte [esp + 0x29]
call fcn.101212e9
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
cmp al, 1
jne 0x100875f3
mov byte [esp + 0x18], 0x12
call fcn.10081130
jmp 0x1008760e
cmp al, 2
jne 0x10087636
push str.ErrorType
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, esi
mov byte [esp + 0x18], 0x12
call fcn.100811e0
push edi
push 5
mov dword [esp + 0x21], eax
lea eax, [esp + 0x20]
push 1
push eax
call fcn.101212e9
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
cmp al, 4
jne 0x1008765f
sub esp, 0x18
push esp
call fcn.10081020
mov ecx, edi
call fcn.100874f0
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
cmp al, 3
jne 0x100876a7
call fcn.10081290
movsd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
push edi
mov dword [esp + 0x1d], eax
mov eax, dword [esp + 0x18]
push 9
mov dword [esp + 0x25], eax
lea eax, [esp + 0x20]
push 1
push eax
mov byte [esp + 0x28], 0x22
call fcn.101212e9
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
cmp al, 7
jne 0x100876c2
call fcn.10087730
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
cmp al, 6
jne 0x10087710
mov byte [esp + 0x18], 0x52
call fcn.100813a0
push edi
push 5
mov dword [esp + 0x21], eax
lea eax, [esp + 0x20]
push 1
push eax
call fcn.101212e9
add esp, 0x10
mov ecx, esi
xor ebx, ebx
call fcn.100813a0
test eax, eax
je 0x10087710
push ebx
mov ecx, esi
call fcn.10081530
mov edx, edi
mov ecx, eax
call fcn.10087560
mov ecx, esi
inc ebx
call fcn.100813a0
cmp ebx, eax
jb 0x100876f3
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
Function at 0x10087730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013e5a8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10182f40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.10081a40
push eax
lea ecx, [ebp - 0x30]
call fcn.100883c0
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x100877c8
push dword [ebp - 0x24]
mov edx, dword [ebp - 0x38]
push ecx
call fcn.100778e0
mov ecx, dword [ebp - 0x34]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x3c]
add esp, 8
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.10077830
mov ecx, dword [ebp - 0x2c]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x30]
sub ecx, esi
imul ecx
push ebx
sar edx, 2
lea eax, [ebp - 0x18]
mov edi, edx
mov byte [ebp - 0x18], 0x51
push 5
shr edi, 0x1f
add edi, edx
push 1
push eax
mov dword [ebp - 0x17], edi
call fcn.101212e9
add esp, 0x10
test edi, edi
je 0x10087895
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
call fcn.1006f660
mov eax, dword [ebp - 0x38]
push ebx
push 5
mov dword [ebp - 0x1f], eax
lea eax, [ebp - 0x20]
push 1
push eax
mov byte [ebp - 0x20], 0x31
call fcn.101212e9
cmp dword [ebp - 0x34], 0x10
lea eax, [ebp - 0x48]
push ebx
push dword [ebp - 0x38]
cmovae eax, dword [ebp - 0x48]
push 1
push eax
call fcn.101212e9
mov eax, dword [ebp - 0x34]
add esp, 0x20
cmp eax, 0x10
jb 0x10087867
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.1006d540
cmp dword [esi + 0x14], 0x10
jb 0x10087871
mov eax, dword [esi]
jmp 0x10087873
mov eax, esi
push ecx
mov ecx, dword [ebp - 0x24]
push eax
call fcn.10081710
mov edx, ebx
mov ecx, eax
call fcn.10087560
add esi, 0x18
sub edi, 1
jne 0x10087801
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x100878c7
push dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
push ecx
mov ecx, esi
call fcn.100778e0
mov ecx, dword [ebp - 0x28]
mov eax, 0x2aaaaaab
sub ecx, esi
add esp, 8
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.10077830
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
Function at 0x100878f0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013e5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10182f40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp word [esi], ax
jne 0x10087942
xor ecx, ecx
jmp 0x10087954
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10087945
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.100734f0
push 4
push 0x1016e564
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.10073e70
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 0x1016e570
cmovae eax, dword [ebp - 0x40]
push eax
call fcn.1011ccd1
mov edi, eax
add esp, 8
test edi, edi
je 0x10087aeb
mov edx, edi
mov ecx, ebx
call fcn.10087730
push edi
call fcn.1011c569
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea edx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x40]
call fcn.10076ce0
push dword [ebp - 0x18]
call fcn.1011cfc7
push dword [ebp - 0x18]
mov edi, eax
push 0
push edi
call fcn.10118ce0
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x5c]
push edi
call fcn.100882a0
xor eax, eax
mov dword [ebp - 0x44], 7
add esp, 0x1c
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
cmp word [esi], ax
jne 0x10087a1b
xor ecx, ecx
jmp 0x10087a2f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10087a20
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x58]
call fcn.100734f0
push 2
push 0x101758b0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.10073e70
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
push 0x1016e570
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.1011ccd1
mov esi, eax
add esp, 8
test esi, esi
je 0x10087a80
push esi
push dword [ebp - 0x18]
push 1
push edi
call fcn.101212e9
push esi
call fcn.1011c569
add esp, 0x14
push edi
call fcn.1011cd46
add esp, 4
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x44]
cmp eax, 8
jb 0x10087ab0
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.1006f7f0
xor eax, eax
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
cmp eax, 0x10
jb 0x10087ad9
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.1006d540
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x10087b00
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.1006f7f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
Function at 0x10088090
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013e6e6
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x10182f40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x234], ebx
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x244], 0
push 0
push eax
call fcn.10118ce0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x10088116
mov eax, dword [ecx]
jmp 0x10088118
mov eax, ecx
push 0x32
push str.E46AC5FDFAFCE904ED75C9EAB8D9E72CD95AE8FDFEFCF334CC
mov byte [eax], 0
call fcn.1006f560
lea ecx, [ebp - 0x230]
call fcn.1010b1a0
add esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - method.Sc_Convert.virtual_0], vtable.Sc_Convert.0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x230]
cmp dword [ebp - 0x21c], 0x10
lea ecx, [ebp - 0x240]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.10077a90
mov edx, eax
mov esi, eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10088182
lea edi, [ebp - 0x218]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100881a0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
call fcn.10076eb0
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100881d0
mov ecx, 6
mov esi, str.Preferences
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movsw word es:[edi], word [esi]
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov word [ebx], ax
cmp word [ebp - 0x218], ax
jne 0x1008820a
xor ecx, ecx
jmp 0x10088222
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10088213
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.100734f0
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x10088246
push 1
push eax
call fcn.101149e4
add esp, 8
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x1008825b
push 2
push eax
call fcn.101149e4
add esp, 8
mov ecx, dword [ebp - 0x21c]
cmp ecx, 0x10
jb 0x10088279
inc ecx
push ecx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x230]
call fcn.1006d540
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101149a0
mov esp, ebp
pop ebp
ret
Function at 0x100882a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, edx
mov edx, dword [ebp + 0xc]
test edx, edx
jle 0x1008832a
mov eax, dword [ebp + 8]
sub ebx, eax
push esi
mov dword [ebp - 8], ebx
push edi
lea ebx, [eax - 1]
nop dword [eax]
inc byte [ecx + 0x100]
mov edi, edx
movzx esi, byte [ecx + 0x100]
inc ebx
mov dword [ebp - 4], ebx
movzx eax, byte [esi + ecx]
add byte [ecx + 0x101], al
movzx edx, byte [ecx + 0x101]
mov bl, byte [esi + ecx]
movzx eax, byte [edx + ecx]
mov byte [esi + ecx], al
mov byte [edx + ecx], bl
movzx eax, byte [ecx + 0x100]
movzx edx, byte [ecx + 0x101]
mov ebx, dword [ebp - 4]
movzx eax, byte [eax + ecx]
add al, byte [edx + ecx]
mov edx, dword [ebp - 8]
movzx eax, al
mov al, byte [eax + ecx]
xor al, byte [ebx + edx]
mov edx, dword [ebp + 0xc]
dec edx
mov byte [ebx], al
mov dword [ebp + 0xc], edx
cmp edi, 1
jne 0x100882c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp + 0xf]
pop ebx
mov esp, ebp
pop ebp
ret