joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c4d1
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf84
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp eax, ebx
je 0x100c6b0
cmp esi, ebx
je 0x100c6b0
xor ecx, ecx
cmp cx, word [eax]
je 0x100c6b0
xor eax, eax
cmp ax, word [esi]
je 0x100c6b0
lea ecx, [ebp - 0x764]
call fcn.010103d7
push esi
lea ecx, [ebp - 0xf80]
call fcn.0100f4f8
push esi
push ebx
push 0x1002c8c
push 0x1002bf8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 4
jae 0x100c6b0
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x10039a8
lea eax, [ebp - 0xb6a]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x1003998
mov edi, 0x900
push edi
push ebx
push ebx
mov esi, 0x105
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.01011c3f
add esp, 0x24
test eax, eax
jl 0x100c6b0
lea eax, [ebp - 0x628]
push eax
call fcn.01010f56
test eax, eax
je 0x100c6b0
push 0x20a
lea eax, [ebp - 0x41c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
push 0x104
lea eax, [ebp - 0x41c]
push eax
push 0x10017d4
push 0x1003918
push 0x1002c64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp ax, word [ebp - 0x41c]
je 0x100c659
lea eax, [ebp - 0x41c]
push eax
push 0x1003984
push edi
push ebx
push ebx
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.01011c3f
add esp, 0x1c
test eax, eax
jl 0x100c6b0
lea eax, [ebp - 0xf84]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c6b0
push dword [ebp - 0xf84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x764]
call fcn.01010437
test eax, eax
je 0x100c65e
xor eax, eax
inc eax
jmp 0x100c6b2
lea eax, [ebp - 0x41c]
push eax
push 0x1003958
push edi
push ebx
push ebx
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.01011c3f
add esp, 0x1c
test eax, eax
jl 0x100c6b0
lea eax, [ebp - 0xf84]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c659
push dword [ebp - 0xf84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e410
leave
ret 8
Function at 0x100c9c0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe54
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xe54], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0xe50], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0xe4c], eax
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x628], ax
xor edi, edi
lea eax, [ebp - 0x626]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
push 0x105
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0xe48], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100cb0b
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
push 0x1001760
call esi
push 0x100390c
mov ebx, eax
call esi
add ebx, eax
lea eax, [ebp - 0x210]
push eax
call esi
lea esi, [eax + ebx + 1]
push esi
call sub.cmutil.dll_CmMalloc
mov dword [ebp - 0xe48], eax
pop ebx
cmp eax, edi
je 0x100cb0b
push 0x1001760
push 0x100390c
lea ecx, [ebp - 0x210]
push ecx
push 0x100186c
push 0x900
push edi
push edi
push esi
push eax
call fcn.01011c3f
add esp, 0x24
test eax, eax
jl 0x100cb0b
mov eax, dword [ebp - 0xe48]
cmp eax, edi
jne 0x100cad2
mov eax, 0x1001efc
push eax
push dword [ebp - 0xe4c]
push 0x1003a20
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0x10
push 1
push dword [ebp - 0xe48]
push dword [ebp - 0xe4c]
push edi
call fcn.010076d2
push dword [ebp - 0xe48]
call sub.cmutil.dll_CmFree
push dword [ebp - 0xe54]
mov esi, 0x105
push esi
lea eax, [ebp - 0x41c]
push eax
call fcn.01006852
test eax, eax
jne 0x100cb2e
xor eax, eax
jmp 0x100cbed
push dword [ebp - 0xe50]
lea ecx, [ebp - 0xe44]
call fcn.0100f4f8
lea eax, [ebp - 0xa2e]
push eax
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1003a04
push 0x900
push edi
push edi
lea eax, [ebp - 0x628]
push esi
push eax
call fcn.01011c3f
add esp, 0x24
test eax, eax
jl 0x100cb27
push 1
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x41c]
push eax
push edi
call fcn.010065f8
test eax, eax
je 0x100cb27
mov eax, dword [ebp - 0xe48]
cmp eax, edi
jne 0x100cb97
mov eax, 0x1001efc
push eax
push dword [ebp - 0xe4c]
push 0x1003a20
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0x10
push 1
push dword [ebp - 0xe48]
push dword [ebp - 0xe4c]
push edi
call fcn.010076d2
lea eax, [ebp - 0x628]
push eax
push dword [ebp - 0xe48]
push dword [ebp - 0xe4c]
push edi
call fcn.0100894d
push dword [ebp - 0xe48]
mov esi, eax
call sub.cmutil.dll_CmFree
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100e410
leave
ret 0xc
Function at 0x100d004
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x424]
push eax
push 0xf003f
xor edi, edi
push edi
push 0x1001660
push 0x80000002
mov dword [ebp - 0x420], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d15d
push esi
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x434]
push eax
push edi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 0x428], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, 0x104
jmp 0x100d132
cmp dword [ebp - 0x434], 1
jne 0x100d101
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0100c4d1
test eax, eax
je 0x100d101
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.0100c9c0
and dword [ebp - 0x420], eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.0100c6c8
push dword [ebp - 0x438]
and dword [ebp - 0x420], eax
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.0100cd81
and dword [ebp - 0x420], eax
inc dword [ebp - 0x428]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x434]
push eax
push 0
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x424]
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x430], esi
call edi
test eax, eax
je 0x100d094
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
jmp 0x100d16f
push 0x1003b18
push dword [0x10143ec]
call fcn.0100f2af
pop ecx
pop ecx
call fcn.01006f3b
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
pop edi
xor ecx, ebp
add eax, 0x80004005
pop ebx
call fcn.0100e410
leave
ret 8
Function at 0x100d19d
Capabilities:
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x63c], eax
lea eax, [ebp - 0x628]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x100d1dd
mov eax, 0x80004005
jmp 0x100d3df
push ebx
push edi
push 0x900
xor edi, edi
push edi
push edi
push 0x10014fc
push 0x105
lea eax, [ebp - 0x628]
push eax
call fcn.01011bb9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x62c]
push eax
push 0xf003f
push edi
push 0x1001660
push 0x80000002
call ebx
test eax, eax
jne 0x100d37f
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x640]
push eax
push edi
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 0x630], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x100d353
cmp dword [ebp - 0x640], 1
jne 0x100d322
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x63c]
call fcn.0100c9c0
test eax, eax
jne 0x100d2a6
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1003d98
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0x10
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x63c]
call fcn.0100c6c8
test eax, eax
jne 0x100d2e4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1003cc0
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0x10
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x63c]
call fcn.0100cd81
test eax, eax
jne 0x100d322
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1003c00
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0x10
inc dword [ebp - 0x630]
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x640]
push eax
push 0
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x630]
push dword [ebp - 0x62c]
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x634], esi
call edi
test eax, eax
je 0x100d25b
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x100d391
push 0x1003b18
push dword [0x10143ec]
call fcn.0100f2af
pop ecx
pop ecx
call fcn.01006f3b
lea eax, [ebp - 0x62c]
push eax
push 2
push edi
push 0x1003ba0
push 0x80000002
call ebx
cmp eax, edi
jle 0x100d3bc
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
pop edi
pop ebx
jl 0x100d3dd
push 0x1003b58
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100e410
leave
ret 4
Function at 0x100d3f3
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
and dword [esi + 4], 0
push 0x10041a8
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
push edi
xor ebx, ebx
inc ebx
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x100d432
xor eax, eax
jmp 0x100d52a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100d447
mov dword [esi + 4], ebx
jmp 0x100d528
push edi
push 0x1004148
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x100d482
push edi
push 0x10040e0
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi], 0
jmp 0x100d42b
push 0x1004088
push dword [0x10143ec]
call fcn.0100f2af
pop ecx
pop ecx
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100d511
cmp eax, 0x80
je 0x100d4d6
cmp eax, 0x102
je 0x100d4ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push 0x1004008
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0x10
jmp 0x100d475
push edi
push 0x1003fa8
jmp 0x100d467
push edi
push 0x1003f20
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x100d511
push edi
push 0x1003eb8
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x100d475
push edi
mov dword [esi + 4], ebx
push 0x1003e60
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x100d5c4
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x83c], eax
xor eax, eax
push 0x208
xor edi, edi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
mov dword [ebp - 0x838], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x210]
push eax
push 0xd2
push ebx
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
call ebx
push dword [ebp - 0x83c]
lea eax, [ebp - 0x41c]
push esi
push eax
push 0x10017d4
push 0x1002c74
push 0x1002c64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp ax, word [ebp - 0x41c]
je 0x100d6b5
push esi
lea eax, [ebp - 0x834]
push eax
push 0xca
push dword [ebp - 0x838]
call ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x834]
push eax
push 0x900
push edi
push edi
lea eax, [ebp - 0x628]
push 0x105
push eax
call fcn.01011c3f
add esp, 0x1c
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
sub edi, 6
neg edi
sbb edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e410
leave
ret 8
Function at 0x100d6cd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x105
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xa2c]
call fcn.0100f4f8
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x822]
push eax
push 0x10028fc
push 0x900
push 0
push 0
push dword [ebp + 0x10]
push esi
call fcn.01011c3f
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x20
push esi
call edi
push 0x5c
pop ecx
cmp cx, word [esi + eax*2 - 2]
jne 0x100d772
push esi
call edi
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100e410
leave
ret 0xc
Function at 0x100d787
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor edi, edi
push 0x57
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
pop esi
mov dword [ebp - 0x10], edi
cmp dword [ebp + 8], edi
je 0x100d8d1
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, edi
je 0x100d8d0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
je 0x100d854
push 0x5c
pop ecx
cmp cx, word [ebx + eax*2 - 2]
jne 0x100d854
lea ecx, [ebp + 0xc]
push ecx
xor esi, esi
inc esi
push esi
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp + 0xc], edi
call fcn.0100d596
cmp eax, edi
jl 0x100d800
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
push 2
pop ecx
mul ecx
push edx
push eax
call fcn.0100d564
cmp eax, edi
jge 0x100d821
push eax
push 0x1004310
push dword [0x10143ec]
mov esi, eax
and esi, 0xffff
call fcn.0100f2af
add esp, 0xc
jmp 0x100d8b5
push dword [ebp - 0xc]
call sub.cmutil.dll_CmMalloc
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100d850
push 0x900
push edi
push edi
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
push eax
call fcn.01007439
mov esi, eax
and esi, 0xffff
jne 0x100d8b5
jmp 0x100d857
push 8
jmp 0x100d8b4
mov dword [ebp - 4], ebx
lea eax, [ebp - 8]
push eax
push 0xf003f
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d8b2
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x100d8b2
cmp dword [ebp - 0x14], edi
jne 0x100d8ae
cmp dword [ebp + 0x10], edi
jne 0x100d89e
cmp dword [ebp - 0x18], edi
jne 0x100d8ae
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x100d8b5
push 0x50
jmp 0x100d8b4
push 2
pop esi
cmp dword [ebp - 8], edi
je 0x100d8c3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], edi
je 0x100d8d0
push dword [ebp - 4]
call sub.cmutil.dll_CmFree
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x100d8de
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push ebx
xor edi, edi
call fcn.0100fe1c
test eax, eax
je 0x100d9b3
xor eax, eax
push 0x20a
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x100
push esi
push esi
push ebx
push 0x105
lea eax, [ebp - 0x210]
push eax
call fcn.01007439
cmp eax, esi
jge 0x100d94c
movzx edi, ax
jmp 0x100d9b3
lea eax, [ebp - 0x210]
mov dword [ebp - 0x228], eax
mov eax, 0x414
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
push eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], 3
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x21e], esi
mov dword [ebp - 0x21a], esi
mov dword [ebp - 0x216], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, eax
cmp edi, esi
je 0x100d9b3
push edi
push 0x1004398
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e410
leave
ret 4
Function at 0x100e401
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x10123d0
call fcn.0100e8e4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1014c1c
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100e1b8
cmp eax, esi
jne 0x100e1ab
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100e1bb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100e192
xor esi, esi
inc esi
mov eax, dword [0x1014c18]
cmp eax, esi
jne 0x100e1ce
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100e1fd
mov eax, dword [0x1014c18]
test eax, eax
jne 0x100e1f7
mov dword [0x1014c18], esi
push 0x1001248
push 0x100123c
call fcn.0100e0f7
pop ecx
pop ecx
test eax, eax
je 0x100e1fd
jmp 0x100e325
mov dword [0x10148b4], esi
mov eax, dword [0x1014c18]
cmp eax, esi
jne 0x100e221
push 0x1001238
push 0x1001230
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1014c18], 2
test ebx, ebx
jne 0x100e22d
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1014c24], 0
je 0x100e251
push 0x1014c24
call fcn.0100e859
pop ecx
test eax, eax
je 0x100e251
push 0
push 2
push 0
call dword [0x1014c24]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100e2ad
test al, al
je 0x100e26b
cmp dword [ebp - 0x1c], 0
jne 0x100e2ad
mov al, byte [esi]
test al, al
je 0x100e27b
cmp al, 0x20
ja 0x100e27b
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100e26b
test byte [ebp - 0x3c], 1
je 0x100e287
movzx eax, word [ebp - 0x38]
jmp 0x100e28a
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x10148b0], eax
cmp dword [0x10148a4], 0
jne 0x100e301
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100e2bc
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x100e2cf
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100e258
cmp dword [0x10148b4], 0
jne 0x100e310
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10148b0]
jmp 0x100e331
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0100e929
ret
call fcn.0100ea31
jmp 0x100e158
Function at 0x100f321
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
inc ebx
and dword [ebp - 0x420], 0
mov eax, esi
push 2
mov dword [ebp - 0x424], ebx
lea ecx, [eax + 2]
pop edi
mov dx, word [eax]
add eax, edi
test dx, dx
jne 0x100f354
sub eax, ecx
sar eax, 1
cmp eax, edi
jbe 0x100f3b9
movzx ecx, word [esi + 2]
cmp cx, 0x3a
jne 0x100f383
xor ecx, ecx
cmp word [esi + 4], 0x5c
sete cl
inc ecx
mov dword [ebp - 0x420], ecx
jmp 0x100f3c6
cmp word [esi], 0x5c
jne 0x100f3c6
cmp cx, 0x5c
jne 0x100f3b1
xor edx, edx
mov ecx, edi
cmp eax, edi
jbe 0x100f4dc
cmp word [esi + ecx*2], 0x5c
jne 0x100f3a7
inc edx
cmp edx, edi
je 0x100f37b
inc ecx
cmp ecx, eax
jb 0x100f39b
jmp 0x100f4dc
mov dword [ebp - 0x420], ebx
jmp 0x100f3c6
cmp word [esi], 0x5c
jne 0x100f3c6
and dword [ebp - 0x420], 0
dec eax
mov dword [ebp - 0x428], eax
mov ebx, 0x208
mov edi, 0x105
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x428]
jae 0x100f3f8
inc dword [ebp - 0x420]
mov eax, dword [ebp - 0x420]
cmp word [esi + eax*2], 0x5c
jne 0x100f3d7
xor eax, eax
push ebx
push eax
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x100f4d5
xor eax, eax
push ebx
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x900
push 0
push 0
push esi
push edi
lea eax, [ebp - 0x210]
push eax
call fcn.01011b30
test eax, eax
jl 0x100f4d5
mov eax, dword [ebp - 0x420]
lea ecx, [eax + 1]
cmp ecx, edi
jae 0x100f4d5
xor ecx, ecx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x100f4aa
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x424], eax
test eax, eax
jne 0x100f4aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100f4dc
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x420], eax
jb 0x100f3d7
mov dword [ebp - 0x424], 1
jmp 0x100f4dc
and dword [ebp - 0x424], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x424]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e410
leave
ret 4