joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18fd1f1
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
test eax, eax
je 0x18fd20a
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x18fd279
push ebx
push 0x190a9b8
call dword [sym.imp.Kernel32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x18fd278
push esi
push 0x190aab4
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x18fd277
call fcn.018fcffe
cmp eax, 0xffffffff
je 0x18fd277
push eax
push 1
push 1
call esi
mov esi, eax
test esi, esi
jne 0x18fd262
push 0x190aad4
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
je 0x18fd277
push esi
call eax
push 0x190aaa0
push ebx
call dword [sym.imp.Kernel32.dll_GetProcAddress]
test eax, eax
je 0x18fd277
push 0
push esi
call eax
pop esi
pop ebx
leave
ret

Function at 0x18feb7a
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
push ebx
push ebx
push ecx
push 0x18febb6
push dword fs:[0]
mov dword fs:[0], esp
mov ebx, 0
mov eax, 1
invalid

Function at 0x18fec03
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
and dword [ebp - 0xc], 0
push 0x190a9b8
call dword [sym.imp.Kernel32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x18fec24
jmp 0x18fec99
push 0x190aad4
push dword [ebp - 4]
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x18fec3d
jmp 0x18fec99
push ebx
push ecx
push edx
push 0x18fec81
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
pop dword fs:[0]
add esp, 4
cmp ebx, 0x564d5868
sete byte [ebp - 0xc]
pop edx
pop ecx
pop ebx
jmp 0x18fec8e
cmp dword [ebp - 0xc], 1
jne 0x18fec99
push 0
call dword [ebp - 8]
pop ebx
leave
ret

Function at 0x18ff040
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x18ff05d
shr eax, 1
xor eax, 0xedb88320
jmp 0x18ff05f
shr eax, 1
dec edx
test edx, edx
jg 0x18ff050
mov dword [ebp + ecx*4 - 0x400], eax
inc ecx
cmp ecx, 0x100
jl 0x18ff04b
or eax, 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x18ff09f
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
dec dword [ebp + 0xc]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [ebp + edx*4 - 0x400]
inc ecx
cmp dword [ebp + 0xc], 0
jne 0x18ff080
not eax
leave
ret
Function at 0x18ff277
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push esi
push edi
push 0x190a9b8
call dword [sym.imp.Kernel32.dll_LoadLibraryA]
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x18ff3df
push 0x190aa48
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x18ff3df
push ebx
push 0x190b180
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov ebx, eax
cmp ebx, edi
je 0x18ff3de
push 0x190b174
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x18ff3de
push 0x190b168
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x18ff3de
push 0x190ab0c
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x18ff3de
push 0x190aad4
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp eax, edi
je 0x18ff3de
push 0x190b15c
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x18ff3de
push 0x190b150
push esi
call dword [sym.imp.Kernel32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x18ff3de
call fcn.018feff1
push 0x104
lea ecx, [ebp - 0x124]
push ecx
push eax
call dword [ebp - 4]
test eax, eax
je 0x18ff3de
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x124]
push eax
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x18ff3de
push edi
push ebx
call dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x18ff3de
push eax
push edi
call dword [ebp - 0x1c]
mov esi, eax
cmp esi, edi
je 0x18ff3de
push edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
push esi
push ebx
call dword [ebp - 0xc]
push ebx
call dword [ebp - 0x10]
mov eax, dword [ebp + 8]
push dword [ebp - 4]
add eax, esi
mov ebx, dword [eax]
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
push esi
mov dword [esi + eax], edi
call fcn.018ff040
pop ecx
pop ecx
push esi
cmp eax, ebx
jne 0x18ff3d7
call dword [ebp - 8]
jmp 0x18ff3de
call dword [ebp - 8]
push edi
call dword [ebp - 0x14]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10002cf0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x10002d31
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.10003fc0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100048e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002e7b7
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x1004234c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xa0], 8
lea eax, [esi + 0x8c]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x1000492d
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
push eax
push edi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x10004a76
xor eax, eax
mov dword [ebp - 0x814], 7
push eax
push 0x10031468
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
call fcn.10007770
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.1001a520
push edi
lea eax, [ebp - 0x810]
push 0x10031628
push eax
call fcn.100079d0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [esi + 5], 0
mov ecx, esi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x100049c5
call fcn.10004750
mov esi, eax
jmp 0x100049cc
call fcn.100048b0
mov esi, eax
lea eax, [ebp - 0x828]
cmp eax, esi
je 0x10004a19
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x100049f4
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10007870
xor eax, eax
mov dword [ebp - 0x814], 7
push esi
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], eax
mov word [ebp - 0x828], ax
call fcn.10007160
mov eax, dword [ebp - 0x82c]
cmp eax, 8
jb 0x10004a37
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.10007870
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.1001c727
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10004a74
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10007870
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017646
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004aa0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002e802
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x1004234c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], 0
call fcn.1001a520
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10004b23
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10004b69
mov eax, dword [esi]
jmp 0x10004b6b
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0x810], cx
je 0x10004b91
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004b82
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10007770
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x834], 1
jb 0x10004bbb
mov eax, dword [esi]
jmp 0x10004bbd
mov eax, esi
mov ecx, ebx
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10004be6
test dx, dx
je 0x10004be2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10004be6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10004bc0
xor eax, eax
jmp 0x10004beb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10004c52
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x10004c27
call fcn.10004750
push eax
mov ecx, esi
call fcn.100045a0
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x10004c52
inc ecx
push ecx
jmp 0x10004c41
call fcn.100048b0
push eax
mov ecx, esi
call fcn.100045a0
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10004c52
inc eax
push eax
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.10007870
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017646
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10005e50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x1004234c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.1001a520
lea eax, [esi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10005e87
mov eax, dword [eax]
push str.Config
push eax
lea eax, [ebp - 0x20c]
push 0x10031560
push eax
call fcn.100079d0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10005ec1
lea eax, [ebp - 0x20c]
push eax
call fcn.1000c770
add esp, 4
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1001a520
push str.UseVestige.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push str._s_s
push eax
call fcn.100079d0
add esp, 0x1c
cmp word [ebp - 0x414], 0
jne 0x10005f02
xor ecx, ecx
jmp 0x10005f1f
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005f10
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
push eax
lea ecx, [esi + 0x8c]
call fcn.10007770
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.1001a520
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push str._s_s
push eax
call fcn.100079d0
add esp, 0x1c
cmp word [ebp - 0x61c], 0
jne 0x10005f73
xor ecx, ecx
jmp 0x10005f8f
lea ecx, [ebp - 0x61c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005f80
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x61c]
push eax
lea ecx, [esi + 0xa4]
call fcn.10007770
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.1001a520
lea eax, [ebp - 0xa44]
push str.OdPath
push eax
call fcn.1000cf80
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x10005fd1
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x100315b8
push eax
call fcn.100079d0
mov eax, dword [ebp - 0xa30]
add esp, 0xc
cmp eax, 8
jb 0x10006004
inc eax
lea ecx, [ebp - 0xa44]
push eax
push dword [ebp - 0xa44]
call fcn.10007870
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10006024
lea eax, [ebp - 0x824]
push eax
call fcn.1000c770
add esp, 4
push 0x208
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.1001a520
push str.UseCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push str._s_s
push eax
call fcn.100079d0
add esp, 0x1c
cmp word [ebp - 0xa2c], 0
jne 0x10006065
xor ecx, ecx
jmp 0x1000607f
lea ecx, [ebp - 0xa2c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006070
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [esi + 0xbc]
call fcn.10007770
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10017646
mov esp, ebp
pop ebp
ret
Function at 0x1000c770
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000c781
sub ecx, edx
mov edx, 2
sar ecx, 1
mov dword [ebp - 8], ecx
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100176ad
add esp, 4
mov dword [ebp + 8], eax
sub eax, esi
movzx ecx, word [esi]
lea esi, [esi + 2]
mov word [eax + esi - 2], cx
test cx, cx
jne 0x1000c7b4
call fcn.100163e0
test al, al
je 0x1000c7e6
push eax
push esp
push edx
push edi
pop edx
pop esp
pop edi
push eax
push ebx
push esp
pop esi
pop ecx
pop ebx
push esp
push edi
push ebp
push edx
pop ebp
push esp
push ecx
pop edi
push edi
pop ecx
push ecx
pop ebx
call fcn.100164c0
test al, al
je 0x1000c805
pop eax
pop edx
push esi
pop ebp
pop ebp
pop ebp
push eax
pop ebp
push edi
pop eax
pop ecx
push edx
push ebp
pop esp
pop eax
pop ecx
pop ebp
pop ecx
pop ebp
pop esi
pop ebp
push eax
call fcn.10016840
test al, al
je 0x1000c821
push esi
push ecx
push esi
push edi
push esp
pop edx
push esi
push ebp
pop ecx
pop eax
pop ebx
pop edi
push ebx
push esi
push esp
pop esi
pop edx
push esp
pop edx
mov eax, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea esi, [ebx + 1]
test eax, eax
js 0x1000c8cb
mov esi, dword [ebp + 8]
cmp word [esi + ebx*2], 0x5c
jne 0x1000c8ba
call fcn.10016760
test al, al
je 0x1000c865
push ecx
push esp
push esi
push ebx
push edx
pop esi
pop ebx
pop esp
pop edi
pop eax
pop esi
pop edx
pop esp
pop esi
pop esp
pop ebp
push ebx
pop edi
pop edx
pop ebx
pop esi
push eax
pop ecx
push ebx
mov ebx, dword [ebp - 4]
mov esi, dword [ebp + 8]
call fcn.10016760
test al, al
je 0x1000c892
push edi
pop ecx
push ecx
pop esi
push ebx
pop ebp
push edx
pop esp
pop esi
push edx
pop ebx
push ecx
push esp
pop ebp
pop edi
pop edi
pop ebp
pop edi
pop esp
pop ecx
push edx
pop edx
push ecx
push esp
pop eax
pop ebp
push esp
push eax
push esp
pop edi
mov ebx, dword [ebp - 4]
mov esi, dword [ebp + 8]
movzx edi, word [esi + ebx*2]
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000c8b3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1000c8df
mov eax, dword [ebp - 8]
mov word [esi + ebx*2], di
inc ebx
mov dword [ebp - 4], ebx
cmp ebx, eax
jle 0x1000c837
mov esi, 1
push dword [ebp + 8]
call fcn.100172f4
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
xor esi, esi
call fcn.100172f4
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cdc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004234c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10043298], 0
push ebx
push esi
push edi
je 0x1000ce22
call fcn.100165a0
test al, al
je 0x1000cdf9
pop ebx
pop esi
pop esi
push esi
pop eax
push esi
push eax
pop edx
push ecx
pop ecx
pop ebx
push edi
push ebx
pop ebx
push esi
pop esp
pop ebp
call fcn.10016b50
test al, al
je 0x1000cf67
pop edi
pop ecx
pop ebx
pop edx
pop esi
pop ebp
push esi
push edi
pop edi
push edi
pop edx
push ebx
push esi
pop eax
pop ebp
push ebp
push edi
push ebx
pop esi
pop edi
push ecx
push eax
pop ebx
jmp 0x1000cf67
call fcn.10016610
test al, al
je 0x1000ce49
push edi
push edi
push ebp
pop edi
push esi
pop ebx
pop ecx
push ecx
push edi
push esp
pop ecx
pop esi
pop esp
push esi
pop esi
push ecx
push esi
pop edi
pop esi
pop ebp
push edx
push eax
pop edx
pop edx
push edi
push edx
push edi
push esi
pop ebp
pop esi
call fcn.10016990
test al, al
je 0x1000ce66
push esp
pop esp
push esp
pop edx
push edx
pop edi
pop edi
pop eax
push ebx
push ecx
pop ecx
push ebx
push ebx
pop edi
pop ebp
pop ebx
push ecx
push edi
pop ebp
push edi
call fcn.100168b0
test al, al
je 0x1000ce8e
pop esi
pop esp
pop edi
push edx
push ecx
push edi
push edi
pop ecx
push eax
push ebx
push ebp
push eax
push eax
pop ebx
push esp
pop ecx
push esp
pop ecx
pop ebx
push esp
pop edx
pop edx
push ecx
pop edi
pop edi
push ebp
pop esi
pop esi
push ebx
pop eax
pop esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1001a520
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000cefe
lea eax, [ebp - 0x20c]
push eax
call fcn.1001f1ab
lea eax, [ebp - 0x20c]
push str.config_systemprofile
push eax
call fcn.1001a72d
add esp, 0xc
test eax, eax
jne 0x1000cef7
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.1001a72d
add esp, 8
test eax, eax
je 0x1000cefe
mov byte [0x10043298], 1
call fcn.100161b0
test al, al
je 0x1000cf25
push ebp
pop ebp
pop edi
push edx
pop ebx
push esi
pop ecx
pop edi
pop edi
pop esp
pop eax
push ecx
push ecx
pop esi
push edi
push edx
push esi
pop esp
push eax
pop ebp
push edi
push esi
pop ecx
pop ebp
pop eax
push esp
pop ecx
pop edi
pop eax
pop esp
call fcn.10016060
test al, al
je 0x1000cf42
pop esi
pop ebx
pop ecx
pop edx
pop edx
push eax
pop ebp
pop ebp
push esi
push ebp
push ebx
pop edx
push edx
push esp
pop edx
push edi
pop ebx
pop edx
pop ecx
push ecx
call fcn.10016ae0
test al, al
je 0x1000cf67
push eax
pop edi
pop edi
pop ecx
push edx
pop edx
push eax
push esi
pop esi
pop eax
push esi
push edx
push edi
push ebp
pop esi
push esi
pop ecx
push ebp
pop esp
push edx
push ecx
pop edi
pop esp
pop edi
pop ebp
push ebp
push ecx
push esi
mov ecx, dword [ebp - 4]
mov al, byte [0x10043298]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10017646
mov esp, ebp
pop ebp
ret
Function at 0x1000d570
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov byte [ebp - 4], 0
call fcn.1000cdc0
test al, al
je 0x1000d639
call fcn.100166f0
test al, al
je 0x1000d5b3
push edi
push ebx
pop edx
pop esi
push ebx
push eax
push eax
push edi
push esi
pop ecx
push ebx
pop ebx
pop esi
pop edx
push ecx
pop ecx
push esp
pop edi
push esp
pop edx
push ebp
push ebp
push eax
push ebx
pop esi
push edx
pop eax
push edx
pop ecx
push ecx
push esi
pop ebp
call fcn.100167d0
test al, al
je 0x1000d5ce
pop esi
push ebx
pop eax
pop ebp
pop eax
push esp
push ecx
push edx
pop ebp
push eax
push esp
push ebx
push ebx
push esi
push ebp
pop ecx
pop ecx
push esp
call fcn.100160d0
test al, al
je 0x1000d5e9
push esi
pop ebp
pop edx
push ebx
push esp
pop ebx
pop ecx
pop edi
pop edx
pop eax
push ebx
push ebx
push edx
push edx
push edi
push edx
pop ebp
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call fcn.1000cc30
add esp, 4
test al, al
je 0x1000d639
push dword [ebp + 0xc]
push 1
push dword [ebp - 8]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ebx, dword [ebp - 4]
test eax, eax
mov eax, 1
movzx ebx, bl
cmove ebx, eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
jne 0x1000d67d
call fcn.10015ff0
test al, al
je 0x1000d658
pop ebp
push esp
pop eax
push esi
push esi
pop ebp
push ebx
pop eax
push esp
push ebp
pop ebp
push edi
push edi
push eax
pop esi
pop esp
pop ebp
pop esi
push eax
pop ebx
push ebx
pop edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edx, dword [ebp - 4]
test eax, eax
movzx ecx, dl
mov eax, 1
cmovne ecx, eax
mov byte [ebp - 4], cl
call fcn.10016220
test al, al
je 0x1000d69d
pop edx
push ebx
push edx
push ecx
push esi
push ebp
pop esi
push edx
push esp
push ecx
pop esi
pop eax
pop ebx
push eax
pop ebp
push edx
pop edx
push eax
pop ebp
push ebx
push ecx
pop ebx
push ebx
call fcn.10015ff0
test al, al
je 0x1000d6bc
pop ebp
pop esp
push edi
push eax
push ebp
push edx
pop edi
push edx
pop ebp
push esi
push ecx
pop edi
pop esp
pop edi
pop eax
pop esi
pop ebx
pop esi
pop esi
pop esi
push edx
pop esi
call fcn.100164c0
test al, al
je 0x1000d6e5
push edi
pop edx
push edi
pop esi
pop ecx
push esi
pop esi
push eax
push ecx
pop esp
pop ecx
pop eax
pop ebp
pop ecx
push ebx
pop ebp
pop ecx
push eax
pop edi
push ebp
push ecx
pop ecx
push ebx
push esi
pop esi
push esi
push ecx
pop esi
pop edi
pop eax
pop esi
push eax
mov edx, dword [ebp - 4]
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028e5d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10028b1d
Function at 0x113b3f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1140494]
cmp dword [eax + 0x28], 0
jne 0x113b408
xor eax, eax
jmp 0x113b537
mov ecx, dword [0x1140414]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x1140408], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x1140404], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1140408]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x1140404]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x114048c]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x113f604
push 0x113f620
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x1140400], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.0113b330
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x113b3c0
mov edx, dword [0x1140494]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x114040c], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x113b537
cmp dword [ebp - 0x38], 0x12
jne 0x113b52b
mov dword [0x114041c], 0
call fcn.0113b540
xor eax, eax
jmp 0x113b537
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x113b4fc
mov esp, ebp
pop ebp
ret 4

Function at 0x113c840
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]