joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004fcba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov dword [ebp - 0x10], edx
mov edi, ecx
mov esi, dword [ecx]
mov ebx, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov eax, ebx
mov edx, ecx
lock cmpxchg8b qword [esi + 0x58]
xor edx, ecx
xor eax, ebx
or eax, edx
jne 0x1004fcc8
mov eax, dword [ebp + 8]
cmp eax, ebx
mov ebx, dword [ebp + 0xc]
mov eax, ebx
sbb eax, ecx
mov eax, dword [edi + 8]
mov edx, dword [edi]
mov esi, dword [edi + 4]
jae 0x1004fd0c
xor edi, edi
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
push edi
push edi
push eax
push esi
call fcn.1004fdca
add esp, 0x10
mov eax, ebx
jmp 0x1004fd21
mov edi, dword [ebp - 0x10]
mov ecx, edi
push ebx
push dword [ebp + 8]
push eax
push esi
call fcn.1004fdca
add esp, 0x10
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1005399a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 0x58]
mov edi, dword [ecx + 0x5c]
mov eax, ebx
mov edx, edi
mov ecx, edi
mov esi, dword [ebp - 0x10]
lock cmpxchg8b qword [esi + 0x58]
mov ecx, dword [ebp - 0x10]
xor edx, edi
xor eax, ebx
or eax, edx
jne 0x100539ae
mov edx, dword [ebp + 0xc]
mov esi, dword [edx + 0x40]
mov ecx, dword [edx + 0x44]
cmp esi, ebx
mov eax, ecx
sbb eax, edi
jb 0x100539ab
add esi, dword [edx + 0x38]
adc ecx, 0
mov eax, ebx
mov edx, edi
mov ebx, esi
mov esi, dword [ebp - 0x10]
lock cmpxchg8b qword [esi + 0x58]
mov eax, dword [ebp + 0xc]
jne 0x100539ab
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov eax, dword [ecx + 0x70]
mov dword [ebp - 0x18], eax
mov edi, dword [ecx + 0x74]
mov ebx, eax
add ebx, dword [ebp - 0x14]
mov ecx, edi
adc ecx, 0
mov edx, edi
lock cmpxchg8b qword [esi + 0x70]
mov ecx, dword [ebp - 0x10]
xor edx, edi
xor eax, dword [ebp - 0x18]
or eax, edx
jne 0x10053a03
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005469a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov esi, edx
mov edx, dword [ebp + 8]
mov eax, dword [0x1008e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx + 4]
cmp byte [eax + 0xd], 0
mov dword [ebp - 0x1c], esi
jne 0x100547c1
mov dword [ebp - 0x18], ecx
mov ecx, dword [edx]
mov esi, dword [edx + 0x10]
mov dword [ebp - 0x3c], esi
mov esi, dword [edx + 0x14]
mov dword [ebp - 0x40], esi
cmp esi, 0x10
mov dword [ebp - 0x30], ecx
cmovae edx, ecx
mov dword [ebp - 0x20], edx
mov edi, dword [ebp - 0x3c]
mov ebx, eax
add eax, 0x10
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x24]
mov dword [ebp - 0x34], edx
cmp edx, 0x10
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], ecx
cmovae eax, ecx
mov esi, dword [ebx + 0x20]
cmp esi, edi
mov ecx, edi
cmovb ecx, esi
push ecx
push eax
push dword [ebp - 0x20]
call fcn.10078566
add esp, 0xc
xor edx, edx
cmp edi, esi
setb dl
xor ecx, ecx
test eax, eax
sets cl
cmove ecx, edx
mov eax, ecx
xor al, 1
movzx eax, al
mov eax, dword [ebx + eax*8]
cmp byte [eax + 0xd], 0
je 0x100546e7
mov dword [ebp - 0x20], esi
mov edx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ebx
test cl, cl
jne 0x100547c8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp + 8]
mov eax, esi
mov esi, edx
mov ecx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x20]
cmp ecx, 0x10
mov edx, dword [ebp - 0x30]
cmovb edx, ebx
cmp dword [ebp - 0x34], 0x10
cmovae esi, dword [ebp - 0x38]
cmp eax, edi
mov ecx, esi
mov esi, eax
mov eax, edi
cmovb eax, esi
push eax
push edx
push ecx
call fcn.10078566
add esp, 0xc
xor ecx, ecx
cmp edi, esi
setb cl
xor edx, edx
test eax, eax
sets dl
cmove edx, ecx
cmp dl, 1
je 0x100547df
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
xor eax, eax
mov byte [esi + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100375ba
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14], ecx
mov ebx, ecx
jmp 0x100547ce
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp ebx, dword [ecx]
jne 0x100547fc
mov ecx, dword [ebp - 0x2c]
mov edx, esi
push dword [ebp + 8]
push ebx
push 1
jmp 0x100547f0
movzx eax, byte [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x1c]
mov edx, esi
push ebx
push dword [ebp - 0x24]
push eax
call fcn.1005484a
add esp, 0xc
mov al, 1
jmp 0x100547aa
mov dword [ebp - 0x24], ebx
lea esi, [ebp - 0x14]
mov ecx, esi
call fcn.10054a4a
mov edi, dword [esi]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ebp - 0x30], eax
mov eax, dword [ecx + 0x10]
mov ebx, ecx
mov ecx, dword [ecx + 0x14]
lea esi, [edi + 0x10]
mov edx, dword [edi + 0x10]
mov dword [ebp - 0x38], edx
mov edx, edi
mov edi, dword [edi + 0x20]
mov dword [ebp - 0x18], edx
mov edx, dword [edx + 0x24]
mov dword [ebp - 0x34], edx
mov dl, 1
mov dword [ebp - 0x28], edx
jmp 0x10054763
Function at 0x1005abaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, ecx
call fcn.1003bd1a
mov ebx, dword [edi + 0x58]
mov esi, dword [edi + 0x5c]
mov eax, ebx
mov edx, esi
mov ecx, esi
lock cmpxchg8b qword [edi + 0x58]
xor edx, esi
xor eax, ebx
or eax, edx
jne 0x1005abba
mov eax, dword [edi + 0x60]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x64]
mov dword [ebp - 0x14], eax
cmp byte [edi + 0x38], 0
je 0x1005abf6
mov dword [edi + 0x30], 0
add edi, 0x18
push edi
call dword [0x1008bee0]
xor ebx, dword [ebp - 0x10]
xor esi, dword [ebp - 0x14]
or esi, ebx
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005b68a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1008e00c]
xor eax, ebp
mov dword [esp + 0x30], eax
test ecx, ecx
jne 0x1005b6cb
push dword [esi]
push 0
call fcn.1004e44a
add esp, 8
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.100375ba
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea edi, [esp + 0x10]
push edi
call fcn.1005b33a
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov eax, dword [edi + 0x18]
mov ecx, dword [esi]
sub eax, edx
jne 0x1005b6ef
push ecx
jmp 0x1005b6ac
push ecx
push eax
call fcn.1004e44a
add esp, 8
mov ecx, dword [esi]
mov ebx, 8
lea eax, [esp + 8]
push ebx
push eax
call fcn.1004e55a
mov ecx, dword [esi]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
push eax
push edi
call fcn.10056d9a
mov ecx, dword [esi]
mov eax, dword [esi + 4]
movsd xmm0, qword [eax + 0x68]
mov eax, esp
movsd qword [eax], xmm0
push ebx
push eax
call fcn.1004e55a
mov edi, dword [esi]
mov esi, dword [esi + 4]
mov ebx, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
mov eax, ebx
mov edx, ecx
lock cmpxchg8b qword [esi + 0x70]
xor edx, ecx
xor eax, ebx
or eax, edx
jne 0x1005b738
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov ecx, edi
push 8
lea eax, [esp + 4]
push eax
call fcn.1004e55a
jmp 0x1005b6b6
Function at 0x1005bfda
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor eax, eax
cmp byte [ecx + 0x40], 0
je 0x1005bfeb
pop esi
pop edi
pop ebp
ret
cmp dword [ecx + 0x10], 0
je 0x1005c085
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
jb 0x1005bfff
mov eax, dword [ecx]
xor esi, esi
mov edx, esi
movzx edi, byte [eax]
rol esi, 5
xor esi, edi
imul esi, esi, 0x9e3779b9
inc eax
test edi, edi
jne 0x1005c001
imul eax, edx, 0x9e3779b9
movzx edx, byte [ecx + 0x18]
rol eax, 5
xor eax, edx
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [ecx + 0x20]
imul eax, eax, 0x9e3779b9
rol eax, 5
imul eax, eax, 0x9e3779b9
mov edx, eax
rol edx, 5
xor edx, dword [ecx + 0x28]
imul edx, edx, 0x9e3779b9
cmp byte [ecx + 0x2c], 0
cmove edx, eax
mov eax, edx
rol eax, 5
xor eax, dword [ecx + 0x30]
imul eax, eax, 0x9e3779b9
cmp byte [ecx + 0x34], 0
cmove eax, edx
cmp byte [ecx + 0x3c], 0
je 0x1005bfe7
rol eax, 5
xor eax, dword [ecx + 0x38]
imul eax, eax, 0x9e3779b9
jmp 0x1005bfe7
xor eax, eax
jmp 0x1005c01c
Function at 0x1005d07a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov edi, edx
mov esi, ecx
mov eax, dword [0x1008e00c]
xor eax, ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], ecx
call fcn.1003bd1a
mov ebx, dword [esi + 0x3c]
test ebx, ebx
je 0x1005d1cb
mov dword [esp + 8], edi
mov eax, dword [ebx]
mov edi, dword [eax + 0x1c]
mov ecx, edi
call dword [section..00cfg]
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call edi
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.1004de1a
mov edi, dword [esi + 0x44]
test edi, edi
mov ebx, esi
mov dword [esp + 4], esi
je 0x1005d1d3
lea esi, [ebx + 0x44]
lea ebx, [esp + 0x18]
push 1
push ebx
call fcn.10021dea
add esp, 8
movsd xmm0, qword [ebx + 0x10]
movsd qword [edi + 0x30], xmm0
movups xmm0, xmmword [ebx]
movups xmmword [edi + 0x20], xmm0
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x1005d1b1
mov ecx, dword [esi]
mov dword [esi], 0
mov dword [esp + 0x10], ecx
mov ebx, dword [esp + 4]
lea eax, [ebx + 0x48]
test ecx, ecx
jne 0x1005d1c0
mov ecx, dword [eax]
mov dword [eax], 0
mov dword [esp + 0x10], ecx
mov esi, dword [ebx + 0x3c]
mov eax, dword [esi]
mov edi, ebx
mov ebx, dword [eax + 0x20]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
call ebx
mov ebx, dword [edi + 0x50]
mov ecx, dword [edi + 0x54]
mov dword [edi + 0x64], ecx
mov dword [edi + 0x60], ebx
mov esi, dword [esp + 4]
mov eax, dword [esi + 0x58]
mov dword [esp + 0xc], eax
mov edi, dword [esi + 0x5c]
mov edx, edi
lock cmpxchg8b qword [esi + 0x58]
xor edx, edi
xor eax, dword [esp + 0xc]
or eax, edx
jne 0x1005d15c
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 8]
mov dword [edi], eax
mov esi, dword [esp + 0x14]
cmp byte [esi + 0x38], 0
je 0x1005d19c
mov dword [esi + 0x30], 0
add esi, 0x18
push esi
call dword [0x1008bee0]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.100375ba
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call fcn.1004e40a
mov ecx, dword [esp + 0x10]
jmp 0x1005d117
push eax
call fcn.1004e40a
jmp 0x1005d136
mov dword [edi], 0
jmp 0x1005d185
mov ecx, dword [esp + 0x10]
jmp 0x1005d11f
Function at 0x10008210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x10117d48]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x428], ecx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x420]
push edx
mov ecx, dword [ebp - 0x428]
call sym.ser.dll_protected:_void___thiscall_CRc4Op::RC4Init_struct_CRc4Op::_tagRc4Key___unsigned_char___int_
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x41c]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x418]
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x10], 0
jmp 0x10008273
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jge 0x100082f7
mov edx, dword [ebp - 0xc]
add edx, 1
movzx eax, dl
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x424]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 4]
movzx edx, cl
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x424]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax*4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x424]
mov edx, dword [ebp - 4]
mov dword [ecx + eax*4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x14]
movzx ecx, al
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
mov edx, dword [ebp - 0x424]
xor eax, dword [edx + ecx*4]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov byte [ecx], al
jmp 0x1000826a
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1008efb4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10008410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d5650
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x10117d48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x27c], 0xff
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x284], 1
mov ecx, dword [ebp + 0x14]
call fcn.10008dd0
mov ecx, dword [ebp + 0x10]
call fcn.10008dd0
call fcn.10024ec0
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x288], 0
jmp 0x10008489
mov eax, dword [ebp - 0x288]
add eax, 1
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x68]
add ecx, 1
cmp dword [ebp - 0x288], ecx
jge 0x10008673
cmp dword [ebp - 0x288], 0
jle 0x100084b6
mov edx, dword [ebp - 0x284]
or edx, 0x100
mov dword [ebp - 0x284], edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.10024250
add esp, 8
mov dword [ebp - 0x290], eax
lea edx, [ebp - 0x278]
push edx
mov eax, dword [ebp - 0x284]
push eax
push 0
mov ecx, dword [ebp - 0x290]
call fcn.100030a0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x280], eax
lea ecx, [ebp - 0x2c]
call fcn.10003030
cmp dword [ebp - 0x280], 0
je 0x1000850e
jmp 0x1000847a
mov ecx, dword [ebp + 0x14]
call fcn.10002d60
movzx edx, al
test edx, edx
je 0x100085c4
mov dword [ebp - 0x27c], 0x208
push 0x208
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.10092830
add esp, 0xc
lea ecx, [ebp - 0x27c]
push ecx
lea edx, [ebp - 0x274]
push edx
lea eax, [ebp - 0x6c]
push eax
push 0
push str.InstallTime
mov ecx, dword [ebp - 0x278]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x28c], eax
movzx edx, word [ebp - 0x274]
test edx, edx
je 0x100085c4
push 0
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x48]
push ecx
call fcn.10024dc0
add esp, 0xc
mov dword [ebp - 0x294], eax
mov edx, dword [ebp - 0x294]
mov dword [ebp - 0x298], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x298]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.10001ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100018b0
mov dword [ebp - 0x27c], 0x208
push 0x208
push 0
lea ecx, [ebp - 0x274]
push ecx
call fcn.10092830
add esp, 0xc
lea edx, [ebp - 0x27c]
push edx
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push 0
push str.Channel
mov edx, dword [ebp - 0x278]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx eax, word [ebp - 0x274]
test eax, eax
je 0x10008661
push 0
lea ecx, [ebp - 0x274]
push ecx
lea edx, [ebp - 0x64]
push edx
call fcn.10024dc0
add esp, 0xc
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x2a0]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.10001ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.100018b0
mov edx, dword [ebp - 0x278]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000847a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008efb4
mov esp, ebp
pop ebp
ret
Function at 0x100086a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x10117d48]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x298], 0
xor eax, eax
mov word [ebp - 0x290], ax
push 0x206
push 0
lea ecx, [ebp - 0x28e]
push ecx
call fcn.10092830
add esp, 0xc
push 0x104
lea edx, [ebp - 0x290]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1000871f
push 0x5c
lea eax, [ebp - 0x290]
push eax
call fcn.10008fc0
add esp, 8
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
je 0x1000871f
xor ecx, ecx
mov edx, dword [ebp - 0x294]
mov word [edx], cx
push str.Version.ini
lea eax, [ebp - 0x290]
push eax
call fcn.10008df0
add esp, 8
xor ecx, ecx
mov word [ebp - 0x88], cx
push 0x7e
push 0
lea edx, [ebp - 0x86]
push edx
call fcn.10092830
add esp, 0xc
lea eax, [ebp - 0x290]
push eax
push 0x80
lea ecx, [ebp - 0x88]
push ecx
push 0
push str.VERSION
push str.ROOT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10024dc0
add esp, 0xc
mov ecx, dword [ebp - 0x298]
or ecx, 1
mov dword [ebp - 0x298], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008efb4
mov esp, ebp
pop ebp
ret
Function at 0x10008c00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d5618
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x10117d48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x264], 0xff
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x26c], 1
mov ecx, dword [ebp + 0x10]
call fcn.10008dd0
call fcn.10024ec0
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x270], 0
jmp 0x10008c71
mov eax, dword [ebp - 0x270]
add eax, 1
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x4c]
add ecx, 1
cmp dword [ebp - 0x270], ecx
jge 0x10008dab
cmp dword [ebp - 0x270], 0
jle 0x10008c9e
mov edx, dword [ebp - 0x26c]
or edx, 0x100
mov dword [ebp - 0x26c], edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.10024250
add esp, 8
mov dword [ebp - 0x278], eax
lea edx, [ebp - 0x260]
push edx
mov eax, dword [ebp - 0x26c]
push eax
push 0
mov ecx, dword [ebp - 0x278]
call fcn.100030a0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x268], eax
lea ecx, [ebp - 0x2c]
call fcn.10003030
cmp dword [ebp - 0x268], 0
je 0x10008cf6
jmp 0x10008c62
mov dword [ebp - 0x264], 0x208
push 0x208
push 0
lea edx, [ebp - 0x25c]
push edx
call fcn.10092830
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x50]
push edx
push 0
push str.DisplayVersion
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x274], eax
movzx ecx, word [ebp - 0x25c]
test ecx, ecx
je 0x10008d99
push 0
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.10024dc0
add esp, 0xc
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x280]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.10001ef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.100018b0
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10008c62
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008efb4
mov esp, ebp
pop ebp
ret
Function at 0x1000e5f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d54a8
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x10117d48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x244], 0
mov ecx, dword [ebp - 0x248]
add ecx, 0x318
call fcn.1001a120
test eax, eax
je 0x1000e66b
mov eax, dword [ebp - 0x248]
add eax, 0x318
push eax
mov ecx, dword [ebp + 8]
call fcn.100029f0
mov ecx, dword [ebp - 0x244]
or ecx, 1
mov dword [ebp - 0x244], ecx
mov eax, dword [ebp + 8]
jmp 0x1000e736
mov byte [ebp - 0x134], 0
push 0x103
push 0
lea edx, [ebp - 0x133]
push edx
call fcn.10092830
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.10092830
add esp, 0xc
mov dword [ebp - 0x240], 0
lea ecx, [ebp - 0x240]
push ecx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 0x240], 0
je 0x1000e6f3
lea edx, [ebp - 0x134]
push edx
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x1000e6f3
push 0x104
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10001740
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002160
mov edx, dword [ebp - 0x244]
or edx, 1
mov dword [ebp - 0x244], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100018b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008efb4
mov esp, ebp
pop ebp
ret 4
Function at 0x1001aa70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d4788
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10117d48]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x44], 0
je 0x1001aab0
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x1001aabc
mov al, 1
jmp 0x1001ac5f
mov dword [ebp - 0x10], 8
call fcn.100237f0
push eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.100237f0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.100237d0
add esp, 8
movzx eax, al
test eax, eax
je 0x1001aaff
xor al, al
jmp 0x1001ac5f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.10019ac0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.10006ea0
mov ecx, eax
call fcn.10006db0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.1001a120
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.10006ea0
mov ecx, eax
call fcn.10006db0
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx + 0x44]
call fcn.1001d8e0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x1001ab7a
cmp dword [ebp - 0x5c], 1
je 0x1001ab81
cmp dword [ebp - 0x5c], 3
je 0x1001ac1b
jmp 0x1001ac33
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.10006ea0
mov ecx, eax
call fcn.10006db0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x1001abe4
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.10006ea0
mov ecx, eax
call fcn.10006db0
push eax
call fcn.1009097e
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1001abe4
mov byte [ebp - 0x51], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.100018b0
mov al, byte [ebp - 0x51]
jmp 0x1001ac5f
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x1001ac07
mov byte [ebp - 0x52], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.100018b0
mov al, byte [ebp - 0x52]
jmp 0x1001ac5f
cmp dword [ebp - 0x38], 0
jne 0x1001ac19
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.10001f40
jmp 0x1001ac4b
mov byte [ebp - 0x53], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.100018b0
mov al, byte [ebp - 0x53]
jmp 0x1001ac5f
mov byte [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.100018b0
mov al, byte [ebp - 0x54]
jmp 0x1001ac5f
jmp 0x1001ab12
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1008efb4
mov esp, ebp
pop ebp
ret