joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c8ac0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x5c8ad7
mov eax, ebx
call fcn.005c8444
cmp dword [ebx + 0x68], 0
jne 0x5c8ae4
mov eax, ebx
call fcn.005c83c8
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x5c8c75
cmp dword [ebx + 0x68], 0
je 0x5c8c75
mov edx, esp
mov eax, esi
call fcn.005cc57c
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.005c82a8
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005cc62c
cmp eax, dword [esp]
je 0x5c8b59
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005cc640
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5c8b35
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.005cc62c
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x5c8b4e
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x5c8b6c
mov eax, dword [eax + 0x28]
call fcn.004668b8
mov esi, eax
jmp 0x5c8b6f
mov esi, dword [ebx + 0x5c]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x5c8b80
or esi, 0xffffffff
jmp 0x5c8b8a
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.0045f748
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.0045f76c
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.0045f794
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.0045f7b8
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.005cc5c8
mov edx, edi
lea eax, [esp + 0x10]
call fcn.005ccd8c
push 0x61b
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004668b8
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004668b8
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.004668b8
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042e7d8
call fcn.00429ca0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.004668b8
push eax
mov eax, dword [0x5f47ac]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.004668b8
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x5c8f84
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa0
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.00403358
lea eax, [esp + 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x5c918d
push 0
push 0x5c9198
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x5c918d
push 0
push 0x5c91a8
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x5c918d
push 0
push 0x5c91b8
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x5c918d
push 0
push 0x5c91c8
push 0
push eax
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x5c918d
push 0
push 0
push 0x418
push esi
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x5c918d
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push esi
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x5c918d
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebp, eax
test ebp, ebp
je 0x5c918d
push 0x40
push 0x1000
push 0x1000
push 0
push ebp
call sub.kernel32.dll_VirtualAllocEx
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x5c918d
or edi, 0xffffffff
cmp edi, dword [esp + 4]
jge 0x5c9175
inc edi
mov eax, dword [esp + 0xc]
push eax
push edi
push 0x417
push esi
call sub.user32.dll_SendMessageA
test eax, eax
je 0x5c916b
lea eax, [esp + 0x14]
push eax
push 0x18
lea eax, [esp + 0x54]
push eax
mov eax, dword [esp + 0x18]
push eax
push ebp
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x5c916b
test byte [esp + 0x55], 0xd
jne 0x5c916b
mov al, byte [esp + 0x54]
and al, 8
cmp al, 8
je 0x5c916b
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x64]
push eax
push ebp
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x5c916b
cmp dword [esp + 0x14], 0
je 0x5c916b
mov eax, dword [0x5f4c98]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp]
cmp eax, dword [esp + 0x10]
jne 0x5c916b
mov eax, dword [esp + 0xc]
push eax
push edi
push 0x41d
push esi
call sub.user32.dll_SendMessageA
test eax, eax
je 0x5c9148
lea eax, [esp + 0x14]
push eax
push 0x10
push ebx
mov eax, dword [esp + 0x18]
push eax
push ebp
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0x14], 0
je 0x5c9175
lea eax, [esp + 0x18]
push eax
push esi
call sub.user32.dll_GetWindowRect
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
call fcn.00406de8
jmp 0x5c9175
cmp edi, dword [esp + 4]
jl 0x5c9095
push 0x8000
push 0
mov eax, dword [esp + 0x14]
push eax
push ebp
call sub.kernel32.dll_VirtualFreeEx
push ebp
call sub.kernel32.dll_CloseHandle
add esp, 0x60
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5cd444
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00404cb0
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
jne 0x5cd466
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5d02a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x5d034a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x44]
add eax, 2
add dword [ebx + 0x24], eax
cmp byte [ebx + 0x75], 0
je 0x5d02f3
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebx + 0x48]
mov esi, dword [ebx + 0x50]
sub ecx, esi
mov edx, esi
mov eax, dword [ebx + 0x14]
call fcn.00404d10
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebx + 0x44]
mov edx, dword [ebx + 0x40]
mov eax, ebx
call fcn.005ce034
mov eax, dword [ebx + 0x4c]
mov dword [ebx + 0x50], eax
mov eax, dword [ebx + 0x40]
cmp eax, dword [ebx + 0x38]
jle 0x5d02fe
mov dword [ebx + 0x38], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x44], eax
inc dword [ebx + 0x30]
mov eax, ebx
call fcn.005d002c
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x54], eax
mov eax, dword [ebx + 0x4c]
mov dword [ebx + 0x58], eax
lea eax, [ebx + 0xc]
mov edx, dword [ebx + 4]
call fcn.00404844
lea eax, [ebx + 0x10]
mov edx, dword [ebx + 8]
call fcn.00404844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d0351
lea eax, [ebp - 4]
call fcn.004047f0
ret

Function at 0x5d4388
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5d442c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 8]
lea edx, [esi + esi*4]
mov ecx, dword [ebx + 0x1c4]
mov edx, dword [ecx + edx*4 + 0x10]
call fcn.00404888
cmp word [ebx + 0x1d2], 0
je 0x5d43df
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x1d4]
call dword [ebx + 0x1d0]
cmp dword [ebp - 8], 0
setne al
and al, byte [ebp - 1]
je 0x5d4416
xor eax, eax
mov al, byte [ebx + 0x1c8]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404cb0
push eax
push 0x5d443c
mov eax, dword [0x5f4c98]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d4433
lea eax, [ebp - 8]
call fcn.004047f0
ret
Function at 0x5d5124
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0x5d512c
push ebx
xor eax, eax
push ebp
push 0x5d53c9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x5d53e0
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.0040a344
push dword [ebp - 0x110]
push 0x5d53ec
lea edx, [ebp - 0x118]
mov eax, dword [0x5f4c98]
mov eax, dword [eax]
call fcn.004809d4
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.00409f34
push dword [ebp - 0x114]
push 0x5d53f8
lea eax, [ebp - 4]
mov edx, 5
call fcn.00404b70
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x109]
call fcn.0040a344
push dword [ebp - 0x124]
push 0x5d53ec
lea edx, [ebp - 0x12c]
mov eax, dword [0x5f4c98]
mov eax, dword [eax]
call fcn.004809d4
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.00409f34
push dword [ebp - 0x128]
lea eax, [ebp - 0x120]
mov edx, 3
call fcn.00404b70
mov eax, dword [ebp - 0x120]
call fcn.00404cb0
mov edx, eax
lea eax, [ebp - 0x11c]
call fcn.004049e8
mov eax, dword [ebp - 0x11c]
call fcn.00409ce4
push 2
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x109]
call fcn.0040a344
push dword [ebp - 0x134]
push 0x5d53ec
lea edx, [ebp - 0x13c]
mov eax, dword [0x5f4c98]
mov eax, dword [eax]
call fcn.004809d4
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00409f34
push dword [ebp - 0x138]
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.00404b70
mov eax, dword [ebp - 0x130]
call fcn.00404cb0
push eax
lea edx, [ebp - 0x140]
mov eax, dword [0x5f4c98]
mov eax, dword [eax]
call fcn.004809d4
mov eax, dword [ebp - 0x140]
call fcn.00404cb0
push eax
call sub.kernel32.dll_MoveFileExA
mov dl, 1
mov eax, dword [0x43eee0]
call fcn.0043f04c
mov ebx, eax
xor eax, eax
push ebp
push 0x5d539c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000000
mov eax, ebx
call fcn.0043f0ec
mov cl, 1
mov edx, 0x5d5408
mov eax, ebx
call fcn.0043f154
test al, al
je 0x5d52f8
mov ecx, 0x5d5418
mov edx, 0x5d542c
mov eax, ebx
call fcn.0043f420
mov cl, 1
mov edx, 0x5d5444
mov eax, ebx
call fcn.0043f154
test al, al
je 0x5d5316
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, ebx
call fcn.0043f420
mov eax, ebx
call fcn.0043f0bc
mov edx, 0x80000002
mov eax, ebx
call fcn.0043f0ec
mov cl, 1
mov edx, 0x5d5460
mov eax, ebx
call fcn.0043f154
test al, al
je 0x5d5349
xor ecx, ecx
mov edx, 0x5d54c4
mov eax, ebx
call fcn.0043f420
mov eax, ebx
call fcn.0043f0bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5d53a3
lea edx, [ebp - 0x148]
mov eax, dword [0x5f4c98]
mov eax, dword [eax]
call fcn.004809d4
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00409e4c
lea eax, [ebp - 0x144]
mov edx, 0x5d54d8
call fcn.00404ab8
mov eax, dword [ebp - 0x144]
call fcn.00409ce4
ret
Function at 0x100012c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
sub esp, 8
mov byte [esi + 0x10], 1
cmp eax, 0xffffffff
je 0x100012f2
test eax, eax
je 0x100012f2
push 0x3e8
push eax
call fcn.10008012
mov eax, dword [esi]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
mov eax, dword [0x10102400]
mov dword [ebp - 8], 0x40
mov dword [ebp - 4], 0
test eax, eax
je 0x10001341
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 6
push eax
call edi
mov edx, dword [0x10102404]
mov eax, dword [0x10102400]
mov dword [eax], edx
mov cx, word [0x10102408]
lea edx, [ebp - 8]
push edx
mov word [eax + 4], cx
mov ecx, dword [ebp - 4]
push ecx
push 6
push eax
call edi
pop edi
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10001354
call fcn.10007e9c
mov dword [esi + 0xc], 0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10001369
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov dword [esi + 8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002280
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002d5fb
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x100ff120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], esi
mov word [ebp - 0x82c], ax
push 0x7fe
lea edx, [ebp - 0x80e]
xor ecx, ecx
push esi
mov dword [ebp - 4], esi
push edx
mov word [ebp - 0x810], cx
call fcn.100174f0
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
push esi
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1000231e
cmp dword [ebp - 0x818], 8
jb 0x10002316
mov ecx, dword [ebp - 0x82c]
push ecx
call fcn.100157f1
add esp, 4
or eax, 0xffffffff
jmp 0x1000242e
lea edx, [ebp - 0x810]
push edx
call fcn.10008519
lea eax, [ebp - 0x810]
add esp, 4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x10002336
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x82c]
call fcn.10001b40
push 0x13
push 0x100fb904
lea ecx, [ebp - 0x82c]
call fcn.10002920
mov eax, dword [0x10102440]
xor ecx, ecx
mov word [ebp - 0x810], cx
cmp eax, esi
jne 0x100023bf
push 0x10004650
call int.100157da
push 0x3c
call fcn.1001584d
add esp, 8
cmp eax, esi
je 0x100023b8
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], esi
xor edx, edx
mov word [eax], dx
mov dword [eax + 0x30], 7
mov dword [eax + 0x2c], esi
xor ecx, ecx
mov word [eax + 0x1c], cx
mov dword [eax + 0x38], esi
jmp 0x100023ba
xor eax, eax
mov dword [0x10102440], eax
mov edx, dword [eax + 0x38]
push edx
lea eax, [ebp - 0x810]
push 0x100fb92c
push eax
call fcn.10001150
lea eax, [ebp - 0x810]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x100023e0
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x810]
push ecx
lea ecx, [ebp - 0x82c]
call fcn.10002920
push 0xffffffffffffffff
push esi
lea edx, [ebp - 0x82c]
push edx
lea ecx, [ebx + 0x20]
call fcn.100019f0
cmp dword [ebp - 0x818], 8
jb 0x1000242c
mov eax, dword [ebp - 0x82c]
push eax
call fcn.100157f1
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10015100
mov esp, ebp
pop ebp
ret
Function at 0x100045a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10102424]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0x40
mov dword [ebp - 4], 0
test eax, eax
je 0x100045f4
lea ecx, [ebp - 4]
push ecx
push 0x40
push 6
push eax
call esi
mov edx, dword [0x1010242c]
mov eax, dword [0x10102424]
mov dword [eax], edx
mov cx, word [0x10102430]
lea edx, [ebp - 8]
push edx
mov word [eax + 4], cx
mov ecx, dword [ebp - 4]
push ecx
push 6
push eax
call esi
mov eax, dword [0x10102428]
test eax, eax
je 0x1000462b
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push eax
call esi
mov ecx, dword [0x10102434]
mov eax, dword [0x10102428]
mov dword [eax], ecx
mov dl, byte [0x10102438]
lea ecx, [ebp - 8]
push ecx
mov byte [eax + 4], dl
mov edx, dword [ebp - 4]
push edx
push 5
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004e10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002d7a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100ff120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], 0x100fbe00
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [ebp - 4], edi
xor eax, eax
mov dword [esi + 0x84], 7
mov dword [esi + 0x80], edi
mov word [esi + 0x70], ax
mov byte [ebp - 4], 1
push 0x1c
mov dword [esi + 0x94], edi
call fcn.1001584d
add esp, 4
cmp eax, edi
je 0x10004f07
mov dword [esi + 0x90], eax
mov dword [eax], eax
mov eax, dword [esi + 0x90]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x90]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x90]
mov byte [ecx + 0x18], 1
mov edx, dword [esi + 0x90]
mov byte [edx + 0x19], 1
mov dword [esi + 0x9c], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], edi
call fcn.10015197
push 0x100fcd8c
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call int.1001b87b
int3
Function at 0x10005210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x100ff120]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [ebp - 0x802]
push ecx
mov word [ebp - 0x804], ax
call fcn.100174f0
add esp, 0xc
lea edx, [ebp - 0x804]
push edx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x1000526f
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015100
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x804]
push eax
call fcn.10008519
lea eax, [ebp - 0x804]
add esp, 4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005287
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x804]
add esi, 0x70
push ecx
mov ecx, esi
call fcn.10001b40
push 0x13
push 0x100fb904
mov ecx, esi
call fcn.10002920
mov eax, dword [0x10102440]
xor edx, edx
mov word [ebp - 0x804], dx
test eax, eax
jne 0x1000530c
push 0x10004650
call int.100157da
push 0x3c
call fcn.1001584d
add esp, 8
test eax, eax
je 0x10005305
mov ecx, 7
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], 0
xor edx, edx
mov word [eax], dx
mov dword [eax + 0x30], ecx
xor ecx, ecx
mov dword [eax + 0x2c], edx
mov word [eax + 0x1c], cx
mov dword [eax + 0x38], ecx
jmp 0x10005307
xor eax, eax
mov dword [0x10102440], eax
mov eax, dword [eax + 0x38]
push eax
push eax
lea edx, [ebp - 0x804]
push 0x100fbb84
push edx
call fcn.10001150
lea eax, [ebp - 0x804]
add esp, 0x10
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005330
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x804]
push eax
mov ecx, esi
call fcn.10002920
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10015100
mov esp, ebp
pop ebp
ret

Function at 0x10007fd1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov edi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10007ffd
mov dword [ecx], eax
jmp 0x1000800d
cmp eax, 0xffffffff
je 0x1000800d
test eax, eax
je 0x1000800d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebp
ret

Function at 0x100084c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100084e2
test al, 0x10
jne 0x100084e2
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100151f3
Capabilities:
Encode data using xor

Disassembly:
jnp 0x10015210
mov gs, word [ecx - 0x7b]
jo 0x1001522a
jne 0x100151ad
pushal
sahf
jmp 0xdb1c1762
pop ss
mov eax, dword [0xc16bf9be]
movsd dword es:[edi], dword [esi]
jnp 0x10015298
aaa
stosd dword es:[edi], eax
cwde
inc eax
mov esi, 0x871aafba
mov ah, bh
mov ecx, 0xf807016f
outsd dx, dword [esi]
add dword [edi], eax
clc
and ebx, esp
insd dword es:[edi], dx
jecxz 0x10015299
out 0x39, eax
call dword [edi - 0x13]
sub ebx, ebp
jecxz 0x10015273
lodsd eax, dword [esi]
mov fs, ecx
jno 0x10015261
out 0x1b, eax
push ecx
std
enter 0x36c0, 0xffffffffffffff8c
xchg ecx, eax
cmp dword [edi + 0x7c555b5d], edx
or eax, 0xe4a5418
and al, 0x27
mov al, byte [esi + 0x3910f18d]
push eax
jmp 0x100152bf
fist word [edi + 0x53]
mov dl, 0x87
mov bh, 0xa0
xchg ebx, edx
cdq
mov ah, 0xb2
rcl dword [edx + ecx - 0x6f], 0xf2
pop ds
mov esi, 0x4f0451ed
mov ecx, 0x94a880a1
stosb byte es:[edi], al
test al, dh
add al, byte [esi - 0x61efac37]
mov al, 0x13
loope 0x10015316
adc esp, ecx
jp 0x100152eb
dec esi
ljmp 0xfe94:0xe5412aa8
inc edi
jmp 0x3a7aca0b
aad 0xfc
fdiv qword [edx]
fdivr qword [eax - 0x52baa4fb]
sar byte [ecx + 0x72d6ae43], 0xd9
cmpsd dword [esi], dword es:[edi]
or cl, byte [edi]
mov ch, 0x4b
out 0x91, al
and cl, ah
adc dword [eax + 0x53], 0xaec3ef51
or byte [ebx - 0x3f], al
xchg ebp, eax
dec ecx
int3
jne 0x1001529c
pop ebp
mov ch, 0x32
sub byte [ebp + eax*2 + 0x36], cl
mov cl, 0xb0
cmpsd dword [esi], dword es:[edi]
xor ecx, esp
xor byte [edi + 0x79f7add2], dl
xchg edi, edx
cwde
push ebx
jmp 0xd99a03e3

Function at 0x10015d26
Capabilities:
Encode data using xor

Disassembly:
pop edx
cmp byte [edx], al
dec edx
aas
push ebp
sub byte [edi - 0x75], ah
push edi
das
xchg dword [ebp - 0x71], ebp
fistp qword [esi + 0x61]
retf 0xe83f
insd dword es:[edi], dx
invalid
jge 0x10015bf4
inc eax
mov dword [0x30c2080], eax
push eax
push esi
movsd dword es:[edi], dword [esi]
and eax, 0x447e8c4f
cmpsd dword [esi], dword es:[edi]
fstp st(6)
loop 0x10015c21
stosb byte es:[edi], al
sbb al, 0x4b
sub ah, byte [esi + 0x24]
or esi, dword [eax - 0x60]
xchg dword [edx + 0x679152f6], esi
dec esp
dec ecx
xchg dword [ebx + 0x78], esp
bound esp, qword [ebx + edi*8]
and eax, ebx
pop esp
xchg esp, eax
stc
push edx
mov ah, 0x9c
mov esp, 0xa4e797e2
loop 0x10015be8
out 0xa4, eax
test eax, 0x303da58c
mov bh, 0x4e
salc
push ebp
invalid
pop ds
jle 0x10015c17
xlatb
pop esp
ja 0x10015c6d
inc edx
pop edi
shr dword [esi], cl
jecxz 0x10015c7b
jecxz 0x10015c7b
and ah, byte [esi + ebp*4 - 6]
push esi
ja 0x10015c4f
mov dword [0x904d819a], eax
nop
invalid
adc al, 0xa9
pop ebp
in al, dx
daa
fstp qword [ebx]
cli
ljmp 0x6c05
jg 0x10015c62
jo 0x10015cc1
dec edx
test eax, 0xe4c6c4c9
push edi
pop edx
xor edx, dword [ebp + 0x1c]
cmp ebp, edx
push edi
dec esi
jmp 0xdac5ee98
rol dword [eax + 0x51], 1
jnp 0x10015cdd
invalid