joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401400
Capabilities:
Create directory

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x1c]
mov edx, ecx
mov ecx, 0x40
cmp edx, 0xff
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
jle 0x40143e
mov dword [esp + 0x10], 0xff
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
test eax, eax
jle 0x4014cd
lea ecx, [esp + 0x1c]
lea edi, [esp + 0x1d]
lea ebx, [esp + 0x1e]
sub ecx, esi
lea ebp, [esp + 0x1f]
sub edi, esi
sub ebx, esi
mov dword [esp + 0x14], ecx
sub ebp, esi
mov al, byte [esi]
cmp al, 0x5c
je 0x401479
cmp al, 0x2f
je 0x401479
mov byte [ecx + esi], al
jmp 0x4014bb
mov byte [ecx + esi], 0x5c
lea eax, [esp + 0x1c]
mov byte [edi + esi], 0x2a
mov byte [ebx + esi], 0x2e
push eax
mov byte [esi + ebp], 0x2a
call fcn.004013c0
add esp, 4
mov byte [edi + esi], 0
test al, al
mov byte [ebx + esi], 0
mov byte [esi + ebp], 0
jne 0x4014b7
lea ecx, [esp + 0x1c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4014cd
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
inc eax
inc esi
cmp eax, edx
mov dword [esp + 0x18], eax
jl 0x40146a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret

Function at 0x4014e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x200
lea eax, [esp]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push 0x25
push 0x25
push 0x431094
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x104]
lea edx, [esp + 4]
push pe_nt_image_headers32
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [esp + 0x208]
lea ecx, [esp + 0x104]
push eax
push ecx
lea edx, [esp + 0xc]
push 0x431084
push edx
call esi
lea eax, [esp + 0x14]
push eax
call fcn.00401400
mov edx, dword [esp + 0x220]
lea ecx, [esp + 0x18]
push ecx
push 0x431080
push edx
call esi
add esp, 0x20
pop esi
add esp, 0x200
ret
Function at 0x4034e0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0x1c]
sub esp, 0x554
test eax, eax
push ebx
push ebp
push esi
push edi
jne 0x4034ff
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x554
ret
mov ebp, dword [esp + 0x578]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ax, word [esp + 0x57c]
mov edi, ebp
mov word [esp + 0x50], ax
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], 0x44
mov dword [esp + 0x4c], 1
je 0x403542
mov esi, ebp
mov edi, dword [esp + 0x574]
mov ebx, dword [esp + 0x570]
push edi
push ebx
lea ecx, [esp + 0x16c]
push 0x431678
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x164]
push edx
push eax
push esi
push 0
push 0x230
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4036b4
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x18]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x64]
push ecx
push edx
call fcn.00402c80
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4035f1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea ecx, [esp + 0x68]
push 0x4313c8
push ecx
call esi
add esp, 0xc
test eax, eax
jne 0x403646
lea edx, [esp + 0x64]
push str..bat
push edx
call esi
add esp, 8
test eax, eax
jne 0x403646
lea eax, [esp + 0x64]
push str..cmd
push eax
call esi
add esp, 8
test eax, eax
jne 0x403646
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
cmp byte [esp + 0x65], 0x3a
jne 0x403652
mov byte [esp + 0x64], 0x63
lea ecx, [esp + 0x64]
push str.debug
push ecx
call esi
add esp, 8
test eax, eax
jne 0x403686
lea edx, [esp + 0x64]
push str.player.exe
push edx
call esi
add esp, 8
test eax, eax
jne 0x403686
lea eax, [esp + 0x64]
push 0x1b
push eax
push str._s_c
jmp 0x403692
lea ecx, [esp + 0x64]
push 0x1b
push ecx
push 0x431394
push 0x433bcc
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esp + 0x28]
add esp, 0x10
mov dword [0x433e5c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x554
ret
mov edx, dword [esp + 0x57c]
mov eax, dword [esp + 0x56c]
mov ecx, dword [esp + 0x568]
push edx
push ebp
push edi
push ebx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, 0x20
pop edi
cmp edx, eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x554
ret
Function at 0x4212f0
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x429958
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1458c]
mov dword [esp + 0x38], 0
test eax, eax
je 0x421325
call fcn.00421230
mov ecx, esi
call fcn.00421260
test eax, eax
jne 0x421354
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
lea eax, [esp + 0x40]
lea ecx, [esi + 0x8e0]
push eax
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
push ecx
mov dword [esi + 0x8e4], ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4213a3
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
mov edx, dword [eax + 0xc]
push edi
push ebx
mov eax, dword [edx]
mov edi, dword [eax]
mov dword [esp + 0x10], edi
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0xf]
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0xd]
and ecx, 0xff
and edx, 0xff
push ecx
and eax, 0xff
push edx
and edi, 0xff
push eax
push edi
lea ecx, [esp + 0x24]
push 0x431388
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esi + 0x14594]
add esp, 0x18
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
mov edi, dword [eax + 0x38]
push ecx
push edx
mov edx, dword [eax + 0x3c]
mov eax, dword [eax + 0x2c]
push edx
push edi
push eax
lea ecx, [esp + 0x28]
push ebx
push ecx
mov ecx, dword [esi + 8]
call fcn.00426900
test eax, eax
pop edi
jne 0x421443
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
mov ecx, dword [esi + 8]
push 0x15f90
call fcn.004267b0
lea ecx, [esp + 0x40]
mov dword [esi + 0x1458c], 1
mov dword [esp + 0x38], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x30]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 8

Function at 0x421600
Capabilities:
Check mutex on windows

Disassembly:
push str.NetbladeIf_Win32_Instance_Mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
jne 0x421614
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov eax, ecx
ret
Function at 0x10003e40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10003e99
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10003e99
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10003e8a
cmp esi, edx
jae 0x10003e99
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10003e78
cmp esi, edx
jae 0x10003e99
cmp word [esi], 0
je 0x10003e99
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10007110
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002432b
mov eax, dword fs:[0]
push eax
sub esp, 0x620
mov eax, dword [0x10031320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x62c]
push 1
push eax
call fcn.1000a510
add esp, 8
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push 0x1002558c
push dword [ebp - 0x62c]
mov dword [ebp - 4], 0
push eax
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1000d050
add esp, 0xc
lea eax, [ebp - 0x218]
push str.DataCenter.log.on
push eax
lea eax, [ebp - 0x420]
push eax
call esi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x208
mov dword [0x100322b8], eax
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.1000d050
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
push str._cfgcenter.log
push esi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10007210
sub eax, edx
lea ecx, [edi + 0x2c]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.10005d50
mov edx, dword [ebp - 0x62c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10007254
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000b4cd
mov esp, ebp
pop ebp
ret
Function at 0x10007500
Capabilities:
Check if file exists
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100243a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10031320]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esi, [ecx + 0x2c]
mov ecx, dword [esi]
or ebx, 0xffffffff
mov dword [ebp - 4], 0
lea edx, [eax - 0x10]
lea edi, [ecx - 0x10]
cmp edx, edi
je 0x10007589
cmp dword [edi + 0xc], 0
jl 0x1000757c
mov ecx, dword [edx]
cmp ecx, dword [edi]
jne 0x1000757c
push edx
call fcn.10005c20
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, ebx
lea edx, [edi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10007575
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x10]
mov dword [esi], ecx
jmp 0x10007589
push dword [eax - 0xc]
mov ecx, esi
push eax
call fcn.10005d50
mov ecx, dword [esi]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100075ef
mov eax, dword [esi]
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
cmp dword [eax - 0xc], 0
je 0x100075ef
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100075d6
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0
jl 0x100075ef
jg 0x100075e7
cmp dword [ebp - 0x14], 0x40000000
jbe 0x100075ef
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1000760e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10007860
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x10007884
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x100078f0
push 0
push 0
call fcn.10011674
add esp, 0x18
mov dword [esi + 8], eax
pop esi
ret

Function at 0x10008c30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [ebp + 8]
mov esi, ecx
push 0
push 0
push 1
mov eax, dword [esi + 0x1c]
push 1
push 0
push 0
push 0xcf0000
push eax
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0xe0], eax
test eax, eax
jne 0x10008c68
pop esi
pop ebp
ret 4
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
pop ebp
ret 4
Function at 0x10008c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10008d9a
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10008cb6
xor ecx, ecx
jmp 0x10008cd0
mov ecx, edx
push ebx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008cc0
sub ecx, ebx
sar ecx, 1
pop ebx
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10005d50
mov edi, dword [ebp + 8]
test edi, edi
je 0x10008cfe
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008ce6
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.10005d50
push dword [0x10032304]
mov ecx, esi
call fcn.10008bb0
test ax, ax
jne 0x10008d25
push 0x10026bc0
call fcn.10005ed0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
push dword [0x10032304]
mov ecx, esi
call fcn.10008c30
test eax, eax
jne 0x10008d4b
push 0x10026bd0
call fcn.10005ed0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp dword [esi + 0x78], 0
mov dword [esi + 0x20], eax
jne 0x10008d75
push 0
push 0
push esi
push 0x10009960
push 0
push 0
call fcn.10011674
add esp, 0x18
mov dword [esi + 0x78], eax
cmp dword [esi + 0xd8], 0
jne 0x10008d9a
push 0
push 0
push esi
push 0x10008f70
push 0
push 0
call fcn.10011674
add esp, 0x18
mov dword [esi + 0xd8], eax
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
Function at 0x10008db0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0xe0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10008f47
mov edx, dword [ebp + 0xc]
push ebx
push edi
test edx, edx
jne 0x10008dd7
xor ecx, ecx
jmp 0x10008def
mov ecx, edx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008de0
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10005d50
mov edx, dword [ebp + 8]
test edx, edx
je 0x10008e1e
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008e05
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 4]
call fcn.100057d0
mov eax, dword [esi + 0x1c]
mov ebx, dword [esi]
sub ebx, 0x10
mov dword [ebp + 8], eax
lea edi, [eax - 0x10]
cmp edi, ebx
je 0x10008eb6
cmp dword [ebx + 0xc], 0
jl 0x10008eab
mov ecx, dword [edi]
cmp ecx, dword [ebx]
jne 0x10008eab
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x10008e59
cmp ecx, dword [edi]
jne 0x10008e59
lock inc dword [eax]
jmp 0x10008e8d
mov eax, dword [ecx]
lea edx, [edi + 4]
push 2
push dword [edx]
mov dword [ebp + 0xc], edx
call dword [eax]
mov edi, eax
test edi, edi
je 0x10008f51
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [edi + 4], eax
mov eax, dword [ecx]
inc eax
push eax
push dword [ebp + 8]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.100024f0
add esp, 0x10
or eax, 0xffffffff
lea ecx, [ebx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10008ea4
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [edi + 0x10]
mov dword [esi], eax
jmp 0x10008eb6
push dword [eax - 0xc]
mov ecx, esi
push eax
call fcn.10005d50
push dword [0x10032304]
mov ecx, esi
call fcn.10008bb0
pop edi
pop ebx
test ax, ax
jne 0x10008ede
push 0x10026bc0
call fcn.10005ed0
add esp, 4
xor eax, eax
pop esi
pop ebp
ret 8
push dword [0x10032304]
mov ecx, esi
call fcn.10008c30
test eax, eax
jne 0x10008f03
push 0x10026bd0
call fcn.10005ed0
add esp, 4
xor eax, eax
pop esi
pop ebp
ret 8
cmp dword [esi + 0x78], 0
jne 0x10008f22
push 0
push 0
push esi
push 0x10009960
push 0
push 0
call fcn.10011674
add esp, 0x18
mov dword [esi + 0x78], eax
cmp dword [esi + 0xd8], 0
jne 0x10008f47
push 0
push 0
push esi
push 0x10008f70
push 0
push 0
call fcn.10011674
add esp, 0x18
mov dword [esi + 0xd8], eax
mov eax, 1
pop esi
pop ebp
ret 8
call fcn.10003e30
int3
Function at 0x1000a510
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100246cc
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x10031320]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
mov dword [ebp - 0x21c], esi
call fcn.10005d10
add esp, 4
lea ecx, [ebp - 0x220]
mov eax, dword [eax + 0x10]
push eax
call fcn.10001b80
mov eax, dword [ebp - 0x220]
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
jne 0x1000a5dd
call fcn.10004e70
mov ecx, eax
test ecx, ecx
je 0x1000a717
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x1002572c
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.10005af0
test al, al
jne 0x1000a5af
push 0
push 0x1002572c
mov ecx, esi
call fcn.10005d50
mov edi, dword [ebp - 0x220]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1000a6fa
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x1000a6fa
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1000d050
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a639
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
call fcn.10004e70
mov ecx, eax
test ecx, ecx
je 0x1000a721
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x21c]
call fcn.10005af0
test al, al
jne 0x1000a6a2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000a680
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.10005d50
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.1000a480
mov edx, dword [ebp - 0x21c]
or edi, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000a6d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1000a6fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000b4cd
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002360
push 0x80004005
call fcn.10002360
int3
Function at 0x1000a770
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x10031320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x1000a904
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.1000d050
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
test esi, esi
jle 0x1000a7df
lea eax, [ebp - 0x228]
push eax
call edi
sub esi, 1
jne 0x1000a7d1
lea eax, [ebp - 0x63c]
mov dword [ebp - 0x63c], 0
push eax
call fcn.10005cf0
mov ecx, dword [ebp - 0x63c]
mov edi, eax
add esp, 4
mov esi, edi
lea ecx, [ecx + ecx*4]
shl ecx, 4
add ecx, edi
cmp edi, ecx
je 0x1000a904
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
nop dword [eax + eax]
push 0x208
lea eax, [ebp - 0x638]
push 0
push eax
call fcn.1000d050
add esp, 0xc
lea eax, [ebp - 0x228]
push dword [esi + 8]
push eax
lea eax, [ebp - 0x638]
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esi]
test eax, eax
jne 0x1000a92a
cmp ecx, 2
jne 0x1000a8eb
push 0x208
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.1000d050
add esp, 0xc
mov dword [ebp - 0x20], 0x61004d
lea eax, [ebp - 0x430]
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x720065
mov dword [ebp - 0x14], 0x440050
push 0
push 0x1a
push eax
push 0
mov dword [ebp - 0x10], 0x440046
mov dword [ebp - 0xc], 0x740061
mov dword [ebp - 8], 0x61
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x1000a917
mov eax, dword [ebp - 0x63c]
add esi, 0x50
lea eax, [eax + eax*4]
shl eax, 4
add eax, edi
cmp esi, eax
jne 0x1000a820
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b4cd
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000b4cd
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000b4cd
mov esp, ebp
pop ebp
ret