joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007c3e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x1010001c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x1007c462
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x1007c462
test ecx, ecx
je 0x1007c45e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x1007c420
xor eax, eax
jmp 0x1007c467
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1007c471
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1008a187
add esp, 0xc
ret 0xc

Function at 0x1007cf00
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x1010001c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 0x10]
cmp eax, 0xffffffff
je 0x1007cf73
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007cf4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1007cf73
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1008a187
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1008a187
add esp, 8
ret 4

Function at 0x1007d300
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x1010001c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x1007d373
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1007d34e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1007d373
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1008a187
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.1008a187
add esp, 8
ret 4
Function at 0x10080900
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ca63f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1010001c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.100021e0
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.10006780
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.10006780
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10006780
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10006780
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10006780
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10006780
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10083720
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x1010001c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x10083785
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10083760
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10083785
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1008a187
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.1008a187
add esp, 8
ret 4
Function at 0x100838c0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc058
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x10083909
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x10083a5b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x10083a26
test eax, eax
je 0x10083a26
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x10083a29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x100839ab
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1008399f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100839ab
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x100839b9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.10006780
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x10083a26
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x10083964
jmp 0x10083a29
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x10083a52
test edx, edx
je 0x10083a4e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x10083920
mov al, 1
jmp 0x10083a5d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x10083a5b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100856e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc286
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x248]
push eax
call fcn.100848e0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10004c50
movzx ecx, al
test ecx, ecx
je 0x10085757
mov byte [ebp - 0x249], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10003910
mov al, byte [ebp - 0x249]
jmp 0x10085836
lea ecx, [ebp - 0x230]
call fcn.10003a00
mov byte [ebp - 4], 1
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.1008c730
add esp, 0xc
lea ecx, [ebp - 0x248]
call fcn.100038a0
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x100ce490
mov ecx, 0x10101820
call fcn.100038a0
push eax
mov ecx, 0x10101868
call fcn.100038a0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x218]
test eax, eax
jne 0x100857db
push 0x100ce494
lea ecx, [ebp - 0x230]
call fcn.100038b0
jmp 0x100857ed
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.100038b0
push 0
lea ecx, [ebp - 0x230]
call fcn.100038a0
push eax
call fcn.10008ed0
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 0x24a], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10003910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10003910
mov al, byte [ebp - 0x24a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret

Function at 0x10085850
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc2bb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x230]
push eax
call fcn.100848e0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10004c50
movzx ecx, al
test ecx, ecx
je 0x100858c7
mov byte [ebp - 0x231], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10003910
mov al, byte [ebp - 0x231]
jmp 0x1008596d
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.1008c730
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.100038a0
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x10101808
call fcn.100038a0
push eax
mov ecx, 0x10101850
call fcn.100038a0
push eax
mov ecx, 0x10101868
call fcn.100038a0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x218]
test eax, eax
jne 0x1008593f
push 0x10101808
mov ecx, dword [ebp + 8]
call fcn.100038e0
jmp 0x1008594e
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100038b0
mov byte [ebp - 0x232], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10003910
mov al, byte [ebp - 0x232]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
Function at 0x10085990
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc311
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x230]
call fcn.10003a00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x248]
push eax
call fcn.100848e0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x248]
call fcn.10004c50
movzx ecx, al
test ecx, ecx
je 0x10085a25
mov byte [ebp - 0x249], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10003910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10003910
mov al, byte [ebp - 0x249]
jmp 0x10085b1d
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.1008c730
add esp, 0xc
lea ecx, [ebp - 0x248]
call fcn.100038a0
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x10101808
call fcn.100038a0
push eax
mov ecx, 0x10101850
call fcn.100038a0
push eax
mov ecx, 0x10101868
call fcn.100038a0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x218]
test eax, eax
jne 0x10085aa0
push 0x10101808
lea ecx, [ebp - 0x230]
call fcn.100038e0
jmp 0x10085ab2
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.100038b0
push 0x100ce48c
lea ecx, [ebp - 0x264]
call fcn.100039b0
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.10085520
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x264]
call fcn.10003910
mov byte [ebp - 0x24a], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10003910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10003910
mov al, byte [ebp - 0x24a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
Function at 0x10085b40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc2bb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x230]
push eax
call fcn.100848e0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10004c50
movzx ecx, al
test ecx, ecx
je 0x10085bb7
mov byte [ebp - 0x231], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10003910
mov al, byte [ebp - 0x231]
jmp 0x10085c5d
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.1008c730
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.100038a0
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x10101808
call fcn.100038a0
push eax
mov ecx, 0x10101838
call fcn.100038a0
push eax
mov ecx, 0x10101868
call fcn.100038a0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x218]
test eax, eax
jne 0x10085c2f
push 0x10101808
mov ecx, dword [ebp + 8]
call fcn.100038e0
jmp 0x10085c3e
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100038b0
mov byte [ebp - 0x232], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10003910
mov al, byte [ebp - 0x232]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
Function at 0x10085c80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc361
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x248]
push eax
call fcn.100848e0
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.10004c50
movzx ecx, al
test ecx, ecx
je 0x10085cf7
mov byte [ebp - 0x249], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10003910
mov al, byte [ebp - 0x249]
jmp 0x10085dfe
lea ecx, [ebp - 0x230]
call fcn.10003a00
mov byte [ebp - 4], 1
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.1008c730
add esp, 0xc
lea ecx, [ebp - 0x248]
call fcn.100038a0
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov ecx, 0x10101808
call fcn.100038a0
push eax
mov ecx, 0x10101838
call fcn.100038a0
push eax
mov ecx, 0x10101868
call fcn.100038a0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x218]
test eax, eax
jne 0x10085d81
push 0x10101808
lea ecx, [ebp - 0x230]
call fcn.100038e0
jmp 0x10085d93
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x230]
call fcn.100038b0
push 0x100ce42c
lea ecx, [ebp - 0x264]
call fcn.100039b0
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.10085520
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x264]
call fcn.10003910
mov byte [ebp - 0x24a], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.10003910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.10003910
mov al, byte [ebp - 0x24a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
Function at 0x100879d0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc680
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006ad0
add esp, 4
movzx edx, al
test edx, edx
jne 0x10087a24
mov eax, dword [ebp + 0x18]
mov dword [eax], 3
xor al, al
jmp 0x10087bd2
mov ecx, dword [ebp + 8]
call fcn.100038a0
push eax
call fcn.100341d0
mov ecx, eax
call fcn.100342c0
movzx ecx, al
test ecx, ecx
jne 0x10087a50
mov edx, dword [ebp + 0x18]
mov dword [edx], 4
xor al, al
jmp 0x10087bd2
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10006780
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
je 0x10087b57
lea ecx, [ebp - 0x44]
call fcn.10003a00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
push ecx
call fcn.10089b40
add esp, 4
movzx edx, al
test edx, edx
jne 0x10087abc
mov eax, dword [ebp + 0x18]
mov dword [eax], 5
mov byte [ebp - 0x46], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10003910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003910
mov al, byte [ebp - 0x46]
jmp 0x10087bd2
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10089e30
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x10087b07
mov edx, dword [ebp + 0x18]
mov dword [edx], 5
mov byte [ebp - 0x47], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10003910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003910
mov al, byte [ebp - 0x47]
jmp 0x10087bd2
cmp dword [ebp + 0x14], 2
jne 0x10087b25
lea eax, [ebp - 0x2c]
push eax
call fcn.10089880
add esp, 4
lea ecx, [ebp - 0x2c]
push ecx
call fcn.10089310
add esp, 4
push 4
push 0
lea ecx, [ebp - 0x2c]
call fcn.100038a0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
lea ecx, [ebp - 0x44]
call fcn.100038a0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.10003910
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x45], 0
mov edx, dword [ebp + 0x18]
mov dword [edx], 6
cmp dword [ebp + 0x10], 0
jne 0x10087b8a
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.10034c00
add esp, 0xc
mov byte [ebp - 0x45], al
jmp 0x10087ba1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.10034be0
add esp, 0xc
mov byte [ebp - 0x45], al
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10087bba
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
mov cl, byte [ebp - 0x45]
mov byte [ebp - 0x48], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003910
mov al, byte [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
Function at 0x10089f80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 0
jbe 0x10089fce
cmp dword [ebp + 0xc], 0xffffffff
jbe 0x10089fa1
mov dword [ebp - 0xc], 0xffffffff
jmp 0x10089fa7
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_SystemFunction036
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 4]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x10089f8c
mov esp, ebp
pop ebp
ret

Function at 0x100a3378
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a3038
Function at 0x100b3ed0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cd328
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x68]
call fcn.10003a00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x68]
push eax
call fcn.100b4050
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x100b3f35
mov byte [ebp - 0x69], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10003910
mov al, byte [ebp - 0x69]
jmp 0x100b4037
lea edx, [ebp - 0x68]
push edx
call fcn.10006ad0
add esp, 4
movzx eax, al
test eax, eax
jne 0x100b3f63
mov byte [ebp - 0x6a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10003910
mov al, byte [ebp - 0x6a]
jmp 0x100b4037
push 0x40
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.1008c730
add esp, 0xc
lea ecx, [ebp - 0x68]
call fcn.100038a0
push eax
push 0x20
lea edx, [ebp - 0x50]
push edx
push 0x100d83d8
push 0x100d816c
push 0x100d8154
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x74], 0x100d83dc
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dx, word [ecx]
mov word [ebp - 0x76], dx
mov eax, dword [ebp - 0x74]
cmp dx, word [eax]
jne 0x100b3fe9
cmp word [ebp - 0x76], 0
je 0x100b3fe0
mov ecx, dword [ebp - 0x70]
mov dx, word [ecx + 2]
mov word [ebp - 0x78], dx
mov eax, dword [ebp - 0x74]
cmp dx, word [eax + 2]
jne 0x100b3fe9
add dword [ebp - 0x70], 4
add dword [ebp - 0x74], 4
cmp word [ebp - 0x78], 0
jne 0x100b3fa4
mov dword [ebp - 0x7c], 0
jmp 0x100b3ff1
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
jne 0x100b4015
mov byte [ebp - 0x6b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10003910
mov al, byte [ebp - 0x6b]
jmp 0x100b4037
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 8]
call fcn.100038b0
mov byte [ebp - 0x6c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10003910
mov al, byte [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret
Function at 0x100b4330
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cd3f6
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.100b7420
mov eax, dword [0x1010001c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1030], 0
lea ecx, [ebp - 0x102c]
call fcn.10003a00
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x1014]
call fcn.10004940
lea ecx, [ebp - 0x1014]
call fcn.1000b190
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1014]
call fcn.1000ba90
push 0x1000
push 0
lea eax, [ebp - 0x1010]
push eax
call fcn.1008c730
add esp, 0xc
push 0
push 0x1c
lea ecx, [ebp - 0x1010]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100b43e1
lea edx, [ebp - 0x1010]
push edx
lea ecx, [ebp - 0x102c]
call fcn.100038b0
lea ecx, [ebp - 0x1014]
call fcn.1000bd90
lea eax, [ebp - 0x102c]
push eax
mov ecx, dword [ebp + 8]
call fcn.100040e0
mov ecx, dword [ebp - 0x1030]
or ecx, 1
mov dword [ebp - 0x1030], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.1000b210
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.10003910
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008a187
mov esp, ebp
pop ebp
ret