joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
push esi
call fcn.10005450
mov eax, dword [0x1003d2d4]
test eax, eax
jne 0x10005946
mov al, 0x6c
mov cl, 0x74
mov byte [esp + 7], al
mov byte [esp + 8], al
mov byte [esp + 0xb], al
mov byte [esp + 0xc], al
mov al, 0x65
mov byte [esp + 5], cl
mov byte [esp + 0x20], al
mov byte [esp + 0x23], al
mov byte [esp + 0x1d], cl
mov byte [esp + 0x25], cl
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
mov dl, 0x6e
push eax
push ecx
mov byte [esp + 0xc], dl
mov byte [esp + 0xe], 0x64
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x12], 0x64
mov byte [esp + 0x15], 0
mov byte [esp + 0x24], 0x4e
mov byte [esp + 0x26], 0x4f
mov byte [esp + 0x27], 0x70
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x53
mov byte [esp + 0x2c], 0x63
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x6f
mov byte [esp + 0x30], dl
mov byte [esp + 0x31], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea edx, [esp + 0x10]
push 5
lea eax, [esp + 8]
push edx
push eax
push esi
call fcn.10019170
add esp, 0x10
test eax, eax
je 0x10005933
push 0x40
push 0x3000
add esi, 5
push 0xb
push 0
mov byte [esp + 0x25], 0x68
mov dword [esp + 0x26], esi
mov byte [esp + 0x2a], 0xc3
call fcn.10006420
test eax, eax
mov dword [0x1003d2d4], eax
je 0x1000593c
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov cx, word [esp + 0x18]
mov word [eax + 8], cx
mov dl, byte [esp + 0x1a]
mov byte [eax + 0xa], dl
mov eax, dword [0x1003d2d4]
test eax, eax
jne 0x10005946
or eax, 0xffffffff
pop esi
add esp, 0x28
ret 0xc
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x10005958
or eax, 0xffffffff
pop esi
add esp, 0x28
ret 0xc
mov edx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push edx
push ecx
call eax
pop esi
add esp, 0x28
ret 0xc
Function at 0x10006030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1003d2e8]
sub esp, 0x30
test eax, eax
push esi
jne 0x10006161
mov al, 0x6c
mov cl, 0x74
mov dl, 0x64
mov byte [esp + 7], al
mov byte [esp + 8], al
mov byte [esp + 0xb], al
mov byte [esp + 0xc], al
mov byte [esp + 0x2b], al
mov byte [esp + 5], cl
mov byte [esp + 0x1d], cl
mov byte [esp + 0x21], cl
mov byte [esp + 0x24], cl
mov byte [esp + 0x28], cl
lea eax, [esp + 0x1c]
mov byte [esp + 6], dl
mov byte [esp + 0xa], dl
lea ecx, [esp + 4]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0xc], 0x6e
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
mov byte [esp + 0x24], 0x4e
mov byte [esp + 0x26], 0x50
mov byte [esp + 0x27], dl
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0x63
mov byte [esp + 0x2d], 0x56
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], dl
mov byte [esp + 0x31], 0x75
mov byte [esp + 0x32], 0x61
mov byte [esp + 0x34], 0x4d
mov byte [esp + 0x35], 0x65
mov byte [esp + 0x36], 0x6d
mov byte [esp + 0x37], 0x6f
mov byte [esp + 0x38], dl
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea edx, [esp + 0x10]
push 5
lea eax, [esp + 8]
push edx
push eax
push esi
call fcn.10019170
add esp, 0x10
test eax, eax
je 0x10006158
push 0x40
push 0x3000
add esi, 5
push 0xb
push 0
mov byte [esp + 0x25], 0x68
mov dword [esp + 0x26], esi
mov byte [esp + 0x2a], 0xc3
call fcn.10006420
test eax, eax
mov dword [0x1003d2e8], eax
je 0x10006187
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov cx, word [esp + 0x18]
mov word [eax + 8], cx
mov dl, byte [esp + 0x1a]
mov byte [eax + 0xa], dl
mov eax, dword [0x1003d2e8]
test eax, eax
je 0x10006187
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x10006187
mov edx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push edx
push ecx
call eax
pop esi
add esp, 0x30
ret 0x14
or eax, 0xffffffff
pop esi
add esp, 0x30
ret 0x14
Function at 0x100062b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1003d2ec]
sub esp, 0x30
test eax, eax
push esi
jne 0x100063e6
mov cl, 0x74
mov al, 0x6c
mov byte [esp + 0x1d], cl
mov byte [esp + 0x24], cl
mov byte [esp + 0x29], cl
mov byte [esp + 5], cl
mov cl, 0x64
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov byte [esp + 0x2c], al
mov byte [esp + 7], al
mov byte [esp + 8], al
mov byte [esp + 0xb], al
mov byte [esp + 0xc], al
mov byte [esp + 6], cl
mov byte [esp + 0xa], cl
lea eax, [esp + 0x1c]
lea ecx, [esp + 4]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x24], 0x4e
mov byte [esp + 0x26], 0x41
mov byte [esp + 0x29], 0x6f
mov byte [esp + 0x2a], 0x63
mov byte [esp + 0x2b], 0x61
mov byte [esp + 0x2d], 0x65
mov byte [esp + 0x2e], 0x56
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x30], dl
mov byte [esp + 0x32], 0x75
mov byte [esp + 0x33], 0x61
mov byte [esp + 0x35], 0x4d
mov byte [esp + 0x36], 0x65
mov byte [esp + 0x37], 0x6d
mov byte [esp + 0x38], 0x6f
mov byte [esp + 0x39], dl
mov byte [esp + 0x3a], 0x79
mov byte [esp + 0x3b], 0
mov byte [esp + 0xc], 0x6e
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea edx, [esp + 0x10]
push 5
lea eax, [esp + 8]
push edx
push eax
push esi
call fcn.10019170
add esp, 0x10
test eax, eax
je 0x100063dd
push 0x40
push 0x3000
add esi, 5
push 0xb
push 0
mov byte [esp + 0x25], 0x68
mov dword [esp + 0x26], esi
mov byte [esp + 0x2a], 0xc3
call fcn.10006440
test eax, eax
mov dword [0x1003d2ec], eax
je 0x10006411
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], edx
mov cx, word [esp + 0x18]
mov word [eax + 8], cx
mov dl, byte [esp + 0x1a]
mov byte [eax + 0xa], dl
mov eax, dword [0x1003d2ec]
test eax, eax
je 0x10006411
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x10006411
mov edx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push edx
push ecx
call eax
pop esi
add esp, 0x30
ret 0x18
or eax, 0xffffffff
pop esi
add esp, 0x30
ret 0x18
Function at 0x100064a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1003d2f0]
sub esp, 0x24
test eax, eax
jne 0x1000656f
mov cl, 0x74
mov al, 0x6c
mov byte [esp + 0xd], cl
mov byte [esp + 0x14], cl
mov byte [esp + 0x19], cl
mov byte [esp + 1], cl
mov cl, 0x64
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x1c], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 7], al
mov byte [esp + 8], al
mov byte [esp + 2], cl
mov byte [esp + 6], cl
lea eax, [esp + 0xc]
lea ecx, [esp]
mov dl, 0x72
push eax
push ecx
mov byte [esp + 0x14], 0x4e
mov byte [esp + 0x16], 0x41
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], 0x63
mov byte [esp + 0x1b], 0x61
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], 0x56
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], dl
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x23], 0x61
mov byte [esp + 0x25], 0x4d
mov byte [esp + 0x26], 0x65
mov byte [esp + 0x27], 0x6d
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x79
mov byte [esp + 0x2b], 0
mov byte [esp + 8], 0x6e
mov byte [esp + 0xd], 0x2e
mov byte [esp + 0x11], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003d2f0], eax
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push ecx
call eax
add esp, 0x24
ret 0x18
Function at 0x10006af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1003d310]
sub esp, 0x24
test eax, eax
je 0x10006b05
mov eax, 1
add esp, 0x24
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
push 0x14
push 0
push esi
call fcn.100068a0
push 3
push 5
push esi
mov dword [0x1003d310], eax
call fcn.10006940
add esp, 0x18
mov dword [0x1003d304], eax
call fcn.10006c30
test eax, eax
pop esi
jne 0x10006c17
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
push 3
push 5
push eax
call fcn.10006940
mov cl, 0x6c
mov dl, 0x72
mov byte [esp + 0x14], cl
mov byte [esp + 0x15], cl
mov byte [esp + 0x22], cl
mov cl, 0x6f
add esp, 0xc
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1e], cl
mov byte [esp + 3], dl
mov byte [esp + 0x19], dl
mov byte [esp + 0x1c], dl
lea ecx, [esp + 0xc]
mov dword [0x1003d308], eax
lea edx, [esp]
mov al, 0x73
push ecx
push edx
mov byte [esp + 8], 0x75
mov byte [esp + 9], al
mov byte [esp + 0xa], 0x65
mov byte [esp + 0xc], 0x33
mov byte [esp + 0xd], 0x32
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x12], 0
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], 0x50
mov byte [esp + 0x18], 0x68
mov byte [esp + 0x19], 0x79
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0x69
mov byte [esp + 0x1c], 0x63
mov byte [esp + 0x1d], 0x61
mov byte [esp + 0x1f], 0x43
mov byte [esp + 0x20], 0x75
mov byte [esp + 0x22], al
mov byte [esp + 0x25], 0x50
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 3
push 5
push eax
call fcn.10006940
add esp, 0xc
mov dword [0x1003d30c], eax
mov ecx, dword [0x1003d310]
xor eax, eax
test ecx, ecx
setne al
add esp, 0x24
ret
Function at 0x10006c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x1003d2f8]
sub esp, 0x20
test eax, eax
jne 0x10006d57
mov eax, dword [0x1003d2fc]
test eax, eax
jne 0x10006d57
mov al, 0x6c
mov dl, 0x65
mov byte [esp + 8], al
mov byte [esp + 9], al
mov al, 0x72
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [esp + 0x15], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x14], dl
mov byte [esp + 0x17], dl
lea eax, [esp + 4]
push edi
mov cl, 0x73
mov dl, 0x6f
push eax
mov byte [esp + 0xc], 0x77
mov byte [esp + 0xd], 0x69
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0xf], 0x33
mov byte [esp + 0x10], 0x32
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0x64
mov byte [esp + 0x16], 0
mov byte [esp + 0x18], 0x4e
mov byte [esp + 0x19], 0x74
mov byte [esp + 0x1a], 0x55
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1e], 0x53
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x43
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], dl
mov byte [esp + 0x27], 0x50
mov byte [esp + 0x28], dl
mov byte [esp + 0x29], cl
mov byte [esp + 0x2a], 0
call esi
test eax, eax
je 0x10006d3d
lea ecx, [esp + 0x14]
lea edx, [esp + 8]
push ecx
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x10006d3d
cmp byte [eax + 0xd], 0xc
jne 0x10006d29
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push eax
push ecx
call esi
push eax
call edi
mov dword [0x1003d2f8], eax
jmp 0x10006d3d
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
push eax
call esi
push eax
call edi
mov dword [0x1003d2fc], eax
mov eax, dword [0x1003d2f8]
pop edi
test eax, eax
pop esi
jne 0x10006d57
mov eax, dword [0x1003d2fc]
test eax, eax
jne 0x10006d57
xor eax, eax
add esp, 0x20
ret
mov eax, 1
add esp, 0x20
ret
Function at 0x10009960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2f0
mov cl, 0x64
mov al, 0x6c
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2e], cl
push ebx
mov cl, 0x72
push ebp
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x37], al
mov byte [esp + 0x38], al
mov byte [esp + 0x19], al
push esi
mov byte [esp + 0x15], cl
mov byte [esp + 0x19], cl
mov byte [esp + 0x22], cl
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0x38]
xor ebx, ebx
mov dl, 0x79
push eax
push ecx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x40], 0x6e
mov byte [esp + 0x41], 0x74
mov byte [esp + 0x45], 0x2e
mov byte [esp + 0x49], bl
mov byte [esp + 0x4a], bl
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x1c], 0x5a
mov byte [esp + 0x1d], 0x77
mov byte [esp + 0x1e], 0x51
mov byte [esp + 0x1f], 0x75
mov byte [esp + 0x20], 0x65
mov byte [esp + 0x22], dl
mov byte [esp + 0x23], 0x56
mov byte [esp + 0x24], 0x69
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x75
mov byte [esp + 0x28], 0x61
mov byte [esp + 0x2a], 0x4d
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x6d
mov byte [esp + 0x2d], 0x6f
mov byte [esp + 0x2f], dl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], bl
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
cmp ebp, ebx
je 0x10009b3e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
mov dword [esp + 0x34], eax
je 0x10009b3e
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x76]
mov word [esp + 0x74], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x74]
lea edx, [esp + 0x74]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x304]
push 0x3c
push edx
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, dword [esp + 0x34]
push ebx
lea ecx, [esp + 0x5c]
push 0x1c
push ecx
push ebx
push esi
push edi
call ebp
test eax, eax
jl 0x10009b1e
cmp dword [esp + 0x70], 0x1000000
jne 0x10009b1e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
cmp eax, edx
je 0x10009b1e
push ebx
lea eax, [esp + 0xf8]
push 0x20c
push eax
push 2
push esi
push edi
call ebp
test eax, eax
jl 0x10009b1e
mov eax, dword [esp + 0xf8]
push 0x5c
push eax
call fcn.10019b23
add eax, 2
lea ecx, [esp + 0x7c]
push eax
push ecx
call fcn.1001ac75
add esp, 0x10
test eax, eax
jne 0x10009b1e
cmp esi, dword [esp + 0x308]
jne 0x10009b31
cmp dword [esp + 0x10], ebx
jne 0x10009b31
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x10], edx
add esi, 0x10000
cmp esi, 0x80000000
jae 0x10009b3e
jmp 0x10009aa0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f0
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2f0
ret
Function at 0x1000b320
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x1003c9fc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jne 0x1000b337
call esi
mov dword [0x1003c9fc], eax
inc dword [0x1003ca00]
call esi
mov esi, dword [0x1003c9fc]
mov ecx, eax
sub ecx, esi
pop esi
cmp ecx, 0x3e8
jbe 0x1000b36d
mov edx, dword [0x1003ca00]
mov dword [0x1003ca00], 0
mov dword [0x1003c9f8], edx
mov dword [0x1003c9fc], eax
ret

Function at 0x1000b500
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0xf], al
mov byte [esp + 0x12], al
mov al, 0x6c
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x33
mov byte [esp + 0x10], 0x38
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000b5a5
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000b5b9
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret

Function at 0x1000b5d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0xf], al
mov byte [esp + 0x12], al
mov al, 0x6c
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x33
mov byte [esp + 0x10], 0x39
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000b675
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000b689
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret
Function at 0x1000b6a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0xe], al
mov byte [esp + 0x13], al
mov al, 0x6c
mov byte [esp + 0x14], al
mov byte [esp + 0x15], al
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xf], 0x72
mov byte [esp + 0x10], 0x61
mov byte [esp + 0x11], 0x77
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x16], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000b74a
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000b75e
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret

Function at 0x1000b770
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0x15], al
mov al, 0x6c
or ecx, 0xffffffff
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], 0x70
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x38
mov byte [esp + 0x14], 0x2e
mov byte [esp + 0x18], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000b825
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
test ecx, ecx
jne 0x1000b839
xor eax, eax
add esp, 0x210
ret
add eax, ecx
add esp, 0x210
ret
Function at 0x1000b850
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0x14], al
mov al, 0x6c
or ecx, 0xffffffff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x69
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], 0x70
mov byte [esp + 0x11], 0x75
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x17], 0
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000b900
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000b914
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret

Function at 0x1000b920
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebp
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
push 0x200
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov al, 0x64
lea edi, [esp + 0xc]
mov byte [esp + 0xd], al
mov byte [esp + 0x12], al
mov al, 0x6c
or ecx, 0xffffffff
mov byte [esp + 0x13], al
mov byte [esp + 0x14], al
xor eax, eax
mov byte [esp + 0xc], 0x5c
mov byte [esp + 0xe], 0x78
mov byte [esp + 0xf], 0x67
mov byte [esp + 0x10], 0x69
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x15], 0
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x1000b9c6
add esp, 0x20c
ret
mov ecx, dword [esp + 0x210]
test ecx, ecx
jne 0x1000b9da
xor eax, eax
add esp, 0x20c
ret
add eax, ecx
add esp, 0x20c
ret