joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9cd8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a9f38
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4a9d3b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004a97a0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d510
cmp al, 1
jne 0x4a9d3b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004a9ab8
test al, al
je 0x4a9ec7
cmp dword [ebp - 8], 0
jge 0x4a9d59
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004a97a0
mov eax, dword [ebp - 0x210]
call fcn.004044f8
cmp ebx, eax
jge 0x4a9da3
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004a97a0
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4e3490]
and eax, 0xff
bt dword [edx], eax
jae 0x4a9da3
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4a9db7
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a9cb4
cmp ebx, dword [ebp - 8]
je 0x4a9eb9
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4a9de3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e1c44]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4a9ea6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e1c44]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0046c324
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004034d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e1c44]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0046c324
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9ead
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4a9f1a
cmp dword [ebp - 8], 0
jge 0x4a9ed2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004a97a0
mov eax, dword [ebp - 0x218]
call fcn.004044f8
cmp eax, dword [ebp - 8]
jg 0x4a9f0c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004a97a0
mov eax, dword [ebp - 0x21c]
call fcn.004044f8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a9cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9f3f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040425c
ret
Function at 0x4b281c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x14]
shr eax, 1
add eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4b902f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4e27f6
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4b9087
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4e2817
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4b907d
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4b908b
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4c70ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef0
mov ebx, eax
push esp
push 0x20019
push 0
push 0x4c71b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c71ae
mov dword [esp + 4], 0x105
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4c71dc
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c71a5
mov eax, ebx
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004044a8
mov edx, dword [ebx]
mov eax, 0x4c71ec
call fcn.0040483c
test eax, eax
jle 0x4c7179
push ebx
mov edx, dword [ebx]
mov eax, 0x4c71ec
call fcn.0040483c
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.00404758
mov eax, dword [ebx]
call fcn.004044f8
cmp eax, 2
jle 0x4c71a5
mov eax, dword [ebx]
call fcn.004044f8
mov edx, eax
mov eax, dword [ebx]
call fcn.0040d7c0
test al, al
jne 0x4c71a5
mov eax, ebx
mov edx, 0x4c71f8
call fcn.00404500
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x110
pop ebx
ret

Function at 0x4ddc28
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x4ddcd2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404430
mov eax, dword [ebp - 8]
call fcn.00409218
test al, al
je 0x4ddcbc
mov eax, 0x4e4fd0
mov edx, ebx
call fcn.00404430
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4de1e8
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
push 0xea60
push ebx
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4ddc98
push 0
push ebx
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x4e4fb4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x54]
test al, al
je 0x4ddcbc
mov eax, dword [0x4e4fb4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddcd9
lea eax, [ebp - 8]
call fcn.00404238
ret
Function at 0x4ddf28
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4ddff6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404430
mov eax, dword [ebp - 8]
call fcn.00409228
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404430
mov eax, dword [ebp - 0xc]
call fcn.00409218
test al, al
jne 0x4ddfdb
mov eax, 0x4e4fc8
mov edx, esi
call fcn.00404430
mov eax, 0x4e4fcc
mov edx, ebx
call fcn.00404430
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4de040
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
push 0xea60
push ebx
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x4ddfb7
push 0
push ebx
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x4e4fb4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x54]
test al, al
je 0x4ddfdb
mov eax, dword [0x4e4fb4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ddffd
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040425c
ret

Function at 0x4de55c
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov ebx, edx
mov eax, ebx
call fcn.0040945c
mov edx, eax
mov eax, dword [0x4e4fbc]
mov ecx, dword [eax]
call dword [ecx + 4]
push 0
push 0
mov eax, dword [0x4e4fbc]
call fcn.004201f8
mov eax, ebx
call fcn.0040945c
mov ecx, eax
mov edx, ebx
mov eax, dword [0x4e4fbc]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push esp
push 0
push 0
push 0x4de394
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
pop ebx
ret

Function at 0x4de7b4
Capabilities:
Create thread

Disassembly:
push ecx
push esp
push 0
push 0
push 0x4de5ac
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
ret

Function at 0x4de9ac
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
push 0
push 2
call sub.kernel32.dll_OpenFileMappingA
test eax, eax
jne 0x4de9d4
push ebx
push 0x2710
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
push 0
push 0
push 0
push 0xf001f
push eax
call sub.kernel32.dll_MapViewOfFile
pop ebx
pop ebp
ret 4
Function at 0x10008f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 4], edx
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], eax
mov ebx, dword [eax + 0xc]
push edi
test ebx, ebx
je 0x10008fc7
mov al, byte [edx]
mov edi, edx
test al, al
je 0x10008fb0
movzx eax, al
lea edi, [edi + 1]
movzx ecx, byte [eax + 0x100f44b0]
lea eax, [esi*8]
xor ecx, eax
mov al, byte [edi]
xor esi, ecx
test al, al
jne 0x10008f92
mov ecx, dword [ebp - 8]
mov eax, esi
xor edx, edx
div dword [ecx]
mov esi, edx
mov edx, dword [ebp - 4]
mov edi, dword [ebx + esi*8 + 4]
mov ecx, dword [ebx + esi*8]
jmp 0x10008fcd
mov edi, dword [eax + 8]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax], esi
test ecx, ecx
je 0x1000902d
mov esi, dword [edi + 0xc]
dec ecx
mov dword [ebp + 8], ecx
mov bl, byte [esi]
test bl, bl
je 0x10009009
sub esi, dword [ebp - 4]
mov al, bl
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x100f44b0]
cmp al, byte [ecx + 0x100f44b0]
jne 0x10009009
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x10008fe8
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x100f44b0]
movzx eax, bl
movzx eax, byte [eax + 0x100f44b0]
sub eax, ecx
je 0x10009036
mov ecx, dword [ebp + 8]
mov edi, dword [edi]
mov edx, dword [ebp - 4]
test ecx, ecx
jne 0x10008fd6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e340
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], ebx
cmp edx, dword [ebx + 0x2c]
jbe 0x1001e37c
push 0x100f284c
push 0xe96c
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.10007030
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x14]
push 0
push eax
call fcn.10017280
add esp, 8
test eax, eax
jne 0x1001e508
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
movzx eax, word [esi + 0x12]
movzx edi, byte [esi + 6]
mov edx, eax
mov dword [esp + 0x1c], edi
cmp cx, ax
jae 0x1001e451
nop dword [eax + eax]
mov eax, dword [esi + 0x40]
movzx edi, byte [eax + ecx*2 + 1]
movzx eax, byte [eax + ecx*2]
shl eax, 8
or edi, eax
movzx eax, word [esi + 0x14]
and edi, eax
add edi, dword [esi + 0x38]
cmp byte [esi + 5], 0
jne 0x1001e417
movzx edx, byte [edi]
mov ecx, ebx
movzx eax, byte [edi + 1]
push dword [ebp + 0xc]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 3]
shl edx, 8
or edx, eax
push 1
call fcn.1001e340
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1001e4fe
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.1001bc50
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1001e4fe
mov ecx, dword [esp + 0x14]
movzx eax, word [esi + 0x12]
inc ecx
mov ebx, dword [esp + 0x18]
mov edx, eax
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x1001e3c0
mov edi, dword [esp + 0x1c]
cmp byte [esi + 5], 0
movzx eax, dx
jne 0x1001e495
mov ecx, dword [esi + 0x38]
push dword [ebp + 0xc]
add ecx, edi
push 1
movzx edx, byte [ecx + 8]
movzx eax, byte [ecx + 9]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xa]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xb]
shl edx, 8
mov ecx, ebx
or edx, eax
call fcn.1001e340
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1001e4fe
jmp 0x1001e49e
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1001e49e
add dword [ecx], eax
cmp dword [ebp + 8], 0
je 0x1001e4c7
push dword [esi + 0x48]
mov ecx, dword [esi + 0x34]
mov edx, esi
call fcn.1001b7d0
mov ecx, dword [esi + 0x44]
add esp, 4
mov ebx, eax
call fcn.10012370
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x44]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x94]
cmp eax, dword [edx + 0x98]
jbe 0x1001e4e2
call fcn.10012a50
jmp 0x1001e4e7
call fcn.10012740
mov ebx, eax
test ebx, ebx
jne 0x1001e4fe
mov eax, dword [esi + 0x38]
mov ecx, esi
movzx edx, byte [eax + edi]
or edx, 8
call fcn.100171a0
mov ecx, dword [esi + 0x44]
call fcn.10012370
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.100048b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x10031150
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x100fcad4], 0
mov edi, dword [ebp + 8]
je 0x10031183
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10007270
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.100c0fe2
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10031190
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x100311a9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], edx
xor eax, eax
mov edx, ecx
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edi
cmp dword [edx + 0x14], eax
jle 0x1004176b
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edi
xor esi, 1
cmp edi, 2
cmovae esi, edi
test ebx, ebx
je 0x10041724
mov eax, dword [edx + 0x10]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
mov ecx, dword [ebp + 8]
mov bl, byte [ecx]
test bl, bl
je 0x10041706
sub ecx, edx
mov al, bl
mov dword [ebp - 0x10], ecx
mov edi, ecx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x100f44b0]
cmp al, byte [ecx + 0x100f44b0]
jne 0x10041703
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x100416e2
mov edi, dword [ebp - 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x100f44b0]
movzx eax, bl
mov ebx, dword [ebp + 8]
movzx eax, byte [eax + 0x100f44b0]
sub eax, ecx
jne 0x10041756
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
add esi, esi
push eax
mov eax, dword [edx + 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax + esi*8 + 0xc]
add ecx, 8
call fcn.10008f70
add esp, 4
test eax, eax
je 0x1004174f
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10041769
jmp 0x10041759
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x10041759
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [edx + 0x14]
jl 0x100416b7
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10041810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0xc], edx
push edi
xor ecx, ecx
xor edi, edi
mov dword [ebp - 4], ecx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x10], edx
test edx, edx
jle 0x100418ed
mov edx, dword [eax + 0x10]
push ebx
mov dword [ebp - 0x14], edx
push esi
nop dword [eax]
mov ecx, dword [ebp + 8]
mov eax, edi
xor eax, 1
cmp edi, 2
cmovae eax, edi
add eax, eax
mov esi, dword [edx + eax*8 + 0xc]
mov dword [ebp - 8], esi
test ecx, ecx
je 0x100418ac
mov bl, byte [ecx]
mov edx, dword [edx + eax*8]
test bl, bl
je 0x10041894
mov esi, ecx
mov al, bl
sub esi, edx
nop word [eax + eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x100f44b0]
cmp al, byte [ecx + 0x100f44b0]
jne 0x10041891
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x10041870
mov esi, dword [ebp - 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x100f44b0]
movzx eax, bl
movzx eax, byte [eax + 0x100f44b0]
sub eax, ecx
jne 0x100418dc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea ecx, [esi + 0x18]
call fcn.10008f70
add esp, 4
test eax, eax
je 0x100418d5
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x100418df
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x100418df
mov ecx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp - 0x10]
jge 0x100418cc
mov edx, dword [ebp - 0x14]
jmp 0x10041840
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10085f50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100fc008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x128], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10085fa0
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.100af160
push 0x100f72fc
lea ecx, [ebp - 0x128]
call fcn.100ae850
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [ebp - 0x114]
cmp edx, 0x10
jb 0x10086031
mov ecx, dword [ebp - 0x128]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10086027
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10086042
push edx
push ecx
call fcn.100baf94
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100baa39
mov esp, ebp
pop ebp
ret
call fcn.100c79a0
int3
Function at 0x10086170
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100fc008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x100861a7
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov word [eax + ecx], 0
jmp 0x100861bc
push 0
push 1
mov byte [ebp - 0x28], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x28]
push 1
call fcn.100b0400
mov edx, dword [ebp + 0x34]
mov eax, edx
mov ecx, dword [ebp + 0x30]
sub eax, ecx
cmp eax, 1
jb 0x100861e3
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov word [eax + ecx], 0
jmp 0x100861f8
push 0
push 1
mov byte [ebp - 0x28], 0
lea ecx, [ebp + 0x20]
push dword [ebp - 0x28]
push 1
call fcn.100b0400
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
xorps xmm0, xmm0
cmp dword [ebp + 0x34], 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, 0x610
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
movlpd qword [ebp - 0x12], xmm0
mov dword [ebp - 0xa], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
cmp edx, 0x10
jb 0x10086277
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008626d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100862ca
push edx
push ecx
call fcn.100baf94
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x100862b9
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100862af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100862ca
push edx
push ecx
call fcn.100baf94
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100baa39
mov esp, ebp
pop ebp
ret
call fcn.100c79a0
int3
Function at 0x100862d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100fc008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x10086307
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov word [eax + ecx], 0
jmp 0x1008631c
push 0
push 1
mov byte [ebp - 0x28], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x28]
push 1
call fcn.100b0400
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, 0x215
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x18], 0x100ede68
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
cmp edx, 0x10
jb 0x10086385
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008637b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10086396
push edx
push ecx
call fcn.100baf94
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100baa39
mov esp, ebp
pop ebp
ret
call fcn.100c79a0
int3
Function at 0x100863a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100fc008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100fe398]
push ebx
push esi
inc eax
mov dword [ebp - 0xc], edx
push edi
push eax
mov byte [0x10101e60], 0
call fcn.100bafa2
add esp, 4
mov esi, eax
cmp dword [0x100fe39c], 0x10
mov ecx, 0x100fe388
mov edx, esi
cmovae ecx, dword [0x100fe388]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100863e5
push 0
push 0
push 4
push 0
push 0
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100864a9
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
je 0x100864a9
push esi
call fcn.100c13f3
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10086441
push esi
push 0
push ebx
call fcn.100bd8d0
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100864a9
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.100c13f3
mov edi, eax
add esp, 4
test edi, edi
je 0x10086476
push esi
push 0
push edi
call fcn.100bd8d0
add esp, 0xc
xor ecx, ecx
test esi, esi
je 0x100864a9
lea eax, [ebx + 2]
nop
cmp byte [eax - 2], 0x6b
jne 0x100864a3
cmp byte [eax - 1], 0x65
jne 0x100864a3
cmp byte [eax], 0x79
jne 0x100864a3
cmp byte [eax + 1], 0x22
jne 0x100864a3
cmp byte [eax + 2], 0x3a
jne 0x100864a3
cmp byte [eax + 3], 0x22
je 0x100864bc
inc ecx
inc eax
cmp ecx, esi
jb 0x10086480
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100baa39
mov esp, ebp
pop ebp
ret
mov al, byte [ecx + ebx + 6]
cmp al, 0x22
je 0x100864de
add ecx, 6
mov edx, edi
add ecx, ebx
nop dword [eax + eax]
mov byte [edx], al
lea ecx, [ecx + 1]
mov al, byte [ecx]
lea edx, [edx + 1]
cmp al, 0x22
jne 0x100864d0
push ebx
call fcn.100c13d8
add esp, 4
push edi
push 0x10101e60
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10101e60
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0xc]
push edi
mov dword [ecx], eax
call fcn.100c13d8
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.100baa39
mov esp, ebp
pop ebp
ret