joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100108c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c535d
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.10075220
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1038], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x102c], 0
call fcn.10006440
mov ecx, eax
test ecx, ecx
je 0x10010a58
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x1000
lea eax, [ebp - 0x1010]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x102c], 1
mov dword [ebp - 0x1034], 1
call fcn.1009c2f0
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1030], 0x800
push str.TK8Fj70YG_v_3_vPPg7Vdm30XuBkLQEO1THF4mZ06i_foDUuatiCLqo3UQuDlAcNYT9wv6OGo2LxfcPIj7LcA
push eax
call fcn.100473c0
add esp, 0x14
cmp dword [ebp - 0x1014], 8
lea ecx, [ebp - 0x1030]
push ecx
lea ecx, [ebp - 0x1010]
mov dword [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x1034]
push ecx
lea eax, [ebp - 0x1028]
cmovae eax, dword [ebp - 0x1028]
push str.InstallLocation
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100109fe
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefault
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x1010]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100109e0
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.10006f80
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x10010a3a
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10010a30
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010a62
push edx
push ecx
call fcn.10074e52
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005aa0
call fcn.1009fa75
int3
Function at 0x100161d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4c4b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], edi
cmp word [0x10108490], 0
jne 0x1001628b
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1009c2f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.SogouExplorer
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x10108490
lea esi, [ebp - 0x218]
mov edx, 0x104
sub esi, ecx
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1001627e
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001627e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10016260
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.10006440
mov ecx, eax
test ecx, ecx
je 0x100162fb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x10108490
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.10005ae0
test al, al
jne 0x100162dc
mov ecx, 0x10108490
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100162c0
sub ecx, edx
sar ecx, 1
push ecx
push 0x10108490
mov ecx, edi
call fcn.10006f80
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10005aa0
int3
Function at 0x10016e30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4a30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1010445c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x30], 0
je 0x10016e74
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
call fcn.100161d0
mov dword [ebp - 4], 0
call fcn.10006440
mov ecx, eax
test ecx, ecx
je 0x10016fcd
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov edx, dword [ebp - 0x10]
mov edi, dword [ebx + 0x40]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edx
jge 0x10016ed2
push 0x104
lea ecx, [ebp - 0x14]
call fcn.10006e70
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp dword [esi - 8], 0x104
jl 0x10016fd7
push edi
push edx
xor eax, eax
mov dword [esi - 0xc], 0x104
push esi
mov word [esi + 0x208], ax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [esi - 8]
push esi
call fcn.1009fd47
add esp, 8
test eax, eax
js 0x10016fd7
cmp eax, dword [esi - 8]
jg 0x10016fd7
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], ecx
je 0x10016f77
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10016f77
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10016f77
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x3c]
call fcn.100051b0
lea eax, [ebx + 0x44]
mov ecx, ebx
push eax
lea eax, [ebx + 0x48]
push eax
call fcn.10016310
lea eax, [ebx + 0x38]
push eax
push 0x11
push dword [ebx + 0x40]
push dword [ebx + 0x3c]
call fcn.100063b0
mov ecx, eax
call fcn.10019080
mov dword [ebx + 0x30], 1
xor edi, edi
jmp 0x10016f7c
mov edi, 0x80004005
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10016f9a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x10016fb9
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10005aa0
push 0x80070057
call fcn.10005aa0
int3
Function at 0x10016ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10017091
cmp byte [esi + 0x3d], 0
je 0x10017091
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10017047
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10017059
sub eax, 1
je 0x1001705d
sub eax, 2
je 0x10017091
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001707a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100a4fec
add esp, 0x10
cmp edi, eax
jne 0x10017047
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100751d1
mov esp, ebp
pop ebp
ret

Function at 0x100171f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5b60
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1010445c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100751e7
mov edi, eax
add esp, 4
test edi, edi
je 0x1001729b
push 1
mov dword [ebp - 4], 0
call fcn.1004e4b1
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10017970
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100179ac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100179ac
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10017a91
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100179d4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10017a07
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.100a4688
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x10017a91
cmp eax, 1
jle 0x10017a64
cmp eax, 3
jne 0x10017a91
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10014be0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10017a81
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100a4fec
add esp, 0x10
cmp edi, eax
jne 0x10017a91
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10017997
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100751d1
mov esp, ebp
pop ebp
ret 4
Function at 0x10018260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10018284
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10018350
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x100182a5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x100182a7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x1001832f
jg 0x100182ba
test esi, esi
je 0x1001832f
test ecx, ecx
jl 0x100182fc
jg 0x100182c4
test eax, eax
je 0x100182fc
cmp ebx, ecx
jg 0x100182d6
jl 0x100182ce
cmp esi, eax
jae 0x100182d6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1009b7f0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10018302
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x1001832f
jg 0x1001830c
test esi, esi
je 0x1001832f
cmp dword [edi + 0x4c], 0
je 0x1001832f
mov ecx, edi
call fcn.10017510
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.100a4958
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10018420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10018444
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10018500
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10018465
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10018467
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x100184e4
jg 0x1001847a
test esi, esi
je 0x100184e4
test ecx, ecx
jl 0x100184be
jg 0x10018484
test eax, eax
je 0x100184be
cmp edi, ecx
jg 0x10018496
jl 0x1001848e
cmp esi, eax
jae 0x10018496
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1009b7f0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x100184c1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x100184e4
jg 0x100184cb
test esi, esi
je 0x100184e4
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100184e4
push eax
push esi
push 1
push edx
call fcn.100a4fec
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100193d0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5e20
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x478], eax
test ebx, ebx
jne 0x1001941d
xor al, al
jmp 0x1001956e
test edi, edi
je 0x10019416
cmp dword [esi], 0
je 0x1001942d
mov al, 1
jmp 0x1001956e
push 0x250
lea eax, [ebp - 0x46c]
push 0
push eax
call fcn.1009c2f0
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.1009c2f0
add esp, 0x18
lea eax, [ebp - 0x21c]
push edi
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001958c
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x100195a7
jmp 0x100194a6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea ecx, [esi + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.10018d10
push edi
lea ecx, [esi + 8]
call fcn.10018d10
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x478]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x46c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x468]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x464]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x460]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x45c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x458]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x454]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x450]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x44c]
push edi
push ebx
mov dword [esi + 0x30], eax
mov dword [esi], 1
call fcn.10019340
mov ecx, eax
call fcn.10018630
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x10019416
push 0
push 0
push esi
push 0x100196a0
push 0
push 0
call fcn.1009f7d7
add esp, 0x18
mov dword [esi + 0x3c], eax
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret 0x10
push 0x100f4e68
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0xffffffff
push eax
call fcn.1009b779
push 0x100f4e68
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0xfffffffe
push eax
call fcn.1009b779
int3
Function at 0x1001c8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x48]
push esi
movups xmmword [ebp - 0x48], xmm0
mov esi, dword [ebp + 0x8c]
movups xmm0, xmmword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x90]
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x4c], esi
mov dword [edi + 0x40], esi
movups xmm0, xmmword [ebp + 0x28]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [ebp + 0x4c]
movups xmmword [ebp - 0x8c], xmm0
movups xmm0, xmmword [ebp + 0x5c]
movups xmmword [ebp - 0x7c], xmm0
movups xmm0, xmmword [ebp + 0x6c]
movups xmmword [ebp - 0x6c], xmm0
movups xmm0, xmmword [ebp + 0x7c]
movups xmmword [ebp - 0x5c], xmm0
test esi, esi
jle 0x1001ca54
cmp esi, 0x40
jb 0x1001ca3d
lea edx, [esi - 1]
lea ecx, [ebp + esi - 0x49]
add edx, edi
cmp edi, ecx
ja 0x1001c977
lea ecx, [ebp - 0x48]
cmp edx, ecx
jae 0x1001ca3d
lea ecx, [ebp + esi - 0x8d]
cmp edi, ecx
ja 0x1001c990
lea ecx, [ebp - 0x8c]
cmp edx, ecx
jae 0x1001ca3d
mov ecx, esi
push ebx
and ecx, 0x8000003f
jns 0x1001c9a0
dec ecx
or ecx, 0xffffffc0
inc ecx
mov ebx, esi
lea edx, [edi + 0x20]
sub ebx, ecx
mov dword [ebp - 0x98], edx
mov esi, edi
lea ecx, [ebp - 0x38]
sub esi, ecx
sub ecx, edi
mov dword [ebp - 0x90], ecx
lea ecx, [ebp - 0x7c]
sub ecx, edi
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x94], ecx
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x48]
lea ecx, [ebp - 0x38]
add edx, eax
movups xmm1, xmmword [ebp + eax - 0x8c]
add ecx, eax
pxor xmm1, xmm0
movups xmm0, xmmword [ecx]
movups xmmword [esi + ecx], xmm1
mov ecx, dword [ebp - 0x94]
movups xmm1, xmmword [ebp + eax - 0x7c]
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x6c]
movups xmmword [edx - 0x10], xmm1
movups xmm1, xmmword [ebp + eax - 0x28]
add eax, 0x40
pxor xmm1, xmm0
movups xmm0, xmmword [edi + edx]
movups xmmword [edx], xmm1
movups xmm1, xmmword [ecx + edx]
pxor xmm1, xmm0
movups xmmword [edx + 0x10], xmm1
mov edx, dword [ebp - 0x98]
cmp eax, ebx
jl 0x1001c9d0
mov esi, dword [ebp - 0x9c]
mov edi, dword [ebp - 0xa0]
pop ebx
cmp eax, esi
jge 0x1001ca54
mov cl, byte [ebp + eax - 0x8c]
xor cl, byte [ebp + eax - 0x48]
mov byte [edi + eax], cl
inc eax
cmp eax, esi
jl 0x1001ca41
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100751d1
mov esp, ebp
pop ebp
ret
Function at 0x1001e360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x101086fc
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x520070
mov dword [ebp - 0x14], 0x730065
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x650076
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x1001e3e3
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001e3e3
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001e3c5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101086fc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret

Function at 0x1001e410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1010445c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x10108724
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x520070
mov dword [ebp - 0x14], 0x730065
mov dword [ebp - 0x10], 0x720065
mov dword [ebp - 0xc], 0x650076
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x1001e493
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001e493
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001e475
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10108724
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100751d1
mov esp, ebp
pop ebp
ret