joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006a0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10237818
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x64], eax
mov eax, dword [eax]
xor edi, edi
test eax, eax
je 0x1006a230
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10278d64
push eax
call esi
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x64]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
push 0x10278d90
push dword [eax]
call esi
mov esi, eax
cmp dword [ebp - 0x58], edi
je 0x1006a230
cmp dword [ebp - 0x68], edi
je 0x1006a230
test esi, esi
je 0x1006a230
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x40], 0x65004b
mov dword [ebp - 0x3c], 0x620079
mov dword [ebp - 0x38], 0x61006f
mov dword [ebp - 0x34], 0x640072
mov dword [ebp - 0x30], 0x4c0020
mov dword [ebp - 0x2c], 0x790061
mov dword [ebp - 0x28], 0x75006f
mov dword [ebp - 0x24], 0x5c0074
mov dword [ebp - 0x20], 0x720050
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x61006f
mov dword [ebp - 0x14], 0x64
mov dword [ebp - 0x60], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x40]
mov dword [ebp - 0x5c], edi
push eax
push 0x20019
lea ecx, [ebp - 0x60]
call fcn.1008d500
push eax
call dword [ebp - 0x58]
test eax, eax
jne 0x1006a206
mov dword [ebp - 0x44], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x14
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push edi
push 0x10277a5c
push dword [ebp - 0x5c]
movups xmmword [ebp - 0x54], xmm0
call dword [ebp - 0x68]
test eax, eax
jne 0x1006a201
push 0x10
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.1020d9f5
add esp, 0xc
mov edi, eax
push dword [ebp - 0x5c]
call esi
lea ecx, [ebp - 0x60]
call fcn.1008d6a0
test edi, edi
je 0x1006a21d
mov ecx, dword [ebp - 0x64]
push edi
call fcn.1006a250
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.1008d6a0
mov eax, edi
jmp 0x1006a232
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
Function at 0x1006a250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10237850
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [eax]
mov edi, dword [ebp + 8]
test eax, eax
je 0x1006a404
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10278d64
push eax
call esi
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x80]
push str.RegQueryValueExW
push dword [eax]
call esi
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x80]
push 0x10278d90
push dword [eax]
call esi
cmp dword [ebp - 0x60], 0
mov esi, eax
je 0x1006a404
cmp dword [ebp - 0x84], 0
je 0x1006a404
test esi, esi
je 0x1006a404
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x48], 0x65004b
mov dword [ebp - 0x44], 0x620079
mov dword [ebp - 0x40], 0x61006f
mov dword [ebp - 0x3c], 0x640072
mov dword [ebp - 0x38], 0x4c0020
mov dword [ebp - 0x34], 0x790061
mov dword [ebp - 0x30], 0x75006f
mov dword [ebp - 0x2c], 0x5c0074
mov dword [ebp - 0x28], 0x750053
mov dword [ebp - 0x24], 0x730062
mov dword [ebp - 0x20], 0x690074
mov dword [ebp - 0x1c], 0x750074
mov dword [ebp - 0x18], 0x650074
mov dword [ebp - 0x14], 0x73
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x7c], 0
push eax
push 0x20019
lea ecx, [ebp - 0x80]
call fcn.1008d500
push eax
call dword [ebp - 0x60]
test eax, eax
je 0x1006a3f5
lea ecx, [ebp - 0x78]
call fcn.1000879d
mov byte [ebp - 4], 1
lea eax, [ebp - 0x78]
push edi
push str._08x
push eax
call fcn.100773d0
add esp, 0xc
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x14
xorps xmm0, xmm0
lea ecx, [ebp - 0x78]
movups xmmword [ebp - 0x5c], xmm0
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
call fcn.10008714
push eax
push dword [ebp - 0x7c]
call dword [ebp - 0x84]
test eax, eax
jne 0x1006a3e4
push 0x10
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.1020d9f5
add esp, 0xc
mov edi, eax
push dword [ebp - 0x7c]
call esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.1008d6a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret 4

Function at 0x1006a430
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
mov dword [esp + 4], 0x114
push 0
push eax
call fcn.101ffde0
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1006a48c
cmp dword [esp + 4], 6
jb 0x1006a48c
mov al, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.101e7040
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor al, al
xor ecx, esp
call fcn.101e7040
add esp, 0x118
ret
Function at 0x1006ca10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10237d98
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [ebp - 0x14], 0
call fcn.101e74f1
mov dword [ebp - 0x14], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x12c]
push eax
call fcn.101ffde0
add esp, 0x10
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1006ca94
cmp dword [ebp - 0x12c], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x14]
call fcn.1009ae90
test al, al
je 0x1006cabe
lea ecx, [ebp - 0x14]
call fcn.1009a450
test al, al
jne 0x1006cabe
xor bl, bl
jmp 0x1006cb24
lea edx, [esi + 4]
xor ecx, ecx
call fcn.10083700
test al, al
jne 0x1006cad4
lea ecx, [esi + 4]
call fcn.10010566
lea edx, [esi + 0x1c]
mov ecx, 0x1a
call fcn.10083700
test al, al
jne 0x1006caed
lea ecx, [esi + 0x1c]
call fcn.10010566
lea edx, [esi + 0x34]
mov ecx, 2
call fcn.10083700
test al, al
jne 0x1006cb06
lea ecx, [esi + 0x34]
call fcn.10010566
lea edx, [esi + 0x4c]
mov ecx, 0xb
call fcn.10083700
test al, al
jne 0x1006cb1f
lea ecx, [esi + 0x4c]
call fcn.10010566
mov byte [esi], 1
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10099d90
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
Function at 0x1006e740
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10237fee
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x264]
push 0x208
push 0
push eax
mov dword [ebp - 0x5c], 0x61004d
mov ebx, 0x6c
mov dword [ebp - 0x58], 0x720063
mov dword [ebp - 0x54], 0x6d006f
mov dword [ebp - 0x50], 0x640065
mov dword [ebp - 0x4c], 0x46005c
mov dword [ebp - 0x48], 0x61006c
mov dword [ebp - 0x44], 0x680073
mov dword [ebp - 0x40], 0x46005c
mov dword [ebp - 0x3c], 0x61006c
mov dword [ebp - 0x38], 0x680073
mov dword [ebp - 0x34], 0x650048
mov dword [ebp - 0x30], 0x70006c
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x650053
mov dword [ebp - 0x24], 0x760072
mov dword [ebp - 0x20], 0x630069
mov dword [ebp - 0x1c], 0x2e0065
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.101ffde0
add esp, 0xc
lea eax, [ebp - 0x264]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.10005e0a
mov dword [ebp - 4], 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x29c]
call fcn.10005e0a
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2b4]
push eax
lea edx, [ebp - 0x29c]
lea ecx, [ebp - 0x27c]
call fcn.10079280
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x29c]
call fcn.10005e05
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2b4]
call fcn.10005e05
lea ecx, [ebp - 0x27c]
call fcn.10079d00
test al, al
je 0x1006e942
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x280], 0
call fcn.101e74f1
add esp, 4
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 5
mov dword [eax], 0
mov dword [eax], 0xffffffff
mov byte [ebp - 4], 4
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x27c]
push 0x80
push 4
push 1
push accept
push eax
lea ecx, [ebp - 0x280]
call fcn.1009c840
test al, al
jne 0x1006e946
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x1006e942
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1006e92d
test eax, eax
je 0x1006e92d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.101e74c0
add esp, 8
mov dword [ebp - 0x280], 0
xor bl, bl
jmp 0x1006e98f
push esi
lea ecx, [ebp - 0x280]
call fcn.1009c9a0
mov bl, al
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x280]
test esi, esi
je 0x1006e98f
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1006e97a
test eax, eax
je 0x1006e97a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push 4
push esi
call fcn.101e74c0
add esp, 8
mov dword [ebp - 0x280], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x27c]
call fcn.10005e05
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret 4
Function at 0x100753c0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023892c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x102ca474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp + 8], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 4
lea ecx, [esi + 0x48]
call fcn.10005e05
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.10005e05
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.10005e05
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.10005e05
push 0x88
push ebx
call fcn.101e74c0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10076610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102377e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
push ecx
lea ecx, [ebp - 0x28]
call fcn.100087b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10077090
lea ecx, [ebp - 0x28]
call fcn.10008710
lea ecx, [ebp - 0x28]
cmp eax, 2
jbe 0x10076739
call fcn.10005e30
mov esi, eax
mov ecx, esi
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x1007667c
mov ecx, dword [esi]
cmp word [ecx], 0x5c
jne 0x10076696
mov ecx, esi
cmp eax, 8
jb 0x1007668b
mov ecx, dword [esi]
cmp word [ecx + 2], 0x5c
je 0x100767b4
mov ecx, esi
cmp eax, 8
jb 0x1007669f
mov ecx, dword [esi]
cmp word [ecx], 0x2f
jne 0x100766b5
mov ecx, esi
cmp eax, 8
jb 0x100766ae
mov ecx, dword [esi]
cmp word [ecx + 2], 0x2f
je 0x1007670a
push 0x5c
mov edx, 0x2f
lea ecx, [ebp - 0x28]
call fcn.10076eb0
mov eax, dword [esi + 0x14]
add esp, 4
mov ecx, esi
cmp eax, 8
jb 0x100766d3
mov ecx, dword [esi]
cmp word [ecx + 2], 0x3a
jne 0x1007670a
mov ecx, esi
cmp eax, 8
jb 0x100766e3
mov ecx, dword [esi]
cmp word [ecx + 4], 0x5c
jne 0x1007670a
mov ecx, esi
cmp eax, 8
jb 0x100766f3
mov ecx, dword [esi]
cmp word [ecx], 0x61
jb 0x1007670a
cmp eax, 8
jb 0x10076700
mov esi, dword [esi]
cmp word [esi], 0x7a
jbe 0x10076795
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
call fcn.10008710
cmp eax, 2
jne 0x1007670a
lea ecx, [ebp - 0x28]
call fcn.10005e30
mov edx, eax
mov ecx, dword [eax + 0x14]
cmp ecx, 8
jb 0x10076757
mov edx, dword [eax]
cmp word [edx + 2], 0x3a
jne 0x1007670a
mov edx, eax
cmp ecx, 8
jb 0x10076767
mov edx, dword [eax]
cmp word [edx], 0x61
jb 0x1007670a
cmp ecx, 8
jb 0x10076774
mov eax, dword [eax]
cmp word [eax], 0x7a
ja 0x1007670a
push 0x10277e48
call fcn.10005f42
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push 0x10277e48
call fcn.1000ba00
lea ecx, [ebp - 0x28]
call fcn.10008714
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1007670a
shr eax, 4
and al, 1
mov byte [edi], al
mov bl, 1
jmp 0x1007670c
Function at 0x100767c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10238a36
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x828], ecx
lea eax, [ebp - 0x810]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x818], edi
test edi, edi
je 0x100768a0
lea edx, [ebp - 0x810]
mov dword [ebp - 0x814], 0
xor esi, esi
mov dword [ebp - 0x81c], edx
mov dword [ebp - 0x814], esi
mov dword [ebp - 4], esi
cmp edi, 0x3fe
jbe 0x100768be
xor ecx, ecx
lea eax, [edi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101e7526
add esp, 4
mov ebx, eax
mov esi, ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x814], esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1007688c
cmp eax, edi
ja 0x1007688c
mov edx, ebx
xor ecx, ecx
mov edi, eax
mov dword [ebp - 0x818], edi
mov dword [edx + eax*2], ecx
jmp 0x100768ec
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100768a0
push ebx
call fcn.101e7521
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
lea eax, [edi + edi]
cmp eax, 0x800
jae 0x10076a18
xor ecx, ecx
mov word [ebp + eax - 0x810], cx
add eax, 2
cmp eax, 0x800
jae 0x10076a18
mov word [ebp + eax - 0x810], cx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x820], ebx
test edi, edi
je 0x100769fd
mov eax, dword [ebp - 0x818]
mov edi, 2
mov esi, dword [ebp - 0x828]
mov dword [ebp - 0x824], edi
nop word [eax + eax]
cmp word [edx + edi - 2], 0
jne 0x100769df
cmp ecx, ebx
je 0x100769df
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x840]
call fcn.10005e0a
mov byte [ebp - 4], 1
lea eax, [ebp - 0x840]
push eax
call fcn.10005f6e
add esp, 4
mov ecx, esi
mov edx, eax
call fcn.1000884d
mov ecx, edx
test al, al
je 0x100769ac
call fcn.10005e30
mov ecx, esi
mov edx, eax
call fcn.100087f5
mov ecx, edx
mov ebx, eax
call fcn.10005e30
push dword [ebx]
mov edi, eax
push 0x18
call fcn.10005b84
add esp, 8
mov ecx, edi
mov edx, eax
call fcn.10005e30
push eax
mov ecx, edx
call fcn.10008e48
add dword [ebx], 0x18
mov ebx, dword [ebp - 0x820]
mov edi, dword [ebp - 0x824]
jmp 0x100769c1
call fcn.10005e30
push eax
mov ecx, esi
call fcn.100087f5
mov eax, dword [eax]
push eax
call fcn.10008a02
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x840]
call fcn.10005e05
mov eax, dword [ebp - 0x818]
lea ecx, [ebx + 1]
mov edx, dword [ebp - 0x81c]
inc ebx
add edi, 2
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x824], edi
cmp ebx, eax
jb 0x10076920
mov esi, dword [ebp - 0x814]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10076a11
push esi
call fcn.101e7521
add esp, 4
mov al, 1
jmp 0x100768a2
call fcn.101e799c
int3
Function at 0x100782b0
Capabilities:
Get common file path

Disassembly:
jmp 0x1009dd90
sub esp, 0x42c
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
mov ebp, ecx
call fcn.10010566
push 0x412
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.101ffde0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1009dfa0
cmp eax, 0x208
jae 0x1009dfa0
push ebx
xor eax, eax
push esi
mov word [esp + 0x430], ax
lea eax, [esp + 0x20]
push edi
push eax
call fcn.10005f42
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x20], eax
cmp ebx, eax
ja 0x1009de49
mov esi, edi
cmp eax, 8
jb 0x1009de1c
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x28]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10005f10
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x1009df85
mov ecx, ebp
call fcn.1000608d
cmp ebx, eax
ja 0x1009dfb8
mov ecx, ebp
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x18], ecx
cmp ecx, esi
ja 0x1009de9f
mov ecx, ebp
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1009de9f
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1009deb1
or ecx, 0xffffffff
jmp 0x1009deb9
cmp ecx, 0x1000
jb 0x1009dee2
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.101e74f1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1009dfbd
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1009def3
test ecx, ecx
je 0x1009def1
push ecx
call fcn.101e74f1
add esp, 4
jmp 0x1009def3
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x24]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10005f29
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [esp + 0x34]
add esp, 0x14
cmp ecx, 8
jb 0x1009df64
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1009df52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009dfbd
mov eax, edx
push ecx
push eax
call fcn.101e74c0
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1009df85
lea eax, [esp + 0x10]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101e7040
add esp, 0x42c
ret
mov ecx, dword [esp + 0x42c]
xor al, al
pop ebp
xor ecx, esp
call fcn.101e7040
add esp, 0x42c
ret
call fcn.1000604b
call fcn.102086be
int3
Function at 0x100799a0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10232618
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x100799db
xor al, al
jmp 0x10079a7e
add edi, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], edi
je 0x100799f7
mov eax, dword [edi]
test eax, eax
je 0x100799f7
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x10079a5b
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x10079540
push 0
push 0
call fcn.1020e08d
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x10079a9a
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x10079a53
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.10079710
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10079a7c
mov eax, dword [edi]
test eax, eax
je 0x10079a75
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x10079ab2
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10079a3d
mov bl, 1
jmp 0x10079a5d
Function at 0x10079f90
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10239000
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x102ca474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.100086fc
test al, al
je 0x10079fcd
xor al, al
jmp 0x1007a179
mov ecx, edi
call fcn.10079e10
test al, al
je 0x10079fdf
mov al, 1
jmp 0x1007a179
push 0
mov ecx, edi
call fcn.10008714
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call ebx
test eax, eax
jne 0x1007a02e
lea ecx, [ebp - 0x28]
call fcn.1000879d
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.1009e820
test al, al
je 0x1007a01f
push 0
lea ecx, [ebp - 0x28]
call fcn.10008714
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
mov ecx, edi
call fcn.10079e10
test al, al
jne 0x10079fd8
mov ecx, edi
call fcn.10008710
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1007a11e
mov ecx, edi
call fcn.10005e30
mov ebx, eax
mov ecx, dword [ebx + 0x14]
mov eax, ebx
cmp ecx, 8
jb 0x1007a062
mov eax, dword [ebx]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x1007a085
mov eax, ebx
cmp ecx, 8
jb 0x1007a07b
mov eax, dword [ebx]
cmp dx, word [eax + esi*2]
jne 0x1007a10e
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10021840
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.100086fc
test al, al
jne 0x1007a0ff
lea ecx, [ebp - 0x28]
call fcn.10079c00
test al, al
jne 0x1007a0ff
push 0
lea ecx, [ebp - 0x28]
call fcn.10008714
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1007a0ff
lea ecx, [ebp - 0x40]
call fcn.1000879d
mov byte [ebp - 4], 2
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.1009e820
test al, al
je 0x1007a0f3
push 0
lea ecx, [ebp - 0x40]
call fcn.10008714
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x1007a056
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, edi
call fcn.10079c00
test al, al
jne 0x1007a172
push 0
mov ecx, edi
call fcn.10008714
push eax
call ebx
test eax, eax
jne 0x1007a172
lea ecx, [ebp - 0x40]
call fcn.1000879d
mov dword [ebp - 4], 3
lea edx, [ebp - 0x40]
mov ecx, edi
call fcn.1009e820
test al, al
je 0x1007a163
push 0
lea ecx, [ebp - 0x40]
call fcn.10008714
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005e05
mov ecx, edi
call fcn.10079e10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e7040
mov esp, ebp
pop ebp
ret