joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015bab
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, 0x10115ddc
push esi
push 0x10115daa
push 0x10115da4
call fcn.10015b31
push 0x1010dde8
push 6
push esi
push 4
push dword [esp + 0x30]
call fcn.100157e0
mov ecx, dword [esp + 0x38]
add esp, 0x20
push 6
mov eax, esi
sub ecx, esi
pop esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x10015be5
mov ebx, 0x10115dd8
push ebx
mov ebp, 0x10115da4
push ebp
mov edi, 0x10115da0
push edi
call fcn.10015b31
movzx eax, byte [0x10115ddc]
movzx ecx, byte [0x10115ddd]
mov esi, eax
shr eax, 2
movzx eax, byte [eax + 0x1010df28]
mov al, byte [eax + 0x1010df28]
mov edx, ecx
shr edx, 4
shl al, 4
and esi, 3
shl esi, 4
or edx, esi
movzx edx, byte [edx + 0x1010df68]
or al, byte [edx + 0x1010df68]
and ecx, 0xf
or byte [0x10115dd8], al
movzx eax, byte [0x10115dde]
mov edx, eax
shl ecx, 2
shr edx, 6
or edx, ecx
movzx ecx, byte [edx + 0x1010dfa8]
mov cl, byte [ecx + 0x1010dfa8]
and eax, 0x3f
movzx eax, byte [eax + 0x1010dfe8]
shl cl, 4
or cl, byte [eax + 0x1010dfe8]
movzx eax, byte [0x10115ddf]
or byte [0x10115dd9], cl
movzx ecx, byte [0x10115de0]
mov esi, eax
mov edx, ecx
shr eax, 2
movzx eax, byte [eax + 0x1010e028]
mov al, byte [eax + 0x1010e028]
shr edx, 4
and esi, 3
shl esi, 4
or edx, esi
movzx edx, byte [edx + 0x1010e068]
shl al, 4
or al, byte [edx + 0x1010e068]
and ecx, 0xf
or byte [0x10115dda], al
movzx eax, byte [0x10115de1]
mov edx, eax
shl ecx, 2
shr edx, 6
or edx, ecx
movzx ecx, byte [edx + 0x1010e0a8]
mov cl, byte [ecx + 0x1010e0a8]
and eax, 0x3f
movzx eax, byte [eax + 0x1010e0e8]
mov esi, 0x10115dd4
shl cl, 4
or cl, byte [eax + 0x1010e0e8]
push esi
or byte [0x10115ddb], cl
push ebp
push edi
call fcn.10015b31
push 0x1010dea8
push esi
push ebx
push 4
pop edi
call fcn.1001578c
add esp, 0x24
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x10016000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x1010dbe8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor ebx, ebx
push 8
pop edi
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
call fcn.1001578c
add esp, 0xc
xor edi, edi
push edi
mov ecx, 0x10115dbc
call fcn.10015933
push eax
push dword [eax + 0xc]
lea ecx, [ebp - 0x14]
call fcn.1001724e
lea ecx, [ebp - 0x14]
call fcn.100168ac
push eax
lea eax, [ebp - 8]
push eax
call fcn.10015bab
pop ecx
pop ecx
mov cl, byte [ebp - 8]
mov byte [ebp - 4], cl
mov cl, byte [ebp - 7]
mov byte [ebp - 3], cl
mov cl, byte [ebp - 6]
mov byte [ebp - 2], cl
mov cl, byte [ebp - 5]
mov byte [ebp - 1], cl
lea ecx, [ebp - 8]
mov edx, ecx
push 4
sub eax, edx
pop esi
mov dl, byte [eax + ecx]
xor dl, byte [ecx - 4]
mov byte [ecx], dl
inc ecx
dec esi
jne 0x10016089
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10015b31
add esp, 0xc
inc edi
cmp edi, 0x10
jl 0x1001603c
push dword [ebp + 0xc]
push 0x10115dbc
push 0x10115db4
call fcn.10015b31
push 0x1010dce8
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 8
pop edi
call fcn.1001578c
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100160dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor al, al
push esi
push edi
push 0x1010dbe8
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], al
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 7], al
mov byte [ebp - 6], al
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push 8
pop edi
call fcn.1001578c
add esp, 0xc
push 0xf
pop edi
push edi
mov ecx, 0x10115dbc
call fcn.10015933
push eax
push dword [eax + 0xc]
lea ecx, [ebp - 0x14]
call fcn.1001724e
lea ecx, [ebp - 0x14]
call fcn.100168ac
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10015bab
pop ecx
pop ecx
mov cl, byte [ebp - 0xc]
mov byte [ebp - 4], cl
mov cl, byte [ebp - 0xb]
mov byte [ebp - 3], cl
mov cl, byte [ebp - 0xa]
mov byte [ebp - 2], cl
mov cl, byte [ebp - 9]
mov byte [ebp - 1], cl
lea ecx, [ebp - 0xc]
mov edx, ecx
push 4
sub eax, edx
pop esi
mov dl, byte [eax + ecx]
xor dl, byte [ecx + 4]
mov byte [ecx], dl
inc ecx
dec esi
jne 0x10016166
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10015b31
add esp, 0xc
dec edi
jns 0x10016119
push dword [ebp + 0xc]
push 0x10115dbc
push 0x10115db4
call fcn.10015b31
push 0x1010dce8
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push 8
pop edi
call fcn.1001578c
add esp, 0x18
pop edi
pop esi
leave
ret
Function at 0x1001c713
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100bd737
call fcn.100a35ac
sub esp, 0x228
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], ebx
cmp eax, 0x101
jne 0x1001c762
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
push str.UpdateEditableItems
call dword [eax + 0xb8]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
cmp eax, 0x100
jne 0x1001c74e
cmp dword [edi + 8], 0xd
je 0x1001c7c0
mov ecx, dword [esi + 0x74]
add ecx, 0xe4
mov byte [esi + 0xfa], bl
call fcn.10055381
cmp al, bl
jne 0x1001c74e
cmp byte [0x101164d0], bl
je 0x1001c7b0
mov eax, dword [edi + 8]
cmp eax, 0x25
je 0x1001c7b0
cmp eax, 0x27
je 0x1001c7b0
cmp eax, 0x24
je 0x1001c7b0
cmp eax, 0x23
je 0x1001c7b0
cmp eax, 8
je 0x1001c7b0
cmp eax, 0x2e
jne 0x1001c74e
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1001c82f
push 0x104
lea eax, [ebp - 0x234]
push eax
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x234]
lea ecx, [esi + 0x80]
push eax
call fcn.10004da9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x98]
cmp al, bl
je 0x1001c74e
cmp dword [esi + 0x10], 0xffffffff
mov byte [esi + 0x12c], 1
je 0x1001c82f
push ebx
lea ecx, [esi + 0x4c]
call fcn.1000357f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
push str.Current_Link
call dword [edx + 0x44]
mov eax, dword [esi]
push ebx
push ebx
push dword [esi + 0x10]
mov ecx, esi
call dword [eax + 0x8c]
xor eax, eax
jmp 0x1001c751
Function at 0x1001cfb4
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100bd7ef
call fcn.100a35ac
sub esp, 0x830
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0xa5], 0
push edi
mov dword [ebp - 0x10], esp
je 0x1001d030
lea edi, [esi + 0xac]
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001d030
push 0x400
lea eax, [ebp - 0x83c]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [esi + 0x8c]
lea eax, [ebp - 0x83c]
push eax
call fcn.100a26ab
pop ecx
pop ecx
lea ecx, [esi + 0x80]
test eax, eax
jne 0x1001d024
push 0x100cb0a0
jmp 0x1001d02b
lea eax, [ebp - 0x83c]
push eax
call fcn.10004da9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4

Function at 0x1001db9a
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100bd914
call fcn.100a35ac
sub esp, 0x228
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], ebx
cmp eax, 0x101
jne 0x1001dbe9
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
push str.UpdateEditableItems
call dword [eax + 0xb8]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
cmp eax, 0x100
jne 0x1001dbd5
cmp dword [edi + 8], 0xd
je 0x1001dc47
mov ecx, dword [esi + 0x74]
add ecx, 0xe4
mov byte [esi + 0xfa], bl
call fcn.10055381
cmp al, bl
jne 0x1001dbd5
cmp byte [0x101164d0], bl
je 0x1001dc37
mov eax, dword [edi + 8]
cmp eax, 0x25
je 0x1001dc37
cmp eax, 0x27
je 0x1001dc37
cmp eax, 0x24
je 0x1001dc37
cmp eax, 0x23
je 0x1001dc37
cmp eax, 8
je 0x1001dc37
cmp eax, 0x2e
jne 0x1001dbd5
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1001dcb6
push 0x104
lea eax, [ebp - 0x234]
push eax
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x234]
lea ecx, [esi + 0x80]
push eax
call fcn.10004da9
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x98]
cmp al, bl
je 0x1001dbd5
cmp dword [esi + 0x10], 0xffffffff
mov byte [esi + 0x12c], 1
je 0x1001dcb6
push ebx
lea ecx, [esi + 0x4c]
call fcn.1000357f
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
push str.Current_Link
call dword [edx + 0x44]
mov eax, dword [esi]
push ebx
push ebx
push dword [esi + 0x10]
mov ecx, esi
call dword [eax + 0x8c]
xor eax, eax
jmp 0x1001dbd8
Function at 0x1001e459
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100bd9cc
call fcn.100a35ac
sub esp, 0x830
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0xa5], 0
push edi
mov dword [ebp - 0x10], esp
je 0x1001e4d5
lea edi, [esi + 0xac]
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001e4d5
push 0x400
lea eax, [ebp - 0x83c]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [esi + 0x8c]
lea eax, [ebp - 0x83c]
push eax
call fcn.100a26ab
pop ecx
pop ecx
lea ecx, [esi + 0x80]
test eax, eax
jne 0x1001e4c9
push 0x100cb0a0
jmp 0x1001e4d0
lea eax, [ebp - 0x83c]
push eax
call fcn.10004da9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x10022af7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022b60
cmp dword [ebp + 0x10], 1
je 0x10022b38
cmp dword [ebp + 0x10], 2
je 0x10022b38
push 0xd
pop eax
jmp 0x10022b60
mov eax, dword [ebp - 4]
test edi, edi
je 0x10022b5a
test eax, eax
je 0x10022b55
test al, 1
jne 0x10022b33
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x10022b5a
jmp 0x10022b33
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x10022deb
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [0x10115e54]
lea ecx, [ebp - 4]
call fcn.10022db7
xor esi, esi
push esi
push esi
push 0x2001f
push esi
push esi
push str.SoftwareAppDataLowSoftwareFreecauseToolbars
push SysReAllocString
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.100014a4
push str.ActiveToolbar
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0xc]
call fcn.10001489
cmp dword [ebp - 4], esi
pop esi
je 0x10022e4e
cmp dword [ebp - 4], 0xffffffff
je 0x10022e4e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
leave
ret

Function at 0x100233f9
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100be034
call fcn.100a35ac
sub esp, 0x810
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
push 0x2001f
push str.SoftwareMicrosoftInternet_ExplorerToolbarWebBrowser
push SysReAllocString
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call fcn.100014fe
xor eax, eax
mov ebx, 0x7fe
push ebx
mov word [ebp - 0x81c], ax
lea eax, [ebp - 0x81a]
push esi
push eax
mov dword [ebp - 0x10], esi
call fcn.100a2490
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x81c]
push eax
push esi
jmp 0x100234c9
lea eax, [ebp - 0x81c]
push eax
mov ecx, 0x10115fd4
call fcn.10002834
test eax, eax
je 0x1002349a
cmp word [ebp - 0x81c], 0x7b
jne 0x1002349a
push esi
lea eax, [ebp - 0x81c]
push eax
push dword [ebp + 8]
call fcn.100487e2
add esp, 0xc
inc dword [ebp - 0x10]
xor eax, eax
push ebx
mov word [ebp - 0x81c], ax
lea eax, [ebp - 0x81a]
push esi
push eax
call fcn.100a2490
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0x400
call edi
test eax, eax
je 0x10023468
lea ecx, [ebp - 0x1c]
call fcn.10001489
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10024c36
Capabilities:
Create directory

Disassembly:
mov eax, 0x100be0f4
call fcn.100a35ac
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
push 0x7f02
xor edi, edi
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.10023287
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov byte [ebp - 4], 1
cmp eax, edi
jne 0x10024c8f
lea ecx, [ebp - 0x1c]
call fcn.10022d99
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001d29
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
dec eax
push eax
lea ecx, [ebp + 8]
call fcn.1000cdc9
cmp ax, 0x5c
je 0x10024cac
push 0x100ccd84
lea ecx, [ebp + 8]
call fcn.1000d0d1
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax - 0xc], edi
jle 0x10024cfe
push esi
lea ecx, [ebp + 8]
call fcn.1000cdc9
cmp ax, 0x5c
jne 0x10024cf5
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.100236cf
mov eax, dword [eax]
push edi
push eax
call fcn.100a6b22
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
cmp eax, 0xffffffff
setne bl
add ecx, 0xfffffff0
call fcn.10001d29
test bl, bl
je 0x10024d0e
mov eax, dword [ebp + 8]
inc esi
cmp esi, dword [eax - 0xc]
jl 0x10024cb6
mov eax, dword [ebp + 8]
cmp esi, dword [eax - 0xc]
jl 0x10024d1f
xor esi, esi
inc esi
jmp 0x10024c6b
call fcn.100a6a50
cmp dword [eax], 2
je 0x10024cfe
xor esi, esi
jmp 0x10024c6b
push 0xc
pop ebx
push ebx
call fcn.100a2ba4
mov edi, eax
and dword [edi + 4], 0
pop ecx
mov dword [edi], ebx
mov dword [edi + 8], 1
push esi
lea ecx, [ebp + 8]
call fcn.1000cdc9
cmp ax, 0x5c
jne 0x10024d78
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
call fcn.100236cf
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.10001d29
test bl, bl
jne 0x10024d8d
mov eax, dword [ebp + 8]
inc esi
cmp esi, dword [eax - 0xc]
jl 0x10024d38
push edi
call fcn.100a2009
pop ecx
jmp 0x10024d06
push edi
call fcn.100a2009
pop ecx
jmp 0x10024d18
Function at 0x10025e54
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x100be3a8
call fcn.100a35ac
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
call fcn.10025ddf
cmp eax, ebx
jne 0x10025e7d
xor eax, eax
inc eax
jmp 0x10025fb6
lea eax, [ebp - 0x18]
push eax
push ebx
push 8
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x10025ed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x10025fb4
lea eax, [ebp - 0x18]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10025fb4
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x10025fb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10025fb4
mov eax, dword [ebp - 0x14]
call fcn.100a58a0
mov edi, esp
mov dword [ebp - 0x10], esp
cmp edi, ebx
je 0x10025fb4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push edi
push 2
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x10025fb4
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10025fb4
xor esi, esi
cmp ebx, dword [edi]
jae 0x10025f65
push dword [ebp - 0x1c]
push dword [edi + ebx*8 + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10025f72
xor esi, esi
inc esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, esi
jmp 0x10025fb6
inc ebx
jmp 0x10025f4d
xor eax, eax
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100268ee
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x100be4a6
call fcn.100a35ac
sub esp, 0x30
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100404f4
pop ecx
pop ecx
push str.Helper.dll
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.100053c1
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10004a20
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.10001d29
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100269a4
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x1002696a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1002696e
xor eax, eax
jmp 0x10026987
lea esi, [eax + eax]
mov eax, esi
call fcn.100a58a0
mov dword [ebp - 0x10], esp
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.1000c578
push eax
lea eax, [ebp - 0x30]
push str.Helper_not_found__path_s
push eax
call fcn.10001f23
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.100029ca
push dword [ebp - 0x14]
call fcn.10022776
mov esi, eax
push str.IsUnicode
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100269db
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x30]
push str.Helper_entry_point_not_found
push eax
call fcn.10001f23
pop ecx
pop ecx
mov byte [ebp - 4], 4
jmp 0x1002699d
call eax
test al, al
jne 0x100269fe
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x30]
push str.Helper_dll_encoding_does_not_match_core
push eax
call fcn.10001f23
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x1002699d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001d29
mov eax, esi
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10026a9c
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x100be4db
call fcn.100a35ac
sub esp, 0x470
push ebx
push esi
push edi
xor edi, edi
push 0x5c
pop eax
mov dword [ebp - 4], edi
mov word [ebp - 0x24], ax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
push str..
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1000c7a3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.10023d81
mov eax, dword [eax]
cmp eax, edi
je 0x10026af0
mov eax, dword [eax]
jmp 0x10026af2
xor eax, eax
push eax
lea ecx, [ebp - 0x47c]
call fcn.100231d0
mov ecx, dword [ebp - 0x10]
mov esi, eax
cmp ecx, edi
je 0x10026b0f
call fcn.10003111
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp ecx, edi
je 0x10026b1f
call fcn.10003111
cmp esi, edi
je 0x10026bc5
lea ecx, [ebp - 0x47c]
call fcn.10022d2d
lea ecx, [ebp - 0x47c]
mov ebx, eax
call fcn.10023193
test eax, eax
jne 0x10026bbd
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x47c]
call fcn.10025d40
push dword [eax]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.100027e0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.10001d29
push 0x10
lea ecx, [ebp - 0x47c]
call fcn.10022d11
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x10026b9a
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.1000cae5
call fcn.10026a9c
pop ecx
jmp 0x10026bab
cmp esi, edi
je 0x10026ba2
mov eax, dword [esi]
jmp 0x10026ba4
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
cmp esi, edi
je 0x10026bbd
mov ecx, esi
call fcn.10003111
mov dword [ebp - 0x10], edi
cmp ebx, edi
jne 0x10026b27
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x10026bd0
mov eax, dword [eax]
jmp 0x10026bd2
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x47c]
call fcn.10022d54
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x10026bf0
call fcn.10003111
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x1002794c
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
add edx, edx
push edx
push eax
push 1
push 0
push eax
push dword [ecx + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 4
Function at 0x1002fd07
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100bec2e
call fcn.100a35ac
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov esi, ecx
mov ecx, dword [esi + 0x74]
push ebx
push esi
mov dword [ebp - 4], ebx
call fcn.10067b42
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xc]
push ebx
push eax
push 0x419
push dword [ebp - 0x14]
call edi
dec eax
js 0x1002fd8f
lea ecx, [ebp - 0x24]
push ecx
push eax
push 0x41d
push dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call edi
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0xac]
call edi
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0xac]
call edi
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0xac]
call dword [sym.imp.USER32.dll_ValidateRect]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10