joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40854c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 1], cl
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x40873e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 1
cmp byte [ebp - 1], 0
je 0x4086e7
test bl, bl
je 0x4085ac
lea edx, [ebp - 8]
mov eax, edi
call fcn.00407020
lea eax, [ebp - 0xc]
mov ecx, 0x40875c
mov edx, dword [ebp - 8]
call fcn.00403454
jmp 0x4085c0
lea edx, [ebp - 8]
mov eax, edi
call fcn.004054d4
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00403328
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004035cc
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x4086e7
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004033f0
test byte [ebp - 0x150], 1
je 0x408633
mov eax, dword [ebp - 0x150]
and eax, 0xfffffffe
push eax
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x154]
call fcn.00403328
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 0x10]
call fcn.00403410
mov eax, dword [ebp - 0x154]
call fcn.004035cc
push eax
call sub.kernel32.dll_SetFileAttributesA
test byte [ebp - 0x150], 0x10
jne 0x40866b
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x154]
call fcn.00403328
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 0x10]
call fcn.00403410
mov eax, dword [ebp - 0x154]
call fcn.004035cc
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x4086cc
cmp byte [ebp + 0x10], 0
je 0x4086cc
mov eax, dword [ebp - 0x10]
mov edx, 0x408768
call fcn.00403518
je 0x4086cc
mov eax, dword [ebp - 0x10]
mov edx, 0x408774
call fcn.00403518
je 0x4086cc
push 1
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x154]
call fcn.00403328
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 0x10]
call fcn.00403410
mov eax, dword [ebp - 0x154]
mov cl, 1
mov dl, 1
call fcn.0040854c
test al, al
jne 0x4086cc
mov byte [ebp - 2], 0
lea eax, [ebp - 0x150]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4085e0
push esi
call sub.kernel32.dll_FindClose
test bl, bl
je 0x408718
cmp dword [ebp + 0xc], 0
je 0x408703
mov edx, dword [ebp + 8]
mov eax, edi
call dword [ebp + 0xc]
test al, al
jne 0x408718
mov byte [ebp - 2], 0
jmp 0x408718
mov eax, edi
call fcn.004035cc
push eax
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x408718
mov byte [ebp - 2], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408745
lea eax, [ebp - 0x154]
call fcn.00403294
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004032b4
ret
Function at 0x408778
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.004035bc
xor eax, eax
push ebp
push 0x4088b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x64]
mov eax, esi
call fcn.004070b0
push dword [ebp - 0x64]
push 0x4088cc
push dword [ebp - 4]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004034c8
cmp dword [ebp - 8], 0
jne 0x4087e9
lea edx, [ebp - 0x64]
mov eax, esi
call fcn.004054d4
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 8]
call fcn.00407060
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00402878
mov dword [ebp - 0x50], 0x44
cmp dword [ebp - 8], 0
je 0x408811
mov eax, dword [ebp - 8]
call fcn.004035cc
mov esi, eax
jmp 0x408813
xor esi, esi
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.004035cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x408848
xor ebx, ebx
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x40888e
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebp + 0x10], 0
je 0x408862
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x14], 0
je 0x408885
test edi, edi
je 0x40886e
call edi
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x60]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x408868
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4088b8
lea eax, [ebp - 0x64]
call fcn.00403294
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004032b4
ret

Function at 0x4088d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004035bc
xor eax, eax
push ebp
push 0x408973
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x408916
lea edx, [ebp - 8]
mov eax, esi
call fcn.004054d4
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00407060
cmp dword [ebp - 4], 0
je 0x408928
mov eax, dword [ebp - 4]
call fcn.004035cc
mov ebx, eax
jmp 0x40892a
xor ebx, ebx
push 5
push ebx
mov eax, edi
call fcn.004035cc
push eax
mov eax, esi
call fcn.004035cc
push eax
push 0x408988
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
setg bl
test bl, bl
jne 0x408958
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40897a
lea eax, [ebp - 8]
mov edx, 2
call fcn.004032b4
ret
Function at 0x4090f0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x409258
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x14
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4091ec
inc esi
xor ebx, ebx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x158]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00408a58
mov eax, dword [ebp - 0x158]
push eax
mov eax, edi
call fcn.00403408
mov ecx, eax
inc ecx
mov edx, 1
pop eax
call fcn.0040360c
mov eax, dword [ebp - 0x154]
push eax
mov edx, edi
lea eax, [ebp - 0x158]
call fcn.00403328
lea eax, [ebp - 0x158]
mov edx, 0x409270
call fcn.00403410
mov edx, dword [ebp - 0x158]
pop eax
call fcn.00403518
jne 0x4091e4
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x154]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00408a58
mov eax, dword [ebp - 0x154]
call fcn.004035cc
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x4091e4
push eax
call sub.kernel32.dll_FindClose
test byte [ebp - 0x150], 0x10
je 0x4091e4
mov byte [ebp - 0xd], 1
jmp 0x4091ec
inc ebx
dec esi
jne 0x40913d
cmp byte [ebp - 0xd], 0
je 0x409205
push 0xfa
call sub.kernel32.dll_Sleep
dec dword [ebp - 0xc]
jne 0x409127
mov eax, edi
call fcn.004035cc
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
je 0x40922a
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004089c0
jmp 0x40923a
cmp dword [ebp - 8], 0
je 0x40923a
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.004089c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40925f
lea eax, [ebp - 0x158]
mov edx, 2
call fcn.004032b4
ret

Function at 0x4093cc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
mov byte [ebp - 0x100], 0
cmp byte [edx], 0
je 0x4093fa
push edx
push pe_nt_image_headers32
lea edx, [ebp - 0x100]
push edx
push 0
push 0
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
jmp 0x409410
push pe_nt_image_headers32
lea edx, [ebp - 0x100]
push edx
push 0
push 0
push eax
call sub.kernel32.dll_GetProfileStringA
cmp byte [ebp - 0x100], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x40a388
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40a43a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.004070b0
push dword [ebp - 0x5c]
push 0x40a454
push esi
lea eax, [ebp - 4]
mov edx, 3
call fcn.004034c8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402878
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004035cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x40a410
mov al, 0x56
call fcn.0040a2b8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a441
lea eax, [ebp - 0x5c]
call fcn.00403294
lea eax, [ebp - 4]
call fcn.00403294
ret

Function at 0x40a694
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test ebx, ebx
je 0x40a6a8
push 0xfa
call sub.kernel32.dll_Sleep
mov eax, esi
call fcn.004035cc
push eax
call sub.kernel32.dll_DeleteFileA_1
test eax, eax
jne 0x40a6d3
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40a6d3
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40a6d3
inc ebx
cmp ebx, 0xc
jne 0x40a69a
pop esi
pop ebx
ret
Function at 0x40a7c4
Capabilities:
Encode data using xor

Disassembly:
cmp ebx, 0xe15e
jbe 0x40a757
mov ebp, 0x91758e5f
imul ebp, ebp
imul ebp, ebx
mov edx, 0xe5d82cf
test al, 0x40
adc esi, 0x5fe54f03
or eax, 0x2dcf02e2
and ecx, ebp
mov esi, 0x81263ceb
test ch, ah
imul edi, edx, 0xf040c3c5
or eax, 0xe25ccee0
call 0x40a7c4
mov eax, ebx
imul edi, eax
test edx, ecx
movzx esi, dl
mov esi, ebp
jno 0x40a79f
or ebx, 0xb895c58a
lea ecx, [0x6ed7989c]
mov edx, 0xd6039
adc al, al
movzx esi, bx
xor edx, 0xd05b2
imul ebx, ecx, 0xfb6bf1bf
xchg ecx, esi
xor ebp, edx
xchg bl, bl
imul eax, ebp
imul edi, edx, 0x1768c1ba
pop ebx
cmp edi, esi
js 0x40a7cc
test ch, 0x36
mov ah, ch
mov dh, 0x5d
add ebx, 0xfff0fb69
cmp ecx, eax
jo 0x40a7e1
lea eax, [0x13ce41a2]
add ebx, 0xf7f8a
test ecx, ebp
add al, 0x21
dec edi
je 0x40a7ef
push 0
push 0
pop eax
xor edx, eax
imul edi, edi
mov cl, cl
imul ecx, ecx
mov cl, 0x78
and dl, ch
add eax, 0x9c3
lea ecx, [0x393456a0]
cmp cl, cl
sub eax, 0x9c2
movzx ecx, bh
imul ecx, ebp
add dh, ch
mov edx, 0x5567139d
test dl, 0x75
cmp eax, 0x205
jbe 0x40a7f2
test ebp, ebx
lea edx, [0x5d6fd131]
adc cl, 0xac
cmp ecx, 0x6a64d01f
mov esi, 0x74037a3f
push ebx
mov ah, cl
jno 0x40a84c
xchg ebp, edi
mov edi, ecx
mov edx, 0x184
xor edx, 0xd8c
jne 0x40a862
movsx esi, cx
mov cl, 0x6f
xor eax, 0x73480566
dec ecx
test ecx, 0x28a87763
movzx ecx, bp
imul ecx, esi, 0xe00228b9
test dh, 0x35
mov esi, 0xe0255
inc ah
movzx eax, cx
mov cl, 0x41
xor esi, 0x5392
movsx eax, dh
xor esi, 0xd89
movzx ecx, ax
sub edx, esi
jmp 0x40a8a1
add edx, 0xe5c4d
test dh, 0x4b
dec eax
mov ah, 0xae
dec esi
mov ecx, ebp
imul ecx, ebx
movsx eax, bp
cmp edx, 0x291
jae 0x40a85a
add eax, 0x5de49920
lea ebp, [0x8a2844a4]
mov ah, 0x47
ret
Function at 0x10007ef0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x10325476
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x10], 0
pop ebp
ret
Function at 0x1000a9c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x28], eax
mov ecx, 0x100c6ed8
call fcn.10021c70
mov dword [ebp - 0x28], eax
mov byte [ebp - 3], 0x74
movsx ecx, byte [ebp - 3]
mov edx, 1
imul eax, edx, 0
movsx edx, byte [eax + 0x100b7c94]
xor edx, ecx
mov byte [ebp - 2], dl
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 0xc], 0
jmp 0x1000aa0f
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 1
jae 0x1000aa4c
lea edx, [ebp - 2]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
movsx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0x38]
movsx eax, byte [edx]
xor eax, ecx
mov byte [ebp - 4], al
lea ecx, [ebp - 2]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov cl, byte [ebp - 4]
mov byte [eax], cl
jmp 0x1000aa06
lea edx, [ebp - 2]
mov dword [ebp - 0x44], edx
mov eax, 1
shl eax, 0
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov byte [ecx], 0
lea edx, [ebp - 2]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x1000aa96
mov dword [ebp - 0x18], 1
jmp 0x1000aa9d
mov dword [ebp - 0x18], 0
mov dl, byte [ebp - 0x18]
mov byte [ebp - 5], dl
movzx eax, byte [ebp - 5]
test eax, eax
je 0x1000aab9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 0x10
jb 0x1000aae9
mov dword [ebp - 0x20], 1
jmp 0x1000aaf0
mov dword [ebp - 0x20], 0
mov cl, byte [ebp - 0x20]
mov byte [ebp - 6], cl
movzx edx, byte [ebp - 6]
test edx, edx
je 0x1000ab0c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x104
lea eax, [ebp - 0x170]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x170]
push ecx
call fcn.1008d39e
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x1000ab50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x28], eax
mov ecx, 0x100c6ed8
call fcn.10021c70
mov dword [ebp - 0x28], eax
mov byte [ebp - 3], 0x2a
movsx ecx, byte [ebp - 3]
mov edx, 1
imul eax, edx, 0
movsx edx, byte [eax + 0x100b7c94]
xor edx, ecx
mov byte [ebp - 2], dl
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 0xc], 0
jmp 0x1000ab9f
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 1
jae 0x1000abdc
lea edx, [ebp - 2]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
movsx ecx, byte [ebp - 3]
mov edx, dword [ebp - 0x38]
movsx eax, byte [edx]
xor eax, ecx
mov byte [ebp - 4], al
lea ecx, [ebp - 2]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov cl, byte [ebp - 4]
mov byte [eax], cl
jmp 0x1000ab96
lea edx, [ebp - 2]
mov dword [ebp - 0x44], edx
mov eax, 1
shl eax, 0
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov byte [ecx], 0
lea edx, [ebp - 2]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x14], 0x10
jb 0x1000ac26
mov dword [ebp - 0x18], 1
jmp 0x1000ac2d
mov dword [ebp - 0x18], 0
mov dl, byte [ebp - 0x18]
mov byte [ebp - 5], dl
movzx eax, byte [ebp - 5]
test eax, eax
je 0x1000ac49
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 0x10
jb 0x1000ac79
mov dword [ebp - 0x20], 1
jmp 0x1000ac80
mov dword [ebp - 0x20], 0
mov cl, byte [ebp - 0x20]
mov byte [ebp - 6], cl
movzx edx, byte [ebp - 6]
test edx, edx
je 0x1000ac9c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x104
lea eax, [ebp - 0x174]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x174]
push ecx
call fcn.1009092f
add esp, 4
fstp dword [ebp - 0x64]
fld dword [ebp - 0x64]
mov esp, ebp
pop ebp
ret
Function at 0x1000b960
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a8fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
mov dword [ebp - 0x3c], 0
push 0xffffffffffffffff
push 0x100b7cac
mov ecx, dword [ebp + 8]
call fcn.1001f250
push eax
push 0
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp + 8]
call fcn.1001f200
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 0x10
jb 0x1000b9c8
mov dword [ebp - 0x20], 1
jmp 0x1000b9cf
mov dword [ebp - 0x20], 0
mov cl, byte [ebp - 0x20]
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x1000b9eb
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
push 0
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1000ba18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000bafd
push 1
push 0x40
push 2
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
call fcn.1001d5d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx + 4]
mov eax, dword [ebp + edx - 0xf8]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1000ba53
mov dword [ebp - 0x28], 1
jmp 0x1000ba5a
mov dword [ebp - 0x28], 0
movzx ecx, byte [ebp - 0x28]
test ecx, ecx
je 0x1000babf
lea ecx, [ebp - 0x104]
call fcn.1001d4d0
mov byte [ebp - 0xe], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.1001d540
lea edx, [ebp - 0x9c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x100b7b6c
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
mov dword [ecx], 0x100b7b20
mov edx, dword [ebp - 0x18]
push edx
call fcn.10083a86
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.100215d0
mov al, byte [ebp - 0xe]
jmp 0x1000bb13
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9c]
call fcn.1001d540
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], 0x100b7b6c
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1c]
mov dword [edx], 0x100b7b20
mov eax, dword [ebp - 0x1c]
push eax
call fcn.10083a86
add esp, 4
mov byte [ebp - 4], 0
mov byte [ebp - 0xf], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.100215d0
mov al, byte [ebp - 0xf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10021160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x1002117d
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10021184
mov al, 1
jmp 0x1002128b
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], 0xffffffff
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
call dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xffffffff
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x2c]
jne 0x100211c1
mov dword [ebp - 0x18], 1
jmp 0x100211c8
mov dword [ebp - 0x18], 0
mov al, byte [ebp - 0x18]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x100211dd
xor al, al
jmp 0x1002128b
mov dword [ebp - 0x3c], 0x20
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x40
push ecx
mov ecx, dword [ebp - 0x1c]
call dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10021228
cmp dword [ebp - 0xc], 1
je 0x1002122f
cmp dword [ebp - 0xc], 3
je 0x1002127e
jmp 0x10021289
mov edx, dword [ebp - 8]
mov byte [edx + 0x3d], 0
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x60]
sub eax, ecx
mov dword [ebp - 0x10], eax
je 0x1002125e
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 1
lea edx, [ebp - 0x60]
push edx
call fcn.1008c508
add esp, 0x10
cmp dword [ebp - 0x10], eax
je 0x1002125e
xor al, al
jmp 0x1002128b
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x10021272
mov dword [ebp - 0x20], 1
jmp 0x10021279
mov dword [ebp - 0x20], 0
mov al, byte [ebp - 0x20]
jmp 0x1002128b
mov edx, dword [ebp - 8]
mov byte [edx + 0x3d], 0
mov al, 1
jmp 0x1002128b
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x100265e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x800
lea ecx, [ebp - 0x814]
push ecx
call fcn.10008370
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.1008bf8b
add esp, 0x1c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x10026631
mov dword [ebp - 0xc], 0xffffffff
jmp 0x10026637
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x814], 0xd
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x813], 0xa
mov edx, dword [ebp - 4]
mov byte [ebp + edx - 0x812], 0
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret