joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011170
Capabilities:
Delete directory
Delete file

Disassembly:
sub esp, 0x804
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x818]
mov dword [esp + 0x10], 0
mov esi, dword [edi + 0x4e94]
test esi, esi
je 0x1001132c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp word [esi + 0x58], 0
jne 0x100111b1
cmp word [esi + 0x5a], 0
je 0x1001122b
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x54]
mov word [esi + 0x58], 1
cmp byte [eax + ecx - 1], 0x2f
je 0x10011227
mov edx, dword [esi + 0x44]
lea eax, [esp + 0x14]
push edx
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
call fcn.10006500
add esp, 4
lea edx, [esp + 0x14]
push edx
call ebp
mov eax, dword [edi + 0x4e68]
test eax, eax
jne 0x1001122b
mov eax, dword [esi + 0x44]
push eax
call fcn.10011150
mov ecx, dword [esi + 0x54]
push ecx
call fcn.10011150
mov eax, dword [esi + 0x54]
add esp, 8
cmp byte [eax], 0
je 0x10011216
push 0x10044334
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [esi + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
mov dword [esi + 0x20], eax
jbe 0x1001122b
inc dword [esp + 0x10]
mov esi, dword [esi + 0x64]
test esi, esi
jne 0x100111a3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001132c
shl eax, 2
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x10011268
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0x804
ret
mov esi, dword [edi + 0x4e94]
xor ebx, ebx
test esi, esi
je 0x100112b1
mov edi, ebp
cmp word [esi + 0x58], 0
je 0x100112aa
mov ecx, dword [esi + 0x20]
test ecx, ecx
jbe 0x100112aa
mov eax, dword [esi + 0x54]
cmp byte [ecx + eax - 1], 0x2f
jne 0x100112aa
test ebx, ebx
je 0x100112a4
mov ecx, dword [edi - 4]
mov edx, dword [ecx + 0x54]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100112aa
mov dword [edi], esi
inc ebx
add edi, 4
mov esi, dword [esi + 0x64]
test esi, esi
jne 0x10011276
push 0x1000df90
push 4
push ebx
push ebp
call sub.api_ms_win_crt_utility_l1_1_0.dll_qsort
add esp, 0x10
xor ebp, ebp
test ebx, ebx
jbe 0x1001131f
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
mov esi, dword [eax + 0x44]
cmp byte [esi], 0
je 0x10011317
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + esi - 1], 0x2f
jne 0x100112f0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [eax + esi - 1], 0
test ebp, ebp
je 0x1001130b
mov ecx, dword [edi - 4]
mov eax, dword [edi]
mov edx, dword [ecx + 0x54]
mov ecx, dword [eax + 0x54]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10011317
mov edx, dword [edi]
mov eax, dword [edx + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
inc ebp
add edi, 4
cmp ebp, ebx
jb 0x100112cc
mov ecx, dword [esp + 0x10]
push ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x804
ret
Function at 0x100114f0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov edx, dword [ecx + 0x42]
mov eax, edx
xor eax, esi
and eax, 0xff
shr edx, 8
mov eax, dword [eax*4 + 0x100424b4]
xor eax, edx
mov edx, dword [ecx + 0x46]
mov dword [ecx + 0x42], eax
and eax, 0xff
add eax, edx
mov edx, dword [ecx + 0x4a]
imul eax, eax, 0x8088405
inc eax
mov esi, edx
mov dword [ecx + 0x46], eax
and esi, 0xff
shr eax, 0x18
xor eax, esi
pop esi
shr edx, 8
mov eax, dword [eax*4 + 0x100424b4]
xor eax, edx
mov dword [ecx + 0x4a], eax
ret
Function at 0x100122e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
cmp ebx, 1
push edi
jge 0x100122f4
mov ebx, 1
jmp 0x100122fe
cmp ebx, 9
jle 0x100122fe
mov ebx, 9
mov esi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, dword [esi + 0x62]
mov dword [esi + 0x6a], ebp
cmp eax, ebp
jne 0x1001231c
mov dword [esi + 0x6a], 1
mov dword [esi + 0x62], 0x10000
cmp dword [esi + 0x4e], ebp
jne 0x10012351
push 2
push 0x8000
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
cmp eax, ebp
mov dword [esi + 0x4e], eax
jne 0x10012351
push esi
push ebp
push 0x17c
call fcn.1000cb20
add esp, 8
push eax
push 4
call fcn.10007220
add esp, 0xc
cmp dword [esi + 0x52], ebp
jne 0x1001239c
push 2
push 0x8000
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
push 2
push 0x4000
mov dword [esi + 0x52], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov ecx, dword [esi + 0x52]
add esp, 0x10
cmp ecx, ebp
mov dword [esi + 0x56], eax
je 0x10012382
cmp eax, ebp
jne 0x1001239c
push esi
push ebp
push 0x186
call fcn.1000cb20
add esp, 8
push eax
push 4
call fcn.10007220
add esp, 0xc
mov eax, dword [esi + 0x56]
mov ecx, 0x1fff
xor edx, edx
mov word [eax + 0x7ffe], bp
mov edi, dword [esi + 0x56]
xor eax, eax
rep stosd dword es:[edi], eax
xor ecx, ecx
stosw word es:[edi], ax
mov cx, word [ebx*8 + 0x1004211a]
xor eax, eax
mov dword [esi + 0x8a], ecx
mov dx, word [ebx*8 + 0x10042118]
mov dword [esi + 0x8e], edx
mov ax, word [ebx*8 + 0x1004211c]
xor ecx, ecx
mov dword [esi + 0x92], eax
mov cx, word [ebx*8 + 0x1004211e]
cmp ebx, 1
mov dword [esi + 0x86], ecx
jne 0x10012402
mov eax, dword [esp + 0x18]
or byte [eax], 4
jmp 0x1001240e
cmp ebx, 9
jne 0x1001240e
mov eax, dword [esp + 0x18]
or byte [eax], 2
mov edx, dword [esi + 0x4e]
push esi
push 0x8000
push edx
mov dword [esi + 0x76], ebp
mov dword [esi + 0x66], ebp
call dword [esi + 0xc77a]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x82], eax
jne 0x10012443
mov dword [esi + 0x7e], 1
mov dword [esi + 0x82], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, 0x106
mov dword [esi + 0x7e], ebp
cmp eax, edi
jae 0x10012467
cmp dword [esi + 0x7e], ebp
jne 0x10012467
push esi
call fcn.10012640
mov eax, dword [esi + 0x82]
add esp, 4
cmp eax, edi
jb 0x1001244f
mov ecx, dword [esi + 0x4e]
mov dword [esi + 0x6e], ebp
xor eax, eax
mov edi, dword [esi + 0x6e]
xor edx, edx
mov dl, byte [ecx + eax]
and edi, 0x1ff
and edx, 0x3fff
shl edi, 5
xor edx, edi
inc eax
cmp eax, 2
mov dword [esi + 0x6e], edx
jb 0x1001246f
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10015330
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
cmp ebx, 1
push edi
jge 0x10015344
mov ebx, 1
jmp 0x1001534e
cmp ebx, 9
jle 0x1001534e
mov ebx, 9
mov esi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, dword [esi + 0x62]
mov dword [esi + 0x6a], ebp
cmp eax, ebp
jne 0x1001536c
mov dword [esi + 0x6a], 1
mov dword [esi + 0x62], 0x2fff6
cmp dword [esi + 0x4e], ebp
jne 0x100153a1
push 1
push 0x2fff6
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
cmp eax, ebp
mov dword [esi + 0x4e], eax
jne 0x100153a1
push esi
push ebp
push 0x17c
call fcn.1000cb20
add esp, 8
push eax
push 4
call fcn.10007220
add esp, 0xc
cmp dword [esi + 0x5a], ebp
jne 0x100153ec
push 4
push 0x10000
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
push 4
push 0x8000
mov dword [esi + 0x5a], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov ecx, dword [esi + 0x5a]
add esp, 0x10
cmp ecx, ebp
mov dword [esi + 0x5e], eax
je 0x100153d2
cmp eax, ebp
jne 0x100153ec
push esi
push ebp
push 0x186
call fcn.1000cb20
add esp, 8
push eax
push 4
call fcn.10007220
add esp, 0xc
mov eax, dword [esi + 0x5e]
mov ecx, 0x7fff
xor edx, edx
mov dword [eax + 0x1fffc], ebp
mov edi, dword [esi + 0x5e]
xor eax, eax
rep stosd dword es:[edi], eax
xor ecx, ecx
mov cx, word [ebx*8 + 0x1004211a]
mov dword [esi + 0x8a], ecx
mov dx, word [ebx*8 + 0x10042118]
mov dword [esi + 0x8e], edx
mov ax, word [ebx*8 + 0x1004211c]
xor ecx, ecx
mov dword [esi + 0x92], eax
mov cx, word [ebx*8 + 0x1004211e]
cmp ebx, 2
mov dword [esi + 0x86], ecx
jg 0x1001544d
mov eax, dword [esp + 0x18]
or byte [eax], 4
jmp 0x10015459
cmp ebx, 8
jl 0x10015459
mov eax, dword [esp + 0x18]
or byte [eax], 2
mov edx, dword [esi + 0x4e]
push esi
push 0x2fff6
push edx
mov dword [esi + 0x76], ebp
mov dword [esi + 0x66], ebp
call dword [esi + 0xc77a]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x82], eax
jne 0x1001548e
mov dword [esi + 0x7e], 1
mov dword [esi + 0x82], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 0xfff6
mov dword [esi + 0x7e], ebp
jae 0x100154a1
push esi
call fcn.10015680
add esp, 4
mov ecx, dword [esi + 0x4e]
mov dword [esi + 0x6e], ebp
xor eax, eax
mov edi, dword [esi + 0x6e]
xor edx, edx
mov dl, byte [ecx + eax]
and edi, 0x3ff
and edx, 0x7fff
shl edi, 5
xor edx, edi
inc eax
cmp eax, 2
mov dword [esi + 0x6e], edx
jb 0x100154a9
mov dword [esi + 0x7a], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100157a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
mov eax, dword [esi + 0x82]
mov dword [esi + 0x72], 2
test eax, eax
je 0x10015968
cmp dword [esi], 0
jne 0x10015968
mov ecx, dword [esi + 0x76]
mov eax, dword [esi + 0x4e]
xor edx, edx
mov dl, byte [eax + ecx + 2]
and ecx, 0xffff
mov eax, edx
mov edx, dword [esi + 0x6e]
and edx, 0x3ff
and eax, 0x7fff
shl edx, 5
xor eax, edx
mov edx, dword [esi + 0x5e]
mov dword [esi + 0x6e], eax
mov eax, dword [edx + eax*4]
mov edx, dword [esi + 0x5a]
test eax, eax
mov dword [edx + ecx*4], eax
mov ecx, dword [esi + 0x6e]
mov edx, dword [esi + 0x5e]
mov ebx, dword [esi + 0x76]
mov dword [edx + ecx*4], ebx
je 0x10015833
mov ecx, dword [esi + 0x76]
sub ecx, eax
cmp ecx, 0xffff
ja 0x10015833
push esi
push eax
call fcn.10015530
mov edi, eax
mov eax, dword [esi + 0x82]
add esp, 8
cmp edi, eax
jbe 0x10015833
mov edi, eax
cmp edi, 3
push esi
jb 0x100158ea
mov eax, dword [esi + 0x76]
mov ebp, dword [esi + 0x7a]
lea edx, [edi - 3]
sub eax, ebp
push edx
push eax
call fcn.10014dd0
mov ecx, dword [esi + 0x82]
mov ebp, eax
mov eax, dword [esi + 0x8a]
add esp, 0xc
sub ecx, edi
cmp edi, eax
mov dword [esi + 0x82], ecx
ja 0x100158ba
dec edi
mov ecx, dword [esi + 0x76]
xor eax, eax
inc ecx
mov ebx, dword [esi + 0x5a]
mov dword [esi + 0x76], ecx
mov edx, ecx
mov ecx, dword [esi + 0x4e]
mov al, byte [ecx + edx + 2]
and edx, 0xffff
mov ecx, eax
mov eax, dword [esi + 0x6e]
and eax, 0x3ff
and ecx, 0x7fff
shl eax, 5
xor ecx, eax
mov eax, dword [esi + 0x5e]
mov dword [esi + 0x6e], ecx
dec edi
mov ecx, dword [eax + ecx*4]
mov dword [ebx + edx*4], ecx
mov edx, dword [esi + 0x6e]
mov eax, dword [esi + 0x5e]
mov ecx, dword [esi + 0x76]
mov dword [eax + edx*4], ecx
jne 0x1001586d
jmp 0x1001590f
mov eax, dword [esi + 0x76]
mov edx, dword [esi + 0x4e]
add eax, edi
xor ecx, ecx
add edx, eax
mov dword [esi + 0x76], eax
xor eax, eax
xor edi, edi
mov cl, byte [edx]
mov dword [esi + 0x6e], ecx
mov al, byte [edx + 1]
and ecx, 0x3ff
and eax, 0x7fff
shl ecx, 5
xor eax, ecx
mov dword [esi + 0x6e], eax
jmp 0x10015912
mov ecx, dword [esi + 0x4e]
mov edx, dword [esi + 0x76]
xor eax, eax
mov al, byte [ecx + edx]
push eax
push 0
call fcn.10014dd0
mov ecx, dword [esi + 0x82]
add esp, 0xc
dec ecx
mov ebp, eax
mov dword [esi + 0x82], ecx
inc dword [esi + 0x76]
test ebp, ebp
je 0x1001593e
mov ecx, dword [esi + 0x66]
test ecx, ecx
jl 0x10015924
mov eax, dword [esi + 0x4e]
add eax, ecx
jmp 0x10015926
xor eax, eax
mov edx, dword [esi + 0x76]
push esi
sub edx, ecx
push 0
push edx
push eax
call fcn.10014b20
mov eax, dword [esi + 0x76]
add esp, 0x10
mov dword [esi + 0x66], eax
cmp dword [esi + 0x82], 0xfff6
jae 0x1001595a
mov eax, dword [esi + 0x7e]
test eax, eax
jne 0x1001595a
push esi
call fcn.10015680
add esp, 4
mov eax, dword [esi + 0x82]
test eax, eax
jne 0x100157bf
mov ecx, dword [esi + 0x66]
test ecx, ecx
jl 0x10015976
mov eax, dword [esi + 0x4e]
add eax, ecx
jmp 0x10015978
xor eax, eax
mov edx, dword [esi + 0x76]
push esi
sub edx, ecx
push 1
push edx
push eax
call fcn.10014b20
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100188f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036311
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10042074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
test esi, esi
jne 0x1001894f
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x24]
call sub.mfc140.dll_Ordinal_500
push 0x10039164
movzx edi, si
push edi
mov byte [ebp - 4], 2
call sub.mfc140.dll_Ordinal_2210
mov esi, eax
test esi, esi
jne 0x10018997
lea ecx, [ebp - 0x24]
call sub.mfc140.dll_Ordinal_1140
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea eax, [esi - 2]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x10039164
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100189d2
lea ecx, [ebp - 0x24]
call sub.mfc140.dll_Ordinal_1140
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea eax, [edi - 3]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x10018a08
lea ecx, [ebp - 0x24]
call sub.mfc140.dll_Ordinal_1140
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea eax, [esi - 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call sub.mfc140.dll_Ordinal_2241
push edi
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
lea ecx, [ebp + 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.mfc140.dll_Ordinal_5095]
push 0
push 0x9001
push eax
lea ecx, [ebp - 0x24]
call sub.mfc140.dll_Ordinal_11907
test eax, eax
jne 0x10018a47
lea ebx, [eax - 5]
jmp 0x10018a5b
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x24]
call sub.mfc140.dll_Ordinal_14520
lea ecx, [ebp - 0x24]
call sub.mfc140.dll_Ordinal_2880
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x24]
call sub.mfc140.dll_Ordinal_1140
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10019200
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
call sub.mfc140.dll_Ordinal_10421
push dword [ebx + 0x2b0]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0x2b0]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [ebp - 0x804]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x804]
push eax
lea esi, [ebx + 0x128]
push str._scrrpt.lng
push esi
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 8
mov ecx, esp
push esi
call dword [sym.imp.mfc140.dll_Ordinal_300]
push 0x3ec
mov ecx, ebx
call fcn.100188f0
mov ecx, ebx
call fcn.10018ad0
mov ecx, esi
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
mov ecx, ebx
call sub.mfc140.dll_Ordinal_14421
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x404]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
inc eax
mov ecx, ebx
push eax
call sub.mfc140.dll_Ordinal_14054
lea eax, [ebp - 0x814]
xorps xmm0, xmm0
push eax
push dword [ebx + 0x20]
movups xmmword [ebp - 0x814], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x3ed
mov ecx, ebx
call sub.mfc140.dll_Ordinal_5401
lea esi, [ebx + 0xa8]
push esi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
mov ecx, ebx
call sub.mfc140.dll_Ordinal_12969
push 0x3ee
mov ecx, ebx
call sub.mfc140.dll_Ordinal_5401
lea esi, [ebx + 0xb8]
push esi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
mov ecx, ebx
call sub.mfc140.dll_Ordinal_12969
push dword [ebx + 0x29c]
mov ecx, ebx
call fcn.10019750
push 0x43
push 0
push 0
push 0
push 0
push dword [sym.imp.mfc140.dll_Ordinal_14514]
mov ecx, ebx
call sub.mfc140.dll_Ordinal_14048
push 0
mov ecx, ebx
call sub.mfc140.dll_Ordinal_2748
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.100337f6
mov esp, ebp
pop ebp
ret
Function at 0x1001b8a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1001b959
push 0x5c
push ebx
xor edi, edi
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x1001b943
nop word [eax + eax]
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, esi
sub eax, ebx
push eax
lea eax, [ebp - 0x404]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy]
add esp, 0x18
lea eax, [ebp - 0x404]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1001b92d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001b92d
test edi, edi
jne 0x1001b959
lea eax, [esi + 1]
inc edi
push 0x5c
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x1001b8e0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100337f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100337f6
mov esp, ebp
pop ebp
ret
Function at 0x1001c0c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100365f9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push 0x10
push eax
xorps xmm0, xmm0
push 0x59
push 0x800
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x10
lea eax, [ebp - 0x20]
push eax
push 0x5a
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push 0x1003a1f8
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x10
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
sub edi, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x1001c152
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100337f6
mov esp, ebp
pop ebp
ret
Function at 0x1001d9e0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036638
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x418]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebp - 0x414]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea eax, [ebp - 0x414]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.1001d730
add esp, 8
lea ecx, [ebp - 0x414]
call dword [sym.imp.mfc140.dll_Ordinal_8146]
test al, al
lea eax, [ebp - 0x410]
jne 0x1001da8a
push dword [ebp - 0x414]
push dword [ebp - 0x418]
push 0x1003a178
push eax
call fcn.1001a8c0
add esp, 0x10
jmp 0x1001da9e
push dword [ebp - 0x418]
push 0x1003a180
push eax
call fcn.1001a8c0
add esp, 0xc
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
mov edi, 1
nop word [eax + eax]
push dword [ebp - 0x424]
call sub.mfc140.dll_Ordinal_265
push dword [ebp - 0x420]
mov ebx, eax
call sub.mfc140.dll_Ordinal_265
add esp, 8
mov dword [ebp - 0x41c], eax
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0x420]
push ecx
push eax
lea eax, [ebp - 0x424]
push eax
push ebx
lea eax, [ebp - 0x410]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x1001db87
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001db32
test edi, edi
je 0x1001db83
push ebx
call sub.mfc140.dll_Ordinal_266
push dword [ebp - 0x41c]
call sub.mfc140.dll_Ordinal_266
add esp, 8
xor edi, edi
jmp 0x1001dac0
lea ecx, [ebp - 0x414]
call dword [sym.imp.mfc140.dll_Ordinal_8146]
test al, al
jne 0x1001db83
push 0x100389e0
lea ecx, [ebp - 0x414]
call dword [sym.imp.mfc140.dll_Ordinal_1529]
push dword [ebp - 0x418]
lea eax, [ebp - 0x410]
push 0x1003a180
push eax
call fcn.1001a8c0
push ebx
call sub.mfc140.dll_Ordinal_266
push dword [ebp - 0x41c]
call sub.mfc140.dll_Ordinal_266
add esp, 0x14
jmp 0x1001dab2
xor ebx, ebx
jmp 0x1001dbec
lea eax, [ebp - 0x428]
push ebx
push eax
call fcn.10020650
add esp, 8
lea ecx, [ebp - 0x428]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1001dba7
push ebx
call sub.mfc140.dll_Ordinal_266
push dword [ebp - 0x41c]
call sub.mfc140.dll_Ordinal_266
add esp, 8
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001dbd0
sub esi, ecx
lea ecx, [ebp - 0x428]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
xor ebx, ebx
test esi, esi
setne bl
lea ecx, [ebp - 0x414]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x418]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100337f6
mov esp, ebp
pop ebp
ret
Function at 0x1001e100
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x10042074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x9c]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
push eax
mov dword [edi], 0
mov dword [ebx], 0
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0xa0]
add esp, 0xc
mov dword [ebp - 0xa0], 0x9c
push eax
call esi
test eax, eax
jne 0x1001e183
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], 0x94
push eax
call esi
test eax, eax
jne 0x1001e183
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100337f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x98]
cmp ecx, 6
jne 0x1001e1f9
cmp eax, 2
jne 0x1001e1f9
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push pe_nt_image_headers32
mov esi, eax
lea eax, [ebp - 0x1b8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1bc], 0x11c
lea eax, [ebp - 0x1bc]
push eax
call esi
test eax, eax
jne 0x1001e1ed
mov ecx, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b4]
jmp 0x1001e1f9
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x9c]
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
mov dword [ebx], eax
xor ecx, ebp
pop esi
mov eax, 1
pop ebx
call fcn.100337f6
mov esp, ebp
pop ebp
ret