joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100742ea
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor dl, dl
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x10074446
push ebx
push edi
push 0x29
mov eax, ecx
pop edi
mov ebx, 0x10000000
cmp eax, 0x7c
je 0x10074444
cmp eax, edi
jne 0x1007432d
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x10074444
cmp eax, edi
jne 0x1007432d
test dword [esi + 0x50], ebx
je 0x10074452
cmp eax, 0x2e
jne 0x10074348
push 5
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov ecx, esi
call fcn.10075f9d
jmp 0x1007442d
cmp eax, 0x5c
jne 0x1007439a
mov ecx, esi
call fcn.10075f9d
test byte [esi + 0x50], 0x80
je 0x1007438e
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x10074377
push 4
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov ecx, esi
call fcn.10075f9d
jmp 0x10074434
cmp al, 0x42
jne 0x1007438e
push 4
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x1007436b
mov ecx, esi
call fcn.1007445c
jmp 0x1007442d
cmp eax, 0x5b
jne 0x100743ba
mov ecx, esi
call fcn.10075f9d
mov ecx, esi
call fcn.10074a69
cmp dword [esi + 0x4c], 0x5d
je 0x1007433c
push 4
jmp 0x10074454
cmp eax, 0x28
jne 0x100743d6
mov ecx, esi
call fcn.10075f9d
mov ecx, esi
call fcn.100762c0
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x10074452
jmp 0x10074422
cmp eax, 0x5e
jne 0x100743df
push 2
jmp 0x10074363
cmp eax, 0x24
jne 0x100743eb
push 3
jmp 0x10074363
cmp eax, 0x2a
je 0x1007444e
cmp eax, 0x2b
je 0x1007444e
cmp eax, 0x3f
je 0x1007444e
cmp eax, 0x7b
je 0x1007444e
cmp ecx, 0x7d
jne 0x10074409
test dword [esi + 0x50], ebx
je 0x1007444a
cmp ecx, 0x5d
jne 0x10074413
test dword [esi + 0x50], ebx
je 0x100743b3
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10042e1e
mov bl, 1
mov ecx, esi
call fcn.10075f9d
test bl, bl
je 0x10074434
mov ecx, esi
call fcn.10075fcd
mov ecx, dword [esi + 0x4c]
mov dl, 1
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x10074302
pop edi
pop ebx
mov al, dl
pop esi
ret
push 6
jmp 0x10074454
push 0xa
jmp 0x10074454
push 5
mov ecx, esi
call fcn.10042e1e
int3
Function at 0x100b010b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x100b011d
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x100b0162
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret

Function at 0x100b01d6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100b01df
pop esi
ret
Function at 0x100bdf4f
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor dl, dl
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x100be0ab
push ebx
push edi
push 0x29
mov eax, ecx
pop edi
mov ebx, 0x10000000
cmp eax, 0x7c
je 0x100be0a9
cmp eax, edi
jne 0x100bdf92
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x100be0a9
cmp eax, edi
jne 0x100bdf92
test dword [esi + 0x50], ebx
je 0x100be0b7
cmp eax, 0x2e
jne 0x100bdfad
push 5
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov ecx, esi
call fcn.100c09cf
jmp 0x100be092
cmp eax, 0x5c
jne 0x100bdfff
mov ecx, esi
call fcn.100c09cf
test byte [esi + 0x50], 0x80
je 0x100bdff3
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x100bdfdc
push 4
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov ecx, esi
call fcn.100c09cf
jmp 0x100be099
cmp al, 0x42
jne 0x100bdff3
push 4
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100bdfd0
mov ecx, esi
call fcn.100be236
jmp 0x100be092
cmp eax, 0x5b
jne 0x100be01f
mov ecx, esi
call fcn.100c09cf
mov ecx, esi
call fcn.100be5d9
cmp dword [esi + 0x4c], 0x5d
je 0x100bdfa1
push 4
jmp 0x100be0b9
cmp eax, 0x28
jne 0x100be03b
mov ecx, esi
call fcn.100c09cf
mov ecx, esi
call fcn.100c13e6
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x100be0b7
jmp 0x100be087
cmp eax, 0x5e
jne 0x100be044
push 2
jmp 0x100bdfc8
cmp eax, 0x24
jne 0x100be050
push 3
jmp 0x100bdfc8
cmp eax, 0x2a
je 0x100be0b3
cmp eax, 0x2b
je 0x100be0b3
cmp eax, 0x3f
je 0x100be0b3
cmp eax, 0x7b
je 0x100be0b3
cmp ecx, 0x7d
jne 0x100be06e
test dword [esi + 0x50], ebx
je 0x100be0af
cmp ecx, 0x5d
jne 0x100be078
test dword [esi + 0x50], ebx
je 0x100be018
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10042e1e
mov bl, 1
mov ecx, esi
call fcn.100c09cf
test bl, bl
je 0x100be099
mov ecx, esi
call fcn.100c0a30
mov ecx, dword [esi + 0x4c]
mov dl, 1
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x100bdf67
pop edi
pop ebx
mov al, dl
pop esi
ret
push 6
jmp 0x100be0b9
push 0xa
jmp 0x100be0b9
push 5
mov ecx, esi
call fcn.10042e1e
int3
Function at 0x100be0c1
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor dl, dl
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x100be220
push ebx
push edi
push 0x29
mov eax, ecx
pop edi
mov ebx, 0x10000000
cmp eax, 0x7c
je 0x100be21e
cmp eax, edi
jne 0x100be104
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x100be21e
cmp eax, edi
jne 0x100be104
test dword [esi + 0x50], ebx
je 0x100be22c
cmp eax, 0x2e
jne 0x100be11f
push 5
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov ecx, esi
call fcn.100c09ff
jmp 0x100be207
cmp eax, 0x5c
jne 0x100be174
mov ecx, esi
call fcn.100c09ff
test byte [esi + 0x50], 0x80
je 0x100be168
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x100be150
push 4
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov ecx, esi
call fcn.100c09ff
jmp 0x100be20e
cmp eax, 0x42
jne 0x100be168
push 4
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100be144
mov ecx, esi
call fcn.100be2e2
jmp 0x100be207
cmp eax, 0x5b
jne 0x100be194
mov ecx, esi
call fcn.100c09ff
mov ecx, esi
call fcn.100be622
cmp dword [esi + 0x4c], 0x5d
je 0x100be113
push 4
jmp 0x100be22e
cmp eax, 0x28
jne 0x100be1b0
mov ecx, esi
call fcn.100c09ff
mov ecx, esi
call fcn.100c1465
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x100be22c
jmp 0x100be1fc
cmp eax, 0x5e
jne 0x100be1b9
push 2
jmp 0x100be13c
cmp eax, 0x24
jne 0x100be1c5
push 3
jmp 0x100be13c
cmp eax, 0x2a
je 0x100be228
cmp eax, 0x2b
je 0x100be228
cmp eax, 0x3f
je 0x100be228
cmp eax, 0x7b
je 0x100be228
cmp ecx, 0x7d
jne 0x100be1e3
test dword [esi + 0x50], ebx
je 0x100be224
cmp ecx, 0x5d
jne 0x100be1ed
test dword [esi + 0x50], ebx
je 0x100be18d
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10042e1e
mov bl, 1
mov ecx, esi
call fcn.100c09ff
test bl, bl
je 0x100be20e
mov ecx, esi
call fcn.100c0b07
mov ecx, dword [esi + 0x4c]
mov dl, 1
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x100be0d9
pop edi
pop ebx
mov al, dl
pop esi
ret
push 6
jmp 0x100be22e
push 0xa
jmp 0x100be22e
push 5
mov ecx, esi
call fcn.10042e1e
int3
Function at 0x100be622
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x24]
call fcn.10042e1e
cmp dword [esi + 0x4c], 0x5e
jne 0x100be642
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.100c09ff
test dword [esi + 0x50], 0x20000000
je 0x100be662
cmp dword [esi + 0x4c], 0x5d
jne 0x100be662
push 0x5d
lea ecx, [esi + 0x24]
call fcn.10042e1e
mov ecx, esi
call fcn.100c09ff
pop edi
mov ecx, esi
pop esi
jmp 0x100bed05
push edi
mov edi, ecx
call fcn.100bea6a
test eax, eax
je 0x100bedcc
push esi
cmp eax, 2
je 0x100bed9f
mov eax, dword [edi + 0x44]
movzx ecx, ax
test eax, eax
jne 0x100bed38
xor ecx, ecx
test dword [edi + 0x50], 0x100000
je 0x100bedce
cmp dword [edi + 0x4c], 0x2d
jne 0x100bed96
mov ecx, edi
call fcn.100c09ff
movzx esi, word [edi + 0x44]
mov ecx, edi
call fcn.100bea6a
test eax, eax
je 0x100bedb4
cmp eax, 2
je 0x100bedb0
test dword [edi + 0x40], 0x800
je 0x100bed81
movzx eax, word [edi + 0x44]
mov ecx, dword [edi + 0x3c]
push eax
call fcn.100c18f3
mov ecx, dword [edi + 0x3c]
movzx eax, ax
push esi
mov dword [edi + 0x44], eax
call fcn.100c18f3
movzx esi, ax
movzx eax, word [edi + 0x44]
cmp ax, si
jb 0x100bedb0
push eax
push esi
lea ecx, [edi + 0x24]
call fcn.10042e1e
jmp 0x100bed9f
push ecx
lea ecx, [edi + 0x24]
call fcn.10042e1e
mov ecx, edi
call fcn.100bea6a
test eax, eax
jne 0x100bed16
jmp 0x100bedcb
push 8
jmp 0x100bedd0
movzx eax, word [edi + 0x44]
lea ecx, [edi + 0x24]
push eax
call fcn.10042e1e
push 0x2d
lea ecx, [edi + 0x24]
call fcn.10042e1e
pop esi
pop edi
ret
push 2
mov ecx, edi
call fcn.10042e1e
int3
Function at 0x100c2fc7
Capabilities:
Create process on windows

Disassembly:
push 0x90
mov eax, 0x100ee35a
call fcn.100d38cc
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x9c], esi
inc ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 4], edx
cmp edi, eax
je 0x100c3059
mov esi, eax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
call fcn.10042e1e
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], bl
call fcn.10042e1e
push 0x1011ae40
lea ecx, [ebp - 0x28]
call fcn.10042e1e
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.10042e1e
xor edx, edx
add edi, 0x18
mov byte [ebp - 4], dl
cmp edi, esi
jne 0x100c3005
mov esi, dword [ebp - 0x9c]
push 0x44
pop edi
push edi
push edx
lea eax, [ebp - 0x84]
push eax
call sub.VCRUNTIME140.dll_memset
mov dword [ebp - 0x84], edi
lea ecx, [ebp - 0x28]
xor eax, eax
lea edi, [ebp - 0x94]
stosd dword es:[edi], eax
add esp, 0xc
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
cmp dword [esi + 0x14], 8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jb 0x100c3092
mov esi, dword [esi]
lea eax, [ebp - 0x94]
xor edi, edi
push eax
lea eax, [ebp - 0x84]
push eax
movzx eax, byte [ebp + 0x10]
push edi
push edi
xor eax, ebx
shl eax, 0x1b
push eax
push edi
push edi
push edi
push ecx
push esi
call dword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x100c30d7
push dword [ebp - 0x94]
mov ebx, edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 0x90]
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 3
call fcn.10042e1e
mov eax, ebx
call fcn.100d3876
ret
Function at 0x100c30ee
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x34
mov eax, 0x100ee38a
call fcn.100d38cc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x100c31bb
mov edi, dword [ecx + 0x10]
test edi, edi
je 0x100c31bb
cmp byte [ebp + 0x10], 0
jne 0x100c31ae
cmp dword [eax + 0x14], 0x10
jb 0x100c312b
mov eax, dword [eax]
cmp dword [ecx + 0x14], 0x10
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edx
jb 0x100c3139
mov ecx, dword [ecx]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], ecx
push eax
xor ebx, ebx
mov dword [ebp - 0x38], edi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x100c31bb
push dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.10042e1e
push dword [ebp - 0x2c]
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_LocalFree]
cmp dword [esi + 0x14], 0x10
mov eax, esi
mov dword [esi + 0x10], ebx
jb 0x100c318e
mov eax, dword [esi]
mov byte [eax], bl
mov ecx, esi
lea eax, [ebp - 0x28]
push eax
call fcn.10042e1e
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.10042e1e
xor eax, eax
jmp 0x100c31be
push esi
push ecx
push eax
call fcn.10042e1e
add esp, 0xc
jmp 0x100c31be
xor eax, eax
inc eax
call fcn.100d3876
ret

Function at 0x100c343c
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x34
mov eax, 0x100ee38a
call fcn.100d38cc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [eax + 0x10]
test edx, edx
je 0x100c3509
mov edi, dword [ecx + 0x10]
test edi, edi
je 0x100c3509
cmp byte [ebp + 0x10], 0
jne 0x100c34fc
cmp dword [eax + 0x14], 0x10
jb 0x100c3479
mov eax, dword [eax]
cmp dword [ecx + 0x14], 0x10
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edx
jb 0x100c3487
mov ecx, dword [ecx]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], ecx
push eax
xor ebx, ebx
mov dword [ebp - 0x38], edi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x40]
push eax
call sub.CRYPT32.dll_CryptProtectData
test eax, eax
je 0x100c3509
push dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.10042e1e
push dword [ebp - 0x2c]
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_LocalFree]
cmp dword [esi + 0x14], 0x10
mov eax, esi
mov dword [esi + 0x10], ebx
jb 0x100c34dc
mov eax, dword [esi]
mov byte [eax], bl
mov ecx, esi
lea eax, [ebp - 0x28]
push eax
call fcn.10042e1e
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.10042e1e
xor eax, eax
jmp 0x100c350c
push esi
push ecx
push eax
call fcn.10042e1e
add esp, 0xc
jmp 0x100c350c
xor eax, eax
inc eax
call fcn.100d3876
ret
Function at 0x100c3aed
Capabilities:
Get storage device properties

Disassembly:
push 0x50
mov eax, 0x100ee4e2
call fcn.100d38cc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
xor eax, eax
push eax
push eax
push 3
push eax
push 3
push eax
push str..PhysicalDrive0
call dword [sym.imp.kernel32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100c3b22
xor al, al
jmp 0x100c3c7a
xor eax, eax
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
lea eax, [ebp - 0x34]
push eax
push 0xc
lea eax, [ebp - 0x40]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
jne 0x100c3b65
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x100c3b1b
mov esi, dword [ebp - 0x30]
push esi
call fcn.10042e1e
push esi
mov edi, eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
push 0
push eax
push esi
push edi
push 0xc
lea eax, [ebp - 0x40]
push eax
push 0x2d1400
push ebx
call dword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
jne 0x100c3ba3
push edi
call fcn.100d3a96
pop ecx
jmp 0x100c3b5c
mov eax, dword [edi + 0x18]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], cl
mov dword [ebp - 4], ecx
test eax, eax
je 0x100c3c59
cmp eax, dword [edi + 4]
jae 0x100c3c59
add eax, edi
lea ecx, [ebp - 0x5c]
push eax
call fcn.10042e1e
push eax
lea ecx, [ebp - 0x2c]
call fcn.10042e1e
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.10042e1e
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x20
cmovae eax, dword [ebp - 0x2c]
push 0
push dword [ebp - 0x1c]
mov byte [ebp - 4], 0
push eax
call fcn.10042e1e
add esp, 0x10
lea ecx, [ebp - 0x2c]
push eax
push 0
call fcn.10042e1e
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x20
cmovae eax, dword [ebp - 0x2c]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push eax
call fcn.10042e1e
add esp, 0x10
lea ecx, [ebp - 0x2c]
inc eax
push eax
call fcn.10042e1e
push dword [ebp - 0x44]
lea eax, [ebp - 0x2c]
push eax
call fcn.10042e1e
push edi
call fcn.100d3a96
add esp, 0xc
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x100c3c69
push edi
call fcn.100d3a96
pop ecx
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
xor bl, bl
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 3
call fcn.10042e1e
mov al, bl
call fcn.100d3876
ret
Function at 0x100c3c80
Capabilities:
Get hostname

Disassembly:
push 0x43c
mov eax, 0x100ee51d
call fcn.100d38cc
mov edi, dword [ebp + 8]
mov ecx, edi
push 0xf
push str.unknown_machine
call fcn.10042e1e
push 0x200
xor ebx, ebx
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x414], 0x100
lea eax, [ebp - 0x414]
mov esi, 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push 5
call dword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x100c3df1
xor eax, eax
mov dword [ebp - 0x438], ebx
mov word [ebp - 0x448], ax
lea ecx, [ebp - 0x448]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x434], 7
push eax
call fcn.10042e1e
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x438], ebx
je 0x100c3d3e
cmp dword [ebp - 0x434], 8
lea eax, [ebp - 0x448]
push edi
cmovae eax, dword [ebp - 0x448]
push eax
call fcn.10042e1e
pop ecx
pop ecx
mov esi, ebx
jmp 0x100c3ddd
push 0x200
lea eax, [ebp - 0x410]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x418], 0x100
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
push 1
call dword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x100c3ddd
xor eax, eax
mov dword [ebp - 0x420], ebx
mov word [ebp - 0x430], ax
lea ecx, [ebp - 0x430]
lea eax, [ebp - 0x410]
mov dword [ebp - 0x41c], 7
push eax
call fcn.10042e1e
cmp dword [ebp - 0x420], 0
mov byte [ebp - 4], 1
je 0x100c3dce
cmp dword [ebp - 0x41c], 8
lea eax, [ebp - 0x430]
push edi
cmovae eax, dword [ebp - 0x430]
push eax
call fcn.10042e1e
pop ecx
pop ecx
mov esi, ebx
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 2
call fcn.10042e1e
lea ecx, [ebp - 0x448]
mov dword [ebp - 4], 3
call fcn.10042e1e
jmp 0x100c3df4
xor esi, esi
inc esi
mov eax, esi
call fcn.100d3876
ret

Function at 0x100c3e31
Capabilities:
Get session user name

Disassembly:
push 0x248
mov eax, 0x100ee55b
call fcn.100d38cc
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x220]
xor esi, esi
push eax
inc esi
lea eax, [ebp - 0x114]
push eax
push 6
lea ebx, [esi + 0x7f]
mov dword [ebp - 0x220], ebx
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x100c3ed6
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
call fcn.10042e1e
and dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x23c]
xor eax, eax
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
lea eax, [ebp - 0x114]
push eax
call fcn.10042e1e
and dword [ebp - 4], 0
lea eax, [ebp - 0x23c]
push edi
push eax
push esi
lea ecx, [ebp - 0x219]
call fcn.1004cf0e
mov bl, al
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], esi
call fcn.10042e1e
test bl, bl
je 0x100c3f52
xor esi, esi
jmp 0x100c3f52
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], ebx
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
and dword [ebp - 0x244], 0
lea ecx, [ebp - 0x254]
xor eax, eax
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
lea eax, [ebp - 0x218]
push eax
call fcn.10042e1e
push edi
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 2
push eax
push esi
lea ecx, [ebp - 0x219]
call fcn.1004cf0e
mov bl, al
lea ecx, [ebp - 0x254]
mov dword [ebp - 4], 3
call fcn.10042e1e
xor eax, eax
test bl, bl
cmovne esi, eax
mov eax, esi
call fcn.100d3876
ret
Function at 0x100c4072
Capabilities:
Get common file path

Disassembly:
push 0x3c
mov eax, 0x100ee58b
call fcn.100d393a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov ecx, eax
mov dword [ebp - 0x2c], 0xff
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], ebx
jb 0x100c409a
mov ecx, dword [eax]
mov byte [ecx], bl
lea edi, [ebp - 0x24]
mov esi, 0x1016662c
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x24]
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x100c4129
cmp dword [ebp - 0x28], 0
je 0x100c4129
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
call fcn.10042e1e
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x48]
push esi
push eax
mov byte [ebp - 4], 1
call fcn.100bd411
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.10042e1e
push 1
mov edi, 0x1011b41c
mov byte [ebp - 4], bl
push edi
mov ecx, esi
call fcn.10042e1e
push 5
push str.Adobe
mov ecx, esi
call fcn.10042e1e
push 1
push edi
mov ecx, esi
call fcn.10042e1e
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x100c4137
xor ebx, ebx
inc ebx
jmp 0x100c4137
mov eax, ebx
call fcn.100d3887
ret

Function at 0x100c413f
Capabilities:
Get common file path

Disassembly:
push 0x3c
mov eax, 0x100ee5b8
call fcn.100d393a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov ecx, eax
mov dword [ebp - 0x2c], 0xff
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], ebx
jb 0x100c4167
mov ecx, dword [eax]
mov byte [ecx], bl
lea edi, [ebp - 0x24]
mov esi, 0x1016660c
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x24]
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x100c41f6
cmp dword [ebp - 0x28], 0
je 0x100c41f6
push dword [ebp - 0x28]
lea ecx, [ebp - 0x48]
call fcn.10042e1e
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x48]
push esi
push eax
mov byte [ebp - 4], 1
call fcn.100bd411
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.10042e1e
push 1
mov edi, 0x1011b41c
mov byte [ebp - 4], bl
push edi
mov ecx, esi
call fcn.10042e1e
push 5
push str.Adobe
mov ecx, esi
call fcn.10042e1e
push 1
push edi
mov ecx, esi
call fcn.10042e1e
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x100c4204
xor ebx, ebx
inc ebx
jmp 0x100c4204
mov eax, ebx
call fcn.100d3887
ret