joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
or dword [ebx + 0x4b], edx
sbb byte [ecx + 0xa], bl
call [edi + 0xec6db5c]
sahf
cwde
scasb al, byte es:[edi]
mov ah, 0xaa
xor dl, ah
sbb esp, dword [edx - 0x7c901db]
sbb al, 0x50
and ebp, esp
fimul dword [esi - 0x64]
pop esp
pushal
stosb byte es:[edi], al
push ds
ficom dword [esi]
out dx, al
cmp al, 0x9b
scasb al, byte es:[edi]
or al, 0x25
push ecx
and dword [ecx + eax*4 + 0x62a32151], esi
mov esi, 0x46da1dbe
pminub mm4, qword [0xda9f1751]
scasb al, byte es:[edi]
ficomp word [edx + ebx*8 - 0x52]
ficomp word [edx + ebx*8 - 0x52]
ficomp word [edx + ebx*8 - 0x52]
fisub word [ebx + 0x5c215125]
fisubr dword [esi + 0x5125a3de]
and dword [edx + ebx*8 - 0x52], ebx
ficomp word [edx + ebx*8 - 0x52]
ficomp word [edx + ebx*8 - 0x52]
ficomp word [edx + ebx*8 + 0x2d]
xor bl, byte [eax + 0x1d]
stosb byte es:[edi], al
cli
mov al, 0x72
in al, dx
ficom word [ebp + 0x21]
loope 0x414aee
pop esp
stosb byte es:[edi], al
out dx, eax
ficom word [edx]
popfd
push ss
push es
fsubrp st(0)
sub byte [ebp - 0x6d], ah
mov ecx, esi
wait
jne 0x414b6f
call 0xef0ba7b6
invalid
pop esp
retf 0xdeee
ja 0x414b4c
scasb al, byte es:[edi]
fsubrp st(7)
invalid
Function at 0x100010a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
push esi
xor ecx, ecx
xor esi, esi
push edi
test ebx, ebx
jle 0x10001198
mov edi, dword [ebp + 8]
nop word [eax + eax]
mov al, byte [esi + edi]
cmp al, 0x3d
jne 0x100010cd
inc ecx
cmp ecx, 2
jg 0x10001114
cmp al, 0x7f
ja 0x10001114
movzx eax, al
mov al, byte [eax + 0x100282b0]
cmp al, 0x7f
je 0x10001114
cmp al, 0x40
jae 0x100010e6
test ecx, ecx
jne 0x10001114
inc esi
inc edx
cmp esi, ebx
jl 0x100010c0
test edx, edx
je 0x10001198
mov ecx, dword [ebp + 0x14]
lea eax, [edx + edx*2]
lea eax, [eax*2 + 7]
sar eax, 3
cmp dword [ecx], eax
jge 0x1000111e
pop edi
pop esi
mov dword [ecx], eax
mov eax, 0xfffffff0
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffee
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp + 0xc], ecx
mov edi, 3
test esi, esi
jle 0x10001190
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx]
mov dl, byte [ecx + 0x100282b0]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub edi, ecx
movzx ecx, dl
mov edx, dword [ebp + 0xc]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0xc], edx
cmp edx, 4
jne 0x10001184
xor ecx, ecx
mov dword [ebp + 0xc], ecx
test edi, edi
jle 0x1000116f
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
cmp edi, 1
jle 0x1000117c
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
cmp edi, 2
jle 0x10001184
mov byte [eax], bl
inc eax
mov ecx, dword [ebp + 8]
dec esi
inc ecx
mov dword [ebp + 8], ecx
test esi, esi
jg 0x10001134
mov ecx, dword [ebp + 0x14]
sub eax, dword [ebp + 0x10]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x100011a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x68], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x100011e1
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.10002400
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x100034b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100264f7
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x1003706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x9c], 8
lea eax, [esi + 0x88]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x100034fd
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
push eax
push edi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x10003646
xor eax, eax
mov dword [ebp - 0x814], 7
push eax
push 0x10028410
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
call fcn.10002ac0
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.10012290
push edi
lea eax, [ebp - 0x810]
push 0x10028414
push eax
call fcn.10002ce0
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [esi + 5], 0
mov ecx, esi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x10003595
call fcn.10003320
mov esi, eax
jmp 0x1000359c
call fcn.10003480
mov esi, eax
lea eax, [ebp - 0x828]
cmp eax, esi
je 0x100035e9
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x100035c4
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10002bc0
xor eax, eax
mov dword [ebp - 0x814], 7
push esi
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x818], eax
mov word [ebp - 0x828], ax
call fcn.100025e0
mov eax, dword [ebp - 0x82c]
cmp eax, 8
jb 0x10003607
inc eax
lea ecx, [ebp - 0x840]
push eax
push dword [ebp - 0x840]
call fcn.10002bc0
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.1001688c
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10003644
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.10002bc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f678
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003670
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026542
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x1003706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], 0
call fcn.10012290
lea eax, [edi + 0x88]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x100036f3
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x10003739
mov eax, dword [esi]
jmp 0x1000373b
mov eax, esi
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0x810], cx
je 0x10003761
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003752
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10002ac0
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x834], 1
jb 0x1000378b
mov eax, dword [esi]
jmp 0x1000378d
mov eax, esi
mov ecx, ebx
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100037b6
test dx, dx
je 0x100037b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100037b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003790
xor eax, eax
jmp 0x100037bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10003822
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x100037f7
call fcn.10003320
push eax
mov ecx, esi
call fcn.10002530
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x10003822
inc ecx
push ecx
jmp 0x10003811
call fcn.10003480
push eax
mov ecx, esi
call fcn.10002530
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x10003822
inc eax
push eax
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.10002bc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f678
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10004a70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x1003706c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.10012290
lea eax, [esi + 0x28]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x10004aa7
mov eax, dword [eax]
push str.CfgPath
push eax
lea eax, [ebp - 0x20c]
push 0x100284b0
push eax
call fcn.10002ce0
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004ae1
lea eax, [ebp - 0x20c]
push eax
call fcn.10009db0
add esp, 4
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10012290
push str.Use.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push str._s_s
push eax
call fcn.10002ce0
add esp, 0x1c
cmp word [ebp - 0x414], 0
jne 0x10004b22
xor ecx, ecx
jmp 0x10004b3f
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004b30
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
push eax
lea ecx, [esi + 0x88]
call fcn.10002ac0
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.10012290
push str.UseCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push str._s_s
push eax
call fcn.10002ce0
add esp, 0x1c
cmp word [ebp - 0x61c], 0
jne 0x10004b93
xor ecx, ecx
jmp 0x10004baf
lea ecx, [ebp - 0x61c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004ba0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x61c]
push eax
lea ecx, [esi + 0xa0]
call fcn.10002ac0
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.10012290
lea eax, [ebp - 0xa44]
push str.CCYSPath
push eax
call fcn.1000a200
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x10004bf1
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x100284fc
push eax
call fcn.10002ce0
mov eax, dword [ebp - 0xa30]
add esp, 0xc
cmp eax, 8
jb 0x10004c24
inc eax
lea ecx, [ebp - 0xa44]
push eax
push dword [ebp - 0xa44]
call fcn.10002bc0
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004c44
lea eax, [ebp - 0x824]
push eax
call fcn.10009db0
add esp, 4
push 0x208
lea eax, [ebp - 0xa2c]
push 0
push eax
call fcn.10012290
push str.UseCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push str._s_s
push eax
call fcn.10002ce0
add esp, 0x1c
cmp word [ebp - 0xa2c], 0
jne 0x10004c85
xor ecx, ecx
jmp 0x10004c9f
lea ecx, [ebp - 0xa2c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004c90
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [esi + 0xb8]
call fcn.10002ac0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000f678
mov esp, ebp
pop ebp
ret
Function at 0x10009a40
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.1000f6b0
mov eax, dword [0x1003706c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
call fcn.1001695f
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1010], edx
call fcn.10017083
add esp, 8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push eax
push dword [edi]
mov eax, dword [edi + 0x10]
push dword [edi + 4]
inc eax
push dword [edi + 8]
push dword [edi + 0xc]
push eax
mov eax, dword [edi + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x1004]
push str.__d__d__d__d__d__d___d_:_s
push eax
call fcn.100098f0
add esp, 0x28
xor edi, edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, 1
push 0x10028890
push ebx
cmovne edi, ecx
call fcn.10016de2
mov esi, eax
add esp, 8
test esi, esi
je 0x10009b70
test edi, edi
jne 0x10009b06
push esi
push 2
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0xfeff
push 1
push eax
call fcn.1001386b
add esp, 0x10
lea eax, [ebp - 0x1004]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10009b10
sub eax, edx
sar eax, 1
push esi
add eax, eax
push eax
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.1001386b
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xd
push 1
push eax
call fcn.1001386b
push esi
push 2
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0xa
push 1
push eax
call fcn.1001386b
push esi
call fcn.100135b3
add esp, 0x34
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000f678
mov esp, ebp
pop ebp
ret

Function at 0x10009db0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, esi
lea ecx, [edi + 2]
nop
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x10009dc0
sub edi, ecx
mov edx, 2
sar edi, 1
xor ecx, ecx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000f6dd
add esp, 4
mov ebx, eax
sub eax, esi
nop
movzx ecx, word [esi]
lea esi, [esi + 2]
mov word [eax + esi - 2], cx
test cx, cx
jne 0x10009df0
xor esi, esi
mov dword [ebp + 8], 1
test edi, edi
js 0x10009e49
nop dword [eax]
cmp word [ebx + esi*2], 0x5c
jne 0x10009e3d
xor eax, eax
push ebx
mov word [ebx + esi*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10009e34
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10009e5a
mov eax, 0x5c
mov word [ebx + esi*2], ax
inc esi
cmp esi, edi
jle 0x10009e10
mov dword [ebp + 8], 1
push ebx
call fcn.1000f673
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
mov dword [ebp + 8], 0
call fcn.1000f673
mov eax, dword [ebp + 8]
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10009e80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1003706c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push 0
call fcn.1000a5f0
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10009ec0
sub ecx, edx
sar ecx, 1
je 0x10009fa2
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10009ee0
mov eax, dword [0x10028424]
push esi
mov dword [edi], eax
mov esi, ebx
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x10009ef6
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10009f10
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
pop esi
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x10009f34
mov dword [edi], eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
test eax, eax
jne 0x10009f63
lea eax, [ebp - 0x20c]
push eax
call fcn.10009db0
add esp, 4
cmp word [ebp - 0x20c], 0
jne 0x10009f71
xor ecx, ecx
jmp 0x10009f8f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10009f80
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.10002ac0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000f678
mov esp, ebp
pop ebp
ret

Function at 0x1000a140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1003706c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x10037fa8]
test al, al
jne 0x1000a1e3
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10012290
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000a1de
lea eax, [ebp - 0x20c]
push eax
call fcn.10016b2a
lea eax, [ebp - 0x20c]
push str.config_systemprofile
push eax
call fcn.1001253d
add esp, 0xc
test eax, eax
jne 0x1000a1c9
lea eax, [ebp - 0x20c]
push str.documents_and_settingslocalservice
push eax
call fcn.1001253d
add esp, 8
test eax, eax
je 0x1000a1de
mov al, 1
mov byte [0x10037fa8], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f678
mov esp, ebp
pop ebp
ret
mov al, byte [0x10037fa8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f678
mov esp, ebp
pop ebp
ret
Function at 0x1000a5f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor bl, bl
call fcn.1000a140
test al, al
je 0x1000a651
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call fcn.1000a090
add esp, 4
test al, al
je 0x1000a651
push dword [ebp + 0xc]
push 1
push dword [ebp - 4]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
mov eax, 1
cmove ebx, eax
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1000a651
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
mov eax, 1
cmovne ecx, eax
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a970
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2068
call fcn.1000f6b0
mov eax, dword [0x1003706c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1000ab7e
push 0x2000
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x2010], 0
push 0
push eax
mov dword [ebp - 0x2008], 0
call fcn.10012290
push edi
push esi
lea eax, [ebp - 0x2004]
push str.__s___s
push eax
call fcn.10002ce0
push str.EXPLORER.EXE
call fcn.1000ae30
add esp, 0x20
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000ab3b
lea eax, [ebp - 0x2010]
push eax
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000ab3b
lea eax, [ebp - 0x2008]
push eax
push 1
push 1
push 0
push 0xf01ff
push dword [ebp - 0x2010]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1000ab3b
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1000aa88
push str.WTSGetActiveConsoleSessionId
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000aa81
call eax
push 4
mov dword [ebp - 0x2014], eax
lea eax, [ebp - 0x2014]
push eax
push 0xc
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x1000ab3b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x44
lea eax, [ebp - 0x2068]
push 0
push eax
call fcn.10012290
add esp, 0xc
mov dword [ebp - 0x2068], 0x44
mov eax, 5
mov dword [ebp - 0x2060], str.WinSta0Default
mov word [ebp - 0x2038], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x203c], 1
push 0
push dword [ebp - 0x2008]
movups xmmword [ebp - 0x2024], xmm0
push eax
mov dword [ebp - 0x200c], 0
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x1000ab3b
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2068]
push eax
push 0
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2004]
push 0x430
push 0
push 0
push 0
push eax
push 0
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1000ab3b
mov eax, dword [ebp - 0x200c]
test eax, eax
je 0x1000ab3b
push eax
call sub.USERENV.dll_DestroyEnvironmentBlock
mov eax, dword [ebp - 0x2008]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000ab53
cmp eax, 0xffffffff
je 0x1000ab53
push eax
call esi
mov eax, dword [ebp - 0x2010]
test eax, eax
je 0x1000ab65
cmp eax, 0xffffffff
je 0x1000ab65
push eax
call esi
test edi, edi
jne 0x1000ab6c
push edi
call esi
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f678
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push edi
push esi
call fcn.1000a730
mov ecx, dword [ebp - 4]
add esp, 0x14
test eax, eax
setne al
xor ecx, ebp
pop edi
pop esi
call fcn.1000f678
mov esp, ebp
pop ebp
ret
Function at 0x1000ae30
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026d50
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x1003706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000af9b
push eax
lea ecx, [ebp - 0x40]
call fcn.10002d10
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.1000cad0
push 0x22c
lea eax, [ebp - 0x26c]
push 0
push eax
call fcn.10012290
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1000af82
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1000af7b
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
je 0x1000af05
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000aef6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002ac0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.1000cad0
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
mov ebx, dword [ebp - 0x28]
push ecx
push dword [ebp - 0x18]
cmovae eax, ebx
push eax
call fcn.100027c0
add esp, 0x14
test eax, eax
je 0x1000afb7
mov byte [ebp - 4], 0
cmp esi, 8
jb 0x1000af66
lea eax, [esi + 1]
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.10002bc0
lea eax, [ebp - 0x26c]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1000aed0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x1000af99
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.10002bc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f678
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
call fcn.100024e0
jmp 0x1000af84