joyce8/EMBER2024-capa huggingface dataset:
Function at 0x122493a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x1204b40], 1
jne 0x1224a65
push 0xb
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.012101c9
add esp, 0xc
xor esp, 0
jl 0x122496d
jns 0x1224967
mov ebx, ebx
jge 0x122496d
mov ebp, 0xe845c6a6
dec eax
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x47
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x66
cld
or edx, edx
jl 0x12249b3
pushf
je 0x12249a2
xor edi, dword [esp + 0x10]
xor edi, dword [esp + 0x10]
lea esi, [esi]
popf
jp 0x12249b0
jge 0x12249b3
or dword [edx - 0x167f17b3], 0xe84d8801
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
call fcn.01210cba
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1224a20
mov eax, dword [ebp + 8]
jmp 0x1224adc
jp 0x1224a22
xchg esp, esp
jnp 0x1224a2d
mov esp, esp
jp 0x1224a2a
jp 0x1224a2d
mov edi, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.01227c60
mov dword [ebp - 8], eax
push 0xb
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x1224a5e
mov edx, dword [ebp - 8]
mov dword [0x1204b40], edx
jmp 0x1224a63
mov eax, dword [ebp + 8]
jmp 0x1224adc
jmp 0x1224a6d
mov eax, dword [0x1204b40]
mov dword [ebp - 8], eax
nop
rol ebx, 3
rol ebx, 0x1d
xor edi, 0
test edx, 0x32d4
jl 0x1224a8b
xchg ecx, eax
xchg ecx, eax
jns 0x1224a83
jno 0x1224a85
jge 0x1224a87
jge 0x1224a8b
mov esi, 0xf84d8b7a
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, esi
xchg esp, esp
ja 0x1224aa4
pushf
jg 0x1224a9b
popf
xchg edi, edi
xchg ecx, ecx
jbe 0x1224aa4
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.01225301
add esp, 4
test esp, 0x157b
jo 0x1224ad5
pushf
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
cmc
call 0x1224ac8
add esp, 4
popf
nop
jbe 0x1224ad0
ja 0x1224ad2
jno 0x1224ad5
mov ebx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1225606
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.012101c9
add esp, 0xc
jae 0x1225628
lea esi, [esi + 0x69db]
lea esi, [esi - 0x69db]
xor esi, dword [esp + 4]
xor esi, dword [esp + 4]
jg 0x122564d
pushf
jnp 0x1225642
stc
popf
ja 0x1225647
nop
jle 0x122564a
jle 0x122564d
sub eax, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
ror edx, 0x1e
rol edx, 0x1e
jge 0x1225709
jne 0x1225700
nop
jae 0x1225703
jp 0x1225705
jl 0x1225709
mov esi, 0xb5ace80e
invalid
call fcn.01210cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x122571e
xor eax, eax
jmp 0x12257a9
inc ebx
dec ebx
jg 0x1225722
mov edx, edx
test esp, 0x1ab3
je 0x1225736
jmp 0x122572e
xchg edi, eax
xchg edi, eax
lea esp, [esp]
jne 0x1225736
call 0x540aacc7
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.01227c60
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x1225760
xor eax, eax
jmp 0x12257a9
lea esi, [esi + 0x4511]
lea esi, [esi - 0x4511]
xor esi, ecx
xor esi, ecx
ja 0x1225777
xchg ecx, ecx
jbe 0x1225777
ljmp 0x81e8:0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.01225301
add esp, 4
call 0x1225788
lea esp, [esp + 4]
mov eax, eax
jle 0x1225790
je 0x122579e
je 0x1225794
jmp 0x1225796
jg 0x1225798
ja 0x122579a
jne 0x122579e
add eax, 0xc458b6e
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x122e52b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.012101c9
add esp, 0xc
jmp 0x122e546
cld
jge 0x122e554
pushf
jge 0x122e54d
popf
xchg ecx, ecx
jl 0x122e554
mov ecx, 0x44ec45c6
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 9], 0
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x6d
jl 0x122e586
stc
or edx, 0
cmc
jns 0x122e59d
pushf
jle 0x122e591
test dword [esp], edx
popf
xchg esi, edx
xchg esi, edx
js 0x122e59d
mov esp, 0x80ec4d8a
jmp 0xed706da7
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.01210cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x122e60f
xor eax, eax
jmp 0x122e689
rol esp, 0
shl esp, 0
shr edx, 0
cmp edi, 0x5798
je 0x122e625
xchg esi, esi
jne 0x122e625
mov ebp, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.01227c60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x122e64f
xor eax, eax
jmp 0x122e689
mov esp, esp
je 0x122e660
pushf
jb 0x122e657
popf
jns 0x122e65b
jbe 0x122e65d
jne 0x122e660
mov edi, 0x50fc458b
mov eax, dword [ebp - 4]
push eax
call fcn.01225301
add esp, 4
jae 0x122e66e
xor ebx, 0x7bb
xor ebx, 0x7bb
js 0x122e682
nop
xchg esp, esp
jns 0x122e682
call 0x522b3411
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x12306c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xf
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.012101c9
add esp, 0xc
ror eax, 8
ror eax, 0x18
jg 0x12306fa
jne 0x12306f0
jns 0x12306f2
lea edi, [edi]
lea esp, [esp]
jle 0x12306fa
mov esi, 0x51ec45c6
mov byte [ebp - 0x14], 0x51
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xa], 0x6a
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x34
mov byte [ebp - 8], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 7], 0x75
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 6], 0
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0xb]
sub cl, 1
mov byte [ebp - 0xb], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
call fcn.01210cba
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x12307c2
xor eax, eax
jmp 0x123082f
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.01227c60
mov dword [ebp - 0x18], eax
push 0xf
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 0x18], 0
jne 0x12307ec
xor eax, eax
jmp 0x123082f
jg 0x12307ee
js 0x123080c
pushf
jl 0x12307f4
jo 0x12307f6
popf
jo 0x12307fa
lea ecx, [ecx + 0x2a55]
lea ecx, [ecx - 0x2a55]
lea esp, [esp]
jns 0x123080c
mov ecx, 0x50e8458b
mov eax, dword [ebp - 0x18]
push eax
call fcn.01225301
add esp, 4
test eax, esi
mov esp, esp
jge 0x1230824
jae 0x1230820
jl 0x1230824
sub eax, 0xc4d8b2f
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1230bd1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.012101c9
add esp, 0xc
cmc
add edi, 0
jns 0x1230c05
pushf
cmp edx, dword [esp + 0x10]
and esp, 0xffffffff
shl edx, 0
popf
jge 0x1230c00
jle 0x1230c02
js 0x1230c05
mov esp, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
jl 0x1230c37
test dword [esp], eax
add esi, dword [esp]
sub esi, dword [esp]
jbe 0x1230c4e
jno 0x1230c44
jns 0x1230c46
jae 0x1230c48
je 0x1230c4a
ja 0x1230c4e
ljmp 0xe980:0xec4d8abd
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov edi, edi
jl 0x1230cb2
je 0x1230cc7
pushf
rol ecx, 4
rol ecx, 0x1c
popf
xchg esp, esp
jl 0x1230cc2
jge 0x1230cc4
jne 0x1230cc7
mov edi, 0xfdffeee8
dec dword [ecx + 0x7d83f845]
clc
add byte [ebp + 7], dh
call fcn.01210cba
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1230cdc
xor eax, eax
jmp 0x1230d5c
std
cld
jns 0x1230ce9
js 0x1230ce2
xchg edx, edx
nop
js 0x1230ce9
ljmp 0x8b50:0xec458d0e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.01227c60
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.012101c9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x1230d46
shl edi, 0
mov ebx, ebx
jno 0x1230d1d
jne 0x1230d18
nop
jo 0x1230d1d
mov eax, 0xfc458b9e
mov eax, dword [ebp - 4]
push eax
call fcn.01225301
add esp, 4
test edx, 0x2bfe
je 0x1230d31
jne 0x1230d3d
jg 0x1230d35
jno 0x1230d37
lea eax, [eax]
je 0x1230d3d
sub eax, 0x84d8bc4
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x1230d5c
cmp eax, dword [esp + 0x10]
ror edi, 3
rol edi, 3
jp 0x1230d5a
nop
je 0x1230d55
lea esi, [esi]
jnp 0x1230d5a
add eax, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1232db5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.012101c9
add esp, 0xc
shr edi, 0
jns 0x1232dda
jp 0x1232de7
jbe 0x1232dde
jnp 0x1232de0
jp 0x1232de2
xchg esp, esp
jnp 0x1232de7
mov ecx, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
lea ecx, [ecx + 0xc9a]
lea ecx, [ecx - 0xc9a]
mov esp, esp
jp 0x1232e31
jle 0x1232e29
jnp 0x1232e2b
jl 0x1232e2d
jnp 0x1232e31
ljmp 0xe980:0xf04d8ac8
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 7]
sub cl, 1
mov byte [ebp - 7], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
lea edi, [edi + 0x7044]
sub edi, 0x7044
clc
test dword [esp + 0x10], edx
xor edx, esi
xor edx, esi
je 0x1232eb7
pushf
add edx, dword [esp]
sub edx, dword [esp]
popf
lea eax, [eax]
jne 0x1232eb7
add eax, 0xfdbb40e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.0120e9fc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1232ec9
xor eax, eax
jmp 0x1232f08
lea ecx, [ecx]
jle 0x1232ee5
pushf
shr esi, 0
popf
lea edx, [edx + 0x3104]
lea edx, [edx - 0x3104]
mov esp, esp
jg 0x1232ee5
add eax, 0x50f0458d
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.01227c60
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.012101c9
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001080
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8004
call fcn.1000db20
mov eax, dword [0x10047140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100484a0], 0
je 0x100010c8
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x8004]
push 0x7fff
push eax
call fcn.1000d7b0
add esp, 0x10
lea eax, [ebp - 0x8004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000db11
mov esp, ebp
pop ebp
ret

Function at 0x100010e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10004
call fcn.1000db20
mov eax, dword [0x10047140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100484a0], 0
je 0x10001128
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.1000daf6
add esp, 0x10
lea eax, [ebp - 0x10004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000db11
mov esp, ebp
pop ebp
ret

Function at 0x10002b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x10002bbd
xor byte [edx], 0x88
push esi
mov esi, dword [ebp + 0xc]
mov eax, 1
cmp esi, eax
jbe 0x10002bbc
lea ebx, [ebx]
mov cl, byte [eax + edx - 1]
xor byte [eax + edx], cl
inc eax
cmp eax, esi
jb 0x10002bb0
pop esi
pop ebp
ret
Function at 0x10002e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10002ebb
push ebx
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov bl, 0x88
test edi, edi
je 0x10002eb9
mov dl, byte [eax + esi]
mov cl, dl
xor cl, bl
mov byte [eax + esi], cl
inc eax
mov bl, dl
cmp eax, edi
jb 0x10002ea8
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x10005ba0
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020c
call fcn.1000db20
mov eax, dword [0x10047140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x18]
push edi
push ebx
push eax
push ecx
push esi
push str._SKUtil__CheckUpgradeRule_IniPath___s_Section___s__Key___s_BaseVersion___s_BaseVType___s
call fcn.100010e0
add esp, 0x18
test edi, edi
je 0x10005ce3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10005ce3
push esi
push 0x7fff
lea eax, [ebp - 0x1020c]
push eax
push 0x10036b08
push str.UpgradeFromOrg
push 0x10037c04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x1020c]
push 0x10037c0c
push eax
call fcn.1000ec9b
mov esi, eax
add esp, 8
test esi, esi
je 0x10005ce3
push ebx
push esi
call fcn.1000ea04
add esp, 8
test eax, eax
je 0x10005cca
lea edx, [ebp - 0x20c]
mov ecx, ebx
sub edx, ebx
mov edi, edi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10005c50
lea eax, [ebp - 0x20c]
push eax
push 0x10037c10
call fcn.100010e0
push 0x10037c80
push esi
call fcn.1000ec9b
push 0x10037c80
push 0
call fcn.1000ec9b
push 0x10037c80
push 0
call fcn.1000ec9b
push 0x10037c84
push eax
call fcn.1000ec9b
mov esi, eax
add esp, 0x28
test esi, esi
je 0x10005cca
push edi
push esi
call fcn.1000ed4e
add esp, 8
test eax, eax
je 0x10005cf6
push 0x10037c84
push 0
call fcn.1000ec9b
mov esi, eax
add esp, 8
test esi, esi
jne 0x10005ca7
push 0x10037c0c
push 0
call fcn.1000ec9b
mov esi, eax
add esp, 8
test esi, esi
jne 0x10005c32
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000db11
mov esp, ebp
pop ebp
ret
push esi
push 0x10037c88
call fcn.100010e0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
mov eax, 1
pop ebx
call fcn.1000db11
mov esp, ebp
pop ebp
ret
Function at 0x10006250
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x10047140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.100105b0
lea edx, [ebp - 0x20c]
add esp, 0xc
mov eax, ebx
sub edx, ebx
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x10006290
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
jmp 0x100062b0
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x100062b0
mov eax, dword [0x10036b78]
mov dword [ecx], eax
mov ax, word [0x10036b7c]
push ebx
push str._SKUtil__SK_DeleteFolderW_pwszFolder___s
mov word [ecx + 4], ax
call fcn.100010e0
add esp, 8
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x460], eax
cmp eax, 0xffffffff
je 0x100063e6
push esi
push edi
push str._SKUtil__Deletefolder_start
call fcn.10001080
mov esi, ebx
add esp, 4
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10006312
sub esi, ecx
sar esi, 1
xor ecx, ecx
lea eax, [esi + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000f93e
push esi
mov edi, eax
push ebx
push edi
call fcn.1000e9ba
xor eax, eax
mov dword [edi + esi*2], eax
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x474], eax
mov eax, 0x54
add esp, 0x10
mov word [ebp - 0x470], ax
lea eax, [ebp - 0x480]
push eax
mov dword [ebp - 0x47c], 3
mov dword [ebp - 0x478], edi
mov dword [ebp - 0x46e], 0
mov dword [ebp - 0x466], 0
mov dword [ebp - 0x46a], 0
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push edi
mov esi, eax
call fcn.1000f947
push str._SKUtil__Deletefolder_end
call fcn.10001080
add esp, 8
test esi, esi
pop edi
pop esi
je 0x100063c8
push ebx
push str._SKUtil_::DeleteFolderW__pwszFolder___s_Delete_Fail_
call fcn.100010e0
add esp, 8
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_FindClose]
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000db11
mov esp, ebp
pop ebp
ret
push ebx
push str._SKUtil_::DeleteFolderW__pwszFolder___s_Not_exist_
call fcn.10001080
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.1000db11
mov esp, ebp
pop ebp
ret
Function at 0x10006410
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x10047140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
or edi, 0xffffffff
call fcn.100105b0
lea edx, [ebp - 0x20c]
add esp, 0xc
mov ecx, esi
sub edx, esi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10006454
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
lea esp, [esp]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10006470
mov eax, dword [0x10036b78]
mov dword [ecx], eax
mov ax, word [0x10036b7c]
push esi
push str._SKUtil_::SK_DeleteFolderW2_pwszFolder___s
mov word [ecx + 4], ax
call fcn.100010e0
add esp, 8
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
push esi
cmp ebx, 0xffffffff
je 0x10006510
call fcn.10002bc0
add esp, 4
cmp eax, 1
jne 0x100064c8
xor edi, edi
jmp 0x100064d6
push esi
push str._SKUtil_::SK_DeleteFolderW2_pwszFolder___s_Delete_Fail_
call fcn.100010e0
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1000651d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str._SKUtil__RemoveDirectoryW__s_Fail__Error_Code___d
call fcn.100010e0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000db11
mov esp, ebp
pop ebp
ret
push str._SKUtil_::SK_DeleteFolderW2_pwszFolder___s_Not_exist_
call fcn.100010e0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000db11
mov esp, ebp
pop ebp
ret