joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c2c3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4291a0]
jne 0x40c2cd
repz ret
jmp fcn.0040edb8

Function at 0x416054
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e88d
and dword [ebp - 4], 0
cmp dword [0x42b11c], 0
mov ebx, eax
jne 0x416105
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4161b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4236c4
push edi
call esi
test eax, eax
je 0x4161b6
push eax
call fcn.0040e81b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42b11c], eax
call esi
push eax
call fcn.0040e81b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42b120], eax
call esi
push eax
call fcn.0040e81b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42b124], eax
call esi
push eax
call fcn.0040e81b
pop ecx
mov dword [0x42b12c], eax
test eax, eax
je 0x416105
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040e81b
pop ecx
mov dword [0x42b128], eax
mov eax, dword [0x42b128]
cmp eax, ebx
je 0x41615d
cmp dword [0x42b12c], ebx
je 0x41615d
push eax
call fcn.0040e896
push dword [0x42b12c]
mov esi, eax
call fcn.0040e896
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41615d
test edi, edi
je 0x41615d
call esi
test eax, eax
je 0x416154
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x416154
test byte [ebp - 0xc], 1
jne 0x41615d
or dword [ebp + 0x10], 0x200000
jmp 0x416196
mov eax, dword [0x42b120]
cmp eax, ebx
je 0x416196
push eax
call fcn.0040e896
pop ecx
test eax, eax
je 0x416196
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416196
mov eax, dword [0x42b124]
cmp eax, ebx
je 0x416196
push eax
call fcn.0040e896
pop ecx
test eax, eax
je 0x416196
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42b11c]
call fcn.0040e896
pop ecx
test eax, eax
je 0x4161b6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4161b8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d590
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x68
mov eax, dword [0x4291a0]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push edi
mov edi, dword [esp + 0x74]
lea eax, [esp + 0x14]
push eax
push str.Software
push Ordinal_2
call esi
test eax, eax
je 0x41d5d2
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0040c2c3
add esp, 0x68
ret
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push str.SuperMenu
push edx
call esi
test eax, eax
jne 0x41d5bf
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0xc]
push eax
lea esi, [edi + 0x1c]
push esi
lea ecx, [esp + 0x24]
push ecx
push 0
push str.Font
push edx
mov dword [esp + 0x24], 0x1f
call ebp
test eax, eax
jne 0x41d6da
cmp byte [esi], al
je 0x41d6da
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push str.FontSize
push eax
mov dword [esp + 0x24], 0xa
call ebp
test eax, eax
jne 0x41d6da
push eax
lea ecx, [esp + 0x60]
push ecx
call fcn.0040c5b3
lea edx, [eax + eax*4]
add edx, edx
add esp, 4
push edx
call sub.LibG5IX.dll_Ordinal_299
add esp, 8
neg eax
push 0
mov dword [edi], eax
call dword [sym.imp.USER32.dll_GetDC]
lea edx, [esp + 0x3c]
mov edi, eax
mov dword [esp + 0x14], 0
mov byte [esp + 0x37], 1
mov eax, esi
sub edx, esi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x41d690
push 0
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x43], cl
push 0x41d570
lea ecx, [esp + 0x2c]
push ecx
push edi
call dword [sym.imp.GDI32.dll_EnumFontFamiliesExA]
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
cmp dword [esp + 0x14], eax
pop ebp
pop edi
setne al
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0040c2c3
add esp, 0x68
ret
mov ecx, dword [esp + 0x70]
pop ebp
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040c2c3
add esp, 0x68
ret
Function at 0x41e090
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xa4
mov eax, dword [0x4291a0]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
push edi
mov edi, dword [esp + 0xb0]
push 0x50
lea eax, [esp + 0x5c]
push eax
push str.DEPURAR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
je 0x41e0d9
push 0
push str.Aviso
push str.nndo_a_depurar
push 0
call esi
call fcn.0041d400
cmp dword [esp + 0xb4], 0
jne 0x41e1c3
push edi
call fcn.0041e010
add esp, 4
test eax, eax
je 0x41e1d3
push 0x4266b0
call sub.LibG5IX.dll_Ordinal_334
call sub.LibG5IX.dll_Ordinal_207
push eax
lea ecx, [esp + 0x10]
push str.usrdirg5_s.zz
push ecx
call fcn.0040c0c2
call fcn.0040cd9a
add eax, 0x40
push eax
lea edx, [esp + 0x1c]
push 0x42428c
push edx
call fcn.0041e865
add esp, 0x1c
mov dword [0x4266e4], eax
test eax, eax
je 0x41e153
push 0
call fcn.0040cd9a
add eax, 0x40
push eax
call fcn.0041e764
add esp, 8
call fcn.0040cd9a
add eax, 0x20
push eax
lea eax, [esp + 0xc]
push 0x42428c
push eax
call fcn.0041e865
add esp, 0xc
mov dword [0x4266e4], eax
test eax, eax
je 0x41e18a
push 0
call fcn.0040cd9a
add eax, 0x20
push eax
call fcn.0041e764
add esp, 8
mov ecx, dword [esp + 0xbc]
push ecx
push edi
call fcn.0041d6f0
add esp, 8
test eax, eax
je 0x41e1d3
mov edx, dword [0x42a7a4]
mov eax, dword [0x42a7a0]
push edx
push eax
call fcn.00402220
mov ecx, dword [0x426718]
add esp, 8
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x41e1d3
push 0x10
push str.Error
push str.No_se_pueden_ejecutar_dos_versiones
push 0
call esi
mov ecx, dword [esp + 0xa8]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040c2c3
add esp, 0xa4
ret 0x10
Function at 0x408962
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x4085d8
and ebx, edi
call fcn.00408992
mov edi, 0x82d89dd4
add edi, edi
xor dword [edx], esi
inc edx
and edi, edi
add edi, 0x1b9abf0b
cmp edx, ecx
jne fcn.00408962
add ebx, 0x181a37b4
ret
Function at 0x10002130
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x2c
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x30
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x10002120
mov dword [esp + 0x1c], esi
push eax
mov dword [esp + 0x34], 0x100d4e38
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x100021ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegisterClassEx_fail__code:__d_
push 3
push 0x67
push 0x100d4e90
push 0x100d4ed0
call fcn.100c3e10
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0
push 0
push 0x64
push 0x64
push 0x64
push 0x64
push 0xcf0000
push 0x100d4ee4
push str.keyboard
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x1000220d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateWindowEx_fail__code:__d_
push 3
push 0x6d
push 0x100d4f4c
push str.CreateWnd
call fcn.100c3e10
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x100f0614
mov byte [0x100f062c], 0
mov dword [0x100f0630], 0
mov dword [0x100f0634], 0
mov dword [0x100f0638], 0
mov dword [0x100f0650], 0xf
mov dword [0x100f064c], 0
mov byte [0x100f063c], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x100f0610
push 0x10005bb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100f0610], eax
mov eax, 0x100f0610
mov esp, ebp
pop ebp
ret
Function at 0x100074e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], edi
call fcn.10007900
test eax, eax
jne 0x1000754b
cmp byte [edi + 8], al
je 0x10007506
mov byte [edi + 8], al
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.10006e00
mov ecx, dword [ebp - 4]
cmp ecx, dword [edi]
je 0x1000754b
mov esi, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
add ecx, 0x14
push eax
push ecx
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], 0
mov word [esi], ax
call fcn.10001870
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
lea eax, [ebx - 0x30]
cmp eax, 9
ja 0x1000759a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffffff00
and ax, cx
xor ecx, ecx
cmp cx, ax
jne 0x10007583
mov ecx, dword [ebp + 8]
mov dl, bl
call fcn.100073e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
mov ecx, edi
push ebx
push esi
call fcn.100076d0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x41]
cmp eax, 0x19
ja 0x10007603
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov ecx, 0xffffff00
and ax, cx
push 0x12
movzx edi, ax
call esi
mov ecx, 0xffffff00
and ax, cx
xor ecx, ecx
movzx eax, ax
cmp cx, di
jne 0x100075ea
cmp cx, ax
jne 0x100075ea
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 8]
push ebx
push esi
call fcn.100076d0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x100d66fc
call fcn.10002350
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x60]
cmp eax, 9
ja 0x10007622
mov ecx, dword [ebp + 8]
lea edx, [ebx - 0x30]
call fcn.100073e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x6a]
cmp eax, 5
ja 0x10007644
mov dl, byte [ebx + 0x100de826]
mov ecx, dword [ebp + 8]
call fcn.100073e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x70]
cmp eax, 0x17
ja 0x1000766c
mov esi, dword [ebp + 8]
lea eax, [ebx - 0x6f]
push eax
push 0x100d687c
push esi
call fcn.10008f20
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0xba]
cmp eax, 6
jbe 0x10007583
lea eax, [ebx - 0xdb]
cmp eax, 4
jbe 0x10007583
cmp ebx, 0x20
jne 0x100076a8
mov ecx, dword [ebp + 8]
push 0x100d6884
call fcn.10002350
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x100d68dc
call fcn.10002350
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100076d0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x514], ebx
push 0
mov dword [ebp - 0x518], edi
mov dword [ebp - 0x51c], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov byte [ebp - 0x104], 0
push 0xff
lea eax, [ebp - 0x103]
mov dword [ebp - 0x508], esi
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push esi
mov esi, dword [ebp + 0xc]
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [ebp - 0x50c], eax
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x304], ax
lea eax, [ebp - 0x302]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push dword [ebp - 0x508]
push 0
push 0x100
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x50c]
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x510], eax
push ecx
push eax
push str.ret:__d___s
push 1
push 0xba
push 0x100d68f8
push str.CVirtualKeyManager::GetUnicodeVal
call fcn.100c3e10
mov edx, dword [ebp - 0x510]
add esp, 0x1c
cmp edx, 0xffffffff
jne 0x10007831
mov ebx, dword [ebp - 0x50c]
mov edi, dword [ebp - 0x508]
jmp 0x100077e0
push 0xff
lea eax, [ebp - 0x403]
mov byte [ebp - 0x404], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push edi
push 0
push 0x100
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
js 0x100077e0
mov edi, dword [ebp - 0x518]
mov ebx, dword [ebp - 0x514]
mov edx, dword [ebp - 0x510]
cmp dword [edi + 0x10], 0
je 0x100078cc
cmp byte [edi + 9], 0
je 0x100078cc
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x504], ax
lea eax, [ebp - 0x502]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x504]
lea esi, [edi + 0x14]
push dword [ebp - 0x508]
push 0
push 0x100
push eax
push esi
push dword [edi + 0xc]
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_ToUnicodeEx]
push 0x100
push 0
push esi
mov dword [edi + 0x10], 0
mov byte [edi + 9], 0
mov dword [edi + 0xc], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
mov ecx, ebx
call fcn.10002350
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ce74b
mov esp, ebp
pop ebp
ret 8
cmp edx, 0xffffffff
mov dword [edi + 0x10], esi
mov ecx, 0x40
lea esi, [ebp - 0x104]
sete al
mov byte [edi + 9], al
mov eax, dword [ebp - 0x50c]
mov dword [edi + 0xc], eax
add edi, 0x14
rep movsd dword es:[edi], dword [esi]
cmp edx, 0xffffffff
jne 0x100078a9
push 0x100d6954
jmp 0x100078b0
Function at 0x10007900
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d01cb
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x63
lea eax, [ebp - 0x77]
mov byte [ebp - 0x78], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x78]
push eax
push str.keyboard_name:__s
push 1
push 0xde
push str..._srcKeyboadHookutilVirtualKeyManager.cpp
push str.CVirtualKeyManager::GetSpecialKeyBoard
call fcn.100c3a80
add esp, 0x18
mov dword [ebp - 0x7c], 0xf
cmp byte [ebp - 0x78], 0
mov dword [ebp - 0x80], 0
mov byte [ebp - 0x90], 0
jne 0x1000798d
xor ecx, ecx
jmp 0x1000799c
lea ecx, [ebp - 0x78]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007993
sub ecx, edx
push ecx
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x90]
call fcn.10006d00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x90]
mov edi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x90]
mov ebx, dword [ebp - 0x90]
lea edx, [ebp - 0x90]
mov esi, dword [ebp - 0x80]
cmp edi, 0x10
cmovae eax, ebx
cmovae ecx, ebx
add eax, esi
cmp edi, 0x10
cmovae edx, ebx
cmp edx, eax
je 0x10007a08
push dword [sym.imp.MSVCR120.dll_towlower]
push ecx
push eax
lea ecx, [ebp - 0x94]
call fcn.10007bf0
mov edi, dword [ebp - 0x7c]
add esp, 0xc
mov esi, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x90]
cmp edi, 0x10
lea ecx, [ebp - 0x90]
mov eax, 8
cmovae ecx, ebx
cmp esi, eax
cmovb eax, esi
push eax
push str.0000000a
push ecx
call fcn.10007cb0
add esp, 0xc
test eax, eax
jne 0x10007a40
cmp esi, 8
jb 0x10007a40
cmp esi, 8
setne al
test eax, eax
je 0x10007ab1
cmp edi, 0x10
lea ecx, [ebp - 0x90]
mov eax, 8
cmovae ecx, ebx
cmp esi, eax
cmovb eax, esi
push eax
push str.0000040a
push ecx
call fcn.10007cb0
add esp, 0xc
test eax, eax
jne 0x10007a78
cmp esi, 8
jb 0x10007a78
cmp esi, 8
setne al
test eax, eax
je 0x10007ab1
cmp edi, 0x10
lea eax, [ebp - 0x90]
mov ecx, 8
cmovae eax, ebx
cmp esi, 8
cmovb ecx, esi
push ecx
push str.0001040a
push eax
call fcn.10007cb0
add esp, 0xc
test eax, eax
jne 0x10007ab8
cmp esi, 8
jb 0x10007ab8
cmp esi, 8
setne al
test eax, eax
jne 0x10007ab8
mov esi, 1
jmp 0x10007b1a
push str.00000016
lea ecx, [ebp - 0x90]
call fcn.10007d90
test eax, eax
je 0x10007b0c
push str.00000416
lea ecx, [ebp - 0x90]
call fcn.10007d90
test eax, eax
je 0x10007b0c
push str.00010416
lea ecx, [ebp - 0x90]
call fcn.10007d90
test eax, eax
je 0x10007b0c
push str.00000816
lea ecx, [ebp - 0x90]
call fcn.10007d90
test eax, eax
je 0x10007b0c
xor esi, esi
jmp 0x10007b11
mov esi, 2
mov ebx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x7c]
cmp edi, 0x10
jb 0x10007b29
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce74b
mov esp, ebp
pop ebp
ret
Function at 0x10009910
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0468
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x100e7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.10009980
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x1000996b
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f010
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0946
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x444], 0
push str.C:Program_Files__x86_Windows_Assistant_AppMVConfiguration.ini
lea ecx, [ebp - 0x428]
call fcn.10006ca0
mov dword [ebp - 4], 0
mov byte [ebp - 0x410], 0
push 0x3ff
push 0
lea eax, [ebp - 0x40f]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x428]
call fcn.10004ca0
push eax
push 0x400
lea ecx, [ebp - 0x410]
push ecx
push 0
push str.UniquePC
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x410]
push edx
lea ecx, [ebp - 0x440]
call fcn.10006ca0
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x44c], esp
lea eax, [ebp - 0x440]
push eax
call fcn.100069e0
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp + 8]
call fcn.10009160
add esp, 0x18
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x444]
or ecx, 1
mov dword [ebp - 0x444], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x440]
call fcn.10004d30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10004d30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce74b
mov esp, ebp
pop ebp
ret
Function at 0x100382f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x88], 0
je 0x10038340
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x88], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100383d3
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x8c]
add ecx, 0x28
xor edx, edx
push edx
push ecx
call fcn.10027130
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
jne 0x100383a1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
sub ecx, 1
xor esi, esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x98]
cdq
push edx
push eax
push esi
push ecx
call fcn.100ced90
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.10025bb0
add esp, 0x10
mov eax, 7
jmp 0x100383f6
mov edx, 0x28
shl edx, 0
add edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov ecx, 0x20
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], cx
mov eax, 1
mov ecx, dword [ebp - 4]
mov word [ecx + 0x1e], ax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c4300
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1950
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.100c4e80
add esp, 4
cmp dword [ebp + 0x18], 0
jle 0x100c44dc
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001870
call fcn.100c4740
add esp, 0x18
test al, al
je 0x100c437f
mov bl, 1
jmp 0x100c44de
call fcn.100c4ab0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10008770
mov esi, eax
add esp, 0xc
lea eax, [ebp + 8]
cmp eax, esi
je 0x100c43cc
cmp dword [ebp + 0x1c], 8
jb 0x100c43af
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.100049f0
cmp dword [ebp - 0x14], 8
jb 0x100c43dd
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
lea eax, [ebp + 8]
push eax
call fcn.100c4950
mov ecx, dword [ebp + 0x18]
mov esi, 1
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
cmp ecx, esi
jbe 0x100c448d
cmp ecx, esi
jbe 0x100c44d1
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
cmp word [eax + esi*2], 0x5c
jne 0x100c4484
push esi
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 8]
call fcn.100081c0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp - 0x28]
push eax
call fcn.10001870
call fcn.100c4740
add esp, 0x18
test al, al
jne 0x100c446c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov byte [ebp - 4], 0
jb 0x100c4481
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp + 0x18]
inc esi
cmp ecx, esi
ja 0x100c4407
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 0
cmovae eax, dword [ebp + 8]
push eax
call edi
sub esp, 0x18
xor eax, eax
mov ecx, esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [ebp + 8]
push eax
call fcn.10001870
call fcn.100c4740
add esp, 0x18
test al, al
je 0x100c44dc
mov bl, 1
jmp 0x100c44de
push str.invalid_string_position
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xout_of_range_char_const__]
xor bl, bl
cmp dword [ebp + 0x1c], 8
jb 0x100c44ef
push dword [ebp + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce74b
mov esp, ebp
pop ebp
ret