joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100561e0
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab49e
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
push ebx
push esi
push edi
mov eax, dword [0x100db774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0
cmp dword [esi + 4], 0
mov dword [ebp - 4], 0
je 0x10056237
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x38]
mov dword [esi + 8], 0
push eax
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], 0
call fcn.10055f90
push esi
push 0
push esi
push 0x10056480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
jne 0x100562d6
call fcn.1005c2e0
test eax, eax
je 0x100562cf
call fcn.1005c2e0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100562cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1005c2e0
lea ecx, [ebp - 0xd0]
mov ebx, eax
call fcn.100068b0
mov esi, eax
push str.CWorkThread::Start__CreateThread_failed__errno
push esi
mov byte [ebp - 4], 1
call fcn.10007500
add esp, 8
mov ecx, esi
push edi
call fcn.10022680
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0xd0]
call fcn.100075c0
xor edi, edi
jmp 0x10056372
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [esi + 8], 0
mov dword [ebp - 0x10], eax
jne 0x1005636d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jae 0x10056305
push 0xa
call ebx
cmp dword [esi + 8], 0
je 0x100562f1
cmp dword [esi + 8], 0
jne 0x1005636d
call fcn.1005c2e0
test eax, eax
je 0x100562cf
call fcn.1005c2e0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 4]
call eax
test al, al
je 0x100562cf
call fcn.1005c2e0
lea ecx, [ebp - 0x168]
mov edi, eax
call fcn.100068b0
mov esi, eax
push str.CWorkThread::Start__wait_thread_running_timeout_
push esi
mov byte [ebp - 4], 2
call fcn.10007500
add esp, 8
mov ecx, esi
push dword [ebp + 8]
call fcn.10019420
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x14]
lea ecx, [ebp - 0x168]
call fcn.100075c0
xor edi, edi
jmp 0x10056372
mov edi, 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1005638a
mov esi, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005c6e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aba1b
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x100db774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x20], 8
lea esi, [edi + 0xc]
jb 0x1005c71b
mov esi, dword [esi]
push 0x180
push 0x40
push 0x8101
lea ebx, [edi + 0x24]
push esi
push ebx
call fcn.10092493
add esp, 0x14
mov dword [ebp - 0xac], eax
test eax, eax
je 0x1005c7ec
push 0x98
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.10075330
add esp, 0xc
lea ecx, [ebp - 0xa8]
push 1
push 2
call fcn.1005b4b0
push 0x100b7f6c
push dword [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [ebp - 4], 0
push str._error.__
push esi
push str.open
push eax
call fcn.1000d460
add esp, 8
push eax
call fcn.1000d460
add esp, 8
push eax
call fcn.1000d460
add esp, 8
mov ecx, eax
call fcn.10019420
push eax
call fcn.1000d460
add esp, 8
lea eax, [ebp - 0xc4]
lea ecx, [ebp - 0xa8]
push eax
call fcn.1005c830
cmp dword [eax + 0x14], 8
jb 0x1005c7cf
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xc4]
call fcn.100070c0
lea ecx, [ebp - 0xa8]
call fcn.100075c0
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x1005c805
push 2
push 0
push eax
call fcn.100929c1
add esp, 0xc
mov dword [edi + 4], eax
jmp 0x1005c80c
mov dword [edi + 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100693bc
mov esp, ebp
pop ebp
ret
Function at 0x1005cb70
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100abb18
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100db774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x44]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], esi
cmp eax, 2
je 0x1005cd52
cmp eax, 1
jne 0x1005cd6a
cmp byte [edi + 8], 0
je 0x1005cbc6
call fcn.1005c6e0
mov byte [edi + 8], 0
cmp dword [edi + 4], 0x40000000
jle 0x1005cc02
mov eax, dword [edi + 0x24]
cmp eax, 0xffffffff
je 0x1005cbe7
push eax
call fcn.1009255d
add esp, 4
mov dword [edi + 0x24], 0xffffffff
cmp dword [edi + 0x20], 8
lea eax, [edi + 0xc]
jb 0x1005cbf2
mov eax, dword [eax]
push eax
call fcn.10091a48
add esp, 4
mov ecx, edi
call fcn.1005c6e0
cmp dword [edi + 0x28], 0
jne 0x1005cc9d
push 0
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.1005c8f0
add esp, 0xc
push 2
push 0x100b7fa4
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1000aeb0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 0x10
mov ecx, dword [edi + 0x24]
cmovae eax, dword [ebp - 0x48]
cmp ecx, 0xffffffff
je 0x1005cc82
push dword [ebp - 0x38]
push eax
push ecx
call fcn.10092f92
add esp, 0xc
jmp 0x1005cc85
or eax, 0xffffffff
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x2c], eax
call fcn.10005a30
lea ecx, [ebp - 0x60]
call fcn.10005a30
jmp 0x1005cd46
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 1
push esi
push eax
call fcn.1005c8f0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
push ecx
lea ecx, [edi + 0x2c]
push ecx
push eax
call fcn.10068050
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.10005a30
test esi, esi
jne 0x1005ccf8
push 0xd
push str.write_failed.
lea ecx, [ebp - 0x28]
call fcn.1001c850
push 0x100b7fa4
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.1005ad70
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x1005cd18
mov eax, dword [eax]
mov ecx, dword [edi + 0x24]
cmp ecx, 0xffffffff
je 0x1005cd2d
push edx
push eax
push ecx
call fcn.10092f92
add esp, 0xc
jmp 0x1005cd30
or eax, 0xffffffff
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x2c], eax
call fcn.10005a30
lea ecx, [ebp - 0x28]
call fcn.10005a30
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x1005cd52
add dword [edi + 4], eax
jmp 0x1005cd6a
cmp dword [esi + 0x14], 8
jb 0x1005cd5a
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call esi
push 0x100b2550
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100693bc
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d830
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x100db774]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], ebx
test edi, edi
je 0x1005d9f8
test eax, eax
je 0x1005d9f8
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x20
jl 0x1005d9f8
push ecx
push ebx
push eax
call fcn.10075330
add esp, 0xc
push ebx
push 1
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x84], edi
test edi, edi
je 0x1005d9f8
cmp edi, 0xffffffff
je 0x1005d9f1
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.100116d0
add esp, 8
lea eax, [ebp - 0x78]
xorps xmm0, xmm0
movq qword [ebp - 0x78], xmm0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1005d9f1
mov eax, dword [ebp - 0x78]
or eax, dword [ebp - 0x74]
je 0x1005d987
push ebx
push ebx
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edx, eax
mov dword [ebp - 0x70], edx
test edx, edx
je 0x1005d9f1
mov ecx, dword [ebp - 0x74]
xorps xmm0, xmm0
movq qword [ebp - 0x8c], xmm0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jg 0x1005d987
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x8c]
jl 0x1005d920
cmp edi, esi
jae 0x1005d987
nop
sub esi, edi
sbb ecx, eax
js 0x1005d935
jg 0x1005d930
cmp esi, 0x400000
jb 0x1005d935
mov esi, 0x400000
push esi
push edi
push eax
push 4
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x1005d987
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.10011720
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
mov ecx, dword [ebp - 0x74]
add edi, 0x400000
adc eax, ebx
mov dword [ebp - 0x7c], eax
cmp eax, ecx
jge 0x1005d97b
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
jmp 0x1005d920
jg 0x1005d987
mov esi, dword [ebp - 0x78]
mov edx, dword [ebp - 0x70]
cmp edi, esi
jb 0x1005d920
lea eax, [ebp - 0x6c]
push eax
call fcn.100115c0
mov edi, dword [ebp - 0x80]
add esp, 4
xor esi, esi
nop dword [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
push 3
push edi
call fcn.1001d1a0
inc esi
add esp, 0x10
add edi, 2
cmp esi, 0x10
jl 0x1005d9a0
push dword [ebp + 0x10]
push dword [ebp - 0x80]
call fcn.10093558
add esp, 8
mov esi, 1
test ebx, ebx
je 0x1005d9dd
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x1005d9eb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100693bc
mov esp, ebp
pop ebp
ret
Function at 0x1005e040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100abcae
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100db774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
call fcn.10002dd0
mov ecx, eax
test ecx, ecx
je 0x1005e294
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 1
call fcn.10054fb0
add esp, 4
lea ecx, [ebp - 0x224]
mov esi, eax
push dword [esi + 0xc]
call fcn.100039f0
mov dword [ebp - 4], 1
call fcn.10002dd0
mov ecx, eax
test ecx, ecx
je 0x1005e29e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push str.InstallDate
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.10003930
test al, al
jne 0x1005e11c
push 0xb
push str.InstallDate
lea ecx, [ebp - 0x21c]
call fcn.10002a80
cmp dword [esi], 2
mov byte [ebp - 4], 3
jne 0x1005e137
push 4
push str.Date
lea ecx, [ebp - 0x21c]
call fcn.10002a80
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
push 0x20219
push dword [ebp - 0x224]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10008c80
mov esi, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x238]
test eax, eax
jne 0x1005e22e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10075330
add esp, 0xc
mov dword [ebp - 0x220], 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005e22e
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x1005e1db
cmp eax, 2
jne 0x1005e22e
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x1005e1f8
test al, 1
jne 0x1005e22e
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x1005e201
jmp 0x1005e22e
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e210
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10002a80
test edi, edi
je 0x1005e239
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005e257
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1005e276
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100693bc
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001a70
push 0x80004005
call fcn.10001a70
int3
Function at 0x1005e840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100abcae
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x100db774]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
call fcn.10002dd0
mov ecx, eax
test ecx, ecx
je 0x1005ea74
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 1
call fcn.10054fb0
add esp, 4
lea ecx, [ebp - 0x224]
mov eax, dword [eax + 0xc]
push eax
call fcn.100039f0
mov dword [ebp - 4], 1
call fcn.10002dd0
mov ecx, eax
test ecx, ecx
je 0x1005ea7e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x100b828c
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.10003930
test al, al
jne 0x1005e91b
push 3
push 0x100b828c
lea ecx, [ebp - 0x21c]
call fcn.10002a80
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
push 0x20219
push dword [ebp - 0x224]
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10008c80
mov esi, dword [ebp - 0x21c]
mov edi, dword [ebp - 0x238]
test eax, eax
jne 0x1005ea0e
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10075330
add esp, 0xc
mov dword [ebp - 0x220], 0x208
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005ea0e
mov eax, dword [ebp - 0x22c]
cmp eax, 1
je 0x1005e9bf
cmp eax, 2
jne 0x1005ea0e
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x1005e9dc
test al, 1
jne 0x1005ea0e
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x1005e9e5
jmp 0x1005ea0e
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1005e9f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10002a80
test edi, edi
je 0x1005ea19
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1005ea37
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 0
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x1005ea56
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100693bc
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001a70
push 0x80004005
call fcn.10001a70
int3
Function at 0x1005ead0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x100db774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x1005ec64
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.10075330
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
test esi, esi
jle 0x1005eb3f
lea eax, [ebp - 0x228]
push eax
call edi
sub esi, 1
jne 0x1005eb31
lea eax, [ebp - 0x63c]
mov dword [ebp - 0x63c], 0
push eax
call fcn.10054f90
mov ecx, dword [ebp - 0x63c]
mov edi, eax
add esp, 4
mov esi, edi
lea ecx, [ecx + ecx*4]
shl ecx, 4
add ecx, edi
cmp edi, ecx
je 0x1005ec64
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
nop dword [eax + eax]
push 0x208
lea eax, [ebp - 0x638]
push 0
push eax
call fcn.10075330
add esp, 0xc
lea eax, [ebp - 0x228]
push dword [esi + 8]
push eax
lea eax, [ebp - 0x638]
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esi]
test eax, eax
jne 0x1005ec8a
cmp ecx, 2
jne 0x1005ec4b
push 0x208
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.10075330
add esp, 0xc
mov dword [ebp - 0x20], 0x61004d
lea eax, [ebp - 0x430]
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x720065
mov dword [ebp - 0x14], 0x440050
push 0
push 0x1a
push eax
push 0
mov dword [ebp - 0x10], 0x440046
mov dword [ebp - 0xc], 0x740061
mov dword [ebp - 8], 0x61
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x1005ec77
mov eax, dword [ebp - 0x63c]
add esi, 0x50
lea eax, [eax + eax*4]
shl eax, 4
add eax, edi
cmp esi, eax
jne 0x1005eb80
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100693bc
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100693bc
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100693bc
mov esp, ebp
pop ebp
ret
Function at 0x100656f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac718
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100db774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1006937e
mov edi, eax
add esp, 4
test edi, edi
je 0x1006578d
push 1
mov dword [ebp - 4], 0
call fcn.10057401
add esp, 4
mov dword [edi + 4], eax
jmp 0x1006578f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.10057e05
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov dword [ebp - 4], 3
test edi, edi
je 0x100657f1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x100657f1
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x10065814
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10065837
cmp byte [ebp + 0xc], 0
je 0x10065823
push esi
call fcn.1005780d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10065843
mov esi, str.ios_base::badbit_set
jmp 0x10065853
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.1000b8f0
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10006d00
push 0x100d15b8
lea eax, [ebp - 0x30]
push eax
call fcn.10073fc9
int3
Function at 0x1006ab00
Capabilities:
Get number of processors
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x1006ab0f
pop ebp
jmp fcn.1006b0d0
xor eax, eax
pop ebp
ret 0xc
Function at 0x1006b0d0
Capabilities:
Get number of processors
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acb00
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100db774]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x30]
mov dword [ebp - 0x18], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x14], edi
test edi, edi
je 0x1006b110
mov eax, dword [edi]
push edi
call dword [eax]
cmp dword [esi + 0x20], 0
mov dword [ebp - 4], 0
jl 0x1006b127
mov esi, 1
jmp 0x1006b274
mov ebx, dword [ebp + 8]
mov dword [esi + 0x20], ebx
test ebx, ebx
jns 0x1006b138
xor esi, esi
jmp 0x1006b274
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1006b148
push eax
lea ecx, [esi + 0x2c]
call fcn.100039a0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1006b15a
push eax
lea ecx, [esi + 0x28]
call fcn.100039a0
jmp 0x1006b193
lea eax, [ebp + 8]
push ebx
push eax
call fcn.1005e020
add esp, 8
push eax
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.10002700
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006b193
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.1006b400
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.1005dd80
add esp, 8
push dword [ebp - 0x10]
mov byte [ebp - 4], 2
push 0
push str.stat_rand
push str.statistic
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x18], eax
test eax, eax
jne 0x1006b250
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.10085bdb
add esp, 4
call fcn.10085bba
cdq
mov ecx, 0x64
idiv ecx
inc edx
mov dword [esi + 0x18], edx
call fcn.10002dd0
mov ecx, eax
test ecx, ecx
je 0x1006b29b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push dword [esi + 0x18]
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push 0x100b5230
push eax
call fcn.1000c6c0
mov esi, dword [ebp + 8]
add esp, 0xc
push dword [ebp - 0x10]
push esi
push str.stat_rand
push str.statistic
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1006b250
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov esi, 1
mov byte [ebp - 4], 0
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006b274
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 4
test edi, edi
je 0x1006b285
mov ecx, dword [edi]
push edi
call dword [ecx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10001a70
int3