joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe9a1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e9a140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e9a140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e9a140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e9a140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe9abfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe9ac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xeac87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe9ac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe9ac52
xor eax, eax
pop esi
leave
ret 4

Function at 0x599376
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.005993f5
jae 0x599382
xor ecx, ecx
call fcn.005993f5
jae 0x5993ac
xor eax, eax
call fcn.005993f5
jae 0x5993bd
mov al, 0x10
call fcn.005993f5
adc al, al
jae 0x59939e
jne 0x5993ea
stosb byte es:[edi], al
jmp 0x599383
call fcn.00599401
dec ecx
loop 0x5993c9
mov eax, ebp
call fcn.005993ff
jmp 0x5993eb
lodsb al, byte [esi]
shr eax, 1
je 0x599411
adc ecx, 2
mov ebp, eax
jmp 0x5993eb
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.005993ff
cmp eax, 0x7d00
jae 0x5993e9
cmp eax, 0x500
jae 0x5993ea
cmp eax, 0x7f
ja 0x5993eb
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x599383
pop ebp
ret 8
Function at 0x401090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
push 0xa
push dword [ebp + 8]
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4010b0
jmp 0x4010d0
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
mov dword [0x404420], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4010cd
jmp 0x4010d0
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x4010e0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
pushal
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0x400]
push esi
push ebx
call sub.kernel32.dll_lstrcpyA
xor ecx, ecx
jmp 0x4010ff
inc ecx
cmp byte [ecx + ebx], 0x5c
jne 0x4010fe
mov byte [ecx + ebx], 0
lea esi, [ecx + esi + 1]
mov edi, 0x402bb4
push str.HKEY_CLASSES_ROOT
push ebx
call edi
or eax, eax
jne 0x401125
mov eax, 0x80000000
jmp 0x401186
push str.HKEY_CURRENT_CONFIG
push ebx
call edi
or eax, eax
jne 0x401138
mov eax, 0x80000005
jmp 0x401186
push str.HKEY_CURRENT_USER
push ebx
call edi
or eax, eax
jne 0x40114b
mov eax, 0x80000001
jmp 0x401186
push str.HKEY_LOCAL_MACHINE
push ebx
call edi
or eax, eax
jne 0x40115e
mov eax, 0x80000002
jmp 0x401186
push str.HKEY_USERS
push ebx
call edi
or eax, eax
jne 0x401171
mov eax, 0x80000003
jmp 0x401186
push str.HKEY_DYN_DATA
push ebx
call edi
or eax, eax
jne 0x401184
mov eax, 0x80000006
jmp 0x401186
jmp 0x4011a2
mov byte [ebx], 0
push dword [ebp + 0x10]
push esi
push eax
push ebx
call fcn.00402d50
cmp byte [ebx], 0
je 0x4011a2
push ebx
push dword [ebp + 8]
call sub.kernel32.dll_SetEnvironmentVariableA
popal
leave
ret 0xc

Function at 0x401380
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x4046a5
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcpyA
push str..BAK
push esi
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4013b7
push 0
push esi
push dword [ebp + 8]
call sub.kernel32.dll_CopyFileA
mov al, 0
jmp 0x4013b9
mov al, 1
mov byte [0x4048bd], al
popal
leave
ret 4

Function at 0x4013d0
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x4046a5
cmp dword [ebp + 8], 0
jne 0x401406
cmp byte [0x4048bd], 0
jne 0x4013f5
push 0
push 0x4044a5
push esi
call sub.kernel32.dll_CopyFileA
cmp byte [0x4048bd], 0
jne 0x401456
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x401456
push 0x6b
push dword [0x404444]
call sub.user32.dll_IsDlgButtonChecked
cmp byte [0x404963], 1
jne 0x401431
cmp byte [0x404964], 1
jne 0x40142c
mov eax, 1
jmp 0x401431
mov eax, 0
cmp eax, 1
jne 0x401454
push str.Backup_file:
call fcn.00401330
push esi
call fcn.00401330
push dword [0x4048a5]
push esi
call sub.kernel32.dll_SetFileAttributesA
jmp 0x401456
jmp 0x4013f5
popal
leave
ret 4
Function at 0x401460
Capabilities:
Get file attributes
Get file size
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
pushal
push 0x200
push 0x4044a5
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov dword [ebp - 0x204], 0
push 0x4044a5
call sub.kernel32.dll_GetFileAttributesA
mov dword [0x4048a5], eax
test eax, 1
je 0x4014aa
xor eax, 1
push eax
push 0x4044a5
call sub.kernel32.dll_SetFileAttributesA
push 0x4044a5
call fcn.00401380
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x4044a5
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x401563
cmp byte [0x404963], 0
jne 0x40155e
push 0x34
push 0x4044a5
push str.Can_not_find_the_file._Search_the_file_
push dword [0x404444]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x40155e
lea esi, [ebp - 0x200]
mov edi, 0x4044a5
cmp byte [edi + 1], 0x3a
jne 0x401517
push edi
call fcn.00402cf0
mov edi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
push esi
call sub.kernel32.dll_lstrlenA
inc eax
push esi
push eax
add esi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
pop eax
add esi, eax
push 0x2e
push str.Exe_Files__.exe_
push esi
call sub.kernel32.dll_RtlMoveMemory
pop esi
push dword [0x404444]
push 0
push esi
push 0x4044a5
call fcn.00402c70
cmp eax, 1
jne 0x40155e
jmp 0x401486
jmp 0x401607
push str.loading_file:
call fcn.00401330
push 0x4044a5
call fcn.00401330
mov dword [0x4048a9], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x4048ad], eax
cmp dword [ebp + 0xc], 0
jne 0x401592
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], 1
jne 0x4015b1
add eax, 0x22e
add eax, dword [0x404420]
push 0x100
push eax
call fcn.00402d30
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
pop dword [0x4048b9]
push 0
push dword [0x4048b9]
push 0
push 4
push 0
push dword [0x4048a9]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x4015e3
push str.Can_not_open_file_
call fcn.00401330
jmp 0x401607
mov dword [0x4048b5], eax
push 0
push 0
push 0
push 2
push eax
call sub.kernel32.dll_MapViewOfFile
or eax, eax
jne 0x4015fc
jmp 0x4015d7
mov dword [0x4048b1], eax
mov dword [ebp - 0x204], eax
popal
mov eax, dword [ebp - 0x204]
leave
ret 0xc

Function at 0x401620
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [0x4048a9]
or esi, esi
je 0x401678
push dword [0x4048b1]
call sub.kernel32.dll_UnmapViewOfFile
push dword [0x4048b5]
call sub.kernel32.dll_CloseHandle
push 0
push 0
push dword [0x4048b9]
push esi
call sub.kernel32.dll_SetFilePointer
push esi
call sub.kernel32.dll_SetEndOfFile
push esi
call sub.kernel32.dll_CloseHandle
push dword [ebp + 8]
call fcn.004013d0
push dword [0x4048a5]
push 0x4044a5
call sub.kernel32.dll_SetFileAttributesA
popal
leave
ret 4
Function at 0x4016b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
pushal
mov byte [ebp - 0x201], 0
push 1
push 8
call fcn.00401050
or eax, eax
je 0x40170d
mov esi, eax
push 0x200
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push str.BASSMOD.dll
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_lstrcatA
mov ecx, dword [esi + 1]
lea eax, [esi + 5]
push ecx
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.00402c10
mov byte [ebp - 0x201], 1
popal
movzx eax, byte [ebp - 0x201]
leave
ret
Function at 0x4026f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x40271d
inc ecx
cmp ecx, dword [0x4048ad]
jne 0x40271d
push str.No_PE_Signature_found_
call fcn.00401330
xor eax, eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10
cmp dword [ecx + esi], 0x4550
jne 0x4026ff
add esi, ecx
mov eax, dword [ebp + 8]
add eax, dword [0x4048ad]
cmp dword [eax - 4], 0x32505564
jne 0x402746
push str.Inline_patch_already_applied_
call fcn.00401330
jmp 0x402712
push esi
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
add esi, 0xf8
mov edi, esi
or dword [edi + 0x24], 0x80000000
add edi, eax
pop esi
cmp dword [ebp + 0xc], 4
jne 0x40276c
mov ecx, dword [esi + 0x34]
jmp 0x40276e
xor ecx, ecx
mov dword [0x402a3d], ecx
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x34]
mov dword [0x402a35], ebx
add dword [0x402a35], ecx
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
cmp dword [ebp + 0xc], 4
jne 0x40279f
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 0x10]
add eax, ebx
jmp 0x4027a1
xor eax, eax
mov dword [0x402a41], eax
mov eax, dword [ebp + 8]
add eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
mov ecx, 0x40282a
mov ebx, 0x22e
mov edx, eax
add edx, ebx
push edx
push ebx
push ecx
push eax
call sub.kernel32.dll_RtlMoveMemory
pop edx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x16]
lea ecx, [eax + ecx]
mov ebx, dword [0x404420]
sub ebx, eax
push ebx
push ecx
push edx
call sub.kernel32.dll_RtlMoveMemory
mov eax, dword [ebp + 0x10]
push 0x100
push eax
call fcn.00402d30
add dword [edi + 8], eax
add dword [edi + 0x10], eax
or dword [edi + 0x24], 0xe0000000
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
mov ebx, dword [esi + 0x38]
push ebx
push eax
call fcn.00402d30
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [0x4048b9]
mov dword [eax - 4], 0x32505564
xor eax, eax
inc eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10

Function at 0x402c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402c3b
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x402d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 8]
call sub.advapi32.dll_RegQueryValueExA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x402dd2
mov eax, 4
mov dword [ebp - 4], eax
inc dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 8]
call sub.advapi32.dll_RegQueryValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x402e70
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
pushal
cmp dword [ebp + 8], 0
jne 0x402eb0
push 0
call sub.kernel32.dll_GetModuleHandleA
lea esi, [ebp - 0x200]
push 0x200
push esi
push eax
call sub.kernel32.dll_GetModuleFileNameA
push esi
call sub.kernel32.dll_lstrlenA
push esi
add esi, eax
jmp 0x402ea5
dec esi
cmp byte [esi], 0x5c
jne 0x402ea4
mov byte [esi], 0
pop esi
jmp 0x402eb3
mov esi, dword [ebp + 8]
push esi
call sub.kernel32.dll_SetCurrentDirectoryA
popal
leave
ret 4
Function at 0x61d735
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0061d0f3

Function at 0x61e20e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0061e0e2
Function at 0x401360
Capabilities:
Create pipe
Query environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c0c
call fcn.00409bf0
mov eax, dword [0x45ad2c]
mov ecx, dword [0x45a7b8]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
je 0x401487
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x45ad2c], 0x959
jne 0x401471
push 0
lea eax, [ebp - 0x1408]
push eax
push 0
push 0
push 0
push 0
call edi
push str.mekopid
push 0
call ebx
push 0
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x1008]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push str.hupetapicigilacusafudoziki
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
lea ecx, [ebp - 0x1c08]
push ecx
push 0
call esi
mov edx, dword [ebp - 4]
push edx
call fcn.004010e0
add dword [ebp - 4], 8
dec dword [ebp - 8]
jne 0x40139e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40401b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b770]
jne 0x404025
repz ret
jmp fcn.004078ac

Function at 0x40964b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44b770]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405d88
and dword [ebp - 0x14], 0
cmp dword [0x451e30], 0
mov dword [ebp - 0x18], eax
jne 0x4096fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4097a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4097a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x451e30], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x451e34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x451e38], eax
call edi
push eax
call esi
mov dword [0x451e40], eax
test eax, eax
je 0x4096fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x451e3c], eax
mov eax, dword [0x451e3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409757
cmp dword [0x451e40], ecx
je 0x409757
push eax
call esi
push dword [0x451e40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409757
test ebx, ebx
je 0x409757
call edi
test eax, eax
je 0x40974e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40974e
test byte [ebp - 8], 1
jne 0x409757
or dword [ebp + 0x10], 0x200000
jmp 0x40978a
mov eax, dword [0x451e34]
cmp eax, dword [ebp - 0x18]
je 0x40978a
push eax
call esi
test eax, eax
je 0x40978a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40978a
mov eax, dword [0x451e38]
cmp eax, dword [ebp - 0x18]
je 0x40978a
push eax
call esi
test eax, eax
je 0x40978a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x451e30]
call esi
test eax, eax
je 0x4097a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4097a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040401b
leave
ret
Function at 0x21103050
Capabilities:
Copy file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
push 0x21115338
mov eax, dword [ebp + 0xc]
push eax
call fcn.21109270
add esp, 8
test eax, eax
je 0x21103088
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xffffffff
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov al, 1
jmp 0x21103265
push 0x5c
mov edx, dword [ebp + 0xc]
push edx
call fcn.21108e20
add esp, 8
test eax, eax
je 0x211030b3
push 0x5c
mov eax, dword [ebp + 0xc]
push eax
call fcn.21108e20
add esp, 8
add eax, 1
mov dword [ebp - 0x120], eax
jmp 0x211030bc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0
jmp 0x211030d7
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jae 0x21103263
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0x114
add ecx, 0x2111b7d8
mov dword [ebp - 0x118], ecx
cmp dword [ebp - 4], 0
je 0x21103115
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x21103115
jmp 0x211030ce
mov edx, dword [ebp - 0x118]
cmp dword [edx + 0x108], 0
jle 0x21103158
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x118]
add eax, 4
push eax
call dword [0x2111b628]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov al, 1
jmp 0x21103265
mov edx, dword [ebp - 0x118]
add edx, 4
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.21108e50
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.21109235
add esp, 4
mov dword [ebp - 0x11c], 0
jmp 0x211031ba
mov ecx, dword [ebp - 0x11c]
add ecx, 1
mov dword [ebp - 0x11c], ecx
cmp dword [ebp - 0x11c], 0x10
jge 0x211031e8
call fcn.21109247
cdq
mov ecx, 0x1a
idiv ecx
add edx, 0x61
and edx, 0xff
mov eax, dword [ebp - 0x11c]
mov byte [ebp + eax - 0x110], dl
jmp 0x211031ab
lea ecx, [ebp - 0x110]
push ecx
push str._s.tmp
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
lea ecx, [eax + edx + 4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edx, dword [ebp - 0x118]
mov dword [edx + 0x108], eax
push 0
mov eax, dword [ebp - 0x118]
add eax, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x2110325c
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov edx, dword [ebp - 0x118]
add edx, 4
push edx
call dword [0x2111b628]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov al, 1
jmp 0x21103265
jmp 0x21103263
xor al, al
mov esp, ebp
pop ebp
ret 0x20
Function at 0x21104900
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x2111f014], 0
jne 0x2110492e
push 0x211154e0
push 0xb58
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x2111f014], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [0x2111f014]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x21104969
push 0
push 0x211154f4
push 0x21115500
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x21104a29
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0xa
jl 0x2110498c
push 0
push 0x21115514
push 0x21115520
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x21104a29
mov edx, dword [ebp - 4]
mov eax, dword [edx]
imul eax, eax, 0x108
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 0x108]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax], edx
push 0x5c
mov eax, dword [ebp + 0xc]
push eax
call fcn.21105db0
add esp, 8
test eax, eax
je 0x211049d3
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x211049ff
mov eax, dword [ebp + 0xc]
push eax
push 0x21115538
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edx, dword [ebp - 8]
lea eax, [edx + eax + 4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov al, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x211051b0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
je 0x2110590b
cmp dword [ebp - 0x664], 1
je 0x211051df
jmp 0x2110594a
mov ecx, 1
test ecx, ecx
je 0x211058f0
mov edx, dword [ebp + 8]
push edx
call sym.AhnHelper.dll__AntiHookGetSelfModuleByAddress_4
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [ebp - 0x10c], 0
jmp 0x21105217
mov eax, dword [ebp - 0x10c]
add eax, 1
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x17
jae 0x21105235
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx*4 + 0x2111b778], eax
jmp 0x21105208
push 0x21115734
jmp 0x21141ca8
lea eax, [ebp - 0x134]
push eax
push 2
lea ecx, [ebp - 0x108]
push ecx
call 0x21108c80
xor eax, eax
jmp 0x2110594f
mov dword [ebp - 0x138], 0
jmp 0x21105926
mov edx, dword [ebp - 0x138]
add edx, 1
mov dword [ebp - 0x138], edx
cmp dword [ebp - 0x138], 0x17
jae 0x21105945
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax*4 + 0x2111b778]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x21105917
call fcn.21105ea0
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x21105e40
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x21115e88
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x2111b774], eax
xor eax, eax
cmp dword [0x2111b774], 0
setne al
mov esp, ebp
pop ebp
ret