joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa50058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a501a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa5007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5006a
add dl, dl
jne 0xa50089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa500dc
xor eax, eax
add dl, dl
jne 0xa50096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa5017d
add dl, dl
jne 0xa500a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa500b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa500bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa500c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa500d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa50075
mov eax, 1
add dl, dl
jne 0xa500ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa500f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa500e1
sub eax, ebx
mov ebx, 1
jne 0xa50128
mov ecx, 1
add dl, dl
jne 0xa5010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa50119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa50105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa50075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa5013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa5014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa50136
cmp eax, 0x7d00
jae 0xa5016d
cmp eax, 0x500
jb 0xa50168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa50075
cmp eax, 0x7f
ja 0xa50170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa50075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa5019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa50075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10003bb2
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 0x2008]
push esi
test eax, eax
push edi
je 0x10003bc2
mov esi, dword [eax]
jmp 0x10003bc4
xor esi, esi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x10003bd0
mov edx, dword [edi]
jmp 0x10003bd2
xor edx, edx
mov eax, dword [ecx + 0x2004]
test eax, eax
je 0x10003be0
mov eax, dword [eax]
jmp 0x10003be2
xor eax, eax
push esi
push dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test edi, edi
mov esi, eax
je 0x10003bfc
mov ecx, edi
call fcn.10002801
mov eax, esi
pop edi
pop esi
ret 8

Function at 0x100049d5
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 0x10]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret

Function at 0x100049ec
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x100ca783
call fcn.10030644
sub esp, 0x808
mov eax, dword [0x100fd4c0]
and dword [ebp - 0x14], 0
push esi
push edi
mov dword [ebp - 0x10], eax
push 1
mov esi, 0x400
pop edi
lea eax, [ebp - 0x814]
push esi
push 0
push eax
mov dword [ebp - 4], edi
call fcn.10031000
add esp, 0xc
lea eax, [ebp - 0x814]
push dword [ebp + 0x18]
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x814]
lea ecx, [ebp - 0x10]
push eax
call fcn.100c11fe
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.100c0dd4
mov dword [ebp - 0x14], edi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.100c1067
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10004e32
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x100ca84f
call fcn.10030644
push ecx
push ecx
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 1
pop ebx
mov ecx, edi
mov eax, dword [edi]
mov dword [ebp - 4], ebx
call dword [eax + 0x30]
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.100c0da0
mov edx, dword [edi]
pop ecx
push esi
push eax
mov ecx, edi
mov dword [ebp + 0xc], eax
call dword [edx + 0x34]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
call fcn.100c0da0
mov edi, eax
lea eax, [esi + 2]
push eax
push 0
push edi
call fcn.10031000
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push esi
push dword [ebp + 0xc]
call fcn.10066e28
add esp, 0x24
lea ecx, [ebp - 0x10]
push edi
call fcn.100c10db
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.100c0dc9
push edi
call fcn.100c0dc9
pop ecx
lea eax, [ebp - 0x10]
pop ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.100c0dd4
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.100c1067
and byte [ebp - 4], 0
push ebx
lea ecx, [ebp + 0x10]
call fcn.10002424
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10004fc6
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x100ca8b7
call fcn.10030644
push ecx
push ebx
and dword [ebp - 0x10], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0x30]
mov esi, eax
dec esi
dec esi
shr esi, 1
lea eax, [esi + esi + 2]
push eax
call fcn.100c0da0
pop ecx
mov ebx, eax
mov eax, dword [edi]
push 0
push 2
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
add esi, esi
push esi
push ebx
mov ecx, edi
call dword [eax + 0x34]
and word [esi + ebx], 0
push ebx
lea ecx, [ebp + 0xc]
call fcn.100c10db
push 1
pop esi
push ebx
mov dword [ebp - 4], esi
call fcn.100c0dc9
pop ecx
lea eax, [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
call fcn.100c0dd4
mov dword [ebp - 0x10], esi
and byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.100c1067
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100088c7
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x100caefc
call fcn.10030644
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
lea edi, [esi + 4]
push 0x2000
push ebx
push edi
mov byte [ebp - 4], 1
call fcn.10031000
mov eax, dword [esi + 0x2008]
add esp, 0xc
cmp eax, ebx
je 0x10008906
mov eax, dword [eax]
jmp 0x10008908
xor eax, eax
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x10008913
mov ecx, dword [ecx]
jmp 0x10008915
xor ecx, ecx
mov esi, dword [esi + 0x2004]
cmp esi, ebx
je 0x10008923
mov esi, dword [esi]
jmp 0x10008925
xor esi, esi
push eax
push 0x1000
push edi
push dword [ebp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
lea ecx, [ebp - 0x10]
call fcn.10008984
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
cmp eax, ebx
mov dword [esi], eax
je 0x10008965
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x10008965
call fcn.10002801
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x10008971
call fcn.10002801
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x1000914e
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x88], edi
je 0x10009191
call fcn.10009c51
test eax, eax
je 0x10009197
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x1000960a
push edi
push edi
call fcn.10031186
add esp, 0x18
cmp eax, edi
mov dword [esi + 0xa4], eax
je 0x10009191
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop edi
pop esi
leave
ret
mov eax, dword [esi + 0xac]
cmp eax, edi
je 0x10009191
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0xac]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 4]
push edi
neg edx
push edx
mov eax, dword [esi + 0xac]
push dword [ebp - 8]
mov ecx, dword [eax]
push dword [ebp - 4]
push edi
push dword [esi + 0x64]
push dword [esi + 0x60]
push edi
push edi
push dword [esi + 0x8c]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x10009191
push edi
push edi
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
pop eax
jmp 0x10009193

Function at 0x100092f7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.100c76cf
push dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x100093a0
call fcn.100c76cf
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x100093a0
call fcn.100c76cf
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x100093a0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1000939c
test ebx, ebx
je 0x1000939c
push edi
push eax
push ebx
call fcn.10030860
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push edi
push esi
call fcn.10008cea
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop ebx
jmp 0x100093a2
xor edi, edi
jmp 0x10009390
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x100166c2
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x100cc27c
call fcn.10030644
sub esp, 0x30
push esi
push edi
call fcn.10041bff
test eax, eax
push 0x100fc2b0
je 0x100167a4
lea ecx, [ebp - 0x10]
call fcn.100c1130
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
mov esi, 0x10109850
push eax
mov ecx, esi
call fcn.100c6099
push str._tap64
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
call fcn.100c130c
mov edi, dword [eax]
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.100c6099
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.100c12a6
push str._tap64_tapinstall.exe_
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
call fcn.100c130c
mov eax, dword [eax]
push 5
push edi
push str.install_OemWin2k.inf_tap0901
push eax
push 0x100fb344
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.100c1067
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.100c1067
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.100c1067
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.100c1067
and byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.100c1067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
jmp 0x10016863
lea ecx, [ebp - 0x14]
call fcn.100c1130
lea eax, [ebp - 0x3c]
mov esi, 0x10109850
push eax
mov ecx, esi
mov dword [ebp - 4], 5
call fcn.100c6099
push str._tap
push eax
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 6
push eax
call fcn.100c130c
mov edi, dword [eax]
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.100c6099
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 8
call fcn.100c12a6
push str._tap_tapinstall.exe_
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 9
push eax
call fcn.100c130c
mov eax, dword [eax]
push 5
push edi
push str.install_OemWin2k.inf_tap0901
push eax
push 0x100fb344
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x2c]
call fcn.100c1067
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.100c1067
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 7
call fcn.100c1067
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 6
call fcn.100c1067
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.100c1067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100c1067
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10016876
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x100cc2b8
call fcn.10030644
sub esp, 0x20
call fcn.10041bff
test eax, eax
push 0x100fc2b0
je 0x10016919
lea ecx, [ebp - 0x10]
call fcn.100c1130
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10109850
call fcn.100c6099
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 1
call fcn.100c12a6
push str._tap64_tapinstall.exe_
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
call fcn.100c130c
mov eax, dword [eax]
push 5
push 0
push str.remove_tap0901
push eax
push 0x100fb344
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x18]
call fcn.100c1067
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.100c1067
and byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.100c1067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
jmp 0x1001699b
lea ecx, [ebp - 0x14]
call fcn.100c1130
lea eax, [ebp - 0x2c]
mov ecx, 0x10109850
push eax
mov dword [ebp - 4], 3
call fcn.100c6099
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 4
call fcn.100c12a6
push str._tap_tapinstall.exe_
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
call fcn.100c130c
mov eax, dword [eax]
push 5
push 0
push str.remove_tap0901
push eax
push 0x100fb344
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x24]
call fcn.100c1067
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.100c1067
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.100c1067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100c1067
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x1001822d
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x100cc650
call fcn.10030644
sub esp, 0x14
mov eax, dword [0x100fd4c0]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
push 0xd01
push eax
mov dword [ebp - 4], ebx
call fcn.10020290
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.100c11ae
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.100c1067
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], ebx
jne 0x10018301
push ebx
push ebx
push ebx
lea eax, [ebp - 0xd]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
push str.http:__www.gmbay.com_ip_
call fcn.10003536
lea eax, [ebp - 0x1c]
push eax
call fcn.10020042
add esp, 0x14
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.10003ab9
push eax
lea eax, [ebp - 0xe]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
push str.open
call fcn.10003536
lea eax, [ebp - 0x18]
push eax
call fcn.10020042
add esp, 0x14
mov ecx, eax
call fcn.10003ab9
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x100182f0
call fcn.10002801
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x10018317
call fcn.10002801
mov dword [ebp - 0x1c], ebx
jmp 0x10018317
push ecx
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.100c0dd4
mov ecx, esi
call fcn.10018331
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100c1067
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x10018331
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x100cc66c
call fcn.10030644
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push ecx
lea eax, [ebp + 8]
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov dword [ebp - 4], ebx
call fcn.100c0dd4
lea eax, [ebp - 0x14]
push eax
call fcn.100218c0
push str.about:blank
mov byte [ebp - 4], 1
push dword [ebp - 0x14]
call fcn.10030823
add esp, 0x10
cmp eax, ebx
je 0x100183c5
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
call fcn.1000b810
push eax
lea eax, [ebp - 0xd]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
push str.open
call fcn.10003536
lea eax, [ebp - 0x18]
push eax
call fcn.10020042
add esp, 0x14
mov ecx, eax
call fcn.10003ab9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x100183c5
call fcn.10002801
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.100c1067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100c1067
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x1001b2ea
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
push ebx
push ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
call esi
push dword [ebp - 4]
call fcn.100c0da0
mov edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
push edi
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x1001b37f
mov esi, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
cmp dword [ebp + 8], ebx
jne 0x1001b336
test byte [edi + 0xe], 0x10
jne 0x1001b34b
jmp 0x1001b342
cmp dword [ebp + 8], 1
jne 0x1001b34b
test byte [edi + 0xe], 0x10
je 0x1001b34b
push dword [edi + 4]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push dword [ebp - 8]
call esi
push edi
call fcn.100c0dc9
push dword [ebp - 4]
call fcn.100c0da0
pop ecx
mov edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1001b329
mov dword [ebp - 0xc], 1
cmp edi, ebx
je 0x1001b38a
push edi
call fcn.100c0dc9
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1001b400
Capabilities:
Get file size
Write file on windows

Disassembly:
mov eax, 0x100ccb64
call fcn.10030644
mov eax, 0x2718
call fcn.10031830
mov eax, dword [0x100fd4c0]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov esi, 0x2710
xor ebx, ebx
push esi
lea eax, [ebp - 0x2724]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10031000
add esp, 0xc
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
call fcn.100c11fe
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.100c147f
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.100c1458
push ebx
push 0x80
push 3
push ebx
push 3
push 0x40000000
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1001b4d7
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push ebx
push 0x40
mov edi, eax
push dword [ebp + 8]
sub edi, 0x40
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, ebx
jbe 0x1001b4ca
lea eax, [ebp - 0x14]
cmp edi, esi
push ebx
push eax
jbe 0x1001b4b9
lea eax, [ebp - 0x2724]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub edi, esi
jne 0x1001b499
jmp 0x1001b4ca
lea eax, [ebp - 0x2724]
push edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100c1067
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1001b4f5
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x100ccb80
call fcn.10030644
sub esp, 0x258
mov eax, dword [0x100fd4c0]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x14], eax
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.100c11fe
push 0x100fc7dc
lea ecx, [ebp - 0x14]
call fcn.100c1458
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001b552
xor esi, esi
jmp 0x1001b661
lea eax, [ebp - 0x238]
push 0x100fc7d8
push eax
call fcn.10030823
pop ecx
test eax, eax
pop ecx
je 0x1001b641
lea eax, [ebp - 0x238]
push 0x100fc7d0
push eax
call fcn.10030823
pop ecx
test eax, eax
pop ecx
je 0x1001b641
cmp dword [ebp + 0xc], 0
jne 0x1001b5a9
lea eax, [ebp - 0x238]
push str.desktop.ini
push eax
call fcn.10031ed8
pop ecx
test eax, eax
pop ecx
je 0x1001b641
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.100c11fe
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.100c147f
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x10]
push eax
call fcn.100c1458
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x1001b5e6
and al, 0xfe
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp - 0x264], 0x10
je 0x1001b60a
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.1001b4f5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1001b641
cmp dword [ebp + 0x10], 0
je 0x1001b638
lea eax, [ebp - 0x238]
push str.index.dat
push eax
call fcn.10031ed8
pop ecx
test eax, eax
pop ecx
jne 0x1001b638
lea eax, [ebp - 0x238]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.1001b400
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x264]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001b552
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.100c1067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100c1067
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x1001df74
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x100ccd10
call fcn.10030644
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
lea edi, [esi + 4]
push 0x2000
push ebx
push edi
mov byte [ebp - 4], 3
call fcn.10031000
mov esi, dword [esi + 0x2008]
add esp, 0xc
cmp esi, ebx
je 0x1001dfb3
mov esi, dword [esi]
jmp 0x1001dfb5
xor esi, esi
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x1001dfc0
mov edx, dword [eax]
jmp 0x1001dfc2
xor edx, edx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1001dfcd
mov ecx, dword [eax]
jmp 0x1001dfcf
xor ecx, ecx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1001dfda
mov eax, dword [eax]
jmp 0x1001dfdc
xor eax, eax
push esi
push 0x1000
push edi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push edi
lea ecx, [ebp - 0x10]
call fcn.10008984
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
cmp eax, ebx
mov dword [esi], eax
je 0x1001e01a
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x1001e01a
call fcn.10002801
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x1001e026
call fcn.10002801
mov ecx, dword [ebp + 0x10]
cmp ecx, ebx
je 0x1001e032
call fcn.10002801
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x1001e03e
call fcn.10002801
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x1001e051
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 0x2008]
test eax, eax
je 0x1001e05f
mov eax, dword [eax]
jmp 0x1001e061
xor eax, eax
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
push edi
je 0x1001e06f
mov edx, dword [ebx]
jmp 0x1001e071
xor edx, edx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x1001e07e
mov ecx, dword [esi]
jmp 0x1001e080
xor ecx, ecx
push eax
push dword [esp + 0x1c]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test esi, esi
mov edi, eax
je 0x1001e09a
mov ecx, esi
call fcn.10002801
test ebx, ebx
pop esi
je 0x1001e0a6
mov ecx, ebx
call fcn.10002801
mov eax, edi
pop edi
pop ebx
ret 0xc