joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4509d8
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x37
mov byte [ebp - 3], 0x3c
mov byte [ebp - 2], 0x2f
mov byte [ebp - 1], 0x49
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4509dc
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x44
mov byte [ebp - 3], 0x3e
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x4509e0
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4509e8
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x34
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4509ec
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x4509f0
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x4509f8
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x31
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x4509fc
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x450a00
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x450a08
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x35
mov byte [ebp - 3], 0x30
mov byte [ebp - 2], 0x33
mov byte [ebp - 1], 0x3c
push 4
lea ecx, [ebp - 4]
push ecx
push 0x450a0c
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x2f
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea edx, [ebp - 4]
push edx
push 0x450a10
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x3c
mov byte [ebp - 3], 0x49
mov byte [ebp - 2], 0x44
mov byte [ebp - 1], 0x3e
push 4
lea eax, [ebp - 4]
push eax
push 0x450a18
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x31
mov byte [ebp - 3], 0x34
mov byte [ebp - 2], 0x3c
mov byte [ebp - 1], 0x2f
push 4
lea ecx, [ebp - 4]
push ecx
push 0x450a1c
call fcn.00403cc0
add esp, 0xc
mov byte [ebp - 4], 0x49
mov byte [ebp - 3], 0x44
mov byte [ebp - 2], 0x3e
mov byte [ebp - 1], 0
push 4
lea edx, [ebp - 4]
push edx
push 0x450a20
call fcn.00403cc0
add esp, 0xc
call fcn.00424400
mov esp, ebp
pop ebp
ret 4
Function at 0x4246b0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 1
push 0
push 0
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
test eax, eax
jne 0x424703
mov dword [ebp - 0x14], 0xffffffff
jmp 0x4247cd
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x42471e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xc]
jae 0x4247c6
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x42475c
mov dword [ebp - 0x14], 0xfffffffe
jmp 0x4247c6
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax]
cmp edx, dword [ebp - 4]
jne 0x424784
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x44fe80
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4247ab
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x44fe78]
shl eax, 8
add eax, 0x44ff80
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [0x44fe78]
add ecx, 1
mov dword [0x44fe78], ecx
cmp dword [ebp - 0x10], 0
je 0x4247c1
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov dword [ebp - 0x10], 0
jmp 0x424715
jmp 0x4247cd
cmp dword [ebp - 0x10], 0
je 0x4247dc
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
cmp dword [ebp - 0x18], 0
je 0x4247eb
mov ecx, dword [ebp - 0x18]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x427690
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4372a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0x218], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x42770a
mov dword [ebp - 4], 0
jmp 0x427753
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x427753
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004025b0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x427a20
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4372a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x438830], eax
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004025c0
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.004025c0
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x427b76
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x21c], 0
jmp 0x427ac9
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
test edx, edx
je 0x427b22
mov eax, dword [ebp - 0x21c]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x61
jl 0x427b20
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + edx*2 - 0x218]
cmp eax, 0x7a
jg 0x427b20
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
sub edx, 0x20
mov eax, dword [ebp - 0x21c]
mov word [ebp + eax*2 - 0x218], dx
jmp 0x427aba
lea ecx, [ebp - 0x218]
push ecx
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x427b43
xor edx, edx
mov word [0x44f1a8], dx
jmp 0x427b76
lea eax, [ebp - 0x218]
push eax
push 0x434380
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x427b64
xor ecx, ecx
mov word [0x44f1a8], cx
jmp 0x427b76
lea edx, [ebp - 0x108]
push edx
push 0x44f1a8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
call fcn.00427770
push 0x434390
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x427bbf
push 0x4343ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x427bbf
mov dword [0x438834], 2
jmp 0x427bf9
cmp dword [ebp - 0x10c], 0
je 0x427bf2
push str.AddAccessAllowedAceEx
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x438834], eax
cmp dword [0x438834], 0
jne 0x427bf2
mov dword [0x438834], 3
jmp 0x427bf9
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004025b0
mov esp, ebp
pop ebp
ret 4
Function at 0x42032f
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov byte [0x4d72b0], 0
lea eax, [ecx - 1]
cmp eax, 0xd2
ja case.0x4200d2.24
xor edx, edx
mov dl, byte [eax + 0x4203c4]
jmp dword [edx*4 + 0x420364]
push str.LEFT
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.RIGHT
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push 0x4b66e4
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.DOWN
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.SHIFT
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.CTRL
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push 0x4b66c8
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.SPACE
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.ENTER
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.ESCAPE
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push 0x4b66ac
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.CAPS_LOCK
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.INSERT
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.HOME
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.PAGE_UP
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.PAGE_DOWN
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.DELETE
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.BACKSPACE
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push 0x4b6664
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.NUMLOCK
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.SCROLL_LOCK
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.PRINT_SCREEN
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
push str.PAUSE
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov eax, 0x4d72b0
pop esi
ret
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 1
push ecx
call esi
test eax, eax
je 0x42035b
push 2
push eax
call esi
test eax, eax
je 0x42035b
push eax
push 0x4b6634
push 0x4d72b0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, 0x4d72b0
pop esi
ret
Function at 0x1000e8d0
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x3c
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [ebp + 0x10]
add esi, 0x568
push 0x10017bc8
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push str.file:__
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push dword [ebp + 0xc]
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1000e959
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x1000e95c
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x1000e955
add eax, 0xfffffffd
cmp eax, 1
ja 0x1000e95c
mov esi, edi
jmp 0x1000e95c
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.1000fff4
add esp, 0x10
pop edi
pop esi
leave
ret 0x20
Function at 0x10061b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10061b1f
pop dword [ebp - 0xc]
mov eax, 0x3de6017c
sub eax, 0x2ddfe65d
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x41138
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x3fb2
xor esi, esi
add esi, eax
mov edx, 0xe8630cc4
add edx, 0x27b5653c
add edx, dword [ebp - 0xc]
mov ebx, 0x7778f13e
sub ebx, 0xe666935
xor dword [ebp - 4], ecx
mov edi, dword [edx]
sub dword [ebp - 8], 0x5b2dad65
sub edi, ebx
add dword [ebp - 8], 0x2e81d470
mov dword [esi], edi
add dword [ebp - 8], eax
add esi, 4
add edx, 4
loop 0x10061b75
add eax, 0xf19b
mov ebx, eax
add eax, 0x3e184e23
sub eax, 0x3e184e1e
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvDX9.x3d_public:_void___stdcall_MATRIX3D::Invert_struct_MATRIX3D_const__
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4
Function at 0x100723b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100723e6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10072445
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvDX9.x3d_public:_void___stdcall_MATRIX3D::Invert_struct_MATRIX3D_const__
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvDX9.x3d_public:_void___stdcall_MATRIX3D::Invert_struct_MATRIX3D_const__
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvDX9.x3d_public:_void___stdcall_MATRIX3D::Invert_struct_MATRIX3D_const__
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100762d0
leave
ret 0x10

Function at 0x10072460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007248c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100724bd
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x100724bb
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvDX9.x3d_public:_void___stdcall_MATRIX3D::Invert_struct_MATRIX3D_const__
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x100724bd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100762d0
leave
ret 8
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100062fa
pop dword [ebp - 0x34]
mov eax, 0xde5ecc5f
sub eax, 0xce5e6965
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x388e0
push 0
mov eax, 0xbd898ed5
sub eax, 0xad884e71
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x4833371b
sub ecx, 0x4832f0fa
mov ebx, eax
mov esi, 0x8f53fb7f
sub esi, 0x7f52757f
add esi, dword [ebp - 0x34]
mov edx, 0xf356ad68
add edx, 0xaaefc334
add dword [ebp - 8], 0x9557d5e2
mov edi, dword [esi]
sub dword [ebp - 0x10], edi
xor edi, edx
xor dword [ebp - 0x18], esi
mov dword [ebx], edi
sub dword [ebp - 0x14], edi
add ebx, 4
add esi, 0x56182140
sub esi, 0x5618213c
loop 0x10006359
add eax, 0xdc44fcaf
add eax, 0x23bc0ea8
xor ebx, ebx
add ebx, eax
add eax, 0xae95c25a
sub eax, 0xae95c255
mov ecx, 0x5e09aaab
add ecx, 0xb1f65555
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4290a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500b6d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
sub esp, 0x18
mov eax, esp
push 0xffffffffffffffff
push ecx
push eax
call fcn.00493f50
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call fcn.00491f60
add esp, 0x1c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429170
cmp dword [0x6065c4], 0
je 0x42911c
push 0x6065c0
call fcn.004ae2a0
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
mov ecx, 0x6065c8
push eax
call fcn.00431340
sub esp, 0x18
mov ecx, esp
push 0
push 0x503500
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00401720
push 0
push 0x422cf0
push 0
push 0x6065c0
call fcn.004ab950
add esp, 0x28
cmp byte [0x6065e0], 0
je 0x429187
push dword [0x6065a0]
call fcn.0042e010
add esp, 4
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x4291bd
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4291b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4291d6
push ecx
push edx
call fcn.004d36cd
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret
call fcn.004d826f
int3
Function at 0x42dd20
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3cc
mov eax, dword [0x5e0f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0
push eax
mov byte [0x6065e0], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x2f2
lea eax, [ebp - 0x392]
push 0
push eax
call fcn.004d65b0
push 0x98
lea eax, [ebp - 0x9c]
push 0
push eax
call fcn.004d65b0
mov eax, dword [0x6065a0]
add esp, 0x18
mov dword [ebp - 0x3c0], 0x3bc
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3b8], 0x309
push 0x64
push 0
mov dword [ebp - 0x3b0], 0x401
mov dword [ebp - 0xa0], 3
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
movups xmm0, xmmword [0x537c68]
mov dword [ebp - 0x3ac], eax
mov eax, dword [0x537c78]
mov dword [ebp - 0x398], eax
mov ax, word [0x537c7c]
mov word [ebp - 0x394], ax
lea eax, [ebp - 0x3c0]
push eax
push 0
movups xmmword [ebp - 0x3a8], xmm0
mov dword [ebp - 0x3b4], 7
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x42de39
push str.Shell_NotifyIconW_add_icon
push 0xffffffffffffffff
push 1
sub esp, 0xc
mov dword [ebp - 0x3cc], str.S:MightyGrep_src_app_win32.cpp
mov eax, esp
mov dword [ebp - 0x3c8], str.MinimizeToTray
movq xmm0, qword [ebp - 0x3cc]
movq qword [eax], xmm0
mov dword [eax + 8], 0x96
call fcn.004a4b70
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3b35
mov esp, ebp
pop ebp
ret