joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004261
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1007d060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, ecx
push edi
push 0x40e
push eax
mov dword [esi], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x416]
xor ecx, ecx
push eax
mov word [ebp - 0x418], cx
call fcn.10033520
add esp, 0xc
push 0x208
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logs
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edi, [ebp - 0x418]
mov dword [esi + 0x10], str._.log_
call fcn.10004098
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10031cf1
leave
ret

Function at 0x100042e9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1007d060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
xor eax, eax
mov esi, ecx
push 0x40e
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
mov dword [esi], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
call fcn.10033520
add esp, 0xc
push edi
push 0x23
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.MicrosoftWindowsWERReportArchive
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edi, [ebp - 0x418]
mov dword [esi + 0x10], str._.wer_
call fcn.10004098
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10031cf1
leave
ret
Function at 0x10004cb6
Capabilities:
Check if file exists
Get session user name

Disassembly:
push 0x334
mov eax, 0x1004ae6e
call fcn.1003327a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x31c], ax
lea eax, [ebp - 0x31a]
push eax
mov esi, ecx
call fcn.10033520
add esp, 0xc
lea eax, [ebp - 0x31c]
push eax
mov ebx, str.polocker.exe
call fcn.10019bd2
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10004d0f
push 3
pop eax
jmp 0x10004df8
push esi
push str._lock
lea eax, [ebp - 0x31c]
push eax
push str.__s___s__s
lea ecx, [ebp - 0x338]
call fcn.1001b479
xor esi, esi
xor eax, eax
mov dword [ebp - 4], esi
push 0xfe
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x112]
push esi
push eax
call fcn.10033520
add esp, 0x1c
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x340], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x10004d83
push esi
push 1
lea esi, [ebp - 0x338]
call fcn.10002e12
xor eax, eax
jmp 0x10004df8
call fcn.1001d2de
test eax, eax
mov eax, dword [ebp - 0x334]
jne 0x10004da9
cmp dword [ebp - 0x320], 8
jae 0x10004da1
lea eax, [ebp - 0x334]
push eax
call fcn.1001a8e5
jmp 0x10004dbe
cmp dword [ebp - 0x320], 8
jae 0x10004db8
lea eax, [ebp - 0x334]
push eax
call fcn.1001aa32
mov dword [ebp - 0x33c], eax
cmp eax, esi
je 0x10004dd2
cmp eax, 0xffffffff
je 0x10004dd2
xor ebx, ebx
inc ebx
jmp 0x10004dd4
xor ebx, ebx
lea eax, [ebp - 0x33c]
call fcn.10004ad7
push esi
push 1
lea esi, [ebp - 0x338]
call fcn.10002e12
xor eax, eax
test bl, bl
setne al
dec eax
and eax, 4
call fcn.100332fd
ret

Function at 0x10004fe4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov ebx, str._LockScreenOnStartup
push ebx
mov edi, str.Software_LockScreenOnStartup
push edi
mov esi, 0x80000001
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10005027
cmp dword [ebp - 8], 4
jne 0x10005027
mov eax, dword [ebp - 0xc]
jmp 0x10005029
xor eax, eax
test eax, eax
je 0x10005031
xor eax, eax
jmp 0x1000504a
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push esi
mov dword [ebp - 0x10], 1
call fcn.1001b879
xor eax, eax
add esp, 0x10
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100051b7
Capabilities:
Check if file exists
Get session user name

Disassembly:
push ebp
sub esp, 0x324
lea ebp, [esp - 4]
mov eax, dword [0x1007d060]
xor eax, ebp
mov dword [ebp + 0x324], eax
push 8
mov eax, 0x1004ae3b
call fcn.10033211
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push eax
mov esi, ecx
call fcn.10033520
add esp, 0xc
lea eax, [ebp + 0x1c]
push eax
mov ebx, str.polocker.exe
call fcn.10019bd2
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10005219
push 3
pop eax
jmp 0x100052db
push esi
push str._unlock
lea eax, [ebp + 0x1c]
push eax
push str.__s___s__s
lea ecx, [ebp]
call fcn.1001b479
xor esi, esi
xor eax, eax
mov dword [ebp - 4], esi
push 0xfe
mov word [ebp + 0x224], ax
lea eax, [ebp + 0x226]
push esi
push eax
call fcn.10033520
add esp, 0x1c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x224]
push eax
mov dword [ebp - 0x14], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1000527e
push esi
push 1
lea esi, [ebp]
call fcn.10002e12
xor eax, eax
jmp 0x100052db
call fcn.1001d2de
test eax, eax
mov eax, dword [ebp + 4]
jne 0x1000529b
cmp dword [ebp + 0x18], 8
jae 0x10005293
lea eax, [ebp + 4]
push eax
call fcn.1001a8e5
jmp 0x100052aa
cmp dword [ebp + 0x18], 8
jae 0x100052a4
lea eax, [ebp + 4]
push eax
call fcn.1001aa32
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x100052bb
cmp eax, 0xffffffff
je 0x100052bb
xor ebx, ebx
inc ebx
jmp 0x100052bd
xor ebx, ebx
lea eax, [ebp - 0x10]
call fcn.10004ad7
push esi
push 1
lea esi, [ebp]
call fcn.10002e12
xor eax, eax
test bl, bl
setne al
dec eax
and eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x324]
xor ecx, ebp
call fcn.10031cf1
add ebp, 0x328
leave
ret

Function at 0x1000580c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004df95
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x1007d060]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
push str.desktopManager
lea ecx, [esp + 0x2c]
call fcn.100028ae
and dword [esp + 0x50], 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10005697
pop ecx
pop ecx
mov ecx, eax
mov byte [esp + 0x50], 1
call fcn.100089b4
lea esi, [esp + 0xc]
mov byte [esp + 0x50], 0
call fcn.1002160d
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10002d1a
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000aa84
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10084d6c]
push esi
xor esi, esi
cmp eax, esi
je 0x1000aa9d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10084d6c], esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10084d6c], eax
call fcn.10015a96
push esi
push esi
push esi
push 0x1000a78b
push esi
push esi
mov dword [0x10084d64], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10084d68], eax
pop esi
ret

Function at 0x1000ccdc
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10084da8]
push esi
xor esi, esi
cmp eax, esi
je 0x1000ccf5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10084da8], esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10084da8], eax
call fcn.10015a96
push esi
push esi
push esi
push 0x1000c958
push esi
push esi
mov dword [0x10084da0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10084da4], eax
pop esi
ret
Function at 0x1000ceaa
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x98
lea ebp, [esp - 4]
mov eax, dword [0x1007d060]
xor eax, ebp
mov dword [ebp + 0x98], eax
push 0x3c
mov eax, 0x1004d91a
call fcn.10033211
mov eax, dword [ebp + 0xa4]
mov esi, dword [ebp + 0xa8]
xor edi, edi
cmp eax, edi
je 0x1000cf92
cmp byte [eax], 0
je 0x1000cf92
push eax
lea ecx, [ebp - 0x48]
call fcn.100028ae
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x60]
push eax
mov dword [ebp - 4], edi
call fcn.1002a838
pop ecx
pop ecx
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.10002d1a
push esi
lea ecx, [ebp - 0x2c]
call fcn.100028ae
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x44]
push eax
mov byte [ebp - 4], 3
call fcn.1002a838
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.10002d1a
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x7c]
call fcn.100011da
pop ecx
mov byte [ebp - 4], 6
cmp dword [ebp + 0x94], 8
mov eax, dword [ebp + 0x80]
jae 0x1000cf69
lea eax, [ebp + 0x80]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000cfb9
push edi
push ebx
lea esi, [ebp + 0x7c]
call fcn.10002e12
push edi
push ebx
lea ecx, [ebp + 0x44]
call fcn.10002d1a
push edi
push ebx
lea ecx, [ebp + 0x60]
call fcn.10002d1a
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x98]
xor ecx, ebp
call fcn.10031cf1
add ebp, 0x9c
leave
ret 8
lea eax, [ebp]
call fcn.1000893e
mov byte [ebp - 4], 7
cmp dword [ebp + 0x78], 0x10
mov eax, dword [ebp + 0x64]
mov dword [0x10084dac], ebx
jae 0x1000cfd7
lea eax, [ebp + 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100028ae
lea ecx, [ebp]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.1000c6d0
mov bl, al
neg bl
push edi
sbb bl, bl
push 1
lea ecx, [ebp - 0x2c]
inc bl
mov byte [ebp - 4], 7
call fcn.10002d1a
test bl, bl
je 0x1000d032
lea edi, [ebp]
call fcn.1000895b
xor edi, edi
push edi
push 1
lea esi, [ebp + 0x7c]
call fcn.10002e12
push edi
push 1
lea ecx, [ebp + 0x44]
call fcn.10002d1a
push edi
push 1
jmp 0x1000cf8a
push 0xffffffffffffffff
lea eax, [ebp + 0x1c]
push eax
xor ebx, ebx
lea eax, [ebp + 0x7c]
mov dword [0x10084dac], edi
call fcn.10002d65
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.1000b022
push ebx
lea edi, [ebp]
call fcn.1000cd24
add esp, 0x1c
call fcn.1000895b
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp + 0x7c]
call fcn.10002e12
push ebx
push edi
lea ecx, [ebp + 0x44]
call fcn.10002d1a
push ebx
push edi
lea ecx, [ebp + 0x60]
call fcn.10002d1a
mov eax, edi
jmp 0x1000cf94

Function at 0x1000d6ca
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10084de0]
push esi
xor esi, esi
cmp eax, esi
je 0x1000d6e3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10084de0], esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10084de0], eax
call fcn.10015a96
push esi
push esi
push esi
push 0x1000d3d1
push esi
push esi
mov dword [0x10084dd8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10084ddc], eax
pop esi
ret
Function at 0x1000ef93
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10084e20]
push esi
xor esi, esi
cmp eax, esi
je 0x1000efac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10084e20], esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10084e20], eax
call fcn.10015a96
push esi
push esi
push esi
push 0x1000ebb8
push esi
push esi
mov dword [0x10084e18], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10084e1c], eax
pop esi
ret

Function at 0x10010994
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x100497b0
call fcn.10033244
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.10032208
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x100109de
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
jne 0x100109ca
mov dword [esi + 0x10], edi
jmp 0x100109e0
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [ecx]
jne 0x100109d6
push esi
jmp 0x100109d7
push edi
call dword [eax]
mov dword [esi + 0x10], eax
jmp 0x100109e0
xor esi, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push 0x10010a40
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x18]
mov esi, eax
cmp ecx, edi
je 0x10010a12
mov eax, dword [ecx]
lea edx, [ebp + 8]
cmp ecx, edx
setne dl
movzx edx, dl
push edx
call dword [eax + 0xc]
mov eax, esi
jmp 0x10010a3a
call fcn.100332e9
ret

Function at 0x10011461
Capabilities:
Delete file

Disassembly:
push 0x4c
mov eax, 0x1004b8ea
call fcn.1003327a
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov edi, edx
mov dword [ebp - 0x34], eax
cmp esi, ebx
je 0x10011570
cmp edi, ebx
je 0x10011570
cmp eax, ebx
je 0x10011570
call fcn.1001d2de
test eax, eax
je 0x10011570
push esi
call fcn.1001cf39
push edi
mov dword [ebp - 0x3c], eax
call fcn.1001cf39
lea edi, [ebp - 0x58]
mov dword [ebp - 0x38], eax
call fcn.1002a8d3
mov dword [ebp - 4], ebx
cmp dword [eax + 0x18], 0x10
jb 0x100114c6
mov eax, dword [eax + 4]
jmp 0x100114c9
add eax, 4
push dword [ebp - 0x38]
lea esi, [ebp - 0x2c]
push dword [ebp - 0x3c]
push 0x32e3
push eax
push str.https:___s:_d_globalSmallFile__s__s
call fcn.1001b4d7
add esp, 0x14
push ebx
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.10002d1a
push dword [ebp - 0x3c]
call fcn.1001c822
push dword [ebp - 0x38]
call fcn.1001c822
cmp dword [ebp - 0x14], 0x10
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x30], ebx
jae 0x10011513
lea esi, [ebp - 0x28]
mov eax, dword [0x10085c60]
cmp eax, ebx
jne 0x10011536
push str.E2FE52CB
call fcn.1001c7f1
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10085c60], eax
cmp eax, ebx
je 0x1001155c
lea ecx, [ebp - 0x30]
push ecx
push dword [ebp - 0x34]
push esi
call eax
cmp eax, ebx
je 0x1001155c
cmp dword [ebp - 0x30], 0xc8
jne 0x1001155c
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002d1a
mov al, 1
jmp 0x10011572
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002d1a
xor al, al
call fcn.100332fd
ret
Function at 0x10011578
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x1007d060]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1a4]
push esi
push edi
mov dword [ebp - 0x78], eax
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push ebx
push eax
mov dword [ebp - 0x80], ebx
call fcn.10033520
add esp, 0xc
push ebx
push 0x23
lea eax, [ebp - 0x74]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.projonewallpapers
lea eax, [ebp - 0x74]
push eax
call edi
lea esi, [ebp - 0x74]
call fcn.100197a2
cmp dword [ebp - 0x78], ebx
je 0x100115f9
push dword [ebp - 0x78]
mov eax, esi
push eax
call edi
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push eax
call fcn.1000294c
mov ecx, dword [ebp + 0x194]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031cf1
add ebp, 0x198
leave
ret

Function at 0x10011c7f
Capabilities:
Check if file exists

Disassembly:
push 0x78
mov eax, 0x1004c014
call fcn.1003327a
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x30], ebx
cmp esi, ebx
jne 0x10011ca7
push 0x10051b00
mov esi, edi
call fcn.1000294c
jmp 0x10011daa
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.10011578
pop ecx
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10011cc2
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10011cfd
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10011cd9
lea eax, [ebp - 0x28]
push eax
call fcn.100197ba
cmp edx, ebx
ja 0x10011cea
cmp eax, 0x400
jbe 0x10011cfd
lea eax, [ebp - 0x2c]
push eax
mov esi, edi
call fcn.1000296c
push ebx
push 1
jmp 0x10011da2
push esi
lea esi, [ebp - 0x4c]
call fcn.1000294c
mov eax, esi
push eax
xor ebx, ebx
lea eax, [ebp - 0x84]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.1000121a
pop ecx
pop ecx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x10011d2d
lea ecx, [ebp - 0x28]
cmp dword [eax + 0x18], 0x10
jb 0x10011d38
mov eax, dword [eax + 4]
jmp 0x10011d3b
add eax, 4
push ecx
mov edx, eax
mov ecx, str.wallpapers
call fcn.10011461
pop ecx
test al, al
je 0x10011d52
lea eax, [ebp - 0x2c]
jmp 0x10011d6a
push 0x10051b00
lea esi, [ebp - 0x68]
call fcn.1000294c
mov byte [ebp - 4], 3
mov dword [ebp - 0x30], 2
push eax
mov esi, edi
call fcn.1000296c
or dword [ebp - 0x30], ebx
test byte [ebp - 0x30], 2
je 0x10011d86
push 0
push ebx
lea esi, [ebp - 0x68]
call fcn.10002e12
push 0
push ebx
lea ecx, [ebp - 0x84]
call fcn.10002d1a
push 0
push ebx
lea esi, [ebp - 0x4c]
call fcn.10002e12
push 0
push ebx
lea esi, [ebp - 0x2c]
call fcn.10002e12
mov eax, edi
call fcn.100332fd
ret
Function at 0x100144f1
Capabilities:
Create thread

Disassembly:
push 0x12c
mov eax, 0x1004c8d9
call fcn.1003327a
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea esi, [edi + 0x20]
push 4
mov dword [ebp - 0x138], edi
mov dword [edi + 0xc], 0xa
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], 0x64
mov dword [edi + 0x1c], ebx
mov dword [ebp - 0x134], esi
call fcn.10032208
pop ecx
cmp eax, ebx
je 0x1001453e
mov dword [eax], esi
jmp 0x10014540
xor eax, eax
mov dword [esi], eax
mov dword [ebp - 4], ebx
call fcn.100170b7
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], 1
lea esi, [edi + 0x40]
push 4
mov dword [ebp - 0x134], esi
call fcn.10032208
pop ecx
cmp eax, ebx
je 0x10014584
mov dword [eax], esi
jmp 0x10014586
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 4], 2
call fcn.1001719c
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x19], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
mov byte [ebp - 4], 3
lea esi, [edi + 0x60]
push 4
mov dword [ebp - 0x134], esi
call fcn.10032208
pop ecx
cmp eax, ebx
je 0x100145c8
mov dword [eax], esi
jmp 0x100145ca
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 4], 4
call fcn.1001719c
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x19], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
mov byte [ebp - 4], 5
lea esi, [edi + 0x80]
push 4
mov dword [ebp - 0x134], esi
call fcn.10032208
pop ecx
cmp eax, ebx
je 0x1001460f
mov dword [eax], esi
jmp 0x10014611
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 4], 6
call fcn.100170b7
lea ecx, [esi + 0x18]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov dword [esi + 0x1c], ebx
push 0x118
lea eax, [ebp - 0x12c]
push ebx
mov byte [ebp - 4], 7
push eax
mov dword [ebp - 0x130], 0x11c
call fcn.10033520
add esp, 0xc
lea esi, [ebp - 0x130]
call fcn.10019da3
push 6
pop eax
cmp eax, dword [ebp - 0x12c]
sbb eax, eax
inc eax
mov dword [edi + 0x10], eax
call fcn.100158c1
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
lea eax, [edi + 4]
push eax
push ebx
push edi
push 0x10014744
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [edi + 8]
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, edi
call fcn.100332fd
ret
Function at 0x100146ad
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, 0x1004b377
call fcn.10033211
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], 3
cmp dword [esi], ebx
je 0x100146f6
push ebx
push ebx
push 0x12
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x3e7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
je 0x10014706
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x14], ebx
lea eax, [esi + 0x80]
push eax
mov byte [ebp - 4], 2
call fcn.10015c75
lea eax, [esi + 0x60]
push eax
mov byte [ebp - 4], 1
call fcn.1001615a
lea eax, [esi + 0x40]
push eax
mov byte [ebp - 4], bl
call fcn.1001615a
or dword [ebp - 4], 0xffffffff
add esi, 0x20
push esi
call fcn.10015c75
call fcn.100332e9
ret 4
Function at 0x10019460
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0x1007d060]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa88], ecx
mov ecx, dword [ebp + 0x18]
push edi
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa8c], edx
test esi, esi
je 0x10019685
test eax, eax
jne 0x100194b1
test ecx, ecx
je 0x10019685
movzx eax, word [esi + 2]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp ax, 0x3a
je 0x10019507
cmp ax, 0x5c
je 0x10019507
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.10033520
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 0x828]
push eax
call edi
lea esi, [ebp - 0x828]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10019685
test al, 0x10
je 0x10019685
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x418]
push eax
call ebx
push 0x10054548
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa90], eax
cmp eax, 0xffffffff
je 0x10019685
mov dword [ebp - 0xa7c], 1
push 0x1005454c
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1001964a
push 0x10054550
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1001964a
cmp dword [ebp - 0xa78], 0xffffffff
je 0x1001964a
push esi
lea eax, [ebp - 0x210]
push eax
call ebx
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
test byte [ebp - 0xa78], 0x10
je 0x1001962a
cmp dword [ebp - 0xa80], 0
je 0x100195ee
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x210]
push eax
call dword [ebp - 0xa80]
test eax, eax
je 0x10019667
cmp dword [ebp + 0xc], 0
je 0x1001964a
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x210]
push dword [ebp - 0xa80]
push dword [ebp - 0xa88]
push dword [ebp - 0xa84]
push dword [ebp + 0xc]
push eax
call fcn.10019460
push 2
pop ecx
cmp eax, ecx
jne 0x1001964a
mov dword [ebp - 0xa7c], ecx
jmp 0x10019671
cmp dword [ebp - 0xa84], 0
je 0x1001964a
push dword [ebp - 0xa88]
lea eax, [ebp - 0x210]
push eax
call dword [ebp - 0xa84]
test eax, eax
je 0x10019667
lea eax, [ebp - 0xa78]
push eax
push dword [ebp - 0xa90]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001956a
jmp 0x10019671
mov dword [ebp - 0xa7c], 2
push dword [ebp - 0xa90]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0xa7c]
jmp 0x10019687
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10031cf1
leave
ret 0x18