joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001873
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1001ce8
call fcn.01001a14
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10035ac
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1001688
cmp eax, esi
jne 0x100167b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100168b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001662
xor esi, esi
inc esi
mov eax, dword [0x10035a8]
cmp eax, esi
jne 0x100169e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10016d9
mov eax, dword [0x10035a8]
test eax, eax
jne 0x10016d3
mov dword [0x10035a8], esi
push 0x1001104
push 0x10010f8
call fcn.010015df
pop ecx
pop ecx
test eax, eax
je 0x10016d9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10017a3
mov dword [0x1003054], esi
mov eax, dword [0x10035a8]
cmp eax, esi
jne 0x10016fd
push 0x10010f4
push 0x10010ec
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10035a8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100170a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10035b0], ebx
je 0x100172b
push 0x10035b0
call fcn.01001989
pop ecx
test eax, eax
je 0x100172b
push ebx
push 2
push ebx
call dword [0x10035b0]
push dword [0x100303c]
push dword [0x1003040]
push dword [0x1003038]
call fcn.01001580
add esp, 0xc
mov dword [0x1003050], eax
cmp dword [0x1003044], ebx
jne 0x1001789
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1003054], ebx
jne 0x1001797
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003050]
call fcn.01001a59
ret
call fcn.01001b61
jmp 0x1001640

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x610e0f0b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xd7147cc
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10084c8
Capabilities:
Connect network resource
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x134]
push eax
call fcn.0102cbf9
cmp byte [ebp - 0x133], 0x3a
jne 0x1008530
mov byte [ebp - 0x131], bl
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x1008615
mov eax, dword [ebp - 0xc]
cmp eax, 1
jne 0x1008608
mov eax, dword [ebp - 4]
shr eax, 1
jmp 0x1008617
cmp byte [ebp - 0x134], 0x5c
jne 0x1008615
cmp byte [ebp - 0x133], 0x5c
jne 0x1008615
mov esi, 0x100173c
lea edi, [ebp + 8]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrA]
xor eax, eax
lea edi, [ebp + 0xb]
stosb byte es:[edi], al
push 0x5c
lea eax, [ebp - 0x132]
push eax
call esi
cmp eax, ebx
je 0x1008615
push 0x5c
push eax
call dword [sym.imp.USER32.dll_CharNextA]
push eax
call esi
cmp eax, ebx
je 0x1008586
mov byte [eax], bl
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
xor esi, esi
inc esi
lea eax, [ebp - 0x134]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], eax
mov byte [ebp + 8], 0x44
push ebx
lea eax, [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
push ebx
lea eax, [ebp - 0x30]
push eax
call sub.MPR.dll_WNetAddConnection2A
cmp eax, 0x55
je 0x10085be
cmp eax, ebx
je 0x10085cf
inc byte [ebp + 8]
cmp byte [ebp + 8], 0x5a
jle 0x10085a3
cmp eax, ebx
jne 0x10084f5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x10085f3
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
push ebx
push ebx
lea eax, [ebp + 8]
push eax
call sub.MPR.dll_WNetCancelConnection2A
mov eax, dword [ebp - 0xc]
cmp eax, esi
jmp 0x1008520
imul eax, dword [ebp - 8]
shr eax, 0xa
imul eax, dword [ebp - 4]
jmp 0x1008617
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100a13d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
cmp word [0x103eaa0], 0
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push edi
jne 0x100a16a
push 0x1001b38
push 0x103d3b8
push 0x103eaa0
call esi
push 0x1001a00
push dword [ebp + 8]
lea eax, [ebp - 0x660]
push eax
call esi
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_65]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100a23a
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
test byte [ebp - 0x250], 0x10
je 0x100a21d
push 0x1001b34
lea eax, [ebp - 0x224]
push eax
call edi
test eax, eax
je 0x100a21d
push 0x1001b2c
lea eax, [ebp - 0x224]
push eax
call edi
test eax, eax
je 0x100a21d
push 0x103eaa0
lea eax, [ebp - 0x224]
push eax
push 0x10018b0
call fcn.0102d95b
test eax, eax
jne 0x100a21d
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x458]
push eax
call esi
push 0x1001b10
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100a243
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_Ordinal_341]
test eax, eax
jne 0x100a1a0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x100a23c

Function at 0x100a915
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push 0x103d9e8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100a961
inc eax
jmp 0x100a9b5
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
lea eax, [ebp - 0x208]
jne 0x100a97e
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
push eax
call fcn.0102ce43
jmp 0x100a9af
push dword [ebp + 0xc]
push eax
push 0x1001bc4
lea eax, [ebp - 0x820]
push 0x30c
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push esi
push esi
push 0x103e000
lea eax, [ebp - 0x820]
push eax
call fcn.0102d3fa
neg eax
sbb eax, eax
inc eax
pop esi
leave
ret 0xc
Function at 0x100b2aa
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push esi
push edi
push 0x1001e48
push 0x103ddf8
mov edi, 0x103d9e8
push edi
call ebx
call fcn.0102c70c
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
push edi
call esi
push 0x103c550
push edi
call esi
push edi
call fcn.0102eda3
push 0x1001e30
push edi
call esi
cmp word [0x103dbf0], 0
je 0x100b347
push 0x1001e48
push 0x103dbf0
lea eax, [ebp - 0x20c]
push eax
call ebx
call fcn.0102c70c
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x103c550
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102eda3
push 0x1001e30
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100b368
push 0
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_112]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100b478
push 0x1001b50
push 0x1001e20
lea eax, [ebp - 0xa2c]
push 0x104
push eax
mov dword [ebp - 4], 0x208
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x61c]
push eax
push 0
push 0x103ddf8
lea eax, [ebp - 0xa2c]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100b478
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x1001e14
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x100b478
push 0x1001e48
push 0x103ddf8
lea eax, [ebp - 0x414]
push eax
call ebx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
push 0x1001e30
lea eax, [ebp - 0x414]
push eax
call esi
xor ebx, ebx
inc ebx
push ebx
push edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_112]
cmp word [0x103e658], 0
jne 0x100b478
lea eax, [ebp - 0x414]
push eax
mov esi, 0x103e658
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x100b478
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov dword [0x103b734], ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100e33c
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x100e363
inc esi
mov al, byte [esi]
test al, al
je 0x100e35c
cmp al, 0x22
jne 0x100e351
cmp byte [esi], 0x22
jne 0x100e374
jmp 0x100e373
cmp al, 0x20
jle 0x100e374
inc esi
cmp byte [esi], 0x20
jg 0x100e367
jmp 0x100e374
cmp al, 0x20
jg 0x100e37a
inc esi
mov al, byte [esi]
test al, al
jne 0x100e36f
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x100e394
movzx eax, word [ebp - 0x14]
jmp 0x100e397
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.SHLWAPI.dll_Ordinal_83]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100e6e9
Capabilities:
Get file size

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
cmp esi, ebp
je 0x100e817
push ebx
push edi
push 0x104
lea edi, [esi + 0x544]
push edi
push 0x3c4c
push dword [esp + 0x20]
call dword [sym.imp.SHLWAPI.dll_Ordinal_74]
push ebp
push 0x80
push 3
push ebp
push 3
push 0x80000000
push edi
mov dword [esi + 4], ebp
call dword [sym.imp.SHLWAPI.dll_Ordinal_52]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100e755
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
inc ecx
shr eax, 0xa
neg ecx
sbb ecx, ecx
and ecx, eax
push ebx
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x2e
push ebp
push edi
call ebx
push 0x5c
push 0
push edi
mov ebp, eax
call ebx
test ebp, ebp
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov edi, eax
je 0x100e7b5
push 0x1002288
push ebp
call ebx
test eax, eax
jne 0x100e7b5
push 1
push 0x3c4f
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
and dword [esi + 8], 0
test edi, edi
je 0x100e815
add edi, 2
push edi
add esi, 0x204
push esi
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
jmp 0x100e815
push 0
push 0x3c4f
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
test ebp, ebp
je 0x100e815
push 0x100227c
push ebp
call ebx
test eax, eax
jne 0x100e815
test edi, edi
mov dword [esi + 8], 2
je 0x100e815
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add edi, 2
push edi
lea ebx, [esi + 0x1c4]
push ebx
call ebp
push edi
add esi, 0x204
push esi
call ebp
push ebx
push 0x3c4f
push dword [esp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_Ordinal_138]
pop edi
pop ebx
pop esi
pop ebp
ret 8
Function at 0x100fb7f
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.0102c870
mov eax, dword [0x108f2d4]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
jne 0x100fbb2
push esi
push esi
push esi
push esi
push 0x10023c8
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [0x108f2d4], eax
push esi
push 0x4000000
push 0xffffffffffffffff
push 0x10023a8
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x100fcdf
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_57]
push esi
push 0x80
push 1
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_52]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x100fccb
cmp dword [0x103e438], esi
push ebx
push edi
jne 0x100fcc5
mov edi, dword [ebp + 0x14]
mov ebx, dword [sym.imp.SHLWAPI.dll_Ordinal_116]
jmp 0x100fc2e
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_60]
push 1
push esi
push esi
push dword [0x103ed90]
lea eax, [ebp - 0x2c]
push eax
call ebx
test eax, eax
jne 0x100fc1a
lea eax, [ebp + 0xc]
push eax
push 0x1000
lea eax, [ebp - 0x102c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x100fcc5
cmp dword [ebp + 0xc], esi
je 0x100fcc9
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x102c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
add dword [0x108f2d8], eax
cmp dword [ebp + 0x10], esi
je 0x100fcb9
mov eax, dword [0x108f2d8]
lea ecx, [edi + edi*4]
shl ecx, 1
xor edx, edx
div ecx
push esi
push eax
push 0x402
push dword [ebp + 0x10]
call dword [sym.imp.SHLWAPI.dll_Ordinal_136]
push dword [ebp + 0x18]
push dword [0x103ed8c]
call fcn.0102c450
cmp dword [0x103e438], esi
je 0x100fc2e
or dword [ebp - 4], 0xffffffff
pop edi
pop ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x100fce3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 8], 0x200
pop esi
jae 0x100fcf1
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
leave
ret 0x14
Function at 0x1015e4d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x108ce7c]
add eax, 0x180
xor ecx, ecx
jmp 0x1015e69
mov dword [eax - 0x150], ecx
add eax, 0xb74
cmp word [eax], cx
jne 0x1015e5e
pop ebp
jmp fcn.0101591c

Function at 0x1019711
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x186c
call fcn.0102c870
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0xe0]
test eax, eax
je 0x1019744
push eax
push 0x4076
push dword [0x103ed90]
call dword [sym.imp.SHLWAPI.dll_Ordinal_138]
lea eax, [edi + 0x204]
push eax
mov ebx, 0x108ce98
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x108e0a0
lea eax, [ebp - 0x186c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x1002bec
lea eax, [ebp - 0x186c]
push eax
call esi
lea eax, [edi + 0x204]
push eax
lea eax, [ebp - 0x186c]
push eax
call esi
push ebx
call fcn.010084c8
mov dword [ebp + 8], eax
mov eax, dword [edi + 4]
cmp dword [ebp + 8], eax
jae 0x1019815
mov ebx, dword [sym.imp.SHLWAPI.dll_Ordinal_107]
mov esi, 0x104
push esi
lea eax, [ebp - 0x824]
push eax
push 0x88e3
push dword [0x103d7d0]
call ebx
push esi
lea eax, [ebp - 0x414]
push eax
push 0x88e5
push dword [0x103d7d0]
call ebx
push dword [edi + 4]
lea eax, [ebp - 0x414]
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x61c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
push 0x10000
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
push 0
call dword [sym.imp.SHLWAPI.dll_Ordinal_340]
jmp 0x1019861
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [edi + 0xe0]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x186c]
push eax
push dword [0x103ed90]
call fcn.0100fe0e
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov ecx, 0xdeadbeef
je 0x1019865
cmp esi, ecx
je 0x1019865
push 1
push dword [ebp - 4]
push edi
call fcn.010158b2
xor eax, eax
jmp 0x1019867
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x101a414
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push 0x3bd9
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x1002bb4
mov dword [ebp - 0xc], eax
push 0x108ce98
lea eax, [ebp - 0x214]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x101a469
mov eax, 0xdeadbeef
jmp 0x101a595
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push edi
push 0x108d0a0
mov edi, 0x10016f0
push edi
call esi
test eax, eax
je 0x101a48e
push 0x108e0a0
push edi
call esi
test eax, eax
jne 0x101a493
call fcn.0101047e
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01007b53
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push 0x4e
lea edx, [ebp + 8]
push edx
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jge 0x101a4cd
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x101a4c6
push 1
call fcn.01007c4b
mov eax, esi
jmp 0x101a593
push 0xb74
push 0x40
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
jmp 0x101a55d
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x101a4fb
push dword [ebp - 8]
mov ecx, eax
call fcn.01006e99
mov ebx, eax
jmp 0x101a4fd
xor ebx, ebx
test ebx, ebx
je 0x101a55d
push ebx
xor eax, eax
mov ecx, 0x2dd
mov edi, esi
push esi
rep stosd dword es:[edi], eax
call fcn.0101a076
cmp dword [esi + 0x1c], 0
je 0x101a554
cmp dword [esi + 0x2c], 1
je 0x101a554
push 3
lea eax, [esi + 0x180]
push eax
call fcn.01019c46
cmp eax, 0xdeadbeef
mov dword [esi + 0xc], eax
je 0x101a554
cmp eax, 3
jne 0x101a545
push esi
push dword [ebp - 0xc]
call fcn.01019552
cmp dword [esi + 0xc], 1
jne 0x101a554
push esi
push dword [ebp - 0xc]
call fcn.01019600
mov ecx, ebx
push 1
call fcn.0101021e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x101a4e1
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x101a589
push 1
call fcn.01007c4b
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x101a89a
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push esi
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push esi
push dword [ebp + 8]
push 0x101a66b
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x101aa38
push ebx
push edi
push esi
push 0x1019a81
push dword [ebp + 8]
push 0x82f
push dword [0x103d7d0]
call dword [sym.imp.SHLWAPI.dll_Ordinal_49]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push eax
mov dword [ebp - 8], eax
call edi
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x101a923
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_60]
push 1
push esi
push esi
lea eax, [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_116]
test eax, eax
jne 0x101a8fc
push 0xff
push 0xffffffffffffffff
push esi
lea eax, [ebp - 4]
push eax
push 1
call ebx
test eax, eax
jne 0x101a910
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0xc], 0xdeadbeef
jne 0x101a9b1
mov ebx, dword [sym.imp.SHLWAPI.dll_Ordinal_107]
push 0x104
lea eax, [ebp - 0x43c]
push eax
push 0x8b09
push dword [0x103d7d0]
call ebx
push 0x104
lea eax, [ebp - 0x234]
push eax
push 0x8b12
push dword [0x103d7d0]
call ebx
push esi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x43c]
push eax
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_340]
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
push dword [ebp + 0xc]
call fcn.01019491
push dword [ebp + 0xc]
mov esi, 0x3bdd
push esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_138]
push 5
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
call esi
push eax
call edi
push 1
mov ebx, 0x3bdc
push ebx
push dword [ebp + 8]
call esi
push eax
push 0x3bd9
push dword [ebp + 8]
call esi
push eax
call fcn.01019b97
push 0x104
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_Ordinal_74]
push 5
push ebx
push dword [ebp + 8]
call esi
push eax
call edi
push 5
push 0x3bde
push dword [ebp + 8]
call esi
push eax
call edi
push 0
push 1
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 0xc