joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1014bfd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x1027f34]
push edi
jae 0x1014dd6
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x1027f40]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x1014dd6
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x1014caa
test dl, 2
jne 0x1014caa
test dl, 0x48
je 0x1014c74
cmp byte [eax + 5], 0xa
je 0x1014c74
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1014cbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x1014ca5
mov dword [0x1026068], ecx
jmp 0x1014ddd
cmp eax, 0x6d
jne 0x1014cb1
xor eax, eax
jmp 0x1014dea
push eax
call fcn.010139b4
pop ecx
jmp 0x1014de7
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x1014dd1
test eax, eax
je 0x1014ce4
cmp byte [ebx], 0xa
jne 0x1014ce4
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x1014ced
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x1014dcb
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x1014dbb
cmp al, 0xd
je 0x1014d1f
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x1014dad
dec ecx
cmp dword [ebp - 8], ecx
jae 0x1014d39
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x1014d34
add dword [ebp - 8], 2
jmp 0x1014d8d
mov dword [ebp - 8], eax
jmp 0x1014da9
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1014d61
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1014da9
cmp dword [ebp - 0x10], 0
je 0x1014da9
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x1014d82
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x1014d8d
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x1014dac
cmp ebx, dword [ebp + 0xc]
jne 0x1014d92
cmp byte [ebp - 1], 0xa
jne 0x1014d92
mov byte [ebx], 0xa
jmp 0x1014dac
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0101419e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x1014dad
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x1014d03
jmp 0x1014dcb
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x1014dcb
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x1014dea
and dword [0x1026068], 0
mov dword [0x1026064], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1014df4
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x1027f34]
jae 0x1014f4f
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x1027f40]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x1014f4f
push 1
push esi
push ebx
call fcn.0101130c
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x1014f59
push 2
push esi
push ebx
call fcn.0101130c
add esp, 0xc
cmp eax, 0xffffffff
je 0x1014f59
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x1014efc
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp + 8], eax
jne 0x1014e92
mov dword [0x1026064], 0xc
or esi, 0xffffffff
jmp 0x1014f3c
push 0x8000
push ebx
call fcn.01014f65
pop ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, 0x1000
cmp edi, eax
jge 0x1014ead
mov eax, edi
push eax
push dword [ebp + 8]
push ebx
call fcn.010113a0
add esp, 0xc
cmp eax, 0xffffffff
je 0x1014ec7
sub edi, eax
test edi, edi
jg 0x1014ea2
jmp 0x1014edd
cmp dword [0x1026068], 5
jne 0x1014eda
mov dword [0x1026064], 0xd
or esi, 0xffffffff
push dword [ebp - 4]
push ebx
call fcn.01014f65
pop ecx
pop ecx
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1014f3c
jge 0x1014f3c
push 0
push dword [ebp + 0xc]
push ebx
call fcn.0101130c
push ebx
call fcn.01013bce
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x1014f3c
mov dword [0x1026064], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1026068], eax
push 0
push dword [ebp - 8]
push ebx
call fcn.0101130c
add esp, 0xc
mov eax, esi
pop edi
jmp 0x1014f5c
mov dword [0x1026064], 9
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x10150c2
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x10263e0]
test eax, eax
jne 0x10150d3
push 6
pop eax
jmp 0x10151d1
mov ecx, dword [eax + 8]
add ecx, dword [eax + 4]
je 0x101511e
push ebx
push esi
push edi
mov esi, 0x250
mov edi, ecx
mov ecx, dword [esi + eax]
mov edx, dword [esi + eax + 4]
mov ebx, ecx
and ebx, edx
cmp ebx, 0xffffffff
je 0x1015115
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseTrace]
mov eax, dword [0x10263e0]
or dword [esi + eax], 0xffffffff
mov eax, dword [0x10263e0]
or dword [esi + eax + 4], 0xffffffff
mov eax, dword [0x10263e0]
add esi, 8
dec edi
jne 0x10150e5
pop edi
pop esi
pop ebx
test byte [eax + 0x241], 4
je 0x1015131
call fcn.01017ed4
mov eax, dword [0x10263e0]
test byte [eax + 0x240], 8
je 0x1015170
mov ecx, dword [eax + 0x210]
test ecx, ecx
je 0x1015170
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
mov eax, dword [0x10263e0]
je 0x1015170
push dword [eax + 0x450]
push dword [eax + 0x240]
push dword [eax + 0x210]
call fcn.01018e8b
mov eax, dword [0x10263e0]
mov ecx, dword [0x1028490]
test ecx, ecx
je 0x1015192
push ecx
call fcn.0100c3d7
mov dword [esp], 0x1026400
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x10263e0]
test byte [eax + 0x240], 0x80
je 0x10151ac
mov eax, dword [eax + 0x22c]
test eax, eax
je 0x10151ac
push eax
call fcn.0100c3d7
pop ecx
call fcn.01016c97
push 0x1028460
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
push dword [0x10263e0]
call fcn.0100dc95
and dword [0x10263e0], 0
pop ecx
xor eax, eax
ret 4
Function at 0x1015bab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x10253cc]
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x1015bda
cmp eax, 0x720
jne 0x1015c3c
push edi
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov edi, eax
test edi, edi
jne 0x1015c39
push dword [ebp - 0x818]
lea eax, [ebp - 0x804]
push 0x10024ec
push eax
call fcn.0100b308
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1015c2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100ae9f
leave
ret 8

Function at 0x1019eb2
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push 0x10052b4
mov dword [ebp - 4], esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x1006764
push 1
push esi
push 0x1006834
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, esi
jne 0x1019f24
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
mov ebx, dword [ebp + 8]
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 8]
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, esi
jne 0x1019f23
push esi
push esi
push 3
push 4
push esi
push esi
push 0xa
push dword [ebx]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov edi, eax
pop ebx
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x1019f3a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x10030840
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.1004e0f0
mov edx, dword [esp + 0x18]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
or ecx, 0xffffffff
push ebp
mov ebp, dword [esp + 0x34]
cmp ebp, 1
push esi
mov esi, dword [edx]
setne al
add eax, ebx
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x10030879
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
cmp ebp, 1
je 0x10030944
mov ecx, dword [esp + 0x2c]
dec ecx
add ecx, esi
cmp dword [esp + 0x40], 0
mov dword [esp + 0x10], ecx
mov cl, byte [ecx]
mov byte [esp + 0xf], cl
movzx ebp, cl
je 0x100308b0
sub esi, ebp
mov eax, 1
sub esi, ebx
dec esi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [eax + ebp]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
push edi
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x10030927
mov esi, dword [esp + 0x14]
mov edx, ebp
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov ecx, ebp
lea esi, [esi - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x13]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jb 0x100308e7
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
not ebx
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x3c]
movzx ecx, bl
mov ebx, dword [esp + 0x40]
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edx], esi
pop edi
push dword [esp + 0x44]
push ecx
push ebx
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push edx
call fcn.10030510
add esp, 0x24
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100ad8e
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x103b4b8], ebx
jne 0x100ada2
xor eax, eax
jmp 0x100adff
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
call esi
mov edi, 0x8000
test di, ax
je 0x100adbb
xor ebx, ebx
inc ebx
push 0x11
call esi
test di, ax
je 0x100adc7
or ebx, 2
push 0x12
call esi
test di, ax
je 0x100add3
or ebx, 4
mov edx, dword [0x103b4b0]
xor eax, eax
test edx, edx
jle 0x100adfb
mov ecx, dword [0x103b4b8]
mov esi, ecx
cmp dword [esi + 4], ebx
jne 0x100adf3
mov edi, dword [esi]
cmp edi, dword [ebp + 8]
je 0x100ae04
inc eax
add esi, 0xc
cmp eax, edx
jl 0x100ade7
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
lea eax, [eax + eax*2]
mov eax, dword [ecx + eax*4 + 8]
mov ecx, dword [0x103b4c8]
push dword [ecx + eax*4 + 4]
call fcn.01004fe0
xor eax, eax
inc eax
jmp 0x100adfd
Function at 0x100b179
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test esi, esi
je 0x100b18b
mov ax, word [esi]
cmp ax, word [esi + 2]
jl 0x100b192
xor eax, eax
jmp 0x100b2dc
mov ecx, dword [ebp + 8]
movsx eax, ax
imul eax, eax, 0x16
mov dword [eax + esi + 0x10], ecx
movsx eax, word [esi]
mov ecx, dword [ebp + 0xc]
inc eax
imul eax, eax, 0x16
mov dword [eax + esi], ecx
movsx eax, word [esi]
mov ecx, dword [ebp + 0x10]
imul eax, eax, 0x16
push edi
push 0x26
push dword [ebp + 0x14]
mov dword [eax + esi + 0x1a], ecx
call fcn.010079f0
mov edi, eax
test edi, edi
je 0x100b2a0
cmp dword [0x103d50c], 0
je 0x100b287
push ebx
push dword [ebp + 0x14]
call fcn.0102c5db
push dword [0x103d508]
mov ebx, dword [sym.imp.msvcrt.dll_strstr]
push dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x100b216
inc eax
lea edi, [eax + 1]
mov byte [eax], 0x26
add eax, 3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
mov al, byte [edi]
jmp 0x100b21b
xor eax, eax
mov al, byte [edi + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx ecx, word [esi]
mov edi, dword [ebp + 0x14]
imul ecx, ecx, 0x16
mov word [ecx + esi + 0x14], ax
push dword [0x103d50c]
push edi
call ebx
test eax, eax
pop ecx
pop ecx
pop ebx
je 0x100b24b
lea ecx, [eax + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x100b270
test cl, cl
je 0x100b26c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x100b270
inc eax
inc eax
inc edi
inc edi
test cl, cl
jne 0x100b24e
xor eax, eax
jmp 0x100b275
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100b2ac
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x100b2ac
xor eax, eax
mov al, byte [edi + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx ecx, word [esi]
imul ecx, ecx, 0x16
mov word [ecx + esi + 0x14], ax
jmp 0x100b2ac
movsx eax, word [esi]
imul eax, eax, 0x16
and word [eax + esi + 0x14], 0
push dword [ebp + 0x14]
lea edi, [esi + 4]
push edi
call fcn.0100a9fb
movsx ecx, word [esi]
push dword [ebp + 0x18]
imul ecx, ecx, 0x16
push edi
mov dword [ecx + esi + 8], eax
call fcn.0100a9fb
movsx ecx, word [esi]
imul ecx, ecx, 0x16
mov dword [ecx + esi + 0xc], eax
inc word [esi]
xor eax, eax
inc eax
pop edi
pop ebp
ret 0x14
Function at 0x100b7f6
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, eax
push 0x26
push edi
call fcn.010079f0
cmp dword [ebp + 8], 0
mov esi, eax
je 0x100b8d4
test esi, esi
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_memmove]
jne 0x100b839
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [edi + 1]
push edi
push eax
call ebx
add esp, 0xc
mov byte [edi], 0x26
mov esi, edi
mov edi, dword [sym.imp.USER32.dll_VkKeyScanA]
lea eax, [esi + 1]
mov dword [ebp - 0x10], eax
movsx eax, byte [eax]
push eax
mov dword [ebp - 0x14], esi
call edi
mov ecx, dword [ebp + 8]
and dword [ebp - 8], 0
cmp word [ecx], 0
mov dword [ebp - 0xc], eax
jle 0x100b8d3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
imul eax, eax, 0x16
mov al, byte [eax + ecx + 0x14]
xor al, byte [ebp - 0xc]
jne 0x100b8ae
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
inc dword [ebp - 4]
cmp byte [esi], 0
je 0x100b8bb
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
add esp, 0xc
push eax
mov byte [esi], 0x26
call edi
or dword [ebp - 8], 0xffffffff
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
movsx eax, word [ecx]
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jl 0x100b864
jmp 0x100b8d3
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push dword [ebp - 0x10]
call ebx
add esp, 0xc
mov byte [esi], 0x26
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x100b8df
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x103b3bc]
mov dword [ebp - 4], eax
mov eax, dword [0x103d498]
push esi
lea eax, [eax + eax*4]
push edi
mov edi, dword [ebp + 8]
shl eax, 4
push dword [eax + 0x103d5a4]
call fcn.0100d6f1
test eax, eax
jne 0x100b91e
call fcn.0102535a
test eax, eax
je 0x100ba7c
cmp dword [0x103d530], 0
mov eax, 0x1001d98
jne 0x100b931
mov eax, 0x1001da0
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, 0x100
push esi
push 0x1001808
lea eax, [ebp - 0x104]
push eax
call fcn.0100e69c
push esi
push edi
lea eax, [ebp - 0x104]
push eax
call fcn.0100e69c
xor edi, edi
push 5
lea eax, [ebp - 0x104]
inc edi
push eax
mov dword [0x103d56c], edi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jbe 0x100ba78
push 0
push 0x10017fc
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [0x103d524], eax
je 0x100ba7c
mov ecx, dword [0x103d4a0]
mov eax, dword [0x103d4a8]
mov esi, dword [0x103d4a4]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
dec eax
mov dword [ebp - 0x10c], eax
mov eax, dword [0x103d4ac]
sub eax, esi
mov dword [ebp - 0x108], eax
push 0x10
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], esi
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp - 0x10c]
mov esi, dword [sym.imp.USER32.dll_MoveWindow]
add esp, 0xc
push edi
push dword [ebp - 0x108]
lea ecx, [eax + 2]
push eax
push dword [ebp - 0x110]
mov eax, dword [0x103d498]
push dword [ebp - 0x114]
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x103d5a0]
mov dword [ebp - 0x124], ecx
call esi
push edi
push dword [ebp - 0x118]
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push dword [0x103d524]
call esi
mov eax, dword [0x103d498]
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x103d5a0]
push 0
push 0x429
push dword [0x103d524]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call fcn.01019344
mov eax, edi
jmp 0x100ba7e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01037c59
leave
ret 4

Function at 0x100bf05
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x103b3bc]
push esi
mov esi, dword [ebp + 8]
push 0x64
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
and dword [ebp - 0x6c], 0
cmp word [esi], 0
jle 0x100bf81
push edi
lea edi, [esi + 0xc]
push ebx
mov eax, dword [edi - 4]
mov ecx, dword [esi + 4]
push dword [ecx + eax*4 + 4]
lea ebx, [ebp - 0x68]
call fcn.0100b4d1
test eax, eax
jne 0x100bf62
mov eax, dword [edi]
mov ecx, dword [esi + 4]
push dword [ecx + eax*4 + 4]
call fcn.0102c5db
mov ebx, eax
test ebx, ebx
jne 0x100bf72
movsx eax, word [esi]
inc dword [ebp - 0x6c]
add edi, 0x16
cmp dword [ebp - 0x6c], eax
jl 0x100bf38
jmp 0x100bf7f
push ebx
call fcn.01004fe0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.01037c59
leave
ret 8
Function at 0x100cfbe
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x103b4e0]
push ebx
xor ebx, ebx
sub eax, ebx
je 0x100cfdf
dec eax
jne 0x100d09c
xor eax, eax
inc eax
jmp 0x100d09e
push esi
push edi
mov esi, 0x1001834
push esi
call fcn.0100cb29
mov edi, eax
cmp edi, ebx
jne 0x100d00a
lea eax, [ebp - 4]
push eax
push esi
call fcn.0100cde6
push dword [ebp - 4]
mov edi, eax
call fcn.0100325b
cmp edi, ebx
je 0x100d05e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018d0
push edi
call esi
push 0x10018c4
push edi
mov dword [0x103b4dc], eax
call esi
push 0x10018b0
push edi
mov dword [0x103b4d8], eax
call esi
push 0x10018a4
push edi
mov dword [0x103d9d4], eax
call esi
push 0x1001898
push edi
mov dword [0x103b4d4], eax
call esi
push 0x1001888
push edi
mov dword [0x103b4d0], eax
call esi
mov dword [0x103d9d0], eax
cmp dword [0x103b4dc], ebx
pop edi
pop esi
je 0x100d092
cmp dword [0x103b4d8], ebx
je 0x100d092
cmp dword [0x103b4d4], ebx
je 0x100d092
cmp dword [0x103b4d0], ebx
je 0x100d092
cmp dword [0x103d9d0], ebx
je 0x100d092
xor eax, eax
inc eax
mov dword [0x103b4e0], eax
jmp 0x100d09e
mov dword [0x103b4e0], 2
xor eax, eax
pop ebx
leave
ret

Function at 0x100e852
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x100e877
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100e877
and dword [0x103b974], 0
xor eax, eax
inc eax
jmp 0x100e883
mov dword [0x103b974], 3
xor eax, eax
pop ebp
ret 4

Function at 0x100e9da
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1001938
mov esi, 0x104
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ea2e
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.SharedDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
jne 0x100ea4b
cmp byte [ebp + 0xc], 1
push esi
push dword [ebp + 8]
jne 0x100ea45
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
jmp 0x100ea4b
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop esi
leave
ret 8
Function at 0x100ea55
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebx
movzx eax, ax
dec eax
push esi
push edi
mov edi, ecx
je 0x100eb70
dec eax
je 0x100eb1c
dec eax
dec eax
je 0x100ea82
mov dword [0x103b974], 6
xor edi, edi
jmp 0x100eb8f
push 1
push 0x1a
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jl 0x100eaa4
mov esi, 0x104
push esi
push edi
jmp 0x100eb39
push 0
push edi
call fcn.0100e9da
mov esi, 0x104
push esi
push edi
call fcn.0100e984
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
add eax, edi
push 0x1001d90
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push esi
jne 0x100eb0a
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push edi
call fcn.0100e984
push edi
call ebx
mov ebx, eax
push 0x1001d90
add ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100eb17
push esi
push 0x10019b0
push edi
call fcn.0100e69c
jmp 0x100eb7d
mov byte [ebx], 0
jmp 0x100eb7d
push 1
push 0x1a
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
mov esi, 0x104
push esi
push edi
jl 0x100eb68
call fcn.0100e984
push esi
push 0x1001d90
push edi
call fcn.0100e69c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100eb5f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
push edi
call fcn.0100e984
jmp 0x100eb7d
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x100eb5f
push edi
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test edi, edi
je 0x100eb8f
push esi
push edi
call fcn.0100e984
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x100eb9a
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x103b3bc]
and dword [0x103b974], 0
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100ebde
test al, 0x10
jne 0x100ebf9
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0100e984
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1001d28
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x20c]
push eax
call fcn.0100e745
mov esi, eax
test esi, esi
je 0x100ec44
push esi
call fcn.0102c149
test eax, eax
je 0x100ec44
push esi
call fcn.0100325b
mov dword [0x103b974], 1
xor eax, eax
jmp 0x100ec46
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
call fcn.01037c59
leave
ret