joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f7cd
Capabilities:
Check for peb ntglobalflag flag
Get number of processors

Disassembly:
mov eax, 0x101ca0b
call fcn.01019e88
push ecx
push ecx
push ebx
push esi
mov esi, ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
and dword [ebp - 0x14], 0
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
lea eax, [edi + 0x7c]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [esi + 0x80], eax
lea eax, [edi + 0x84]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [esi + 0x88], eax
lea eax, [edi + 0x8c]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [esi + 0x90], eax
lea eax, [edi + 0x94]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [esi + 0x98], eax
lea eax, [edi + 0xa8]
mov ecx, eax
add eax, 4
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [ecx]
mov dword [esi + 0xac], eax
mov eax, dword [edi + 0x9c]
mov dword [esi + 0x9c], eax
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
lea eax, [edi + 0x4c]
mov dword [ebp - 0x10], esp
push eax
lea ecx, [esi + 0x4c]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x50]
push eax
lea ecx, [esi + 0x50]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0xa0]
push eax
lea ecx, [esi + 0xa0]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0xa4]
push eax
lea ecx, [esi + 0xa4]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x64]
push eax
lea ecx, [esi + 0x64]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x68]
push eax
lea ecx, [esi + 0x68]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x54]
push eax
lea ecx, [esi + 0x54]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x58]
push eax
lea ecx, [esi + 0x58]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x6c]
push eax
lea ecx, [esi + 0x6c]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x5c]
push eax
lea ecx, [esi + 0x5c]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x60]
push eax
lea ecx, [esi + 0x60]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x70]
push eax
lea ecx, [esi + 0x70]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x74]
push eax
lea ecx, [esi + 0x74]
call sub.MFC42u.dll_CString::operator
lea eax, [edi + 0x78]
push eax
lea ecx, [esi + 0x78]
call sub.MFC42u.dll_CString::operator
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x1011da6
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 1
mov esi, ecx
call fcn.010108cc
lea edi, [esi + 0x190]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp dword [ebp - 4], ebx
jne 0x1011e06
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 0x1011bdd
push ebx
push ebx
mov dword [esi + 0x1b4], 1
mov dword [esi + 0x1b0], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x1ac], eax
jne 0x1011e06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1011e1a
mov dword [esi + 0x1b4], ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1012bb7
Capabilities:
Get common file path

Disassembly:
mov eax, 0x101cc6a
call fcn.01019e88
sub esp, 0xa18
mov eax, dword [0x1022d9c]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1012c02
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1012cb9
mov edi, dword [sym.imp.msvcrt.dll_rand]
call edi
mov esi, eax
call edi
imul esi, eax
call edi
imul esi, eax
lea edi, [esi + 1]
cmp edi, esi
je 0x1012cb6
push dword [ebp - 0xa20]
and dword [ebp - 4], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1003818
lea eax, [ebp - 0x21c]
push eax
push 0x10037f8
push ebx
call sub.MFC42u.dll_CString::Format
mov eax, dword [ebx]
or dword [ebp - 4], 0xffffffff
add esp, 0x1c
push 0
push 0x180
push 1
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x1012c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1012cb9
inc edi
jmp 0x1012c19
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1012cb9
push 0x1f
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.010189ca
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1012d46
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x101cc79
call fcn.01019e88
sub esp, 0x164
mov eax, dword [0x1022d9c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp eax, esi
push edi
mov dword [ebp - 0x10], esp
ja 0x1012d8b
cmp dword [ebp + 8], esi
jbe 0x1012d8b
cmp eax, esi
ja 0x1012d8b
jb 0x1012d84
cmp dword [ebp + 8], 0x400
jae 0x1012d8b
xor ecx, ecx
inc ecx
xor eax, eax
jmp 0x1012d95
mov ecx, dword [ebp + 8]
shrd ecx, eax, 0xa
shr eax, 0xa
push eax
push ecx
push 0x1003858
push ebx
mov dword [ebp - 4], esi
call sub.MFC42u.dll_CString::Format
mov eax, dword [ebx]
or dword [ebp - 4], 0xffffffff
add esp, 0x10
push 0x64
lea ecx, [ebp - 0x170]
push ecx
push esi
push eax
push esi
mov edi, 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
je 0x1012ddd
push 0xa
lea eax, [ebp - 0x28]
push eax
push 0xe
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, esi
jne 0x1012de5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1012e63
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, esi
pop ecx
pop ecx
je 0x1012dff
mov word [eax], si
push 0x1f
xor eax, eax
cmp dword [0x1022ecc], esi
mov word [ebp - 0xa8], si
pop ecx
lea edi, [ebp - 0xa6]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 2
stosw word es:[edi], ax
je 0x1012e2d
mov word [ebp - 0xa8], 0x202d
lea eax, [ebp - 0xa8]
push 0x100384c
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0xa8]
push eax
push ebx
call sub.MFC42u.dll_CString::Format
add esp, 0x14
xor eax, eax
jmp 0x1012e63
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.010189ca
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x101338f
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x101ccfe
call fcn.01019e88
sub esp, 0x38
mov eax, dword [0x1022d9c]
and dword [ebp - 0x44], 0
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x40], eax
add esi, 4
mov eax, dword [esi]
cdq
mov ecx, 0x15180
idiv ecx
push edi
test eax, eax
je 0x10133c9
call sub.MFC42u.dll_AfxThrowUserException
push 0x14
lea eax, [ebp - 0x38]
push eax
push 0x1e
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x101340a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.010072ca
test eax, eax
je 0x1013405
push 0x90035
push edi
push 0x8003
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
call sub.MFC42u.dll_AfxThrowResourceException
lea ecx, [ebp - 0x3c]
call sub.MFC42u.dll_CString::CString_2
mov ecx, dword [esi]
mov eax, ecx
push 0x3c
cdq
pop ebx
idiv ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
imul eax, eax, 0x3c
sub ecx, eax
push ecx
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.0101336c
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.01013344
push eax
lea eax, [ebp - 0x3c]
push 0x1003a84
push eax
call sub.MFC42u.dll_CString::Format
mov ecx, dword [ebp - 0x40]
add esp, 0x1c
lea eax, [ebp - 0x3c]
push eax
call sub.MFC42u.dll_CString::CString_1
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x44], edi
mov byte [ebp - 4], 0
call sub.MFC42u.dll_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x40]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.010189ca
leave
ret 4
Function at 0x1016a20
Capabilities:
Delete file

Disassembly:
mov eax, 0x101d13e
call fcn.01019e88
sub esp, 0x428
mov eax, dword [0x1022d9c]
push ebx
mov dword [ebp - 0x14], eax
mov eax, ecx
push esi
lea esi, [eax + 0x124]
push edi
mov ecx, esi
mov dword [ebp - 0x10], esp
call fcn.01009cda
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x1016be8
push ebx
push 0x10026f8
push 0x10026e8
mov ecx, 0x1022db8
call sub.MFC42u.dll_CWinApp::GetProfileIntW
test eax, eax
je 0x1016ae6
lea ecx, [ebp - 0x434]
call sub.MFC42u.dll_CString::CString_2
and dword [ebp - 4], 0
push 0xef33
lea eax, [ebp - 0x434]
push eax
call fcn.010129ff
mov edi, eax
test edi, edi
je 0x1016abf
call fcn.010072ca
test eax, eax
je 0x1016ab4
push 0x5a02a0
push edi
push 0x8003
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x434]
jmp 0x1016bdf
push 0
push 0x24
push dword [ebp - 0x434]
call fcn.010129b3
or dword [ebp - 4], 0xffffffff
cmp eax, 6
lea ecx, [ebp - 0x434]
jne 0x1016be3
call sub.MFC42u.dll_CString::CString
push 2
push 0xffffffffffffffff
mov ecx, esi
call fcn.01009bc5
mov edi, eax
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push edi
mov ecx, esi
call sub.MFC42u.dll_CListCtrl::GetItemText_1
push 0x105
lea eax, [ebp - 0x42c]
push eax
call fcn.0101b5f5
test eax, eax
jne 0x1016b4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.010072ca
test eax, eax
je 0x1016be8
push 0x5a02bc
push esi
push 0x8003
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1016be8
lea ecx, [ebp - 0x430]
call sub.MFC42u.dll_CString::CString_2
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x430]
push 0x10053b8
mov dword [ebp - 4], ebx
push eax
mov byte [ebp - 4], 2
call sub.MFC42u.dll_CString::Format
add esp, 0x10
push dword [ebp - 0x430]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1016bac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.010072ca
test eax, eax
je 0x1016bd9
push 0x5a02d4
push esi
jmp 0x1016bcb
push edi
mov ecx, esi
call fcn.01009b8c
test eax, eax
jne 0x1016bd9
call fcn.010072ca
test eax, eax
je 0x1016bd9
push 0x5a02da
push 0x3eb
push 0x8003
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x430]
or dword [ebp - 4], 0xffffffff
call sub.MFC42u.dll_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.010189ca
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1017187
Capabilities:
Copy file

Disassembly:
mov eax, 0x101d1b8
call fcn.01019e88
sub esp, 0x238
mov eax, dword [0x1022d9c]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
lea edi, [ebp - 0x240]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi]
mov dword [ebp - 0x22c], ecx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x244], 2
mov dword [ebp - 0x240], eax
call sub.MFC42u.dll_CString::CString_2
mov edi, dword [ebp - 0x22c]
and dword [ebp - 4], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x244]
push eax
lea ecx, [edi + 0x124]
call fcn.01009be9
test eax, eax
jl 0x1017241
push dword [esi]
lea eax, [ebp - 0x224]
push 0xef32
push eax
mov byte [ebp - 4], 1
call sub.MFC42u.dll_AfxFormatString1
and dword [ebp - 4], 0
push 0
push 0x24
push dword [ebp - 0x224]
call fcn.010129b3
cmp eax, 6
je 0x1017241
xor esi, esi
jmp 0x10172d3
push 0x105
lea eax, [ebp - 0x220]
push eax
call fcn.0101b5f5
test eax, eax
jne 0x1017260
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10172d3
lea ecx, [ebp - 0x228]
call sub.MFC42u.dll_CString::CString_2
push dword [esi]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push 0x10053b8
push eax
mov byte [ebp - 4], 4
call sub.MFC42u.dll_CString::Format
mov ebx, dword [ebx]
add esp, 0x10
push 0
push dword [ebp - 0x228]
mov dword [ebp - 4], 3
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10172b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10172b7
mov ecx, edi
call fcn.01016e7a
mov esi, eax
jmp 0x10172c4
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 0
call sub.MFC42u.dll_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call sub.MFC42u.dll_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.010189ca
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1017302
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov ebx, ecx
je 0x1017325
push dword [ebp + 8]
call fcn.0101bcc8
mov esi, eax
test esi, esi
jne 0x1017325
push 8
pop eax
jmp 0x1017363
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1016ce1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x10230f0], eax
jne 0x101735a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov ebx, eax
je 0x1017356
push esi
call fcn.0101b86f
mov eax, ebx
jmp 0x1017363
mov ecx, ebx
call fcn.01016c28
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1017d7f
Capabilities:
Copy file
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x1022d9c]
and word [ebp - 0x20c], 0
and dword [ebp - 0x2f4], 0
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x214], eax
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push 0x37
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x2f0]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
push eax
push 0x100284c
push ebx
call fcn.0101ac0d
mov dword [esi], eax
or eax, edx
mov dword [esi + 4], edx
jne 0x1017e07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1017eb0
cmp dword [ebp + 0x10], 0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x1017e50
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x10056f0
push dword [esi + 4]
lea eax, [ebp - 0x20c]
push dword [esi]
push dword [ebp - 0x214]
push ebx
push 0x10056d4
push 0x103
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x20
test eax, eax
jge 0x1017e50
push 0x6f
pop esi
jmp 0x1017eb0
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1017dfa
push dword [ebp + 0x10]
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.FXSTIFF.dll_GetW2kMsTiffTags
mov esi, eax
test esi, esi
jne 0x1017ecd
push dword [ebp + 0x10]
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.FXSTIFF.dll_TiffAddMsTags
test eax, eax
jne 0x1017eb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x2f4]
push eax
call sub.FXSTIFF.dll_FreeMsTagInfo
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.010189ca
leave
ret 0x14
cmp esi, 0x4e21
jne 0x1017ea7
xor esi, esi
jmp 0x1017eb0

Function at 0x10189ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1022d9c]
jne 0x10189db
test ecx, 0xffff0000
jne 0x10189db
ret
jmp fcn.010189e5
Function at 0x1019c21
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10057a0
call fcn.0101a150
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x1000000], 0x5a4d
jne 0x1019c6a
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1019c6a
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1019c83
cmp ecx, 0x20b
je 0x1019c70
and dword [ebp - 0x1c], 0
jmp 0x1019c9a
cmp dword [eax + 0x1000084], 0xe
jbe 0x1019c6a
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x1019c94
cmp dword [eax + 0x1000074], 0xe
jbe 0x1019c6a
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 2
pop esi
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or edi, 0xffffffff
mov dword [0x1023468], edi
mov dword [0x102346c], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1023430]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x102342c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1023464], eax
call fcn.0101a148
cmp dword [0x1022da0], 0
jne 0x1019cfa
push fcn.0101a148
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0101a131
push 0x10019fc
push 0x10019f8
call sub.msvcrt.dll__initterm
mov eax, dword [0x1023428]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1023424]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x10019f4
push 0x10019c4
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov eax, dword [eax]
test eax, eax
jne 0x1019d5f
mov dword [ebp - 4], edi
mov eax, 0xff
jmp 0x1019e0e
mov dword [ebp - 0x20], eax
cmp word [eax], 0x22
jne 0x1019da0
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x1019d7b
cmp cx, 0x22
jne 0x1019d68
cmp word [eax], 0x22
jne 0x1019d86
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x1019d94
cmp cx, 0x20
jbe 0x1019d81
test byte [ebp - 0x54], 1
je 0x1019dad
movzx ecx, word [ebp - 0x50]
jmp 0x1019db0
cmp word [eax], 0x20
jbe 0x1019d86
add eax, esi
mov dword [ebp - 0x20], eax
jmp 0x1019da0
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call fcn.0101c1bb
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1019dd0
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x1019e0c
mov eax, esi
call fcn.0101a18b
ret
Function at 0x101a23d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10057e8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101a295
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1005824
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101a288
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x101a297
xor eax, eax
pop esi
leave
ret 4

Function at 0x101a38a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1022d9c]
push edi
push 0x46
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x11c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x101a42d
push 2
pop edx
cmp dword [ebp - 0x110], edx
jne 0x101a42d
cmp dword [ebp - 0x11c], 5
jb 0x101a42d
mov ecx, dword [ebp - 8]
test cl, 0x40
je 0x101a3f4
mov al, byte [ebp - 6]
dec al
neg al
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x101a434
test ch, 2
je 0x101a3fe
xor eax, eax
inc eax
jmp 0x101a434
test dl, cl
je 0x101a406
push 8
jmp 0x101a433
mov eax, 0x80
test al, cl
je 0x101a413
push 0x10
jmp 0x101a433
test ch, 4
jne 0x101a434
cmp byte [ebp - 6], 1
jne 0x101a422
mov eax, edx
jmp 0x101a434
cmp byte [ebp - 6], 3
je 0x101a431
cmp byte [ebp - 6], dl
je 0x101a431
xor eax, eax
jmp 0x101a434
push 4
pop eax
mov ecx, dword [ebp - 4]
call fcn.010189ca
leave
ret

Function at 0x101a443
Capabilities:
Check os version

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
sbb eax, eax
and eax, 0xfffffff4
add eax, 0x58
ret

Function at 0x101a756
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push edi
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
xor ebx, ebx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x500
mov dword [ebp - 0x30], 0x1003388
mov dword [ebp - 0x20], 1
call esi
test eax, eax
jne 0x101a7b4
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], ebx
call esi
test eax, eax
jne 0x101a7b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x101a7c2
Capabilities:
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor ecx, ecx
test byte [ebp + 0x24], 2
mov eax, 0x100000
je 0x101a7d9
mov eax, 0x102000
push esi
push edi
mov edi, dword [ebp + 0x24]
and edi, 1
je 0x101a7eb
push 4
or eax, 0x4000100
pop ecx
push dword [ebp + 0x20]
or eax, dword [ebp + 0x1c]
or ecx, dword [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x101a82d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x101a832
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x65e
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x101a845
test edi, edi
je 0x101a843
push 4
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, esi
pop edi
pop esi
pop ebp
ret 0x20

Function at 0x101a903
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1294
call fcn.0101c220
mov eax, dword [0x1022d9c]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [ebp - 4], eax
jne 0x101a945
lea eax, [ebp - 0x414]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x101aa0a
lea edi, [ebp - 0x414]
push 0x5c
push edi
call sub.msvcrt.dll_wcsrchr
cmp eax, esi
pop ecx
pop ecx
je 0x101a965
cmp word [eax + 2], si
jne 0x101a965
push 1
push esi
push eax
call sub.msvcrt.dll__wcsnset
add esp, 0xc
cmp dword [ebp + 0xc], esi
mov esi, 0x1003818
jne 0x101a974
mov esi, 0x1005978
push 0x100284c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push edi
push 0x100595c
mov esi, 0x30c
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.0101a89c
add esp, 0x1c
test eax, eax
jl 0x101aa0a
push ebx
lea eax, [ebp - 0x1294]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x101aa09
lea eax, [ebp - 0x1268]
push eax
push edi
push 0x10053b8
lea eax, [ebp - 0x1044]
push esi
push eax
call fcn.0101a89c
add esp, 0x14
test eax, eax
jl 0x101a9ea
lea eax, [ebp - 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x1294]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x101a9bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.010189ca
leave
ret 8