joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10115dd8
mov dword [ebp - 0x58], 0x6f0053
lea esi, [ebp - 0x58]
mov dword [ebp - 0x54], 0x740066
push edi
mov dword [ebp - 0x50], 0x610077
mov edx, 0x2b
mov dword [ebp - 0x4c], 0x650072
sub esi, eax
mov dword [ebp - 0x48], 0x4d005c
mov dword [ebp - 0x44], 0x630069
mov dword [ebp - 0x40], 0x6f0072
mov dword [ebp - 0x3c], 0x6f0073
mov dword [ebp - 0x38], 0x740066
mov dword [ebp - 0x34], 0x49005c
mov dword [ebp - 0x30], 0x74006e
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x65006e
mov dword [ebp - 0x24], 0x200074
mov dword [ebp - 0x20], 0x780045
mov dword [ebp - 0x1c], 0x6c0070
mov dword [ebp - 0x18], 0x72006f
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x4d005c
mov dword [ebp - 0xc], 0x690061
mov dword [ebp - 8], 0x6e
lea ecx, [edx + 0x7fffffd3]
test ecx, ecx
je 0x10040303
movzx ecx, word [esi + eax]
test cx, cx
je 0x10040303
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100402e5
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x10115dd8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x100414d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x780065
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x10115e48
mov dword [ebp - 0x1c], 0x6c0070
mov dword [ebp - 0x18], 0x72006f
mov edx, 0xe
mov dword [ebp - 0x14], 0x720065
sub esi, eax
mov dword [ebp - 0x10], 0x65002e
mov dword [ebp - 0xc], 0x650078
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x1004153e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004153e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10041520
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10115e48
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret

Function at 0x10041560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x10115e64
mov dword [ebp - 0x1c], 0x610074
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x6b0073
mov dword [ebp - 0x14], 0x67006d
mov edx, 0xd
mov dword [ebp - 0x10], 0x2e0072
sub esi, eax
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x100415ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x100415ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100415b0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x10115e64
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x100423c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d42fd
mov eax, dword fs:[0]
push eax
mov eax, 0x102c
call fcn.1007f420
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1038], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x102c], 0
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x10042558
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
push 0x1000
lea eax, [ebp - 0x1010]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x102c], 1
mov dword [ebp - 0x1034], 1
call fcn.100a5d20
lea eax, [ebp - 0x1028]
mov dword [ebp - 0x1030], 0x800
push str.TK8Fj70YG_v_3_vPPg7Vdm30XuBkLQEO1THF4mZ06i_foDUuatiCLqo3UQuDlAcNYT9wv6OGo2LxfcPIj7LcA
push eax
call fcn.10054400
add esp, 0x14
cmp dword [ebp - 0x1014], 8
lea ecx, [ebp - 0x1030]
push ecx
lea ecx, [ebp - 0x1010]
mov dword [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x1034]
push ecx
lea eax, [ebp - 0x1028]
cmovae eax, dword [ebp - 0x1028]
push str.InstallLocation
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100424fe
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.User_DataDefault
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x1010]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100424e0
sub eax, edx
mov ecx, esi
sar eax, 1
push eax
lea eax, [ebp - 0x1010]
push eax
call fcn.100045a0
mov edx, dword [ebp - 0x1014]
cmp edx, 8
jb 0x1004253a
mov ecx, dword [ebp - 0x1028]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10042530
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10042562
push edx
push ecx
call fcn.1007f042
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10003fe0
call fcn.100a9b45
int3
Function at 0x10045b40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d3d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], edi
cmp word [0x10115e90], 0
jne 0x10045bfb
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100a5d20
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.SogouExplorer
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, 0x10115e90
lea esi, [ebp - 0x218]
mov edx, 0x104
sub esi, ecx
nop dword [eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10045bee
movzx eax, word [esi + ecx]
test ax, ax
je 0x10045bee
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10045bd0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x10045c6b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x10115e90
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.10004160
test al, al
jne 0x10045c4c
mov ecx, 0x10115e90
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10045c30
sub ecx, edx
sar ecx, 1
push ecx
push 0x10115e90
mov ecx, edi
call fcn.100045a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10003fe0
int3
Function at 0x100467a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d3b30
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10111404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x30], 0
je 0x100467e4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
call fcn.10045b40
mov dword [ebp - 4], 0
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x1004693d
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
mov edx, dword [ebp - 0x10]
mov edi, dword [ebx + 0x40]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edx
jge 0x10046842
push 0x104
lea ecx, [ebp - 0x14]
call fcn.10004500
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp dword [esi - 8], 0x104
jl 0x10046947
push edi
push edx
xor eax, eax
mov dword [esi - 0xc], 0x104
push esi
mov word [esi + 0x208], ax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push dword [esi - 8]
push esi
call fcn.100aa026
add esp, 8
test eax, eax
js 0x10046947
cmp eax, dword [esi - 8]
jg 0x10046947
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], ecx
je 0x100468e7
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100468e7
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x100468e7
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x3c]
call fcn.10009470
lea eax, [ebx + 0x44]
mov ecx, ebx
push eax
lea eax, [ebx + 0x48]
push eax
call fcn.10045c80
lea eax, [ebx + 0x38]
push eax
push 0x11
push dword [ebx + 0x40]
push dword [ebx + 0x3c]
call fcn.1003a630
mov ecx, eax
call fcn.10048b60
mov dword [ebx + 0x30], 1
xor edi, edi
jmp 0x100468ec
mov edi, 0x80004005
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004690a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x10046929
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003fe0
push 0x80070057
call fcn.10003fe0
int3
Function at 0x10046960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10046a01
cmp byte [esi + 0x3d], 0
je 0x10046a01
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100469b7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100469c9
sub eax, 1
je 0x100469cd
sub eax, 2
je 0x10046a01
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100469ea
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100af76a
add esp, 0x10
cmp edi, eax
jne 0x100469b7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
Function at 0x100470a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100470d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1004710c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1004710c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100471f1
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10047134
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10047167
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.100acf25
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x100471f1
cmp eax, 1
jle 0x100471c4
cmp eax, 3
jne 0x100471f1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10044b10
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100471e1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100af76a
add esp, 0x10
cmp edi, eax
jne 0x100471f1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x100470f7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 4
Function at 0x10047970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10047994
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10017e00
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x100479b5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x100479b7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x10047a3f
jg 0x100479ca
test esi, esi
je 0x10047a3f
test ecx, ecx
jl 0x10047a0c
jg 0x100479d4
test eax, eax
je 0x10047a0c
cmp ebx, ecx
jg 0x100479e6
jl 0x100479de
cmp esi, eax
jae 0x100479e6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.100a57a0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10047a12
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x10047a3f
jg 0x10047a1c
test esi, esi
je 0x10047a3f
cmp dword [edi + 0x4c], 0
je 0x10047a3f
mov ecx, edi
call fcn.10046db0
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.100af0d6
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10047a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10047a84
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10017ed0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10047aa5
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10047aa7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10047b24
jg 0x10047aba
test esi, esi
je 0x10047b24
test ecx, ecx
jl 0x10047afe
jg 0x10047ac4
test eax, eax
je 0x10047afe
cmp edi, ecx
jg 0x10047ad6
jl 0x10047ace
cmp esi, eax
jae 0x10047ad6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.100a57a0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10047b01
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10047b24
jg 0x10047b0b
test esi, esi
je 0x10047b24
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10047b24
push eax
push esi
push 1
push edx
call fcn.100af76a
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100483a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d4a96
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10111404]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x10048496
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
mov dword [ebp - 4], 0
call fcn.10004450
mov ecx, eax
test ecx, ecx
je 0x100484a0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 8], eax
push 0
push 0x100dc924
lea ecx, [esi + 4]
mov byte [ebp - 4], 1
mov dword [esi], 0
call fcn.100045a0
push 0
push 0x100dc924
lea ecx, [esi + 8]
call fcn.100045a0
mov dword [esi + 0xc], 0
mov eax, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10003fe0
push 0x80004005
call fcn.10003fe0
int3
Function at 0x1004a0d0
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d4da0
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x478], eax
test ebx, ebx
jne 0x1004a11d
xor al, al
jmp 0x1004a26e
test edi, edi
je 0x1004a116
cmp dword [esi], 0
je 0x1004a12d
mov al, 1
jmp 0x1004a26e
push 0x250
lea eax, [ebp - 0x46c]
push 0
push eax
call fcn.100a5d20
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.100a5d20
add esp, 0x18
lea eax, [ebp - 0x21c]
push edi
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004a28c
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x1004a2a7
jmp 0x1004a1a6
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
lea ecx, [esi + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.100094e0
push edi
lea ecx, [esi + 8]
call fcn.100094e0
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x478]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x46c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x468]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x464]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x460]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x45c]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x458]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x454]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x450]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x44c]
push edi
push ebx
mov dword [esi + 0x30], eax
mov dword [esi], 1
call fcn.10048d60
mov ecx, eax
call fcn.1004b0c0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x1004a116
push 0
push 0
push esi
push 0x1004a3a0
push 0
push 0
call fcn.100a98a7
add esp, 0x18
mov dword [esi + 0x3c], eax
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret 0x10
push 0x10105244
lea eax, [ebp - 0x470]
mov dword [ebp - 0x470], 0xffffffff
push eax
call fcn.100a5e7a
push 0x10105244
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0xfffffffe
push eax
call fcn.100a5e7a
int3
Function at 0x10051570
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x1005159a
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100515c6
push 1
mov ecx, esi
call fcn.10051340
pop esi
pop ebp
ret 8
cmp dword [esi + 0x2c], 0
push edi
je 0x100515a6
mov edi, dword [esi + 0x34]
jmp 0x100515a9
mov edi, dword [esi + 0x30]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100515c5
test edi, edi
je 0x100515c5
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 8

Function at 0x100515d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x10051601
mov eax, dword [esi + 0x24]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1005162d
push 1
lea ecx, [esi - 0x24]
call fcn.10051340
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [esi + 8], 0
push edi
je 0x1005160d
mov edi, dword [esi + 0x10]
jmp 0x10051610
mov edi, dword [esi + 0xc]
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1005162c
test edi, edi
je 0x1005162c
push 0
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x10052220
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10111404]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x26], bl
mov dword [ebp - 0x2c], ebx
jb 0x10052248
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x1005234d
push esi
mov esi, 1
cmp dword [ebp - 0x2c], esi
jle 0x10052345
nop dword [eax]
mov edx, dword [edi + esi*4]
test edx, edx
je 0x100522ed
xor eax, eax
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
mov eax, edx
mov dword [ebp - 0x10], 7
lea ecx, [eax + 2]
mov dword [ebp - 0x30], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10052293
sub eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x24]
sar eax, 1
push eax
push edx
call fcn.10011730
push 0
push 0
push 0
push 0
xor eax, eax
lea ecx, [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0xc], eax
or ebx, 1
cmp dword [ebp - 0x10], 8
mov word [ebp - 8], ax
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push 3
push ecx
push eax
call fcn.100afd60
add esp, 0x24
test eax, eax
jne 0x100522ed
mov byte [ebp - 0x25], 1
cmp word [ebp - 0xc], ax
jne 0x100522f1
mov byte [ebp - 0x25], 0
test bl, 1
je 0x1005232f
mov edx, dword [ebp - 0x10]
and ebx, 0xfffffffe
cmp edx, 8
jb 0x1005232f
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10052325
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10052360
push edx
push ecx
call fcn.1007f042
add esp, 8
cmp byte [ebp - 0x25], 0
jne 0x10052341
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x10052270
jmp 0x10052345
mov byte [ebp - 0x26], 1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x26]
xor ecx, ebp
pop edi
pop ebx
call fcn.1007f3c1
mov esp, ebp
pop ebp
ret
call fcn.100a9b45
int3