joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1022ca0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1098188
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.01015960
mov ecx, dword [esi + 0x70]
push ecx
lea edx, [esp + 0x14]
xor ebx, ebx
push edx
mov ecx, eax
mov dword [esp + 0x38], ebx
call fcn.01060e30
mov ecx, eax
call fcn.01015680
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.01015990
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x1022e8d
cmp byte [ecx + 0x1a], bl
jne 0x1022e8d
mov byte [ecx + 0x1a], 1
cmp dword [esi + 0x78], ebx
je 0x1022d29
mov ecx, dword [esp + 0x14]
push 3
call fcn.010146f0
test al, 3
je 0x1022d29
mov eax, dword [esp + 0x14]
mov byte [eax + 0x1a], bl
jmp 0x1022e73
lea ecx, [esi + 0x17c]
call fcn.0108de7b
test eax, eax
jne 0x1022d44
mov ecx, dword [esp + 0x14]
mov byte [ecx + 0x1a], bl
jmp 0x1022e73
push 0x1001f54
lea ecx, [esp + 0xc]
call fcn.0108e799
mov edx, dword [esi + 0xe4]
push ebx
push ebx
push 0x147
push edx
mov byte [esp + 0x40], 3
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 8]
push ecx
push eax
lea ecx, [esi + 0xc8]
call fcn.01091df1
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.01026350
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x80]
mov ecx, dword [edx + 0x54c]
mov eax, dword [esi + 0x70]
mov edx, dword [esp + 0x18]
mov dword [ecx + eax*8], edx
mov eax, dword [esi + 0x80]
mov edx, dword [eax + 0x54c]
mov ecx, dword [esi + 0x70]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*8 + 4], eax
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x24], ebx
je 0x1022dff
push edi
call fcn.01095539
mov edx, dword [esi + 0x70]
mov edi, dword [eax + 4]
push edx
call fcn.01014350
add esp, 4
lea ecx, [edi + 0xd0]
push eax
call fcn.010110e0
pop edi
mov eax, dword [esp + 0x14]
mov dword [eax + 0x24], ebx
mov ecx, dword [esp + 0x14]
mov byte [ecx + 0x1a], bl
mov edx, dword [esp + 0x14]
push edx
call fcn.01032f70
mov eax, dword [esi + 0x5c]
add esp, 4
cmp eax, ebx
jne 0x1022e65
mov eax, dword [esi + 0x68]
push eax
call fcn.0108e495
mov ecx, dword [esi + 0x84]
add esp, 4
cmp ecx, ebx
mov dword [esi + 0x68], ebx
je 0x1022e41
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov ecx, dword [esi + 0x88]
cmp ecx, ebx
mov dword [esi + 0x84], ebx
je 0x1022e58
mov edx, dword [ecx]
push 1
call dword [edx + 4]
mov eax, dword [esi]
mov ecx, esi
mov dword [esi + 0x88], ebx
call dword [eax + 0x58]
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.0108e72b
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], 0x1001d00
je 0x1022ea6
jmp 0x1022ea1
cmp ecx, ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], 0x1001d00
je 0x1022ea6
call fcn.010148e0
mov ecx, dword [esp + 0x28]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x1029530
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 2
je 0x1029593
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0x38], eax
jne 0x1029550
pop esi
ret
push 0
push 4
push 0
push 0
push esi
push 0x1029270
mov dword [esi + 0x3c], 0
call fcn.0108eee3
test eax, eax
mov dword [esi + 0x30], eax
jne 0x1029583
mov esi, dword [esi + 0x38]
test esi, esi
je 0x102957f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 0x28]
mov dword [esi + 0x34], ecx
mov edx, dword [eax + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret

Function at 0x1029d60
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x1098a7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push esi
push 0x104
lea eax, [esp + 0x18]
push eax
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0xc], eax
jbe 0x1029e8d
push eax
call fcn.0104c270
add esp, 4
mov esi, eax
mov eax, dword [esp + 0xc]
push esi
push eax
push 0
lea ecx, [esp + 0x20]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1029e80
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x1002bd8
push esi
mov dword [esp + 0x18], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1029e80
mov eax, dword [esp + 8]
test eax, eax
je 0x1029e80
mov ecx, dword [0x10aa77c]
mov dword [esp + 4], ecx
mov ecx, dword [eax + 0xc]
xor edx, edx
mov dx, word [eax + 0xc]
shr ecx, 0x10
mov dword [esp + 0x120], 0
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
push ecx
shr eax, 0x10
lea ecx, [esp + 0x1c]
push edx
push eax
push ecx
lea edx, [esp + 0x18]
push 0x1003200
push edx
call fcn.01089297
add esp, 0x1c
lea ecx, [esp + 4]
call fcn.0108ebf2
mov ecx, dword [esp + 0x128]
push eax
push 1
call fcn.010371f0
lea ecx, [esp + 4]
call fcn.0108ec04
lea ecx, [esp + 4]
mov dword [esp + 0x120], 0xffffffff
call fcn.0108e72b
test esi, esi
je 0x1029e8d
push esi
call fcn.0104ab95
add esp, 4
mov ecx, dword [esp + 0x118]
pop esi
mov dword fs:[0], ecx
add esp, 0x120
ret

Function at 0x1029eb0
Capabilities:
Access the windows event log

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x1029ee8
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 1
push 0
push edx
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
ret
Function at 0x1033990
Capabilities:
Get disk information

Disassembly:
sub esp, 0x830
mov al, byte [esp + 0x834]
push esi
push 0x800
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0xc]
or esi, 0xffffffff
push edx
mov dword [esp + 0x14], esi
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x1033b4d
mov ecx, dword [0x10044b4]
mov eax, dword [0x10044b0]
mov edx, dword [0x10044b8]
mov dword [esp + 0x24], ecx
mov cl, byte [esp + 0xf]
push ebx
mov dword [esp + 0x24], eax
mov ax, word [0x10044bc]
mov byte [esp + 0x14], cl
push edi
mov word [esp + 0x34], ax
xor eax, eax
or ecx, 0xffffffff
mov byte [esp + 0x83b], 0
lea edi, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
push 1
push ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call fcn.0101b0c0
test al, al
je 0x1033a58
mov edi, dword [esp + 0x1c]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
lea ecx, [esp + 0x1c]
call fcn.0101b020
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
mov dword [esp + 0x38], esi
je 0x1033ae5
push ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
jbe 0x1033acd
cmp esi, ebp
ja 0x1033acd
mov ebx, dword [esp + 0x20]
mov eax, 1
sub eax, esi
add ebp, eax
movsx eax, byte [esp + 0x2c]
push ebp
push eax
push ebx
call fcn.0104bca0
add esp, 0xc
test eax, eax
je 0x1033acd
jmp 0x1033aa2
mov esi, dword [esp + 0x3c]
mov ecx, esi
lea edi, [esp + 0x2c]
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1033add
sub ebx, eax
lea ebp, [ebx + ebp - 1]
lea ebx, [eax + 1]
movsx eax, byte [esp + 0x2c]
push ebp
push eax
push ebx
call fcn.0104bca0
add esp, 0xc
test eax, eax
jne 0x1033a9e
mov eax, dword [0x100a5d0]
mov ecx, dword [esp + 0x20]
test eax, eax
pop ebp
jne 0x1033b15
jmp 0x1033ae9
mov ecx, dword [esp + 0x20]
sub eax, ecx
jmp 0x1033ad6
mov ecx, dword [esp + 0x1c]
test ecx, ecx
mov edx, 0x1001f54
je 0x1033af4
mov edx, ecx
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, edx
push ecx
call fcn.0104c756
mov ecx, dword [esp + 0x20]
add esp, 4
mov dword [esp + 0x10], eax
test ecx, ecx
pop edi
pop ebx
je 0x1033b41
mov al, byte [ecx - 1]
test al, al
je 0x1033b37
cmp al, 0xff
je 0x1033b37
dec al
mov byte [ecx - 1], al
mov eax, dword [esp + 8]
pop esi
add esp, 0x830
ret
dec ecx
push ecx
call fcn.0108e495
add esp, 4
mov eax, dword [esp + 8]
pop esi
add esp, 0x830
ret
mov eax, esi
pop esi
add esp, 0x830
ret
Function at 0x1037bd0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x109999e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
push esi
push edi
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
xor esi, esi
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1037c71
cmp dword [esp + 0x1c], 2
jne 0x1037c71
cmp dword [esp + 0x10], 5
jb 0x1037c71
push 0x24
call fcn.0108e46c
add esp, 4
mov dword [esp + 8], eax
cmp eax, esi
mov dword [esp + 0xa8], esi
je 0x1037c58
mov ecx, eax
call fcn.01037c90
pop edi
pop esi
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
add esp, 0xa4
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
add esp, 0xa4
ret
mov ecx, dword [esp + 0xa0]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0xa4
ret

Function at 0x1039e80
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1099c68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
mov esi, ecx
lea ecx, [esp + 0x18]
call fcn.0103ea1e
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x40], 0
call fcn.01039c90
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 8]
test eax, eax
mov byte [esp + 0x3c], 1
je 0x1039f88
push 0x10047e4
lea ecx, [esp + 0x18]
call fcn.0108e799
push eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x48], 2
call fcn.0108e95a
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.0108e72b
mov ecx, dword [0x10aa77c]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x10]
push 0x10047d8
push edx
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x48], 5
call fcn.01089297
mov ecx, dword [esp + 0x10]
add esp, 0xc
push 0
push ecx
lea ecx, [esp + 0x20]
call fcn.0103eae1
test eax, eax
je 0x1039f6c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x1c]
call fcn.0103ed01
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.0103edd0
mov eax, dword [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x10]
call fcn.0108e72b
test esi, esi
jne 0x1039f3e
pop edi
lea ecx, [esp + 4]
mov byte [esp + 0x3c], 4
call fcn.0108e72b
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 1
call fcn.0108e72b
lea ecx, [esp + 8]
mov byte [esp + 0x3c], 0
call fcn.0108e72b
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0103ea5b
mov ecx, dword [esp + 0x34]
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x103a020
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x1099c88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0xc], esp
xor ebx, ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.0108e4a0
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.01039d60
mov eax, dword [esp + 8]
cmp dword [eax - 8], ebx
je 0x103a073
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x103a073
mov bl, 1
lea ecx, [esp + 8]
call fcn.0108e72b
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0108e72b
mov ecx, dword [esp + 0xc]
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 4

Function at 0x103a0b0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1099cc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 4], 0
mov byte [ebp - 0xd], 0
call fcn.0108e4a0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, esi
call fcn.01039d60
mov edx, dword [ebp - 0x18]
mov eax, dword [edx - 8]
test eax, eax
je 0x103a1ec
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x10aa4d0
push 0x17
push 0
push 0x100b5d4
mov byte [ebp - 4], 2
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x103a1db
mov ecx, dword [0x10041dc]
mov dl, byte [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x1c], dl
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x50]
mov ecx, dword [ebp - 0x14]
xor eax, eax
test ecx, ecx
mov dword [ebp + 8], eax
je 0x103a167
mov eax, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0x10aa4c0
push ecx
call dword [eax]
mov eax, dword [ebp + 8]
test eax, eax
mov byte [ebp - 4], 3
je 0x103a1cd
mov ecx, dword [ebp - 0x18]
test ecx, ecx
mov ebx, ecx
je 0x103a1b9
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and eax, 0xfffffffc
call fcn.0104c300
mov esi, esp
test esi, esi
je 0x103a1b2
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov word [esi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x103a1b4
xor eax, eax
mov ecx, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
push 0
push ecx
push eax
call dword [edx + 0x18]
test eax, eax
jl 0x103a1ca
mov byte [ebp - 0xd], 1
mov eax, dword [ebp + 8]
test eax, eax
mov byte [ebp - 4], 2
je 0x103a1db
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
test eax, eax
mov byte [ebp - 4], 1
je 0x103a1ec
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.0108e72b
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.0108e72b
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0xd]
lea esp, [ebp - 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x103a420
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1099d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x10aa77c]
push esi
mov esi, ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov cl, byte [eax]
lea eax, [esp + 4]
mov byte [esp + 0x14], cl
lea edx, [esp + 0x18]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], edx
call fcn.0108e4a0
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 1
call fcn.0108e4a0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov byte [esp + 0x30], 2
call fcn.0103aa40
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 3
call fcn.0108e72b
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 0
call fcn.0108e72b
lea ecx, [esp + 8]
mov dword [esp + 0x28], 4
call fcn.0108e72b
lea ecx, [esp + 4]
mov dword [esp + 0x28], 0xffffffff
call fcn.0108e72b
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
lea eax, [edx + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x103b1d0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x1099e07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push esi
push edi
xor eax, eax
mov dword [esp + 0x6c], 0x94
mov ecx, 0x24
lea edi, [esp + 0x70]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x70]
cmp eax, 5
jne 0x103b227
cmp dword [esp + 0x74], 1
jae 0x103b241
jmp 0x103b229
ja 0x103b241
mov esi, dword [esp + 0x110]
push 0x1001f54
mov ecx, esi
call fcn.0108e799
jmp 0x103b42f
mov ecx, dword [0x10aa77c]
push ebx
push ebp
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x11c]
push edx
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x118], 1
call fcn.01033c30
add esp, 8
or ecx, 0xffffffff
xor eax, eax
mov edi, 0x1001f54
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x2c]
not ecx
dec ecx
mov ebp, ecx
cmp eax, ebp
mov byte [esp + 0x110], 2
mov ecx, eax
jb 0x103b292
mov ecx, ebp
mov ebx, dword [esp + 0x28]
mov edi, 0x1001f54
mov esi, ebx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x103b2a8
sbb edx, edx
sbb edx, 0xffffffff
xor edi, edi
cmp edx, edi
jne 0x103b2c1
cmp eax, ebp
jb 0x103b2c1
xor edx, edx
cmp eax, ebp
setne dl
cmp edx, edi
je 0x103b3d1
cmp ebx, edi
mov esi, 0x1001f54
je 0x103b2cc
mov esi, ebx
push 0x10048dc
lea ecx, [esp + 0x24]
call fcn.0108e799
push esi
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x11c], 3
call fcn.0108e9c0
push 0x10048c0
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x11c], 4
call fcn.0108e9c0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x110], 7
call fcn.0108e72b
lea ecx, [esp + 0x20]
mov byte [esp + 0x110], 6
call fcn.0108e72b
push edi
lea ecx, [esp + 0x44]
call fcn.01084770
push 0x1002948
mov bl, 8
push 0x1004850
lea ecx, [esp + 0x48]
mov byte [esp + 0x118], bl
call fcn.01084d60
cmp eax, edi
je 0x103b369
push 0x1002948
push 0x10047ec
lea ecx, [esp + 0x48]
call fcn.01084d60
cmp eax, edi
jne 0x103b3af
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x34]
call fcn.01084f70
lea eax, [esp + 0x34]
push eax
push esi
lea ecx, [esp + 0x48]
mov byte [esp + 0x118], 9
call fcn.01084980
cmp eax, edi
jne 0x103b39f
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0x14]
call fcn.0108e8b4
lea ecx, [esp + 0x34]
mov byte [esp + 0x110], bl
call fcn.01085020
lea ecx, [esp + 0x40]
mov byte [esp + 0x110], 6
call fcn.01084cd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x110], 2
call fcn.0108e72b
mov esi, dword [esp + 0x118]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0108e4a0
mov eax, dword [esp + 0x28]
cmp eax, edi
pop ebp
mov dword [esp + 0x14], 1
pop ebx
je 0x103b412
lea ecx, [eax - 1]
mov al, byte [ecx]
test al, al
je 0x103b409
cmp al, 0xff
je 0x103b409
dec al
mov byte [ecx], al
jmp 0x103b412
push ecx
call fcn.0108e495
add esp, 4
lea ecx, [esp + 8]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x108], 0
call fcn.0108e72b
mov ecx, dword [esp + 0x100]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x104
ret
Function at 0x103b450
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x1099e45
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
push esi
push edi
xor eax, eax
mov ecx, 0x57
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov eax, dword [0x10aa77c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov edx, dword [esp + 0x184]
push 0x200
push 0x160
lea ecx, [esp + 0x18]
push ecx
push 0
mov edi, 1
push edx
mov dword [esp + 0x18c], edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x103b4d0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xc]
call fcn.0108e8b4
mov esi, dword [esp + 0x180]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0108e4a0
mov dword [esp + 0xc], edi
lea ecx, [esp + 8]
mov byte [esp + 0x178], 0
call fcn.0108e72b
mov ecx, dword [esp + 0x170]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x174
ret

Function at 0x103b520
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1099e6f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x10aa77c]
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x103b5cb
mov eax, dword [esp + 0x2c]
lea edx, [esp + 8]
push edx
push eax
push ebx
mov dword [esp + 0x14], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x103b5bd
push 0x104
lea ecx, [esp + 0x14]
call fcn.0108ebd2
mov ecx, dword [esp + 8]
mov esi, eax
push esi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jne 0x103b59f
mov byte [esi], bl
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.0108ebaa
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
mov dword [esp + 8], ebx
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0108e4a0
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], bl
call fcn.0108e72b
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x103da50
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi], 0
jne 0x103da95
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push 0
push 4
push 0
push 0
push eax
push ecx
call fcn.0108eee3
test eax, eax
mov dword [esi], eax
je 0x103da95
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x24], 0
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov dword [ecx], eax
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret

Function at 0x103daa0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi], 0
jne 0x103dada
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push 0
push 4
push 0
push 0
push eax
push ecx
call fcn.0108eee3
test eax, eax
mov dword [esi], eax
je 0x103dada
mov dword [eax + 0x24], 0
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret

Function at 0x104d3f3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x104d410
call fcn.0104bfa2
mov dword [eax], 0x16
xor eax, eax
jmp 0x104d479
xor ecx, ecx
push esi
mov edx, 0x8c
inc ecx
call fcn.01051370
mov esi, eax
test esi, esi
je 0x104d464
push esi
call fcn.01050f71
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x104d442
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x104d359
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x104d478
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0104ab95
test ebx, ebx
pop ecx
je 0x104d476
push ebx
call fcn.0104bfc8
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret