joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e623
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x100e71a
cmp byte [eax + 0x11a8], 0
je 0x100e71a
push ebx
push edi
push 0x1001648
lea ecx, [eax + 0x9fc]
call fcn.01004914
mov eax, dword [esi + 4]
and dword [eax + 0xd6c], 0
push 0xffffffffffffffff
mov ecx, esi
mov byte [esi + 0x2d], 0
call fcn.0100e42c
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x125
push ebx
push dword [esi]
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x100e69b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 1
push dword [ebp - 4]
call fcn.0100dee7
push 0
push ebx
push dword [esi]
call edi
push eax
call fcn.0100dea6
xor eax, eax
push eax
push eax
push eax
push ebx
push dword [esi]
call edi
push eax
call fcn.0100df38
xor eax, eax
push eax
push eax
push eax
push ebx
push dword [esi]
call edi
push eax
call fcn.0100df65
push 1
push ebx
push dword [esi]
call edi
push eax
call fcn.0100e001
mov eax, dword [esi + 0xc]
test eax, eax
pop edi
pop ebx
je 0x100e6e5
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 4]
add eax, 0x7cc
mov eax, dword [eax + 0x114]
test eax, eax
je 0x100e6fe
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 4]
mov dword [eax + 0x11a4], 0x108
push dword [esi + 0xc]
mov ecx, dword [esi + 4]
call fcn.010064c1
test al, al
jne 0x100e71f
or eax, 0xffffffff
jmp 0x100e739
push 0
push 0
push 0x470
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop esi
leave
ret 8

Function at 0x100ec8b
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, ecx
lea ecx, [ebp - 4]
call fcn.0100aefd
lea ecx, [esi + 0x10]
call fcn.01005f1a
test eax, eax
je 0x100ece2
push edi
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x400
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x34], 0x1001960
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
leave
ret
Function at 0x100f006
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3d4
mov eax, dword [0x1036f44]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x3d4], edi
call fcn.01007096
test byte [esi + 4], 0x20
je 0x100f0bc
and dword [ebp - 0x3c8], 0
xor eax, eax
and dword [ebp - 0x3d0], eax
mov ecx, 0xac
lea edi, [ebp - 0x3c4]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x338]
or eax, 0x8000
push eax
push 0
lea ecx, [ebp - 0x3d0]
call fcn.0100ea4a
mov eax, dword [eax]
push 0x208
push 0x2b4
lea ecx, [ebp - 0x3c8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x3d0]
mov edi, eax
call fcn.01005059
test edi, edi
je 0x100f0b4
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x114]
call fcn.01004914
push dword [ebp - 0x3d4]
jmp 0x100f0e7
mov eax, dword [esi]
test eax, eax
je 0x100f0f5
lea ecx, [ebp - 0x31c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100f0e6
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x114]
call fcn.01004914
push edi
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.0100ef21
mov ecx, dword [ebp - 0x3cc]
lea eax, [ebp - 0x114]
push eax
call fcn.01006c15
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0x1001644
call fcn.010047d1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3cc]
pop edi
pop esi
call fcn.01024a32
leave
ret 8
Function at 0x1010008
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c0
mov eax, dword [0x1036f44]
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x460]
mov dword [ebp - 4], eax
call fcn.0100aefd
mov eax, dword [esi + 4]
add eax, 0x28
push eax
xor ebx, ebx
push ebx
push 0x3b
lea ecx, [ebp - 0x344]
mov byte [ebp - 0x455], 1
call fcn.0100f244
mov ecx, eax
call fcn.0100ee7d
lea ecx, [ebp - 0x344]
mov byte [ebp - 0x456], al
call fcn.01006d67
cmp byte [ebp - 0x456], bl
je 0x1010188
lea eax, [ebp - 0x45c]
push eax
push 0x1002914
push 0x15
push ebx
push 0x10028e4
mov dword [ebp - 0x45c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1010170
mov eax, dword [ebp - 0x45c]
mov ecx, dword [eax]
push 0x104
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1010170
cmp word [ebp - 0x20c], bx
je 0x1010170
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x5c0]
call fcn.01006bd5
push eax
lea eax, [ebp - 0x454]
push eax
call fcn.01007ea4
lea ecx, [ebp - 0x5c0]
mov dword [ebp - 0x5c0], 0x1001644
call fcn.010047d1
lea ecx, [ebp - 0x454]
call fcn.01005f1a
test eax, eax
je 0x101015b
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x4ac]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x4a0], eax
lea eax, [ebp - 0x4b0]
push eax
mov dword [ebp - 0x4b0], 0x3c
mov dword [ebp - 0x494], 5
mov dword [ebp - 0x4a4], 0x1001960
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x101015b
mov byte [ebp - 0x455], bl
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x454], 0x1001644
call fcn.010047d1
mov eax, dword [ebp - 0x45c]
cmp eax, ebx
je 0x1010180
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 0x455], bl
je 0x10101ee
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x474]
mov edi, 0x100195c
push eax
add ecx, 0x6a0
mov dword [ebp - 0x474], edi
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], 0xa
mov dword [ebp - 0x464], ebx
call fcn.0100ffaf
test eax, eax
jl 0x10101dd
lea eax, [ebp - 0x474]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0102a9aa
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x474], edi
call fcn.0100eb93
push dword [ebp - 0x460]
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01024a32
leave
ret
Function at 0x101064b
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
push 0x102
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
xor ecx, ecx
cmp ebx, ecx
je 0x101074f
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ecx
je 0x101073a
mov eax, dword [edi + 4]
cmp eax, ecx
je 0x101073a
cmp dword [ebp + 8], ecx
je 0x101073a
mov eax, dword [eax + 0x698]
dec eax
dec eax
je 0x10106d1
push dword [esi + 0x70]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], ecx
lea ecx, [edi + 0x10]
call fcn.01025f54
test eax, eax
jl 0x10106bd
push dword [ebp + 0xc]
push 0
push 1
push ebx
call fcn.0100dee7
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x101074e
cmp dword [esi + 0xc], ecx
je 0x1010722
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ecx
push ebx
call edi
lea eax, [esi + 0x20]
push eax
push ebx
call fcn.0100dea6
lea eax, [esi + 0x28]
push eax
push 0
push 0
push ebx
call fcn.0100df38
add esi, 0x30
push esi
push 0
push 0
push ebx
call fcn.0100df65
push 1
push ebx
call fcn.0100e001
push dword [ebp + 8]
push 1
push 1
push ebx
call fcn.0100dee7
push 5
push ebx
call edi
jmp 0x101074e
push dword [ebp + 8]
push 1
push 1
push ebx
call fcn.0100dee7
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x101074e
push ecx
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 1
push ebx
call fcn.0100dee7
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x10107d8
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [esi + 4], edi
mov dword [ebp - 8], edi
jle 0x1010844
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], edi
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 4]
add eax, ecx
cmp byte [eax], 0
je 0x1010831
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1010831
test edi, edi
jl 0x1010831
call ebx
test eax, eax
jg 0x1010821
call ebx
mov edi, eax
jmp 0x1010831
call ebx
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 4], 0x11c
cmp eax, dword [esi + 4]
jl 0x10107f7
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x1011ad5
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1036f44]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
and dword [esi + 4], 0
test eax, eax
je 0x1011b0d
mov eax, dword [eax + 0x1c]
test eax, eax
mov dword [esi + 4], eax
je 0x1011b0d
push dword [esi]
lea ecx, [eax + 0xd38]
call fcn.0100ba1a
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x1011b26
push 2
push dword [esi]
call dword [sym.imp.USER32.dll_EndDialog]
or eax, 0xffffffff
jmp 0x1011cd1
push ebx
push edi
call fcn.01005c62
test al, al
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
jne 0x1011b43
mov eax, dword [esi + 4]
cmp dword [eax + 0x698], 3
jne 0x1011b6d
mov ebx, 0xdd
push ebx
push dword [esi]
call edi
test eax, eax
je 0x1011b6d
push 0
push ebx
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ebx
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0
push 0xe
mov ebx, 0x213
push ebx
push dword [esi]
call edi
push eax
call fcn.01026a66
test eax, eax
mov dword [esi + 0xc], eax
je 0x1011b98
push 1
push eax
push 0x30
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 2
mov ebx, 0x215
push ebx
push dword [esi]
call edi
push eax
call fcn.01026fd1
test eax, eax
mov dword [esi + 0x10], eax
je 0x1011bbf
push 1
push eax
push 0x30
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 0
push dword [esi]
call ebx
push eax
call fcn.01026e75
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xd60]
test ecx, ecx
je 0x1011c15
cmp dword [eax + 0xd5c], 0
je 0x1011c15
push ecx
push 0
push 0x80
push dword [esi]
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 4]
push dword [eax + 0xd5c]
push 1
push 0x80
push dword [esi]
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 4]
add eax, 0xb0c
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.01007ea4
mov eax, dword [ebp - 0x110]
push 0x8800
push 0x215
push dword [esi]
mov dword [ebp - 0x118], eax
call edi
push eax
push dword [ebp - 0x118]
lea eax, [ebp - 0x228]
push eax
call fcn.01027ce9
push eax
lea ecx, [ebp - 0x114]
call fcn.01006b02
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x228], 0x1001644
call fcn.010047d1
push 0x215
push dword [esi]
call edi
push eax
lea ecx, [ebp - 0x114]
call fcn.0100b499
push dword [esi]
call ebx
mov ecx, dword [esi + 4]
push eax
call fcn.01006894
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x69c]
mov eax, dword [eax + 0x45c]
test eax, eax
je 0x1011cb8
push eax
push dword [esi]
call ebx
push eax
call fcn.01026e75
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], 0x1001644
call fcn.010047d1
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01024a32
leave
ret 8
Function at 0x1011ce3
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x1036f44]
and dword [ebp - 0x22c], 0
cmp dword [ebp + 0xc], 0
push ebx
mov dword [ebp - 4], eax
mov ebx, ecx
je 0x1011f04
push esi
push edi
lea ecx, [ebp - 0x22c]
call fcn.0100aefd
lea ecx, [ebp - 0x224]
mov edi, 0x80004005
call fcn.01007096
push 0xd02
lea ecx, [ebp - 0x380]
call fcn.0102634f
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x380]
push ecx
push eax
call fcn.0102658c
lea ecx, [ebp - 0x380]
mov byte [ebp - 0x225], al
call fcn.01006235
cmp byte [ebp - 0x225], 0
mov esi, 0x1001644
je 0x1011e1f
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.01007ea4
lea ecx, [ebp - 0x114]
call fcn.01005f1a
test eax, eax
je 0x1011e0c
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [ebx]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x268]
push eax
mov dword [ebp - 0x268], 0x3c
mov dword [ebp - 0x24c], 5
mov dword [ebp - 0x25c], 0x1001960
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1011dea
xor edi, edi
jmp 0x1011e0c
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x1011dfc
call edi
mov edi, eax
jmp 0x1011e0c
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], esi
call fcn.010047d1
jmp 0x1011e88
push 2
lea ecx, [ebp - 0x380]
call fcn.0102634f
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x380]
push ecx
push eax
call fcn.0102658c
test al, al
je 0x1011e60
lea ecx, [ebp - 0x224]
call fcn.01005f1a
test eax, eax
mov byte [ebp - 0x225], 1
jne 0x1011e67
mov byte [ebp - 0x225], 0
lea ecx, [ebp - 0x380]
call fcn.01006235
cmp byte [ebp - 0x225], 0
je 0x1011e8c
push dword [ebp - 0x220]
call fcn.01026c61
mov edi, eax
test edi, edi
jge 0x1011ee5
push dword [0x1037438]
lea ecx, [ebp - 0x378]
push 0x79
call fcn.01007053
push dword [0x1037438]
mov edi, dword [eax + 4]
push 0x69
lea ecx, [ebp - 0x114]
call fcn.01007053
push 0x10
push edi
push dword [eax + 4]
push dword [ebx]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], esi
call fcn.010047d1
lea ecx, [ebp - 0x378]
mov dword [ebp - 0x378], esi
call fcn.010047d1
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], esi
call fcn.010047d1
push dword [ebp - 0x22c]
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop ebx
call fcn.01024a32
leave
ret 8
Function at 0x10123d7
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x1036f44]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x33c]
xor ebx, ebx
cmp eax, ebx
jne 0x10124ad
mov eax, dword [esi + 4]
and eax, 0x20
jne 0x1012413
cmp dword [esi], ebx
setne cl
cmp cl, bl
je 0x10124a7
cmp eax, ebx
push edi
lea edi, [ebp - 0x2b4]
mov ecx, 0xac
mov dword [ebp - 0x2b8], ebx
je 0x1012477
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x338]
or eax, 0x8000
push eax
push ebx
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2bc], ebx
call fcn.0100ea4a
mov eax, dword [eax]
push 0x109
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x2bc]
mov edi, eax
call fcn.01005059
cmp edi, ebx
jmp 0x1012498
push 0x109
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x10124a6
mov eax, dword [ebp - 0x2b8]
mov dword [esi + 0x33c], eax
pop edi
mov eax, dword [esi + 0x33c]
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01024a32
leave
ret

Function at 0x1012e51
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5ec
mov eax, dword [0x1036f44]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
mov esi, ecx
call fcn.0100b9ea
test al, al
jne 0x1012e85
push 0x1001648
mov ecx, ebx
call fcn.01006bd5
jmp 0x1012f80
push edi
lea edi, [esi + 0x120]
mov ecx, edi
mov dword [ebp - 0x3cc], edi
call fcn.01005f1a
test eax, eax
je 0x1012eaa
push edi
mov ecx, ebx
call fcn.01006c15
jmp 0x1012f7f
lea eax, [ebp - 0x114]
push eax
lea ecx, [esi + 0x10]
call fcn.0100bc77
and dword [ebp - 0x3c8], 0
xor eax, eax
mov ecx, 0xac
lea edi, [ebp - 0x3c4]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x4dc]
push eax
push 0x1001948
lea ecx, [ebp - 0x5ec]
call fcn.01006bd5
mov ecx, eax
call fcn.0100bc0c
mov eax, dword [eax + 4]
push 0x410
push 0x2b4
lea ecx, [ebp - 0x3c8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, 0x1001644
lea ecx, [ebp - 0x4dc]
mov edi, eax
mov dword [ebp - 0x4dc], esi
call fcn.010047d1
lea ecx, [ebp - 0x5ec]
mov dword [ebp - 0x5ec], esi
call fcn.010047d1
test edi, edi
je 0x1012f61
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1012f61
mov ecx, dword [ebp - 0x3cc]
lea eax, [ebp - 0x1b4]
push eax
call fcn.01004914
push dword [ebp - 0x3cc]
mov ecx, ebx
call fcn.01006c15
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], esi
call fcn.010047d1
pop edi
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
pop ebx
call fcn.01024a32
leave
ret 4
Function at 0x1015dbb
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x878
mov eax, dword [0x1036f44]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp ebx, esi
mov dword [ebp - 4], eax
je 0x1015f4f
cmp edx, esi
je 0x1015f4f
cmp word [ebx], si
je 0x1015f4f
cmp word [edx], si
je 0x1015f4f
push edi
xor eax, eax
mov word [ebp - 0x61c], si
mov ecx, 0x103
lea edi, [ebp - 0x61a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x1001cf8
push eax
push eax
push ebx
push edx
lea eax, [ebp - 0x61c]
push eax
mov dword [ebp - 0x870], esi
call fcn.01015a19
test al, al
je 0x1015f45
xor eax, eax
mov dword [ebp - 0x86c], esi
mov ecx, 0x93
lea edi, [ebp - 0x868]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x874], eax
je 0x1015f45
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
mov edi, eax
lea eax, [ebp - 0x840]
push eax
call esi
cmp eax, edi
jl 0x1015f1e
and word [ebp - 0x20c], 0
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
call esi
mov ecx, 0x104
sub ecx, eax
push ecx
push ebx
call esi
lea eax, [ebp + eax*2 - 0x840]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
test eax, eax
je 0x1015f1e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0x1001cf4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimW]
and dword [ebp - 0x878], 0
lea eax, [ebp - 0x878]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntExW]
test eax, eax
je 0x1015f1e
mov eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0x870]
jle 0x1015f1e
mov dword [ebp - 0x870], eax
lea eax, [ebp - 0x86c]
push eax
push dword [ebp - 0x874]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1015e74
push dword [ebp - 0x874]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x870]
inc eax
pop edi
jmp 0x1015f52
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01024a32
leave
ret 8

Function at 0x1016303
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x101633e
mov ecx, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 0
jne 0x101633e
push 0
push dword [ebp + 8]
mov ecx, esi
call fcn.010162c6
pop esi
pop ebp
ret 8
Function at 0x10175cc
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0xd30]
test ebx, ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], ebx
je 0x1017757
push 0x1802
lea ecx, [ebp - 0x128]
call fcn.0102634f
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x128]
push ecx
push eax
call fcn.01026879
lea ecx, [ebp - 0x128]
mov byte [ebp - 1], al
call fcn.01006235
cmp byte [ebp - 1], 0
je 0x10176f3
mov ebx, 0x1001d90
mov eax, dword [ebx]
test eax, eax
je 0x1017649
test dword [ebp - 0x10], eax
je 0x10176e1
movzx eax, word [ebx - 8]
push 0
push 0x20
push 0x20
push 1
push eax
push dword [0x1037438]
call dword [sym.imp.USER32.dll_LoadImageW]
push 0
push eax
mov eax, dword [ebp - 8]
push 0x170
push dword [eax*8 + 0x1001d0c]
push dword [esi]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp - 8]
push dword [eax*8 + 0x1001d10]
push dword [esi]
call edi
push eax
push dword [0x1037438]
lea ecx, [ebp - 0x120]
push dword [ebx - 4]
call fcn.01007053
mov ecx, eax
call fcn.0100b499
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x120], 0x1001644
call fcn.010047d1
mov eax, dword [ebx]
test eax, eax
je 0x10176de
or eax, 0x10000
push eax
mov eax, dword [ebp - 8]
push 0xffffffffffffffeb
push dword [eax*8 + 0x1001d10]
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
inc dword [ebp - 8]
add ebx, 0xc
cmp ebx, 0x1001dc0
jl 0x101763a
mov ebx, dword [ebp - 0xc]
push 0xffffffffffffffeb
push 0xd2
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push eax
mov ecx, esi
call fcn.010164e1
push dword [ebx]
lea ecx, [ebx + 0x38]
call fcn.01028303
mov eax, dword [ebx]
push 0x1001d38
push 0x1001800
push 0x80000001
lea ecx, [ebx + 0x3c]
push eax
mov dword [ebp - 0xc], ecx
call fcn.0102863d
test al, al
je 0x1017746
push dword [ebx]
mov ecx, dword [ebp - 0xc]
call fcn.01028150
test eax, eax
jge 0x1017757
mov ecx, esi
call fcn.01016142
push dword [ebx]
mov ecx, dword [ebp - 0xc]
call fcn.01028303
mov eax, dword [ebp - 8]
cmp eax, 4
jge 0x1017790
lea ebx, [eax*8 + 0x1001d0c]
push 0
push dword [ebx + 4]
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx]
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
add ebx, 8
cmp ebx, 0x1001d2c
jl 0x1017766
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101901f
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x1019084
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1019084
push edi
xor eax, eax
mov dword [ebp - 8], esi
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push esi
push 0x2000000
push 3
push esi
push 5
push 0x80000100
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1019083
lea eax, [ebp - 8]
push eax
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret 4

Function at 0x101908e
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x101910b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x101910b
push esi
call fcn.0101598c
test al, al
je 0x101910b
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x101910b
push edi
xor eax, eax
mov dword [ebp - 8], ebx
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
pop edi
je 0x1019104
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1019104
mov eax, dword [ebp - 8]
or eax, dword [ebp - 4]
je 0x1019104
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
leave
ret