joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c10d8
Capabilities:
Get session user name
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c1283
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405a44
xor edx, edx
push ebp
push 0x5c1250
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x5d510c]
cmp dword [eax], 2
jne 0x5c121f
lea eax, [ebp - 0xc]
push eax
push 0x20008
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
mov eax, dword [ebp - 0x10]
inc eax
call fcn.00402fb0
mov ebx, eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x10]
push edx
push eax
push ebx
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetTokenInformation
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebx]
push eax
push 0
call sub.advapi32.dll_LookupAccountSidA
mov eax, dword [ebp - 0x14]
inc eax
call fcn.00402fb0
mov esi, eax
mov eax, dword [ebp - 0x18]
inc eax
call fcn.00402fb0
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push esi
mov eax, dword [ebx]
push eax
push 0
call sub.advapi32.dll_LookupAccountSidA
lea eax, [ebp - 0x120]
mov edx, edi
call fcn.00404440
lea edx, [ebp - 0x120]
lea eax, [ebp - 0x20]
call fcn.00405ca8
push dword [ebp - 0x20]
push 0x5c129c
lea eax, [ebp - 0x124]
mov edx, esi
call fcn.00405c3c
push dword [ebp - 0x124]
mov eax, dword [ebp - 4]
mov edx, 3
call fcn.00405dd8
mov eax, edi
call fcn.00402fcc
mov eax, esi
call fcn.00402fcc
mov eax, ebx
call fcn.00402fcc
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x5c1246
mov eax, 0x104
call fcn.00402fb0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.00405c3c
mov eax, ebx
call fcn.00402fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c1262
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c128a
lea eax, [ebp - 0x124]
call fcn.00405a44
lea eax, [ebp - 0x20]
call fcn.00405a44
ret
Function at 0x1001130
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001080
push 0x1001322
push eax
mov dword fs:[0], esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT40.dll___set_app_type]
add esp, 4
mov dword [0x100204c], 0xffffffff
mov eax, dword [0x100204c]
mov dword [0x1002050], eax
call dword [sym.imp.MSVCRT40.dll___p__fmode]
mov ecx, dword [0x1002040]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT40.dll___p__commode]
mov ecx, dword [0x100203c]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT40.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002054], eax
call fcn.01001320
cmp dword [0x1002038], 0
jne 0x10011c0
push 0x1001310
call dword [sym.imp.MSVCRT40.dll___setusermatherr]
add esp, 4
call fcn.010012f0
push 0x100200c
push 0x1002008
call sub.MSVCRT40.dll__initterm
add esp, 8
mov eax, dword [0x1002034]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x1002030]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.MSVCRT40.dll___getmainargs]
add esp, 0x14
push 0x1002004
push section..data
call sub.MSVCRT40.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT40.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x1001234
mov al, byte [ebp - 0x40]
inc esi
mov al, byte [esi]
test al, al
je 0x100122c
cmp al, 0x22
jne 0x1001221
cmp byte [esi], 0x22
jne 0x100123e
inc esi
jmp 0x100123e
cmp al, 0x20
jbe 0x100123e
inc esi
cmp byte [esi], 0x20
ja 0x1001238
cmp byte [esi], 0
je 0x100124e
cmp byte [esi], 0x20
ja 0x100124e
inc esi
cmp byte [esi], 0
jne 0x1001243
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x5c], 1
mov eax, 0xa
je 0x1001275
mov eax, dword [ebp - 0x58]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT40.dll_exit]
jmp 0x10012b8
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001080
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x10007008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x80
mov edi, ecx
lea eax, [ebp - 0x84]
push 0
mov dword [ebp - 0x88], edi
mov esi, edx
push eax
mov dword [ebp - 0x88], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
movzx eax, byte [ebp + 8]
shl eax, 8
or ecx, eax
lea eax, [ebp - 0x84]
push 0x40
shl ecx, 0x10
push eax
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
xor eax, eax
mov dword [edi + 0x10], 0
lea ecx, [ebp - 0x84]
mov dword [edi + 0x14], 7
mov word [edi], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001100
sub ecx, edx
lea eax, [ebp - 0x84]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.10001d50
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10003595
mov esp, ebp
pop ebp
ret

Function at 0x10002710
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10004530
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10007008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x18]
call fcn.10002900
push str._KeyMouseHook__Create
mov esi, dword [eax]
call fcn.10002ae0
mov eax, dword [ebp + 0xc]
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x10003440
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.CreateThread_handle0x_08x_code_d
call fcn.10002ae0
push str._KeyMouseHook__Create_finish
call fcn.10002ae0
add esp, 0x10
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x100027d1
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x100027d1
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x100027d1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10002ae0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push 0x1000
push 0x10007540
call fcn.10002ad0
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf_s]
add esp, 0x1c
push 0x10007540
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop ebp
ret
Function at 0x103119f
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x10cd0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x210]
push eax
xor esi, esi
push 0x1003280
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x210], esi
call fcn.010ab82f
push 0x5c
xor edi, edi
lea eax, [ebp - 0x290]
push esi
inc edi
push eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], 0xf233
mov dword [ebp - 0x224], 8
mov dword [ebp - 0x220], 0xf234
mov dword [ebp - 0x294], 0x60
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], esi
mov dword [ebp - 0x288], 0x18
mov dword [ebp - 0x270], 2
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x280], 0xf230
mov dword [ebp - 0x278], 0xf231
mov dword [ebp - 0x27c], 0xfffc
mov dword [ebp - 0x274], 0xf232
mov dword [ebp - 0x240], 0x1031177
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
cmp eax, esi
mov dword [ebp - 0x210], eax
jl 0x103130c
cmp dword [ebp - 0x214], edi
jne 0x103130c
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x103130c
push edi
push esi
push 0x100325c
lea eax, [ebp - 0x20c]
push eax
push 0x1003250
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x103130c
mov dword [ebp - 0x210], 0x80004005
mov esi, dword [ebp - 0x210]
lea ecx, [ebp - 0x234]
call fcn.010ab876
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010aac07
leave
ret 4
Function at 0x103215a
Capabilities:
Get file system object information

Disassembly:
push 0x2c8
mov eax, 0x10b432b
call fcn.010aac8f
xor ebx, ebx
push ebx
mov dword [ebp - 0x2cc], ecx
push 0x1004de8
lea ecx, [ebp - 0x2d4]
call fcn.010ab82f
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 4], ebx
call sub.MFC42u.dll_CString::CString_1
mov byte [ebp - 4], 1
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
mov esi, dword [eax + 0x5c0]
cmp esi, ebx
je 0x10321b0
cmp dword [esi + 0x54], ebx
je 0x10321b0
xor edi, edi
inc edi
jmp 0x10321b2
xor edi, edi
mov ecx, esi
call fcn.010424c4
cmp edi, ebx
je 0x10321cb
neg eax
sbb eax, eax
and eax, 0x7e
add eax, 0xef1f
jmp 0x10321d0
mov eax, 0xef20
push eax
lea ecx, [ebp - 0x2c8]
call sub.MFC42u.dll_CString::LoadStringW
test eax, eax
je 0x103222f
cmp edi, ebx
je 0x103221e
push 0x200
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push ebx
add esi, 0x58
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x2c8]
test eax, eax
je 0x1032213
lea eax, [ebp - 0x2b8]
push eax
jmp 0x1032214
push esi
push 0x1003338
call sub.MFC42u.dll_CString::Replace
push dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x2cc]
call sub.MFC42u.dll_CWnd::SetWindowTextW
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], bl
call sub.MFC42u.dll_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.010ab876
call fcn.010aad21
ret

Function at 0x1033079
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x10bbc29
call fcn.010aac1c
mov esi, ecx
push 0
push 0x10050f4
lea ecx, [ebp - 0x14]
call fcn.010ab82f
and dword [ebp - 4], 0
lea ebx, [esi + 0x140]
mov edi, 0xbc
cmp dword [ebx], edi
je 0x1033148
push edi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebx], edi
mov dword [esi + 0x144], 0x100
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 0xc]
push 0
push 0xa
push 0x9b
push eax
call fcn.010ad480
mov edi, eax
test edi, edi
je 0x103311a
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 0xc]
push 0
push edi
push eax
call fcn.010ad3f2
test eax, eax
je 0x103311a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x103311a
mov cl, byte [eax + 4]
mov byte [esi + 0x1ea], cl
movzx eax, word [eax + 2]
imul eax, eax, 0x14
mov dword [esi + 0x1e4], eax
jmp 0x103312b
mov byte [esi + 0x1ea], 0
mov dword [esi + 0x1e4], 0x12c
call fcn.01075d32
test eax, eax
je 0x1033148
or dword [esi + 0x144], 0x10000
xor eax, eax
inc eax
mov word [esi + 0x14a], ax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.010ab876
mov eax, ebx
call fcn.010aad08
ret
Function at 0x1035408
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x10
mov eax, 0x10b45b8
call fcn.010aac1c
lea eax, [ebp - 0x10]
push eax
push 0x100571c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x80004003
call fcn.010ab82f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10354ec
push 0x74
pop edi
push edi
push ebx
push esi
mov dword [ebp - 0x10], ebx
call sub.msvcrt.dll_memset
mov dword [esi], edi
add esp, 0xc
mov dword [esi + 4], 0xe0000003
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
xor edi, edi
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 0xc]
push ebx
push 0xa
push 0x9b
push eax
call fcn.010ad480
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x103549a
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 0xc]
push ebx
push dword [ebp - 0x14]
push eax
call fcn.010ad3f2
cmp eax, ebx
je 0x103549a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
lea ecx, [ebp + 8]
call sub.MFC42u.dll_CString::CString_1
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
cmp edi, ebx
je 0x10354c2
movzx eax, word [edi]
imul eax, eax, 0x14
mov dword [esi + 0xc], eax
movzx eax, word [edi + 6]
push eax
call sub.MFC42u.dll_CString::LoadStringW
jmp 0x10354d3
push 0x1005710
mov dword [esi + 0xc], 0xf0
call fcn.010a966a
push dword [ebp + 8]
add esi, 0x1a
push 0x20
push esi
call fcn.01035122
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call sub.MFC42u.dll_CString::CString
mov esi, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010ab876
mov eax, esi
call fcn.010aad08
ret 4

Function at 0x103cde8
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10cd0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x1006e24
lea ecx, [ebp - 0x214]
call fcn.010ab82f
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x103cea8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x103cea8
mov eax, dword [section..data]
cmp eax, section..data
je 0x103cea8
test byte [eax + 0x1c], 4
je 0x103cea8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103ce89
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov eax, dword [section..data]
push 0x1005ec8
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0103c5cf
lea ecx, [ebp - 0x214]
call fcn.010ab876
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010aac07
leave
ret
Function at 0x103e0a8
Capabilities:
Create process on windows

Disassembly:
push 0x8b8
mov eax, 0x10b4ca9
call fcn.010aac8f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x864], eax
lea eax, [ebp - 0x85c]
push eax
mov dword [ebp - 0x868], ecx
xor esi, esi
push 0x10071e0
lea ecx, [ebp - 0x870]
mov dword [ebp - 0x85c], esi
call fcn.010ab82f
xor eax, eax
push 0x40e
mov word [ebp - 0x858], ax
lea eax, [ebp - 0x856]
push esi
push eax
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memset
xor eax, eax
push 0x436
mov word [ebp - 0x448], ax
lea eax, [ebp - 0x446]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x208
lea eax, [ebp - 0x858]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x858]
push eax
push 0x10071d4
mov edi, 0x21c
lea eax, [ebp - 0x448]
push edi
push eax
call fcn.0103d977
lea eax, [ebp - 0x448]
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x103e15e
push 0x44
sub eax, ecx
pop ebx
sar eax, 1
push ebx
mov dword [ebp - 0x860], eax
lea eax, [ebp - 0x8c4]
push esi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8c4], ebx
mov ebx, dword [ebp - 0x864]
add esp, 0xc
cmp ebx, esi
je 0x103e1a8
cmp eax, 4
je 0x103e1a8
cmp eax, 5
je 0x103e1a8
cmp eax, 3
jne 0x103e1c9
push eax
mov eax, dword [ebp - 0x860]
mov ecx, edi
sub ecx, eax
push 0x10071c4
push ecx
lea eax, [ebp + eax*2 - 0x448]
push eax
call fcn.0103d977
add esp, 0x10
cmp ebx, esi
je 0x103e1f2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x103e1f2
push ebx
lea eax, [ebp - 0x448]
push eax
push 0x10071b4
push edi
push eax
call fcn.0103d977
add esp, 0x14
mov ecx, dword [ebp - 0x868]
add ecx, 0xc8
call fcn.01061c50
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x8c4]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x103e23b
mov dword [ebp - 0x85c], 0x80004005
jmp 0x103e264
push 0x1388
push dword [ebp - 0x880]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push esi
push dword [ebp - 0x87c]
call fcn.010acbee
push esi
push dword [ebp - 0x880]
call fcn.010acbee
mov esi, dword [ebp - 0x85c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x870]
call fcn.010ab876
mov eax, esi
call fcn.010aad21
ret 8
Function at 0x103e9ce
Capabilities:
Get common file path

Disassembly:
push 0x10
mov eax, 0x10b99b9
call fcn.010aac1c
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push 0x10072ac
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esi
call fcn.010ab82f
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
cmp edi, esi
jne 0x103ea1b
mov esi, 0x80070057
mov dword [ebp - 0x10], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010ab876
mov eax, esi
call fcn.010aad08
ret 0xc
mov eax, dword [ebp + 8]
mov ebx, 0x104
cmp eax, esi
je 0x103ea35
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jge 0x103e9fd
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [edi], cx
cmp eax, esi
je 0x103ea53
cmp word [eax], si
je 0x103ea53
push eax
push ebx
push edi
call fcn.01035122
mov dword [ebp - 0x10], esi
cmp word [edi], si
jne 0x103ea83
cmp dword [ebp + 0xc], esi
je 0x103ea70
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
push ebx
push edi
add ecx, 0xc8
call fcn.0106155d
mov dword [ebp - 0x10], eax
jmp 0x103ea77
mov dword [ebp - 0x10], 0x80004005
cmp dword [ebp - 0x10], esi
jge 0x103ea83
xor eax, eax
mov word [edi], ax
jmp 0x103ea94
push esi
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x103eae4
push esi
push ebx
push edi
call fcn.010761ad
cmp eax, esi
mov dword [ebp - 0x10], eax
jl 0x103eab4
push esi
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x103eae4
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
push esi
push esi
push 5
push esi
call ebx
cmp eax, esi
mov dword [ebp - 0x10], eax
jl 0x103eada
push esi
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x103eae4
push edi
push esi
push esi
push esi
push esi
call ebx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
jmp 0x103ea05
Function at 0x1040770
Capabilities:
Copy file

Disassembly:
push 0x258
mov eax, 0x10b4f36
call fcn.010aac8f
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
push 0x1007668
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x220], ebx
call fcn.010ab82f
xor eax, eax
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x224], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
jne 0x104080c
mov esi, 0x80004003
mov dword [ebp - 0x220], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.010ab876
mov eax, esi
call fcn.010aad21
ret 0x10
cmp edi, ebx
je 0x10407e8
cmp dword [ebp - 0x220], ebx
mov dword [edi], ebx
jl 0x1040982
mov eax, dword [esi]
push ebx
push ebx
push esi
call dword [eax + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x264]
call fcn.0103c851
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x264]
push eax
push 0x34
push 0xe851
call fcn.0103dadf
cmp eax, 6
je 0x1040861
mov dword [ebp - 0x220], 0xc6c81221
cmp dword [ebp - 0x220], ebx
jl 0x1040982
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [esi]
push 1
push ebx
push esi
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x228]
push eax
call fcn.0103f992
cmp eax, ebx
mov dword [ebp - 0x220], eax
jl 0x1040982
push ebx
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10408f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10408c4
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x220], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x10408f4
test byte [eax + 0x1c], 4
je 0x10408f4
push dword [ebp - 0x220]
push 0x1005ec8
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01079041
cmp dword [ebp - 0x220], ebx
jl 0x1040982
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xe00]
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 1
push ebx
push ecx
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, eax
call fcn.0108cd22
cmp eax, ebx
mov dword [ebp - 0x220], eax
jl 0x1040982
call sub.MFC42u.dll_AfxGetModuleState
mov esi, dword [eax + 0xc]
mov edi, dword [ebp - 0x224]
call sub.MFC42u.dll_AfxGetModuleState
push dword [ebp - 0x22c]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xe00]
push esi
push dword [ebp + 0xc]
mov ecx, eax
push ebx
push edi
call fcn.0108abcc
cmp eax, ebx
mov dword [ebp - 0x220], eax
jl 0x1040982
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x230]
mov dword [ecx], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 0x224]
mov esi, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x10407f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10407f3