joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101cabc
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x134
or dword [ebp - 8], 0xffffffff
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x101cbb9
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x101cb17
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x101cbb0
push ebx
xor ebx, ebx
cmp dword [esi + 4], edi
mov dword [ebp - 4], edi
jle 0x101cb75
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + edi + 0x110]
cmp ecx, dword [ebp - 0x10]
jne 0x101cb5f
mov eax, dword [eax + edi + 0x114]
cmp eax, dword [ebp - 0xc]
jne 0x101cb5f
cmp dword [ebp - 4], 0
jne 0x101cb4e
push dword [ebp - 0x14]
call fcn.0102ac22
mov dword [ebp - 4], eax
mov ecx, dword [esi + 0x10]
push 1
add ecx, edi
call fcn.010194bc
cmp eax, dword [ebp - 4]
je 0x101cb6d
inc ebx
add edi, 0x120
cmp ebx, dword [esi + 4]
jl 0x101cb22
jmp 0x101cb75
cmp ebx, 0xffffffff
mov dword [ebp - 8], ebx
jne 0x101cbaf
cmp byte [ebp + 0xc], 0
je 0x101cbaf
push dword [ebp - 4]
lea ecx, [ebp - 0x134]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0101a9a1
push eax
mov ecx, esi
call fcn.0101c7d8
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x134], 0x1001644
call fcn.010047d1
pop ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 8
Function at 0x101e617
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_malloc]
push edi
mov ebx, ecx
mov edi, 0x2000
push edi
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x101e647
mov eax, 0x8007000e
jmp 0x101e7b0
push eax
mov ecx, ebx
call fcn.0101e51e
test eax, eax
jge 0x101e65a
mov edi, eax
jmp 0x101e7a0
lea eax, [ebp - 2]
push eax
push dword [ebp - 0x10]
call fcn.0101e394
test eax, eax
jne 0x101e674
mov edi, 0x80020009
jmp 0x101e7a0
push edi
call esi
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0xc], esi
jne 0x101e68b
mov edi, 0x8007000e
jmp 0x101e7a0
mov ecx, ebx
call fcn.0101e4f5
push esi
mov ecx, ebx
call fcn.0101e51e
test eax, eax
jl 0x101e796
movzx eax, word [ebp - 2]
sub eax, 8
je 0x101e77b
sub eax, 9
je 0x101e6de
dec eax
dec eax
jne 0x101e787
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push esi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.0101e21e
jmp 0x101e787
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp - 8], eax
je 0x101e6f6
mov edi, 0x80004005
jmp 0x101e798
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.01024e00
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov edi, esp
mov dword [ebp - 4], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp esp, edi
je 0x101e6ec
cmp dword [ebp - 8], edi
jle 0x101e762
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
push eax
call fcn.0101e41e
mov ecx, edi
and ecx, 1
shl ecx, 2
mov edx, ecx
push 4
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x101e72c
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
push dword [ebp - 4]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x101e787
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.0101e241
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.0101e51e
test eax, eax
jge 0x101e7ae
mov edi, eax
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, edi
jmp 0x101e7b0
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x101ee3a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1036f44]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.0101e1e2
cmp eax, esi
jne 0x101eedb
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x101ee92
lea eax, [ebp - 0x204]
push eax
call fcn.0101ee3a
cmp eax, esi
jne 0x101eeda
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x208]
je 0x101ee82
call fcn.0101e16f
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.0101e16f
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.01024a32
leave
ret 4
Function at 0x101f96c
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [edi + 0x88], eax
jne 0x101f990
xor al, al
jmp 0x101f9a9
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x101f954
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
leave
ret

Function at 0x1020446
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push ebx
push esi
push edi
push 2
push 0
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x1020498
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1020483
call esi
mov esi, eax
jmp 0x102055e
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x102055e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x10204b9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x10204de
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10204cc
call esi
jmp 0x1020553
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1020555
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x102051d
lea edi, [ebx + 1]
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.01024e00
mov ecx, edi
mov edx, ecx
mov eax, esp
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], eax
mov byte [eax + ebx], 0
mov edi, esp
test edi, edi
jne 0x1020525
xor eax, eax
jmp 0x1020547
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.01024e00
mov eax, esp
push esi
push edi
push eax
call fcn.0101e0a6
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push eax
call fcn.0101fe50
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1021433
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 0x464
push 0x40
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x102145b
push dword [ebp + 8]
mov ecx, esi
call fcn.01021498
jmp 0x102145d
xor esi, esi
test esi, esi
je 0x102148b
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x102153c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x102148b
mov ecx, esi
call fcn.01021382
push esi
call fcn.010046d6
pop ecx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
Function at 0x102161c
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x1036f44]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov esi, ecx
call fcn.0100564d
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x228], ebx
je 0x10217ae
cmp word [edi], bx
je 0x10217ae
push edi
lea ecx, [ebp - 0x114]
call fcn.01006bd5
lea ecx, [ebp - 0x114]
xor edi, edi
call fcn.01005f1a
test eax, eax
jle 0x1021696
mov eax, dword [ebp - 0x110]
lea eax, [eax + edi*2]
cmp word [eax], 0x5c
jne 0x1021686
mov word [eax], 0x2d
lea ecx, [ebp - 0x114]
inc edi
call fcn.01005f1a
cmp edi, eax
jl 0x1021672
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x224]
call fcn.01006c15
push 0x1002384
lea ecx, [ebp - 0x338]
call fcn.01006bd5
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x224]
call fcn.0100edac
mov edi, 0x1001644
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x338], edi
call fcn.010047d1
push dword [ebp - 0x220]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
cmp eax, ebx
mov dword [esi], eax
je 0x102178c
push 0xffffffffffffffff
push eax
call fcn.010269c8
test al, al
je 0x102178c
push dword [ebp - 0x110]
mov edi, 0xf001f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x102173d
push 4
push ebx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
mov dword [ebp - 0x228], 2
jmp 0x102177f
cmp byte [ebp + 0xc], bl
je 0x102177f
push dword [ebp - 0x110]
push 4
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, ebx
mov dword [esi + 4], eax
je 0x102177f
push 4
push ebx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
mov dword [esi + 8], edi
je 0x102177f
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x228], 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, 0x1001644
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], edi
call fcn.010047d1
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], edi
call fcn.010047d1
cmp dword [esi + 8], ebx
jne 0x10217ba
mov ecx, esi
call fcn.0100564d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
pop edi
pop esi
pop ebx
call fcn.01024a32
leave
ret 8

Function at 0x10219f3
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 0x464
push 0x40
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1021a1b
push dword [ebp + 8]
mov ecx, esi
call fcn.01021498
jmp 0x1021a1d
xor esi, esi
test esi, esi
je 0x1021a4b
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1021a58
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x1021a4b
mov ecx, esi
call fcn.01021382
push esi
call fcn.010046d6
pop ecx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
Function at 0x1022079
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c8
mov eax, dword [0x1036f44]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x20c], bx
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x27
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [ebp - 0x20c], bx
je 0x10220d4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.01004914
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1022126
sub esp, 0x110
mov ecx, esp
push esi
call fcn.01006c15
call fcn.0100863b
neg al
sbb eax, eax
inc eax
jmp 0x1022131
test al, 0x10
jne 0x10221c1
xor eax, eax
inc eax
cmp eax, ebx
je 0x10221c1
xor eax, eax
mov dword [ebp - 0x414], ebx
mov ecx, 0x81
lea edi, [ebp - 0x410]
push 0xc8
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5a4]
push eax
push 0xaa
push dword [0x1037438]
call dword [sym.imp.USER32.dll_LoadStringW]
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x5c8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5a4]
mov dword [ebp - 0x5bc], eax
lea eax, [ebp - 0x5c8]
push eax
mov dword [ebp - 0x5c8], ebx
mov dword [ebp - 0x5b8], 0x51
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
cmp eax, ebx
je 0x10221b3
lea ecx, [ebp - 0x414]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
call fcn.01004914
mov ecx, dword [ebp - 4]
call fcn.01024a32
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x102248e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1036f44]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x228], eax
push esi
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
mov dword [ebp - 0x210], ebx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov esi, eax
cmp esi, ebx
jl 0x10226aa
push edi
xor eax, eax
mov word [ebp - 0x20c], bx
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1022687
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x100196c
call esi
mov edi, 0x10024d0
push edi
mov ebx, eax
call esi
add ebx, eax
lea eax, [ebp - 0x20c]
push eax
call esi
add ebx, eax
cmp ebx, 0x104
jae 0x102267e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100196c
lea eax, [ebp - 0x20c]
push eax
call esi
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x224], eax
je 0x1022687
push 0x10024b8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x102264e
lea ecx, [ebp - 0x214]
push ecx
push dword [ebp - 0x220]
mov dword [ebp - 0x214], ebx
call eax
mov esi, eax
cmp esi, ebx
jl 0x1022670
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x21c]
push edx
push 0x10024a8
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x10225ff
mov edi, dword [ebp - 0x228]
push dword [edi + 4]
lea eax, [edi + 8]
push eax
push dword [ebp - 0x21c]
call fcn.010222ce
mov esi, eax
cmp esi, ebx
jne 0x10225ff
cmp dword [edi + 4], ebx
je 0x10225ff
push ebx
push dword [ebp - 0x220]
call sub.wiashext.dll_DoDeleteAllItems
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x218], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x102262c
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0x102263c
push dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0x102263c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x21c]
cmp eax, ebx
je 0x1022670
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1022670
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1022660
call esi
mov esi, eax
jmp 0x1022670
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10226a9
mov esi, 0x80004005
xor ebx, ebx
jmp 0x10226a9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1022699
call esi
mov esi, eax
jmp 0x10226a9
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, dword [ebp - 0x210]
cmp eax, ebx
je 0x10226ba
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.01024a32
leave
ret 8
Function at 0x102282c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8a4
mov eax, dword [0x1036f44]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
push 0x1002550
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x574], eax
call fcn.01006bd5
xor edi, edi
push edi
push 0x20019
push 1
lea eax, [ebp - 0x31c]
push eax
push 0x80000001
lea ecx, [ebp - 0x56c]
call fcn.010253ac
mov esi, 0x1001644
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x31c], esi
call fcn.010047d1
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x27
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
lea ecx, [ebx + 8]
push eax
mov dword [ebx + 4], edi
mov dword [ebp - 0x570], ecx
call fcn.01004914
cmp dword [ebp - 0x458], edi
mov dword [ebx], edi
mov dword [ebx + 0x11c], edi
je 0x1022a9b
cmp dword [ebp - 0x454], edi
je 0x1022a9b
lea ecx, [ebp - 0x31c]
call fcn.01007096
push dword [ebp - 0x574]
lea eax, [ebp - 0x31c]
push 0x10023cc
push eax
call fcn.0100ed19
add esp, 0xc
push edi
push 0x20019
push 1
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x454]
lea ecx, [ebp - 0x444]
call fcn.010253ac
push 0x1002530
lea ecx, [ebp - 0x684]
call fcn.01006bd5
push edi
lea eax, [ebp - 0x684]
push eax
lea ecx, [ebp - 0x444]
call fcn.010252a3
lea ecx, [ebp - 0x684]
mov dword [ebx + 4], eax
mov dword [ebp - 0x684], esi
call fcn.010047d1
push 0x100250c
lea ecx, [ebp - 0x684]
call fcn.01006bd5
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x794]
call fcn.01006bd5
push eax
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x8a4]
push eax
lea ecx, [ebp - 0x444]
call fcn.01025429
mov ecx, dword [ebp - 0x570]
push eax
call fcn.01006b02
lea ecx, [ebp - 0x8a4]
mov dword [ebp - 0x8a4], esi
call fcn.010047d1
lea ecx, [ebp - 0x794]
mov dword [ebp - 0x794], esi
call fcn.010047d1
lea ecx, [ebp - 0x684]
mov dword [ebp - 0x684], esi
call fcn.010047d1
push 0x10024fc
lea ecx, [ebp - 0x684]
call fcn.01006bd5
push 1
lea eax, [ebp - 0x684]
push eax
lea ecx, [ebp - 0x444]
call fcn.010252a3
lea ecx, [ebp - 0x684]
mov dword [ebx], eax
mov dword [ebp - 0x684], esi
call fcn.010047d1
push 0x10024ec
lea ecx, [ebp - 0x684]
call fcn.01006bd5
push edi
lea eax, [ebp - 0x684]
push eax
lea ecx, [ebp - 0x444]
call fcn.010252a3
neg eax
sbb eax, eax
neg eax
lea ecx, [ebp - 0x684]
mov dword [ebx + 0x11c], eax
mov dword [ebp - 0x684], esi
call fcn.010047d1
cmp dword [ebx + 0x11c], edi
je 0x1022a7f
push dword [ebp - 0x570]
lea ebx, [ebp - 0x794]
call fcn.010226ec
mov ecx, dword [ebp - 0x570]
push eax
call fcn.01006b02
mov ecx, ebx
mov dword [ebp - 0x794], esi
call fcn.010047d1
lea ecx, [ebp - 0x444]
call fcn.0102537a
lea ecx, [ebp - 0x31c]
mov dword [ebp - 0x31c], esi
call fcn.010047d1
lea ecx, [ebp - 0x56c]
call fcn.0102537a
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01024a32
leave
ret 8
Function at 0x1022ddf
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x488
mov eax, dword [0x1036f44]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
push esi
xor esi, esi
cmp edx, esi
push edi
mov edi, ecx
mov dword [ebp - 0x418], esi
je 0x1022e93
xor eax, eax
push 0x11
pop ecx
lea edi, [ebp - 0x488]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x444]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x488], 0x44
mov word [ebp - 0x458], 5
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x488]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1022f98
push dword [ebp - 0x444]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x440]
call edi
mov eax, dword [ebp - 0x418]
cmp eax, esi
jmp 0x1022fb4
lea ecx, [ebp - 0x418]
push ecx
push 0x1002194
push 4
push esi
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jl 0x1022f7e
mov eax, dword [edi + 0xc]
mov esi, dword [ebp - 0x418]
push ebx
push dword [eax + 0x14]
lea ecx, [ebp - 0x424]
call fcn.01022b87
mov ebx, dword [eax]
mov eax, dword [edi + 0xc]
push dword [eax + 0x344]
lea ecx, [ebp - 0x420]
call fcn.01022b87
mov eax, dword [eax]
mov dword [ebp - 0x42c], eax
mov eax, dword [edi + 0xc]
push dword [eax + 0x234]
lea ecx, [ebp - 0x41c]
call fcn.01022b87
mov eax, dword [eax]
mov dword [ebp - 0x430], eax
mov eax, dword [edi + 0xc]
push dword [eax + 0x124]
lea ecx, [ebp - 0x428]
call fcn.01022b87
mov eax, dword [eax]
mov ecx, dword [esi]
mov dword [ebp - 0x434], eax
mov eax, dword [edi + 0xc]
push dword [eax + 0x458]
lea edx, [eax + 0x454]
push edx
push ebx
push dword [eax + 0x450]
push dword [ebp - 0x42c]
push dword [ebp - 0x430]
push dword [ebp - 0x434]
push eax
push esi
call dword [ecx + 0xc]
push dword [ebp - 0x428]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, eax
call esi
push dword [ebp - 0x41c]
call esi
push dword [ebp - 0x420]
call esi
push dword [ebp - 0x424]
call esi
test ebx, ebx
pop ebx
jge 0x1022fac
xor esi, esi
push esi
push 0xae
push 0xad
push esi
push dword [0x1037438]
push dword [edi + 4]
call fcn.0102aff2
mov eax, dword [ebp - 0x418]
cmp eax, esi
je 0x1022fa8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
jmp 0x1022fbe
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x1022fbc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01024a32
leave
ret 4
Function at 0x10243a2
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
push esi
mov esi, ecx
je 0x10243e3
cmp dword [eax + 4], 0x140
jne 0x10243e3
push 0x1002800
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10243e3
push 1
push 0x1001648
push eax
push 0x1002618
push eax
push dword [esi]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop esi
pop ebp
ret 8