joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010996
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xabb4
call fcn.100515a0
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x4a0]
push esi
push eax
mov ebx, ecx
call fcn.10032c50
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x50]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 0x3fff
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x4a0]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10010a74
test eax, eax
je 0x10010a74
lea eax, [ebp - 0x50]
mov dword [ebp - 0x18], 0xff
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x298]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10010a6e
push 0x10061190
lea ecx, [ebp - 0x34]
call fcn.10004287
push eax
lea edx, [ebp - 0x298]
lea ecx, [ebp - 0x68]
call fcn.1000440d
pop ecx
push eax
mov ecx, 0x1006f3c8
call fcn.1000332a
lea ecx, [ebp - 0x68]
call fcn.10001f09
lea ecx, [ebp - 0x34]
call fcn.10001f09
inc esi
cmp esi, dword [ebp - 4]
jb 0x10010a0e
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10010bb6
xor esi, esi
test eax, eax
je 0x10010bb6
xor eax, eax
mov byte [ebp - 0x5c], 0
lea edi, [ebp - 0x5b]
mov dword [ebp - 0xc], 0x2710
stosd dword es:[edi], eax
mov dword [ebp - 8], 0x3fff
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0xabb0], ax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2bb0]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xabb0]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10010bac
push 0xa
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x1c]
call fcn.1003cdd0
add esp, 0xc
lea ecx, [ebp - 0x80]
push 0x10061190
call fcn.10004287
push eax
lea edx, [ebp - 0xabb0]
lea ecx, [ebp - 0x34]
call fcn.1000440d
pop ecx
push eax
mov ecx, 0x1006f3e0
call fcn.1000332a
lea ecx, [ebp - 0x34]
call fcn.10001f09
lea ecx, [ebp - 0x80]
call fcn.10001f09
push 0x1006073c
lea ecx, [ebp - 0x34]
call fcn.1000209d
push eax
lea edx, [ebp - 0x5c]
lea ecx, [ebp - 0x80]
call fcn.10005405
pop ecx
push eax
mov ecx, 0x1006f3f8
call fcn.1000344f
lea ecx, [ebp - 0x80]
call fcn.10001fe0
lea ecx, [ebp - 0x34]
call fcn.10001fe0
push str._regsplt_
lea ecx, [ebp - 0x98]
call fcn.1000209d
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x2bb0]
push eax
lea ecx, [ebp - 0x34]
call fcn.100020c4
mov edx, eax
lea ecx, [ebp - 0x80]
call fcn.10002f36
pop ecx
push eax
mov ecx, 0x1006f490
call fcn.1000344f
lea ecx, [ebp - 0x80]
call fcn.10001fe0
lea ecx, [ebp - 0x34]
call fcn.10001fe0
lea ecx, [ebp - 0x98]
call fcn.10001fe0
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x10010a89
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001166d
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
and dword [eax], 0
push edi
push ecx
mov dword [ebp - 4], edx
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x100116ed
cmp word [esi + 8], 2
jne 0x100116cf
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x100116cf
mov edi, dword [esi + 0xc]
jmp 0x100116c9
push dword [eax]
mov edx, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
call fcn.10011604
mov ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
test ecx, ecx
je 0x100116e8
lea eax, [ecx + 0x1c]
add edi, 4
mov dword [ebp + 0x14], eax
mov eax, dword [edi]
test eax, eax
jne 0x100116a5
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.10039c73
add esp, 0x10
xor eax, eax
jmp 0x1001170b
push 8
pop eax
jmp 0x1001170b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x10011709
sub eax, 1
je 0x1001171b
sub eax, 1
je 0x10011714
sub eax, 1
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x2afb
jmp 0x1001170b
mov eax, 0x2afa
jmp 0x1001170b
Function at 0x10011d03
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
cmp dword [0x10070a3c], 0
mov dword [ebp - 0x18], str.getaddrinfo
mov dword [ebp - 0x14], 0x100118bb
mov dword [ebp - 0x10], str.getnameinfo
mov dword [ebp - 0xc], 0x10011b3b
mov dword [ebp - 8], str.freeaddrinfo
mov dword [ebp - 4], fcn.1001187d
jne 0x10011e65
push 0x104
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10011e5b
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
mov ebx, 0x10c
push eax
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.1003c99c
push str.ws2_32
lea eax, [ebp - 0x124]
push ebx
push eax
call fcn.1003c9f6
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
xor edi, edi
test esi, esi
je 0x10011dc2
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10011dbe
push esi
call ebx
mov esi, edi
test esi, esi
jne 0x10011e1c
lea eax, [ebp - 0x22c]
mov esi, 0x10c
push eax
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.1003c99c
push str.wship6
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.1003c9f6
add esp, 0x18
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10011e58
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10011e18
push esi
call ebx
mov esi, edi
test esi, esi
je 0x10011e58
mov ebx, edi
push dword [ebp + ebx*8 - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + ebx*8 - 0x14], eax
test eax, eax
je 0x10011e39
inc ebx
cmp ebx, 3
jl 0x10011e1e
jmp 0x10011e42
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, edi
test esi, esi
je 0x10011e58
mov eax, dword [ebp + edi - 0x14]
mov dword [edi + 0x1006b9fc], eax
add edi, 8
cmp edi, 0x18
jl 0x10011e46
pop edi
pop esi
pop ebx
mov dword [0x10070a3c], 1
mov eax, dword [0x1006b9fc]
mov esp, ebp
pop ebp
ret
Function at 0x10013e89
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
push esi
push str._sysinfo.txt
push str.temp
call fcn.100379df
pop ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.10004287
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.100030bf
pop ecx
lea ecx, [ebp - 0x30]
call fcn.10001f09
xor ebx, ebx
lea eax, [ebp - 0x48]
push ebx
push ebx
push eax
mov edx, 0x10066604
lea ecx, [ebp - 0x30]
call fcn.1000a8fe
pop ecx
mov ecx, eax
call fcn.10001f04
push eax
push str.dxdiag
push 0x1006077c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x30]
call fcn.10001f09
lea ecx, [ebp - 0x18]
call fcn.100020ee
mov esi, ebx
lea ecx, [ebp - 0x48]
call fcn.10001f04
lea edx, [ebp - 0x18]
mov ecx, eax
call fcn.10018603
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x18]
inc esi
call fcn.1000629b
test al, al
je 0x10013f30
cmp esi, 0x4b0
jl 0x10013f01
lea ecx, [ebp - 0x18]
call fcn.1000629b
test al, al
jne 0x10013fc0
lea ecx, [ebp - 0x48]
call fcn.10001f04
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
lea ecx, [ebp - 0xc8]
call fcn.10004816
push ecx
lea ecx, [ebp - 0xc8]
call fcn.100049ea
test al, al
je 0x10013fb5
sub esp, 0x18
lea eax, [ebp - 0x18]
mov esi, esp
lea edx, [ebp + 8]
lea ecx, [ebp - 0x30]
push eax
push 0x1006ee80
call fcn.10002fd0
pop ecx
mov edx, eax
mov ecx, esi
call fcn.10002fac
pop ecx
push 0x97
lea ecx, [ebp - 0xc8]
call fcn.10004bc3
lea ecx, [ebp - 0x30]
call fcn.10001fe0
lea ecx, [ebp - 0xc8]
call fcn.10004f2b
mov bl, 1
lea ecx, [ebp - 0xc8]
call fcn.10004fe9
lea ecx, [ebp - 0x18]
call fcn.10001fe0
lea ecx, [ebp - 0x48]
call fcn.10001f09
lea ecx, [ebp + 8]
call fcn.10001fe0
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014518
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
lea eax, [ebp + 8]
lea ecx, [ebp - 0x84]
push ebx
push esi
push edi
push eax
push 0x10060738
call fcn.1000209d
push eax
push str.Temp
call fcn.100379ea
pop ecx
mov edx, eax
lea ecx, [ebp - 0x6c]
call fcn.10005405
pop ecx
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.10002fac
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.10001fe0
lea ecx, [ebp - 0x84]
call fcn.10001fe0
push ecx
push ecx
push 0x10
lea ecx, [ebp - 0x18]
call fcn.10001fae
push eax
lea ecx, [ebp - 0x138]
call fcn.1000d390
lea ecx, [ebp - 0x138]
call fcn.10014755
test al, al
je 0x10014649
lea edx, [ebp + 0x20]
lea ecx, [ebp - 0x138]
call fcn.10014765
lea ecx, [ebp - 0x138]
call fcn.1000d341
and dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x18]
and dword [ebp - 0x48], 0
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
call fcn.10001fae
movaps xmm0, xmmword [0x10066f50]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x54]
push eax
movups xmmword [ebp - 0x40], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
mov esi, 0x10060720
mov edi, 0x1006f548
setne bl
cmp dword [ebp - 0x1c], 0
je 0x10014633
sub esp, 0x18
mov ecx, esp
push esi
call fcn.1000209d
push 0x70
mov ecx, edi
call fcn.10004bc3
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.10001fae
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp bl, 1
jne 0x10014664
sub esp, 0x18
mov ecx, esp
push esi
call fcn.1000209d
push 0x6e
mov ecx, edi
jmp 0x1001465f
sub esp, 0x18
mov ecx, esp
push 0x10060720
call fcn.1000209d
push 0x6f
mov ecx, 0x1006f548
call fcn.10004bc3
lea ecx, [ebp - 0x138]
call fcn.1000ce86
lea ecx, [ebp - 0x18]
call fcn.10001fe0
lea ecx, [ebp + 8]
call fcn.10001fe0
lea ecx, [ebp + 0x20]
call fcn.10001fe0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016ef6
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x20
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x20
lea ecx, [ebp + 8]
mov esi, eax
call fcn.10001f04
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x10016f2e
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10016f4c
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.10001f09
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016f5d
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x11
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf003f
lea ecx, [ebp + 8]
mov esi, eax
call fcn.10001f04
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x10016f98
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10016fe9
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10016fb9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
mov bl, 2
jmp 0x10016fe9
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x18], 1
jne 0x10016fb9
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
neg eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
sbb ebx, ebx
and ebx, 0xfffffffe
add ebx, 3
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.10001f09
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016ffa
Capabilities:
Pause service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x40
lea ecx, [ebp + 8]
mov esi, eax
call fcn.10001f04
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x10017032
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10017050
lea eax, [ebp - 0x1c]
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.10001f09
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017061
Capabilities:
Continue service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0x40
lea ecx, [ebp + 8]
mov esi, eax
call fcn.10001f04
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x10017099
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x100170b7
lea eax, [ebp - 0x1c]
push eax
push 3
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.10001f09
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100170c8
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 2
xor ebx, ebx
mov byte [ebp - 1], cl
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 2
lea ecx, [ebp + 8]
mov esi, eax
call fcn.10001f04
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x10017101
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10017145
movzx eax, byte [ebp - 1]
or ecx, 0xffffffff
sub eax, ebx
je 0x1001711e
sub eax, 1
je 0x1001711a
sub eax, 1
jne 0x10017121
push 3
jmp 0x10017120
push 2
jmp 0x10017120
push 4
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ecx
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
setne bl
call esi
push edi
call esi
lea ecx, [ebp + 8]
call fcn.10001f09
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001716a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
lea ecx, [esp + 4]
mov dl, 0x30
push esi
push str.alarm.wav
call fcn.1000b984
pop ecx
lea ecx, [esp + 8]
call fcn.10001f04
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100171f5
mov esi, 0x1006f880
mov edx, 0x10060720
mov ecx, esi
call fcn.10005c35
test al, al
je 0x100171e3
sub esp, 0x18
cmp byte [0x1006ea99], 0
mov ecx, esp
push 0x10066774
je 0x100171cd
call fcn.1000209d
mov ecx, 0x1006f898
jmp 0x100171d7
call fcn.1000209d
mov ecx, 0x1006f4b0
push 0xa1
call fcn.10004bc3
jmp 0x10017205
lea ecx, [esp + 8]
call fcn.10001f04
mov edx, eax
mov ecx, esi
call fcn.10018675
lea ecx, [esp + 8]
call fcn.10001f04
mov ecx, eax
call fcn.10017213
lea ecx, [esp + 8]
call fcn.10001f09
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10017268
Capabilities:
Check if file exists

Disassembly:
push ebx
push ecx
mov ecx, 0x1006f880
mov bl, dl
call fcn.10001fc6
test bl, bl
je 0x10017280
pop ebx
jmp fcn.1001716a
mov byte [0x1006ea9a], 1
pop ebx
ret
Function at 0x1001749a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
push ecx
lea ecx, [ebp + 8]
call fcn.100176d2
cmp eax, 0xffffffff
jne 0x100174db
lea ecx, [ebp + 8]
call fcn.10001f04
push eax
mov dl, 0x30
lea ecx, [ebp - 0x18]
call fcn.1000b9d0
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.10001f13
lea ecx, [ebp - 0x18]
call fcn.10001f09
mov ecx, esi
call fcn.100024a2
lea ecx, [ebp + 8]
test eax, eax
je 0x100175ba
call fcn.10001f04
mov edx, eax
mov ecx, esi
call fcn.10018675
push str._alias_audio
mov edx, edi
lea ecx, [ebp - 0x78]
call fcn.10017f40
push eax
lea eax, [ebp + 8]
mov edx, str.open__
push str.__type
push eax
lea ecx, [ebp - 0x60]
call fcn.1000a8fe
pop ecx
mov edx, eax
lea ecx, [ebp - 0x48]
call fcn.100030bf
pop ecx
mov edx, eax
lea ecx, [ebp - 0x18]
call fcn.10003049
pop ecx
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.100030bf
pop ecx
lea ecx, [ebp - 0x18]
call fcn.10001f09
lea ecx, [ebp - 0x48]
call fcn.10001f09
lea ecx, [ebp - 0x60]
call fcn.10001f09
lea ecx, [ebp - 0x78]
call fcn.10001f09
xor ebx, ebx
lea ecx, [ebp - 0x30]
push ebx
push ebx
push ebx
call fcn.10001f04
push eax
call dword [sym.imp.WINMM.dll_mciSendStringW]
mov esi, dword [sym.imp.WINMM.dll_mciSendStringA]
push ebx
push ebx
push ebx
push str.play_audio
call esi
sub esp, 0x18
mov ecx, esp
push 0x10060720
call fcn.1000209d
push 0xa9
mov ecx, 0x1006f898
call fcn.10004bc3
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x1006ea9c], eax
jmp 0x10017681
call fcn.10001f04
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100174fb
sub esp, 0x18
mov ecx, esp
push 0x10060720
call fcn.1000209d
push 0xa8
mov ecx, 0x1006f898
call fcn.10004bc3
jmp 0x100176c3
cmp byte [0x1006ea98], bl
je 0x10017609
push ebx
push ebx
push ebx
push str.pause_audio
call esi
mov byte [0x1006ea98], bl
cmp byte [0x1006cd4f], bl
je 0x10017621
push ebx
push ebx
push ebx
push str.resume_audio
call esi
mov byte [0x1006cd4f], bl
push ebx
push 0x14
lea eax, [ebp - 0x14]
push eax
push str.status_audio_mode
call esi
lea edx, [ebp - 0x14]
mov edi, str.stopped
mov ecx, ebx
movzx eax, byte [edx + ecx]
cmp al, byte [edi + ecx]
jne 0x10017654
inc ecx
cmp ecx, 8
jne 0x10017639
push dword [0x1006ea9c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f4
push dword [0x1006ea9c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1001767c
push dword [0x1006ea9c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x100175b0
mov eax, dword [0x1006ea9c]
test eax, eax
jne 0x100175f1
push ebx
push ebx
push ebx
push str.stop_audio
call esi
push ebx
push ebx
push ebx
push str.close_audio
call esi
sub esp, 0x18
mov ecx, esp
push 0x10060720
call fcn.1000209d
push 0xaa
mov ecx, 0x1006f898
call fcn.10004bc3
lea ecx, [ebp - 0x30]
call fcn.10001f09
lea ecx, [ebp + 8]
call fcn.10001f09
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017d62
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
test ecx, ecx
je 0x10017de4
push edi
push edi
lea eax, [ebp - 8]
push eax
push ecx
push edi
call dword [sym.imp.urlmon.dll_URLOpenBlockingStreamW]
test eax, eax
js 0x10017de4
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x54]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
test eax, eax
js 0x10017ddb
mov esi, dword [ebp - 0x4c]
inc esi
push esi
mov dword [ebp - 0x4c], esi
call fcn.1003765d
mov dword [ebx], eax
pop ecx
test eax, eax
je 0x10017ddb
push esi
push edi
push eax
call fcn.10032c50
add esp, 0xc
lea eax, [esi - 1]
mov esi, dword [ebp + 8]
push edi
mov dword [esi], eax
mov eax, dword [ebp - 8]
push edi
push edi
push edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push edi
push dword [esi]
push dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
inc edi
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017ded
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp - 0x200]
push esi
push edi
mov edi, 0x200
mov esi, ecx
push edi
push 0
push eax
call fcn.10032c50
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
lea ecx, [ebp - 0x200]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x200]
mov ecx, esi
push eax
call fcn.10004287
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10017e5f
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push ecx
xor ebx, ebx
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10017e87
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
ret
Function at 0x1001837b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
mov ebx, ecx
lea esi, [ebp - 0x418]
push edi
mov dword [ebp - 8], ebx
mov edx, ebx
sub esi, ebx
movzx eax, word [edx]
mov word [esi + edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10018396
lea ecx, [ebp - 0x418]
sub ecx, 2
xor edx, edx
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
cmp ax, dx
jne 0x100183b0
mov eax, dword [0x100666c8]
lea edx, [ebp - 0x210]
mov dword [ecx], eax
sub edx, ebx
mov ax, word [0x100666cc]
mov word [ecx + 4], ax
mov ecx, ebx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100183d7
lea edi, [ebp - 0x210]
sub edi, 2
xor esi, esi
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, si
jne 0x100183f1
mov eax, dword [0x10060878]
mov dword [edi], eax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10018565
mov ecx, esi
movzx eax, word [ebp + ecx - 0x210]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x41a], ax
test ax, ax
jne 0x10018425
mov byte [ebp - 1], 1
lea eax, [ebp - 0x668]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1001854c
lea ecx, [ebp - 0x63c]
call fcn.10018305
test eax, eax
jne 0x100184e5
lea edx, [ebp - 0x63c]
xor ecx, ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, cx
jne 0x10018470
lea edi, [ebp - 0x210]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x10018486
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test byte [ebp - 0x668], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x10018502
lea ecx, [ebp - 0x210]
call fcn.1001837b
test eax, eax
je 0x1001855e
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor esi, esi
mov ecx, esi
movzx eax, word [ebp + ecx - 0x418]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x212], ax
test ax, ax
jne 0x100184cd
mov al, byte [ebp - 1]
test al, al
jne 0x10018441
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10018567
test byte [ebp - 0x668], 1
je 0x1001851d
push 0x80
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1001855e
xor esi, esi
mov ecx, esi
movzx eax, word [ebp + ecx - 0x418]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x212], ax
test ax, ax
jne 0x10018532
jmp 0x100184e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1001855e
xor eax, eax
mov byte [ebp - 1], al
jmp 0x100184e8
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret