joyce8/EMBER2024-capa huggingface dataset:
Function at 0x108fe00
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 0x21
push 8
mov ebx, 3
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x108feb0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push edi
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x10], ecx
lea ecx, [ebp + 0xc]
push ecx
push 0
push esi
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push 0x108fdc0
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x1c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x20]
push 0
push 0
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x108fe9f
cmp edi, 0xffffffff
je 0x108fe9f
push 0x1388
push edi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
jne 0x108fe95
mov edx, dword [ebp + 8]
mov dword [edx + 0x26d1c], 1
mov ebx, dword [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x1c

Function at 0x1092200
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
push 0x1035100
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x109222c
mov ecx, dword [esi + 0x1bc]
push eax
call ecx
push esi
call fcn.01092110
movzx edx, word [esi + 0x267a4]
push edx
push esi
call fcn.01020b80
push esi
call fcn.01092180
pop esi
pop ebp
ret 4

Function at 0x10930f0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp byte [eax + 0x2f498], 0
lea ecx, [eax + 0x2f498]
je 0x10931f0
push edi
push ecx
push eax
call fcn.0108a610
mov eax, dword [esi]
push 0x1011ab0
add eax, 0x2f498
push eax
push 0x1011a68
call fcn.01061570
mov edi, eax
test edi, edi
je 0x109315d
mov ecx, dword [esi]
push 0
push 0
push 0
push edi
push DirectSoundEnumerateW
push ecx
call fcn.010898e0
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [esi]
cmp dword [eax + 0x26b28], 0
pop edi
je 0x1093179
mov eax, dword [eax + 0x58c]
lea edx, [ebp + 8]
push edx
call eax
test eax, eax
je 0x10931d8
push 0x20a
lea ecx, [ebp - 0x20c]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, dword [esi]
lea edx, [eax + 0x2f498]
push edx
add eax, 0x25f5c
push eax
push 0x100da28
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0101e760
add esp, 0x20
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov eax, dword [esi]
cmp dword [eax + 0x26b28], 0
je 0x10931d8
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x588]
push edx
call eax
mov ecx, dword [esi]
push 0x82
add ecx, 0x2f498
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1093ae0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ecx, dword [eax + 0x2169c]
mov edx, dword [eax + 0x358]
push 3
push 0
push 0
push ecx
call edx
mov ecx, dword [edi]
mov dword [ecx + 0x21698], eax
mov edx, dword [edi]
cmp dword [edx + 0x21698], 0
je 0x1093c2b
push ebx
push esi
xor ebx, ebx
mov edi, edi
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
push 0
add eax, 0x5a8
push eax
push 0x1093960
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp + ebx*4 - 0x10], eax
test eax, eax
je 0x1093bab
mov dword [ebp + 8], 5
lea esp, [esp]
push 0xc29
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1093ba5
mov eax, dword [edi]
mov edx, dword [eax + 0x216dc]
mov dword [eax + edx*4 + 0x216a0], esi
mov eax, dword [edi]
add eax, 0x216dc
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
mov eax, dword [edi]
mov edx, dword [eax + 0x2169c]
mov eax, dword [eax + 0x35c]
lea ecx, [esi + 0xc10]
push ecx
push 0xc10
push esi
push edx
call eax
sub dword [ebp + 8], 1
jne 0x1093b50
inc ebx
cmp ebx, 3
jb 0x1093b20
mov ecx, dword [edi]
mov eax, dword [ecx + 0x468]
push 0xffffffffffffffff
push 1
lea edx, [ebp - 0x10]
push edx
push ebx
call eax
mov ecx, dword [edi]
xor esi, esi
mov dword [ebp + 8], ecx
test ebx, ebx
jle 0x1093bec
mov eax, dword [ebp + esi*4 - 0x10]
test eax, eax
je 0x1093be7
mov edx, dword [ebp + 8]
push eax
mov eax, dword [edx + 0x1bc]
call eax
inc esi
cmp esi, ebx
jl 0x1093bd3
mov esi, 0x216a0
mov ecx, dword [edi]
cmp dword [esi + ecx], 0
lea eax, [esi + ecx]
je 0x1093c12
mov eax, dword [eax]
test eax, eax
je 0x1093c12
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
add esi, 4
cmp esi, 0x216dc
jb 0x1093bf1
mov edx, dword [edi]
pop esi
mov dword [edx + 0x216dc], 0
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x1094700
Capabilities:
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov ecx, dword [esi]
push 0x258
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.01094660
test eax, eax
jne 0x109477b
mov edx, dword [edi]
mov eax, dword [edx + 0x128]
push 0x64
call eax
push esi
push edi
call fcn.01094660
test eax, eax
jne 0x109477b
push ebx
lea ebx, [eax + 4]
jmp 0x1094750
mov ecx, dword [edi + 8]
mov edx, dword [esi]
mov eax, dword [ecx + 0x244]
push 0x320
push edx
call eax
cmp eax, 0x102
jne 0x1094775
push esi
push edi
call fcn.01094660
test eax, eax
jne 0x109477a
sub ebx, 1
jne 0x1094750
pop ebx
mov ecx, dword [edi]
mov edx, dword [esi]
mov eax, dword [ecx + 0x168]
push 0
push edx
call eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x1096220
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x20a
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0xc]
push 0x10018e8
push ecx
push 0x1009a1c
lea edx, [ebp - 0x20c]
push 0x103
push edx
call fcn.0101e760
add esp, 0x20
cmp word [ebp - 0x20c], 0
lea eax, [ebp - 0x20c]
je 0x1096279
add eax, 2
cmp word [eax], 0
jne 0x1096270
lea ecx, [ebp - 0x20c]
sub eax, ecx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
mov eax, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push eax
push 1
push 0x101233c
push 0x10122e0
push DirectSoundEnumerateW
push edx
call fcn.010891e0
mov esp, ebp
pop ebp
ret 8

Function at 0x10964a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.010963f0
test eax, eax
je 0x1096567
mov esi, dword [edi]
push ebx
push 0x2000
call fcn.0101c4b0
lea ebx, [eax*4 + 8]
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push esi
call fcn.01087c30
push 0x20a
lea ecx, [ebp - 0x210]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [edi + 8]
mov ecx, dword [edx + 0x218]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x26
push 0
call ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0101e3c0
test eax, eax
je 0x1096558
push 0x10125b0
mov eax, edx
push eax
call fcn.0101e2a0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1096558
mov esi, 1
test al, 0x10
jne 0x109655b
mov esi, dword [ebp - 4]
mov edx, dword [edi]
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1096580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.010963f0
test eax, eax
je 0x1096647
mov esi, dword [edi]
push ebx
push 0x2000
call fcn.0101c4b0
lea ebx, [eax*4 + 8]
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push esi
call fcn.01087c30
push 0x20a
lea ecx, [ebp - 0x210]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [edi + 8]
mov ecx, dword [edx + 0x218]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x26
push 0
call ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0101e3c0
test eax, eax
je 0x1096638
push 0x1012600
mov eax, edx
push eax
call fcn.0101e2a0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1096638
mov esi, 1
test al, 0x10
jne 0x109663b
mov esi, dword [ebp - 4]
mov edx, dword [edi]
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1096660
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.010963f0
test eax, eax
je 0x1096727
mov esi, dword [edi]
push ebx
push 0x2000
call fcn.0101c4b0
lea ebx, [eax*4 + 8]
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push esi
call fcn.01087c30
push 0x20a
lea ecx, [ebp - 0x210]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [edi + 8]
mov ecx, dword [edx + 0x218]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push 0x26
push 0
call ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0101e3c0
test eax, eax
je 0x1096718
push 0x1012650
mov eax, edx
push eax
call fcn.0101e2a0
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1096718
mov esi, 1
test al, 0x10
jne 0x109671b
mov esi, dword [ebp - 4]
mov edx, dword [edi]
add edx, ebx
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10969c0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 4], 0
test eax, eax
jne 0x10969e0
xor ebx, ebx
jmp 0x10969ee
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10969e3
sub eax, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [ebp + 0x10]
mov edx, dword [eax + 0x470]
push 4
push 0x3000
lea ecx, [ebx + 2]
push ecx
push 0
push edi
call edx
mov dword [ebp + 0x10], eax
test eax, eax
je 0x1096b5f
mov ecx, dword [esi]
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp + 0xc]
push ebx
push edx
push eax
mov eax, dword [ecx + 0x408]
push edi
call eax
test eax, eax
je 0x1096b5f
push 0x20a
lea ecx, [ebp - 0x214]
push 0
push ecx
call sub.msvcrt.dll_memset
mov ebx, dword [esi]
add esp, 0xc
push 0x8000
call fcn.0101c4b0
lea eax, [eax*4 + 8]
mov dword [ebp + 0xc], eax
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x8000
push ebx
call fcn.01087c30
mov ebx, dword [esi + 8]
push 0x103
lea edx, [ebp - 0x214]
push edx
push 0x10099a4
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
mov eax, dword [ebx + 0x210]
push edi
call eax
test eax, eax
je 0x1096b45
push 0x1012924
lea ecx, [ebp - 0x214]
push ecx
call fcn.0101e5e0
test eax, eax
je 0x1096b45
mov edx, dword [esi]
cmp dword [edx + 0x26a8c], 6
push 0
push 0
jb 0x1096b00
mov ecx, dword [ebp + 0x10]
mov edx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov eax, dword [esi + 8]
push 0
push 0
push 0
push ecx
push edx
push edi
push 0
push 0x1fffff
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
mov edx, dword [eax + 0x98]
push ecx
call edx
mov eax, dword [ebp + 8]
jmp 0x1096b19
mov eax, dword [ebp + 0x10]
mov ecx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
push ecx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
mov dword [ebp + 8], eax
test eax, eax
je 0x1096b45
mov edx, dword [esi + 8]
push eax
mov eax, dword [edx + 0x1b8]
mov edi, 1
call eax
mov ecx, dword [esi]
add ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esi]
add ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1096c80
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 0x15
push 8
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1096d01
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 8], ecx
lea ecx, [ebp + 8]
push ecx
push ebx
push esi
push 0x1096c30
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x18]
push ebx
push ebx
mov dword [esi], edi
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x1096ce8
mov edx, dword [edi + 0x1bc]
push eax
call edx
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
pop ebp
ret 0x14
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x14
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x14
Function at 0x109c540
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x1b
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x109c5ab
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x109c57c
push edi
mov edi, 0x18
mov ecx, eax
sub esi, eax
lea esp, [esp]
mov dl, byte [esi + ecx]
mov byte [ecx], dl
inc ecx
sub edi, 1
jne 0x109c570
pop edi
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea edx, [ebp + 0x10]
push edx
push 0
push eax
push 0x109c4f0
push 0
push 0
mov dword [eax + 4], ecx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
je 0x109c5aa
push eax
mov eax, dword [esi + 0x1bc]
call eax
pop esi
pop ebp
ret 0xc
Function at 0x109d080
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 0x19
push 8
xor edi, edi
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x109d111
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [esi + 4], edx
lea edx, [ebp + 0x18]
push edx
push edi
push esi
push 0x109d000
mov dword [esi], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
push edi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], eax
mov dword [esi + 0x14], ecx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x109d100
cmp edi, 0xffffffff
je 0x109d100
mov eax, dword [ebx]
test eax, eax
je 0x109d0ef
cmp eax, 0xffffffff
jne 0x109d110
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x128]
push 0x14
call edx
jmp 0x109d0e4
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x18

Function at 0x10a1280
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
cmp edx, ebx
jne 0x10a12ba
xor edi, edi
jmp 0x10a12cb
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10a12c0
sub eax, esi
mov edi, eax
xor esi, esi
cmp edi, ebx
jbe 0x10a1304
mov ebx, dword [sym.imp.msvcrt.dll_tolower]
jmp 0x10a12e3
mov edx, dword [ebp + 0xc]
movsx eax, byte [esi + edx]
push eax
call ebx
add esp, 4
push 1
lea ecx, [ebp - 1]
push ecx
lea edx, [ebp - 0x6c]
push edx
mov byte [ebp - 1], al
call fcn.0108b9a0
inc esi
cmp esi, edi
jb 0x10a12e0
lea eax, [ebp - 0x6c]
push eax
call fcn.0108ba70
mov ecx, dword [ebp + 8]
mov eax, 0x10
add ecx, 0x58
lea edx, [ebp - 0x14]
jmp 0x10a1320
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10a1348
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x10a1320
xor eax, eax
xor edx, edx
test eax, eax
sete dl
pop edi
pop esi
pop ebx
mov eax, edx
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [edx]
movzx esi, byte [ecx]
sub eax, esi
jne 0x10a1374
movzx eax, byte [edx + 1]
movzx esi, byte [ecx + 1]
sub eax, esi
jne 0x10a1374
movzx eax, byte [edx + 2]
movzx esi, byte [ecx + 2]
sub eax, esi
jne 0x10a1374
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
xor edx, edx
test eax, eax
sete dl
pop edi
pop esi
pop ebx
mov eax, edx
mov esp, ebp
pop ebp
ret 8
Function at 0x10a13a0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x10a144e
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push 0x403
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10a1443
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x1c]
push 0x1ff
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x41
lea edx, [ebp - 0x44]
push edi
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, esi
cmp word [esi], di
je 0x10a1408
jmp 0x10a1400
add eax, 2
cmp word [eax], di
jne 0x10a1400
push 0
push 0
push 0x3f
sub eax, esi
lea ecx, [ebp - 0x44]
push ecx
sar eax, 1
push eax
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x44]
push edx
add eax, 0x20
push eax
call fcn.010a1280
push esi
push 0
mov edi, eax
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10a1460
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
sub esp, 8
push ebx
push esi
push eax
call dword [sym.imp.msvcrt.dll_srand]
mov esi, dword [ebp + 0x20]
xor ebx, ebx
add esp, 4
cmp esi, ebx
je 0x10a14a1
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 1
push 7
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call fcn.01045fa0
mov eax, 0x1012b0c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10a14c2
sub eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
cmp eax, ebx
jle 0x10a156f
mov dword [ebp - 4], eax
push edi
lea ecx, [ecx]
call dword [sym.imp.msvcrt.dll_rand]
xor edx, edx
div dword [ebp - 8]
xor edi, edi
mov byte [ebp + 0x19], 0
mov dword [ebp + 0x1c], edx
mov dl, byte [edx + 0x1012b0c]
mov byte [ebp + 0x18], dl
call fcn.01045dd0
mov esi, eax
test esi, esi
je 0x10a1536
mov edi, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
lea eax, [ebx + edx + 0x14]
push eax
lea ecx, [ebp + 0x18]
push ecx
push edi
call fcn.01045ed0
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x10a1560
mov edx, dword [ebp + 0x1c]
movsx eax, byte [edx + 0x1012b0c]
push eax
call dword [sym.imp.msvcrt.dll_tolower]
add esp, 4
push 1
lea ecx, [ebp + 0x1f]
push ecx
push esi
mov byte [ebp + 0x1f], al
call fcn.0108b9a0
sub dword [ebp - 4], 1
lea ebx, [ebx + edi + 0x14]
jne 0x10a14e0
pop edi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push 0
push 0
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.01045fa0
test esi, esi
je 0x10a1592
push esi
call fcn.0108ba70
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10a2490
Capabilities:
Open clipboard

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
test byte [edi + 0x1104], 1
je 0x10a24c0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10a24c0
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
test byte [edi + 0x1104], 2
mov esi, dword [ebp + 8]
je 0x10a2518
mov edi, dword [esi]
push ebx
push 0x2000
call fcn.0101c4b0
lea ebx, [eax*4 + 8]
lea eax, [ebx + edi]
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
push 0
push 1
push 0x2000
push edi
call fcn.01087c30
mov ecx, dword [esi]
mov edx, dword [ecx + 0x56c]
push 7
push 0
push 0
call edx
mov eax, dword [esi]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
mov edi, dword [ebp + 0xc]
pop ebx
test byte [edi + 0x1104], 4
je 0x10a2528
push edi
push esi
call fcn.010a23a0
pop edi
pop esi
pop ebp
ret 8
Function at 0x10a2a90
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
add edi, 0x237a4
mov dword [ebp + 8], edi
lea esp, [esp]
push 0x82
lea eax, [ebp - 0x84]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x82
lea ecx, [ebp - 0x108]
push 0
push ecx
call sub.msvcrt.dll_memset
push ebx
push 0x100e45c
push 0x1012e18
lea edx, [ebp - 0x84]
push 0x3f
push edx
call fcn.0101e760
push ebx
push 0x100e45c
push 0x1012df8
lea eax, [ebp - 0x108]
push 0x3f
push eax
call fcn.0101e760
add esp, 0x40
lea ecx, [ebp - 0x84]
push ecx
push 0x1009bc4
push edi
call fcn.01061570
mov esi, eax
test esi, esi
je 0x10a2b66
lea edx, [ebp - 0x108]
push edx
push 0x1009bc4
push edi
call fcn.01061570
mov edi, eax
test edi, edi
je 0x10a2b53
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov edi, dword [ebp + 8]
inc ebx
cmp ebx, 5
jl 0x10a2ab0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4