joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c471
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf9c]
mov eax, 0x101c
call fcn.10044f70
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0xf98], eax
mov eax, dword [ebp + 0xfa4]
push ebx
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xfa8]
push edi
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0xfac]
mov edi, 0x7ff
xor ebx, ebx
push edi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x799]
push ebx
push eax
mov byte [ebp + 0x798], bl
call fcn.10044b80
push edi
lea eax, [ebp - 0x67]
lea esi, [edi + 1]
push ebx
push eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x68], bl
call fcn.10044b80
add esp, 0x18
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1002c503
cmp dword [ebp - 0x6c], ebx
je 0x1002c58d
mov dword [ebp - 0x70], ebx
xor edi, edi
jmp 0x1002c574
cmp edi, ebx
jne 0x1002c57f
push esi
lea eax, [ebp + 0x798]
push ebx
push eax
call fcn.10044b80
push esi
lea eax, [ebp - 0x68]
push ebx
push eax
call fcn.10044b80
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x798]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
cmp edi, ebx
jne 0x1002c571
cmp dword [ebp - 0x74], esi
jae 0x1002c571
push dword [ebp - 0x80]
lea eax, [ebp + 0x798]
push eax
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1002c57b
inc dword [ebp - 0x70]
cmp dword [ebp - 0x6c], ebx
jne 0x1002c50a
jmp 0x1002c58d
mov al, 1
jmp 0x1002c58f
cmp dword [ebp - 0x6c], ebx
je 0x1002c58d
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp + 0xf98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0xf9c
leave
ret
Function at 0x1002c5a7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x394], eax
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3a0]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x3a8]
xor ebx, ebx
mov esi, 0x1ff
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x195]
push ebx
push eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], ebx
mov byte [ebp + 0x194], bl
call fcn.10044b80
push esi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.10044b80
add esp, 0x18
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push dword [ebp - 0x78]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002c6a4
cmp dword [ebp - 0x70], ebx
je 0x1002c6a4
cmp dword [ebp - 0x70], 0xffffffff
je 0x1002c6a4
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x194]
push eax
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 0x200
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp - 0x74]
mov esi, eax
cmp byte [ebp + 0x194], bl
je 0x1002c69b
lea eax, [ebp + 0x194]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
push str._s_s
push eax
call fcn.10044ec8
push dword [ebp - 0x80]
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.1002c471
add esp, 0x1c
test al, al
jne 0x1002c6be
mov byte [ebp + 0x194], bl
cmp esi, 0x103
jne 0x1002c632
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp + 0x394]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x398
leave
ret
mov al, 1
jmp 0x1002c6a6
Function at 0x1002c787
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0x800
push 0x10152968
call fcn.10007867
pop ecx
pop ecx
push 6
pop ecx
xor ebx, ebx
push ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
push 4
rep stosd dword es:[edi], eax
call dword [0x10077d28]
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], 0x1c
call sub.KERNEL32.dll_Thread32First
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x1002c83b
cmp dword [ebp - 4], 0x2710
jg 0x1002c83b
mov eax, dword [ebp - 0xc]
inc dword [ebp - 4]
cmp dword [ebp - 0x20], eax
jne 0x1002c82b
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
je 0x1002c82b
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp eax, ebx
je 0x1002c82b
mov dword [edi*4 + 0x10152968], eax
inc edi
cmp edi, 0xc8
jge 0x1002c83b
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1002c7ea
cmp dword [0x1015568c], 8
jne 0x1002c856
push edi
push dword [ebp - 4]
push str.FreezeTh_tot:_d__d
push ebx
call fcn.1004122a
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002d0af
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x390], eax
push ebx
push esi
push edi
mov esi, str..X:
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f9
xor ebx, ebx
lea eax, [ebp - 0x69]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.10044b80
mov al, byte [ebp + 0x39c]
push 0x1ff
mov byte [ebp - 0x6c], al
lea eax, [ebp + 0x191]
push ebx
push eax
mov byte [ebp + 0x190], bl
call fcn.10044b80
add esp, 0x18
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d173
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x200
lea eax, [ebp + 0x190]
push eax
push 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x2d1400
push esi
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x1002d173
cmp dword [ebp - 0x80], ebx
jle 0x1002d173
cmp byte [ebp + 0x1a8], 7
jne 0x1002d173
mov al, 1
jmp 0x1002d175
xor al, al
mov ecx, dword [ebp + 0x390]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x394
leave
ret

Function at 0x1002d18d
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x390], eax
push ebx
push esi
push edi
mov esi, str..X:
lea edi, [ebp + 0x190]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f9
xor ebx, ebx
lea eax, [ebp + 0x197]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.10044b80
push 0x1ff
lea eax, [ebp - 0x6f]
push ebx
push eax
mov byte [ebp - 0x70], bl
call fcn.10044b80
mov eax, dword [ebp + 0x39c]
lea edx, [ebp + 0x190]
add esp, 0x18
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x1002d1f1
lea eax, [ebp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002d204
push ebx
push ebx
push 3
push ebx
sub eax, edx
push 3
mov byte [ebp + eax + 0x18f], bl
push bind
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002d27a
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x200
lea eax, [ebp - 0x70]
push eax
push 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x2d1400
push esi
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x1002d27a
cmp dword [ebp - 0x80], ebx
jle 0x1002d27a
cmp byte [ebp - 0x58], 7
jne 0x1002d27a
mov al, 1
jmp 0x1002d27c
xor al, al
mov ecx, dword [ebp + 0x390]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x394
leave
ret
Function at 0x1002d294
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x8c8]
sub esp, 0x948
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x8c4], eax
mov eax, dword [ebp + 0x8d4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x8d8]
mov esi, 0x1ff
xor ebx, ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x4c5]
push ebx
push eax
mov byte [ebp + 0x4c4], bl
call fcn.10044b80
lea eax, [ebp + 0x4c4]
push edi
push eax
call fcn.1000789a
push esi
lea eax, [ebp + 0x2c5]
push ebx
push eax
mov byte [ebp + 0x2c4], bl
call fcn.10044b80
push esi
lea eax, [ebp + 0x6c5]
push ebx
push eax
mov byte [ebp + 0x6c4], bl
call fcn.10044b80
push esi
lea eax, [ebp + 0xc5]
push ebx
push eax
mov byte [ebp + 0xc4], bl
call fcn.10044b80
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0x6c4]
push eax
call fcn.1000789a
lea edi, [ebp + 0x6c4]
add esp, 0x40
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1002d342
mov eax, dword [0x1018805c]
mov esi, str..
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp eax, ebx
je 0x1002d369
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp + 0x6c4]
push ecx
call eax
jmp 0x1002d37a
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x6c4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002d388
xor eax, eax
jmp 0x1002d430
mov esi, str._s_s
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0x2c4]
push esi
push eax
call fcn.10044ec8
add esp, 0x10
test byte [ebp - 0x7c], 0x10
je 0x1002d3e3
cmp byte [ebp - 0x50], 0x2e
je 0x1002d413
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0xc4]
push esi
push eax
call fcn.10044ec8
lea eax, [ebp + 0xc4]
push eax
push dword [ebp - 0x80]
push dword [ebp + 0x8d0]
call fcn.1002d294
jmp 0x1002d410
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x80]
lea eax, [ebp + 0x6c4]
push esi
push eax
call fcn.10044ec8
lea eax, [ebp + 0x2c4]
push eax
lea eax, [ebp + 0x6c4]
push eax
push dword [ebp + 0x8d0]
call fcn.1001f30e
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002d38d
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x8c4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x8c8
leave
ret
Function at 0x1002d70d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x63
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call fcn.10044b80
lea eax, [ebp - 0x68]
push 0x10066e00
push eax
call fcn.1000789a
add esp, 0x14
xor esi, esi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esi + 0x102e0000], al
cmp eax, 3
jne 0x1002d776
test byte [0x10156880], 0x10
jne 0x1002d7ae
push dword [ebp - 0x68]
call fcn.1002d0af
pop ecx
test al, al
je 0x1002d7ae
mov byte [esi + 0x102e0000], 2
jmp 0x1002d7ae
mov cl, byte [0x10156880]
cmp eax, 2
jne 0x1002d786
test cl, 0x10
jne 0x1002d7a7
cmp eax, 5
jne 0x1002d78f
test cl, cl
js 0x1002d7a7
cmp eax, 4
jne 0x1002d799
test cl, 0x40
jne 0x1002d7a7
cmp dword [0x10153a10], 0
je 0x1002d7ae
cmp eax, 1
jne 0x1002d7ae
mov byte [esi + 0x102e0000], 3
inc byte [ebp - 0x68]
inc esi
cmp esi, 0x1a
jl 0x1002d742
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10044b6f
leave
ret
Function at 0x1002d996
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp - 4], eax
test dword [0x10150864], 0x4000000
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp - 0x408], eax
jne 0x1002d9ca
xor eax, eax
jmp 0x1002db69
push esi
push ebx
call fcn.1002d945
pop ecx
test al, al
jne 0x1002da27
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002d9db
sub eax, edx
cmp eax, 1
jbe 0x1002db66
push str.._
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x1002db66
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002da06
sub eax, edx
push 0x3a
push ebx
mov esi, eax
call fcn.10044a60
pop ecx
pop ecx
lea ecx, [esi + ebx - 1]
cmp eax, ecx
jne 0x1002db66
cmp dword [0x102b4a3c], 5
mov esi, 0x10154428
jne 0x1002da7a
mov ecx, 0x10155e68
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002da3f
sub eax, edi
push eax
push esi
push ecx
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x1002da7a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x1002da7a
cmp byte [eax], 0
je 0x1002da7a
push str._k_localsystemnetworkrestricted
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1002db66
push 0x1006abc0
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1002db66
mov esi, str.melon_player
xor edi, edi
cmp byte [esi], 0
je 0x1002dacf
cmp esi, 0x1006abbf
jae 0x1002dacf
push esi
push 0x10153168
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1002dacc
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002dab9
sub eax, edx
lea esi, [esi + eax + 1]
cmp esi, edi
jne 0x1002da96
jmp 0x1002dad8
or esi, 0xffffffff
cmp esi, 0xffffffff
je 0x1002db66
push 0x3ff
lea eax, [ebp - 0x403]
push edi
push eax
mov byte [ebp - 0x404], 0
call fcn.10044b80
push ebx
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push str.Behavior_Blocking____MBR__s__s_
push eax
call fcn.10044ec8
lea eax, [ebp - 0x404]
push 0x7c
push eax
call fcn.10044a60
add esp, 0x24
cmp eax, edi
je 0x1002db21
mov byte [eax], 0x60
lea eax, [ebp - 0x404]
push 0x7c
push eax
call fcn.10044a60
pop ecx
pop ecx
cmp eax, edi
je 0x1002db38
mov byte [eax], 0x60
push edi
push edi
push edi
lea eax, [ebp - 0x404]
push eax
push 1
push bind
push 0x100
mov ecx, 0x101acab8
call fcn.10039084
test eax, eax
je 0x1002db61
call fcn.1002c8b0
push 4
pop eax
jmp 0x1002db68
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10044b6f
leave
ret
Function at 0x1002f133
Capabilities:
Accept command line arguments

Disassembly:
push dword [esp + 4]
call fcn.10042501
pop ecx
test al, al
je 0x1002f144
mov al, 1
ret
cmp dword [0x102b4a3c], 5
push ebx
push esi
jne 0x1002f1f9
mov ecx, 0x10155e68
mov eax, ecx
lea esi, [eax + 1]
xor ebx, ebx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1002f15f
sub eax, esi
push eax
push 0x10154428
push ecx
call fcn.100077eb
add esp, 0xc
test eax, eax
jne 0x1002f1f9
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
push esi
call fcn.10044e58
pop ecx
cmp esi, ebx
je 0x1002f1f9
cmp byte [esi], bl
je 0x1002f1f9
push str._k_networkservice
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1002f1cd
push str._k_networkservicenetworkrestricted
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x1002f1cd
cmp dword [0x1015568c], ebx
je 0x1002f1c9
push str.InitHook_white_SVCHOST__k_NetworkService
push ebx
call fcn.1004122a
pop ecx
pop ecx
mov al, 1
jmp 0x1002f1fb
cmp byte [esi], bl
je 0x1002f1f9
push str._k_netsvcs
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1002f1f9
push str._s_profsvc
push esi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
je 0x1002f1f9
mov byte [0x10077497], bl
xor al, al
pop esi
pop ebx
ret

Function at 0x10030647
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x410
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push bind
push eax
mov byte [ebp - 0x72], bl
mov byte [ebp - 0x71], bl
mov dword [ebp - 0x78], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push eax
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
cmp dword [ebp - 0x78], ebx
jbe 0x10030703
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.10044b80
add esp, 0xc
push ebx
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10030702
xor edi, edi
cmp dword [ebp - 0x78], ebx
jbe 0x10030702
cmp edi, 0x400
jge 0x100306fd
mov al, byte [ebp + edi - 0x70]
add byte [ebp - 0x72], al
sub byte [ebp - 0x71], al
inc edi
cmp edi, dword [ebp - 0x78]
jb 0x100306e5
cmp dword [ebp - 0x78], ebx
ja 0x100306b1
pop edi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 0x72]
movzx ecx, byte [ebp - 0x71]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 0x390]
or eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
add ebp, 0x394
leave
ret
Function at 0x100330c8
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
cmp dword [0x10150ca4], esi
jne 0x100330e4
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x10150ca4], eax
mov eax, dword [0x10150ca8]
cmp eax, esi
jne 0x1003310b
lea eax, [esp + 4]
push eax
push esi
push dword [0x10150ca4]
push 0x10032ec8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10150ca8], eax
cmp dword [0x1015568c], esi
je 0x10033128
push eax
push dword [0x10150ca4]
push str.InitializeWindowEventHook4URL__d___d_
push esi
call fcn.1004122a
add esp, 0x10
pop esi
pop ecx
ret

Function at 0x10033316
Capabilities:
Accept command line arguments

Disassembly:
cmp dword [0x101570b8], 4
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push edi
mov edi, dword [esp + 0x10]
mov ebx, str..tmp
jne 0x10033344
cmp byte [esp + 0x14], 0
je 0x10033344
push ebx
push edi
call esi
test eax, eax
jne 0x10033495
test edi, edi
jne 0x1003334f
xor eax, eax
jmp 0x10033498
mov al, byte [edi]
test al, al
je 0x10033348
cmp al, 0x7e
je 0x10033348
push ebx
push edi
call esi
test eax, eax
jne 0x10033348
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10033366
sub eax, edx
cmp eax, 4
jbe 0x10033348
push 0x1006af7c
push edi
call fcn.10044fa0
pop ecx
pop ecx
test eax, eax
jne 0x10033348
push str.RECYCLE
push edi
call esi
test eax, eax
jne 0x10033348
push str._releasenotes.pdf
push edi
call esi
test eax, eax
jne 0x10033348
push str._temp
push edi
call esi
test eax, eax
jne 0x10033348
push str.pagefile.sys
push edi
call esi
test eax, eax
jne 0x10033348
test dword [0x10150864], 0x4000000
je 0x1003340f
push edi
call fcn.1002d945
pop ecx
test al, al
je 0x1003340f
cmp dword [0x102b4a3c], 5
jne 0x100333f4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x100333f4
cmp byte [eax], 0
je 0x100333f4
push str._k_localsystemnetworkrestricted
push eax
call esi
test eax, eax
jne 0x10033348
push str.Samsung
push 0x10154228
call esi
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
jmp 0x10033498
mov eax, dword [0x1011d3c0]
test eax, eax
je 0x1003342d
cmp eax, 0xffffffff
je 0x1003342d
push edi
call fcn.100153e5
pop ecx
test al, al
je 0x1003342d
push 2
pop eax
jmp 0x10033498
push str..doc
push edi
call esi
test eax, eax
jne 0x10033495
push str..hwp
push edi
call esi
test eax, eax
jne 0x10033495
push str..pdf
push edi
call esi
test eax, eax
jne 0x10033495
push str..ppt
push edi
call esi
test eax, eax
jne 0x10033495
push str..xls
push edi
call esi
test eax, eax
jne 0x10033495
test dword [0x10150864], 0x4000
je 0x10033348
cmp byte [0x10155760], al
je 0x10033348
push 0x10155760
push edi
call esi
test eax, eax
je 0x10033348
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x100349a7
Capabilities:
Find taskbar

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
xor ebp, ebp
push ebp
push str.Shell_TrayWnd
call edi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, ebp
je 0x10034a5b
push ebp
push str.TrayNotifyWnd
push ebp
push eax
call esi
mov dword [esp + 0x14], eax
cmp eax, ebp
je 0x10034a5b
xor ebx, ebx
mov dword [esp + 0x10], ebp
push ebp
push str.SysPager
push ebx
push dword [esp + 0x20]
call esi
mov ebx, eax
cmp ebx, ebp
je 0x10034a53
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10034a48
push ebp
push str.ToolbarWindow32
push ebp
push ebx
call esi
mov edi, eax
cmp edi, ebp
je 0x10034a48
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10034a48
cmp dword [0x1015568c], 4
jne 0x10034a38
push dword [esp + 0x10]
push edi
push str.hToolbar:_08x__d_
push ebp
call fcn.1004122a
add esp, 0x10
push edi
push dword [esp + 0x20]
call fcn.10036b88
pop ecx
pop ecx
test al, al
jne 0x10034a57
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
jl 0x100349e3
xor al, al
jmp 0x10034aa6
mov al, 1
jmp 0x10034aa6
push ebp
push str.NotifyIconOverflowWindow
call edi
cmp eax, ebp
je 0x10034a53
push ebp
push str.ToolbarWindow32
push ebp
push eax
call esi
mov esi, eax
cmp esi, ebp
je 0x10034a53
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10034a53
cmp dword [0x1015568c], 4
jne 0x10034a9a
push esi
push str.hToolbar2:_08x
push ebp
call fcn.1004122a
add esp, 0xc
push esi
push dword [esp + 0x20]
call fcn.10036b88
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret