joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ec150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ef409
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10283a3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x34], esi
mov ecx, esi
mov dword [ebp - 0x30], 0
mov word [ebp - 0x14], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x2c]
push 0xc
push eax
mov dword [ebp - 0x2c], 0x65006e
mov dword [ebp - 0x28], 0x5f0074
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740069
mov dword [ebp - 0x1c], 0x73005f
mov dword [ebp - 0x18], 0x630075
call fcn.10027e50
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017034a
mov esp, ebp
pop ebp
ret 4

Function at 0x100ef710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ef2c9
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10283a3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x50], esi
mov ecx, esi
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x14], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x48]
push 0x1a
push eax
mov dword [ebp - 0x48], 0x650072
mov dword [ebp - 0x44], 0x650063
mov dword [ebp - 0x40], 0x760069
mov dword [ebp - 0x3c], 0x640065
mov dword [ebp - 0x38], 0x710020
mov dword [ebp - 0x34], 0x690075
mov dword [ebp - 0x30], 0x2c0074
mov dword [ebp - 0x2c], 0x650020
mov dword [ebp - 0x28], 0x690078
mov dword [ebp - 0x24], 0x200074
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x650064
mov dword [ebp - 0x18], 0x20003a
call fcn.10027e50
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017034a
mov esp, ebp
pop ebp
ret 4
Function at 0x100ef800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f3259
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10283a3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x3c], esi
mov ecx, esi
mov dword [ebp - 0x38], 0
push 0x11
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x650072
mov dword [ebp - 0x30], 0x5f0063
mov dword [ebp - 0x2c], 0x6f006e
mov dword [ebp - 0x28], 0x5f0074
mov dword [ebp - 0x24], 0x650073
mov dword [ebp - 0x20], 0x66006c
mov dword [ebp - 0x1c], 0x71005f
mov dword [ebp - 0x18], 0x690075
mov dword [ebp - 0x14], 0x74
call fcn.10027e50
mov dword [ebp - 4], 0
mov dword [ebp - 0x38], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017034a
mov esp, ebp
pop ebp
ret 4
Function at 0x100f8430
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102108da
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10283a3c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.1002dc00
mov ecx, eax
test ecx, ecx
je 0x100f85f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.1002dc00
mov ecx, eax
test ecx, ecx
je 0x100f85fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.1002dc00
mov ecx, eax
test ecx, ecx
je 0x100f8608
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x100f8512
xor ecx, ecx
jmp 0x100f8530
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100f8520
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.1002b150
push edi
mov ecx, ebx
call fcn.100291c0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x100f854c
xor ecx, ecx
jmp 0x100f8564
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100f8554
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.1002b150
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.100f8d70
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.100291c0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100f85a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x100f85de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100f85de
cmp dword [esi + 0x10], 0
je 0x100f85d5
push dword [edi]
call fcn.101d359c
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.100253e0
push 0x80004005
call fcn.100253e0
push 0x80004005
call fcn.100253e0
int3
Function at 0x100f8b70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102109c8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10283a3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x100f8d44
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100f8bc5
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x100f8d44
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100f8be3
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x100f8d44
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100f8c01
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x100f8d44
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100f8c1f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x100f8d44
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100f8d44
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x100f8c44
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x100f8c77
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x100f8c8f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x100f8ccd
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10022de0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.101bd770
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x102296cc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100f9540
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100f8cfb
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x100f8d34
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100f8d34
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.1001fc30
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10020960
lea ecx, [ebp - 0x28]
call fcn.10020960
lea ecx, [ebp - 0x34]
call fcn.10039700
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017034a
mov esp, ebp
pop ebp
ret 4
Function at 0x100f90e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10210a87
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10283a3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x100f912a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100f9136
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10027e50
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x100f91a3
push 0x48
call fcn.1017030c
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x100f9197
push 0x48
push 0
push ebx
call fcn.101be270
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.100f8430
jmp 0x100f9199
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100f91d0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10027e50
push 3
push 0x102296cc
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.1002c370
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100f921f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x100f926e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100f926e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10027e50
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10020960
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100f92a4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100f929a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100f92e1
push edx
push ecx
call fcn.1017033c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x100f92c3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017034a
mov esp, ebp
pop ebp
ret 0x14
call fcn.101c1b70
int3
Function at 0x100fc2d0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x100fc2f5
or esi, 1
push 1
call edi
test ax, ax
jns 0x100fc301
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x100fc30d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x100fc319
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x1010ce00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1010ce45
cmp byte [ebp + 8], 0
je 0x1010ce39
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x10125200
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
movzx eax, word [edi + 0xc]
sub eax, 0x41
je 0x10125262
sub eax, 2
je 0x10125243
sub eax, 0x15
jne 0x101252b2
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x101252b2
push 0
push edi
push dword [ebp + 0xc]
push str.cutkey
jmp 0x101252a7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x101252b2
push 0
push edi
push dword [ebp + 0xc]
push str.copykey
jmp 0x101252a7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x101252b2
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], 2
push eax
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push 0x102b
mov dword [ebp - 0x30], 2
push dword [eax + 0x558]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push dword [ebp + 0xc]
push str.selectallkey
push dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
call fcn.100ff830
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10125da0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
mov ebx, ecx
call fcn.10122510
push dword [ebx + 0x558]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10125dee
mov ecx, dword [ebx + 0x55c]
mov eax, 5
push edi
xor edi, edi
cmp byte [ebp + 8], 0
cmovne edi, eax
push edi
call fcn.1010b840
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [ebx + 0x558]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop ebp
ret 4

Function at 0x10129360
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x594], 0
je 0x101293cd
cmp dword [ebp + 8], 0x100
jne 0x101293bd
cmp word [ebp + 0xc], 0xd
jne 0x101293bd
cmp byte [esi + 0x59a], 0
je 0x1012939e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x101293bd
cmp byte [esi + 0x59b], 0
jne 0x101293bd
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x101293b6
push 0
push 0
push 0
push str.return
push esi
call fcn.100ff830
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x594]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x1012a310
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x1028e558
push 0x34
call fcn.101707de
mov esi, eax
add esp, 8
mov dword [ebp - 4], esi
test esi, esi
je 0x1012a389
mov dword [esi], 2
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
jmp 0x1012a38b
xor esi, esi
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x1012a398
mov edi, dword [edi]
xor ebx, ebx
test edi, edi
je 0x1012a40f
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1012a40f
push ebx
push 0x80
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x1012a40f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x1012a40f
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x1012a40f
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x1012a40f
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.10129c90
mov ebx, eax
test ebx, ebx
jne 0x1012a43d
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1012a424
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1012a443
push eax
call edi
mov dword [esi + 8], 0
jmp 0x1012a443
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1012a455
push eax
call edi
mov dword [esi + 4], 0xffffffff
pop edi
test ebx, ebx
pop ebx
jne 0x1012a474
mov ecx, esi
call fcn.10129950
push 0x34
push esi
call fcn.1017033c
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1012a570
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x1028e558
cmp al, 6
jb 0x1012a5ad
push 0x18
call fcn.101707de
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x1012a5e9
mov ecx, eax
call fcn.1012a600
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x14
call fcn.101707de
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x1012a5e9
mov dword [eax], vtable.CGDIPlusImageImpl.0
mov dword [eax + 4], 6
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1012c770
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102128a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10283a3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x1012c91e
cmp ebx, 7
jb 0x1012c91e
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x1012c878
test esi, esi
je 0x1012c7dc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x28]
push eax
call fcn.10169090
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1012c82b
lea ecx, [ebp - 0x28]
xor esi, esi
call fcn.10020960
mov eax, esi
jmp 0x1012c920
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push ebx
push dword [ebp - 0x2c]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [edi]
lea ecx, [ebp - 0x28]
push ecx
mov ecx, edi
call dword [eax + 4]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov esi, eax
cmovae ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x28]
call fcn.10020960
mov eax, esi
jmp 0x1012c920
push ebx
push dword [ebp - 0x2c]
push eax
call fcn.101bd770
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1012c8a0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0x10], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebx, dword [ebp - 0x30]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x1012c8e6
lea eax, [ebp - 0x2c]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push ebx
mov dword [ebp - 0x2c], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 4], eax
jmp 0x1012c8e8
xor esi, esi
mov dword [edi + 0x10], esi
test esi, esi
je 0x1012c90b
mov ecx, esi
call fcn.1012c2a0
mov ecx, dword [edi + 0x10]
mov dword [edi + 8], eax
call fcn.1012c260
mov dword [edi + 0xc], eax
mov esi, 1
jmp 0x1012c90d
xor esi, esi
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x1012c91a
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
jmp 0x1012c920
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017034a
mov esp, ebp
pop ebp
ret 8

Function at 0x1012d3a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x10], 0
jne 0x1012d3af
xor eax, eax
pop ebp
ret 4
pop ebp
jmp fcn.1012bf40