joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.100337f0
movzx eax, al
test eax, eax
je 0x10033bec
mov al, 1
jmp 0x10033d17
mov byte [ebp - 9], 0
push str._record_AutoMicroPhoneRecord_start
push 1
push 0x27
push 0x10163ce8
push 0x10163d2c
call fcn.101426f0
add esp, 0x14
call fcn.10026730
mov ecx, eax
call fcn.10026800
movzx ecx, al
test ecx, ecx
jne 0x10033c3e
push 0x10163cd4
push 3
push 0x2e
push str..._srcMoniterHelperEventExecuteHandleAutoMicroPhoneRecord.cpp
push str.CHandleAutoMicroPhoneRecordEvent::HandleData
call fcn.101426f0
add esp, 0x14
jmp 0x10033d14
push 2
call fcn.10033810
mov ecx, eax
call fcn.1011ec50
mov byte [ebp - 0x11], al
movzx edx, byte [ebp - 0x11]
test edx, edx
jne 0x10033c7b
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.10003ae0
movzx eax, al
test eax, eax
jne 0x10033c7b
mov ecx, dword [ebp - 0x10]
add ecx, 0x6c
call fcn.10003ae0
movzx ecx, al
test ecx, ecx
je 0x10033cbf
push 2
push 0
call fcn.10033810
mov ecx, eax
call fcn.1011ec90
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.1004eb90
movzx edx, al
test edx, edx
jne 0x10033cbf
push 0x1015d65a
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.10009f70
push 0x1015d65b
mov ecx, dword [ebp - 0x10]
add ecx, 0x6c
call fcn.10009f70
jmp 0x10033d14
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.1004f750
movzx eax, al
test eax, eax
je 0x10033d08
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0xb0]
test edx, edx
jne 0x10033d08
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x10033ae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xac], eax
mov byte [ebp - 9], 1
xor eax, eax
jne 0x10033c0b
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret

Function at 0x10033ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
push str._record_Start_ScreenRecord
push 1
push 0x41
push 0x10164088
push str.CHandleAutoScreenRecordEvent::StartScreenRecord
call fcn.101426f0
add esp, 0x14
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x10033f60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xac], eax
push 0xffffffffffffffff
push 1
mov eax, dword [ebp - 0xc]
add eax, 0xac
push eax
push 1
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret
Function at 0x10049250
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101528bb
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10167c6c
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2bc]
push ecx
call fcn.1000aef0
add esp, 0xc
mov dword [ebp - 0x298], eax
lea edx, [ebp - 0x290]
push edx
mov ecx, dword [ebp - 0x298]
call fcn.10001960
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x294], eax
lea ecx, [ebp - 0x2bc]
call fcn.10002d10
cmp dword [ebp - 0x294], 0xffffffff
jne 0x100492d1
jmp 0x1004940e
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002c60
mov dword [ebp - 4], 0
push 0x10167c74
lea ecx, [ebp - 0x28]
push ecx
call fcn.1004abd0
add esp, 8
movzx edx, al
test edx, edx
je 0x100493d6
push 0x10167c78
lea eax, [ebp - 0x28]
push eax
call fcn.1004abd0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100493d6
push 0x10167c80
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2ec]
push eax
call fcn.1000aef0
add esp, 0xc
mov dword [ebp - 0x29c], eax
mov ecx, dword [ebp - 0x29c]
mov dword [ebp - 0x2a0], ecx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.10048280
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2ec]
call fcn.10002d10
mov edx, dword [ebp - 0x290]
and edx, 0x10
je 0x100493ca
push 0
push 0x10167c84
lea ecx, [ebp - 0x40]
call fcn.1000a030
cmp eax, 0xffffffff
je 0x100493ca
push str.LocalState
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.1000aef0
add esp, 0xc
mov dword [ebp - 0x2a4], eax
mov edx, dword [ebp - 0x2a4]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.10002230
lea ecx, [ebp - 0x2d4]
call fcn.10002d10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10002d10
lea eax, [ebp - 0x290]
push eax
mov ecx, dword [ebp - 0x294]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100492d1
mov edx, dword [ebp - 0x294]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret
Function at 0x1004c090
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x274], 0
push 0x40
push 0
lea eax, [ebp - 0x270]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x274], 0x44
mov dword [ebp - 0x284], 0
xor ecx, ecx
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x278], ecx
push 0x10168904
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x28c], eax
call fcn.10033810
mov ecx, eax
call fcn.1011e160
mov edx, dword [ebp - 0x28c]
push edx
lea eax, [ebp - 0x230]
push eax
call fcn.100f9f50
add esp, 8
mov dword [ebp - 4], 0
push str.Uninstall.exe__force
lea ecx, [ebp - 0x230]
call fcn.1000b470
xor ecx, ecx
mov word [ebp - 0x218], cx
push 0x206
push 0
lea edx, [ebp - 0x216]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.10002460
shl eax, 1
push eax
lea ecx, [ebp - 0x230]
call fcn.10001960
push eax
lea eax, [ebp - 0x218]
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x284]
push ecx
lea edx, [ebp - 0x274]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1004c1e9
mov byte [ebp - 0x285], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10002d10
mov al, byte [ebp - 0x285]
jmp 0x1004c222
mov ecx, dword [ebp - 0x284]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x280]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x286], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10002d10
mov al, byte [ebp - 0x286]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret
Function at 0x10050a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10153393
mov eax, dword fs:[0]
push eax
sub esp, 0x838
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x844], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10001960
push eax
push str.SYSTEMCurrentControlSet_serviceseventlog
push 0x1016a5a8
lea eax, [ebp - 0x830]
push eax
call fcn.1007b7d0
add esp, 0x10
mov byte [ebp - 4], 1
mov dword [ebp - 0x834], 0
lea ecx, [ebp - 0x834]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x830]
call fcn.10001960
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x83c], eax
cmp dword [ebp - 0x83c], 0
je 0x10050b65
mov edx, dword [ebp - 0x83c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegOpenKeyEx_fail_lasterror:0x_x_ret__0x_x
push 1
push 0x28
push 0x1016a5e0
push 0x1016a618
call fcn.101426f0
add esp, 0x1c
mov byte [ebp - 0x837], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x830]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002d10
mov al, byte [ebp - 0x837]
jmp 0x10050c55
mov byte [ebp - 0x835], 0
xor eax, eax
mov word [ebp - 0x810], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x80e]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0x818], 1
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x818]
push ecx
push 0
push str.EventMessageFile
mov edx, dword [ebp - 0x834]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 0
jne 0x10050bef
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp + 0x20]
call fcn.10006e00
mov byte [ebp - 0x835], 1
jmp 0x10050c18
mov ecx, dword [ebp - 0x83c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegQueryValueEx_fail_lasterror:0x_x_ret__0x_x
push 1
push 0x37
push 0x1016a69c
push str.CEventProviderManager::QueryEventMessageFile
call fcn.101426f0
add esp, 0x1c
mov edx, dword [ebp - 0x834]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x835]
mov byte [ebp - 0x836], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x830]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002d10
mov al, byte [ebp - 0x836]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100523e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov byte [0x101aad9e], 1
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x10052410
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x10052428
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 0x18], 0x101ab52c
push 4
lea ecx, [ebp - 8]
call fcn.10001980
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.100126d0
push 4
lea ecx, [ebp - 0xc]
call fcn.10001980
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.10004530
jmp 0x10052465
lea ecx, [ebp - 8]
call fcn.10012970
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
call fcn.10003dd0
movzx eax, al
test eax, eax
je 0x100524b0
lea ecx, [ebp - 8]
call fcn.10012d90
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100524a7
push 1
mov ecx, dword [ebp - 0x14]
call fcn.10018040
mov dword [ebp - 0x24], eax
jmp 0x100524ae
mov dword [ebp - 0x24], 0
jmp 0x1005245d
mov ecx, 0x101ab52c
call fcn.10054650
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret

Function at 0x100524f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov byte [0x101aad9e], 0
push 0x101aadc4
push 0
push 0
push 0x10052930
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x101aadc0
push 0
push 0
push 0x100542f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop ebp
ret
Function at 0x10058450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.10001960
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10058472
xor al, al
jmp 0x10058482
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x10058480
mov al, 1
jmp 0x10058482
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1005b120
Capabilities:
Create thread
Initialize winsock library
Monitor local ipv4 address changes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], ecx
push str.Start_Location_Monitor.
push 1
push 0xcb
push 0x1016e558
push 0x1016e58c
call fcn.101426f0
add esp, 0x14
mov dword [ebp - 0x19c], 0
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1005b19c
push str.WSAStartup_failed.
push 1
push 0xd2
push 0x1016e5c0
push 0x1016e5f4
call fcn.101426f0
add esp, 0x14
xor al, al
jmp 0x1005b2c6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x198]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0x198]
cmp dword [edx + 0x14], 0
jne 0x1005b1f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEvent_failed:_d
push 1
push 0xda
push 0x1016e62c
push 0x1016e660
call fcn.101426f0
add esp, 0x18
mov ecx, dword [ebp - 0x198]
call fcn.1005a9b0
xor al, al
jmp 0x1005b2c6
mov eax, dword [ebp - 0x198]
add eax, 4
push eax
push 0
call dword [sym.imp.IPHLPAPI.DLL_NotifyAddrChange]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x3e5
je 0x1005b24e
mov ecx, dword [ebp - 0x1a0]
push ecx
push str.NotifyAddrChange_failed:__d
push 1
push 0xe3
push 0x1016e69c
push 0x1016e6d0
call fcn.101426f0
add esp, 0x18
mov ecx, dword [ebp - 0x198]
call fcn.1005a9b0
xor al, al
jmp 0x1005b2c6
push 0
push 0
mov edx, dword [ebp - 0x198]
push edx
push 0x1005afe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x1005b2ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateThread_failed:_d
push 1
push 0xec
push str..._srcMoniterHelperlocationLocationMonitor.cpp
push str.CLocationMonitor::StartMonitor
call fcn.101426f0
add esp, 0x18
mov ecx, dword [ebp - 0x198]
call fcn.1005a9b0
xor al, al
jmp 0x1005b2c6
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x19c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x198]
call fcn.1005b2e0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret
Function at 0x1006e390
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0
push 0x2c
push 0
lea eax, [ebp - 0x30]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0x1006e370
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xc], 0x1016fa40
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
test eax, eax
jne 0x1006e422
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1016fa70
push 3
push 0x36
push 0x1016fab0
push 0x1016fa5c
call fcn.10142a80
add esp, 0x18
xor al, al
jmp 0x1006e488
push 0
mov ecx, dword [ebp - 0x3c]
push ecx
push 0
push 0
push 0x64
push 0x64
push 0x64
push 0x64
push 0xcf0000
push 0x1016fafc
push 0x1016fb18
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1006e47a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1016fb34
push 3
push 0x3c
push 0x1016fb88
push str.CreateWnd
call fcn.10142a80
add esp, 0x18
xor al, al
jmp 0x1006e488
push 0
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret
Function at 0x100731f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101550e6
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x230]
call fcn.10002fa0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x100732f0
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x270]
call fcn.10002c60
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x240], edx
mov byte [ebp - 4], 1
push str.InjectUwp.exe
mov eax, dword [ebp - 0x240]
push eax
lea ecx, [ebp - 0x258]
push ecx
call fcn.1000afb0
add esp, 0xc
mov dword [ebp - 0x238], eax
mov edx, dword [ebp - 0x238]
push edx
lea ecx, [ebp - 0x230]
call fcn.10002230
lea ecx, [ebp - 0x258]
call fcn.10002d10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x270]
call fcn.10002d10
lea ecx, [ebp - 0x230]
call fcn.10001960
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10073316
push str.C:Program_Files__x86_Windows_Assistant_AppMVInjectUwp.exe
lea ecx, [ebp - 0x230]
call fcn.10006e00
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10049430
add esp, 8
mov edx, dword [ebp - 0x234]
or edx, 1
mov dword [ebp - 0x234], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10002d10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret
Function at 0x10073a50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x100737c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret

Function at 0x10073f90
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp + 8]
call fcn.10001960
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x10073ff2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileW_error_:_d
push 3
push 0x3d
push 0x10171090
push 0x101710b0
call fcn.101426f0
add esp, 0x18
xor eax, eax
xor edx, edx
jmp 0x1007403f
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1007402f
push str.GetFileSizeEx_error
push 3
push 0x45
push 0x101710d4
push str.getFileSize
call fcn.101426f0
add esp, 0x14
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
xor edx, edx
jmp 0x1007403f
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret
Function at 0x10077a70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015575e
mov eax, dword fs:[0]
push eax
sub esp, 0x658
mov eax, dword [0x101a5034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x62c], ecx
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x218], ax
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x618]
call fcn.10002fa0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x10077b70
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x64c]
call fcn.10002c60
mov dword [ebp - 0x628], eax
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x620], edx
mov byte [ebp - 4], 2
push str._ffmpeg.exe
mov eax, dword [ebp - 0x620]
push eax
lea ecx, [ebp - 0x664]
push ecx
call fcn.1000afb0
add esp, 0xc
mov dword [ebp - 0x624], eax
mov edx, dword [ebp - 0x624]
push edx
lea ecx, [ebp - 0x618]
call fcn.10002230
lea ecx, [ebp - 0x664]
call fcn.10002d10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64c]
call fcn.10002d10
lea ecx, [ebp - 0x618]
call fcn.10001960
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10077b96
push str.C:Program_Files__x86_Windows_Assistant_AppMV_ffmpeg.exe
lea ecx, [ebp - 0x618]
call fcn.10006e00
xor eax, eax
mov word [ebp - 0x600], ax
push 0x3e6
push 0
lea ecx, [ebp - 0x5fe]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.10001960
push eax
lea ecx, [ebp - 0x618]
call fcn.10001960
push eax
push str.__s___f_gdigrab__framerate_1__i_desktop__vframes_1__t_5__y___s_
lea edx, [ebp - 0x600]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x2710
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x630], esp
lea eax, [ebp - 0x600]
push eax
call fcn.10002c60
mov dword [ebp - 0x634], eax
call fcn.100fc4c0
add esp, 0x20
mov byte [ebp - 0x61a], al
mov cl, byte [ebp - 0x61a]
mov byte [ebp - 0x61b], cl
mov dl, byte [ebp - 0x61b]
mov byte [ebp - 0x619], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x618]
call fcn.10002d10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002d10
mov al, byte [ebp - 0x619]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c66b
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10081c40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x101a5cf8], 0
je 0x10081c97
mov eax, dword [0x101aae10]
test eax, eax
je 0x10081c70
push eax
call dword [0x101a5d50]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.1007f2e0
mov eax, dword [0x101aae10]
test eax, eax
je 0x10081c92
push eax
call dword [0x101a5d58]
mov esi, dword [ebp - 4]
jmp 0x10081ca1
mov esi, dword [ebp - 4]
jmp 0x10081ca4
push 0x14
call dword [0x101a5d20]
mov esi, eax
add esp, 4
test esi, esi
jne 0x10081cb2
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x101a5cfc], 0
mov ebx, dword [ebp + 8]
je 0x10081cfd
mov eax, dword [0x101a5e00]
test eax, eax
je 0x10081cd5
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x10081cfd
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10081c10
push 0
push 0
mov dword [esi + 0xc], ebx
call dword [sym.imp.MSVCR120.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10081d0b
xorps xmm0, xmm0
movdqu xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x10081d24
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret