joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006040
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
lea edx, [edi + 0x20c]
push edx
lea eax, [ebp - 0x20c]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call fcn.10028ad0
add esp, 4
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100060d2
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x20c]
push eax
push esi
push str.TBHCONFIGLIB::backupFile__d___s_
call fcn.1001aca0
lea ecx, [ebp - 0x20c]
push ecx
push esi
call fcn.10028c20
add esp, 0x14
test eax, eax
je 0x10006113
push 0x104
push esi
lea edx, [ebp - 0x20c]
push edx
mov ecx, edi
call fcn.10004ed0
mov ebx, 1
jmp 0x10006128
lea eax, [ebp - 0x20c]
push eax
push esi
push str.Failed_to_TBHCONFIGLIB::backupFile__d___s_
call fcn.1001aca0
add esp, 0xc
lea ecx, [ebp - 0x20c]
push 1
push ecx
call fcn.1001cb20
mov ecx, dword [ebp - 4]
add esp, 8
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 4

Function at 0x10006320
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
mov esi, ecx
push 0xf003f
mov ecx, 0x10050ef4
call fcn.1001b4a0
push eax
push SysReAllocString
call fcn.1001dc20
push 0
call fcn.10025380
add esp, 0x14
mov ecx, esi
call fcn.10005840
pop esi
test eax, eax
jne 0x1000637c
push str.Failed_to_UninstallLastVersion____run_Uninst_ProcessUninstall_TRUE_
call fcn.1001aca0
push 1
call fcn.1000a720
add esp, 8
call fcn.10024fa0
test eax, eax
je 0x10006397
call fcn.1001d960
test eax, eax
je 0x10006397
call fcn.1001f450
test eax, eax
je 0x1000640c
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov ecx, 0x10050ec4
call fcn.1001b4a0
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000640c
lea eax, [ebp - 0x20c]
push eax
call fcn.1001ce10
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10006420
Capabilities:
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b7d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1004f0a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
je 0x10006598
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006460
sub eax, edx
sar eax, 1
je 0x10006598
lea eax, [ebp + 8]
push eax
push 0x10042218
push 0x15
push 0
push 0x10042228
mov dword [ebp + 8], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
mov eax, dword [ebp + 8]
test esi, esi
jns 0x100064c5
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x100064b0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0x10], 0
test eax, eax
jne 0x100064da
push 0x80004003
call fcn.1000abc0
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push eax
mov eax, dword [ecx + 0x94]
call eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10006503
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x10]
push 3
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, 8
push edi
mov word [ebp - 0x30], dx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x10006524
push 0x8007000e
call fcn.1000abc0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
test eax, eax
jne 0x10006543
push 0x80004003
call fcn.1000abc0
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push edx
push edx
push edx
lea edx, [ebp - 0x30]
push edx
push eax
mov eax, dword [ecx + 0xd0]
call eax
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x20]
push ecx
mov edi, eax
call esi
lea edx, [ebp - 0x30]
push edx
call esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x10006583
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10007660
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.1000ae30
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x100076c7
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
push 0
push 0x100419a0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x100076b5
lea ecx, [ebp - 0x20c]
push ecx
push str.embedded_config.html
push 0x17
push edi
call fcn.10020070
add esp, 0x10
test eax, eax
je 0x100076b5
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea ecx, [esi + 0x1260]
call fcn.10002150
lea edx, [ebp - 0x20c]
push edx
mov ecx, esi
call fcn.10005420
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x100093d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bad6
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.10005300
test eax, eax
je 0x1000949e
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x222]
push ecx
mov word [ebp - 0x224], ax
call fcn.1000ae30
lea edx, [ebp - 0x224]
push 0x104
push edx
call fcn.1001e3e0
lea eax, [ebp - 0x224]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10009445
sub eax, edx
sar eax, 1
jne 0x10009497
push 0x208
lea eax, [ebp - 0x224]
push 0
push eax
call fcn.1000ae30
lea ecx, [ebp - 0x224]
push 0x104
push ecx
call fcn.1001e4a0
lea eax, [ebp - 0x224]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10009486
sub eax, edx
sar eax, 1
je 0x100094a5
xor eax, eax
jmp 0x100095d6
mov ecx, edi
call fcn.10005370
xor esi, esi
cmp dword [edi + 0x103c], esi
je 0x10009581
push 0xc
lea edx, [ebp - 0x1c]
push edx
push 0x25
lea ecx, [ebp - 0x638]
mov dword [ebp - 0x1c], 0x8fc2c89f
mov dword [ebp - 0x18], 0xd5d1c1b3
mov dword [ebp - 0x14], 0xeae1ecb3
call fcn.1001b390
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], esi
call fcn.1001b4a0
push eax
lea ecx, [ebp - 0x628]
call fcn.100077d0
mov eax, dword [ebp - 0x628]
mov esi, dword [eax - 8]
mov ecx, 0x100510b4
mov byte [ebp - 4], 1
call fcn.1001b4a0
mov ecx, 0x10051094
mov edi, eax
call fcn.1001b4a0
lea ecx, [esi + esi + 2]
push ecx
push 0
lea ecx, [ebp - 0x628]
mov ebx, eax
call fcn.100020c0
push eax
push 1
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x628]
sete dl
lea ecx, [eax - 0xc]
mov esi, edx
cmp ecx, dword [0x10050de4]
je 0x1000956d
lea edi, [eax - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1000956d
push edi
call fcn.1000b015
add esp, 4
lea ecx, [ebp - 0x638]
mov dword [ebp - 4], 0xffffffff
call fcn.1001b3d0
jmp 0x100095d4
push 0x3ff
lea edx, [ebp - 0x623]
push esi
push edx
mov byte [ebp - 0x624], 0
call fcn.1000ae30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x400
lea ecx, [ebp - 0x624]
push ecx
push str.embedded_data.html
push 0x17
push eax
call fcn.1001ff60
add esp, 0x14
test al, al
je 0x100095d4
lea edx, [ebp - 0x624]
push edx
mov ecx, edi
call fcn.10008c70
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x100098e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bb30
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1214
call fcn.1000aeb0
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
push edi
mov dword [ebp - 0x1224], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000993d
mov dword [esi + 0x1040], 0x1006
xor edi, edi
jmp 0x10009987
push 0x104
push edi
lea eax, [esi + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push ebx
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.100097b0
mov edi, eax
test edi, edi
jne 0x10009a68
jmp 0x10009987
cmp dword [esi + 0x1040], 0
je 0x10009a66
cmp dword [esi + 0x61c], 0
jne 0x10009a66
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0xa1a]
push edx
mov word [ebp - 0xa1c], cx
call fcn.1000ae30
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x121a]
push ecx
mov word [ebp - 0x121c], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x21a]
push eax
mov word [ebp - 0x21c], dx
call fcn.1000ae30
mov edx, dword [0x10050e00]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
add esp, 0x24
push 0x400
lea ecx, [ebp - 0x121c]
push ecx
push 0x97
push edx
call ebx
mov eax, dword [esi + 0x1040]
push eax
lea ecx, [ebp - 0x121c]
push ecx
lea edx, [ebp - 0xa1c]
push 0x3ff
push edx
call fcn.1000c37d
mov ecx, dword [0x10050e00]
add esp, 0x10
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0x6e
push ecx
call ebx
push 0x10
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0xa1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret 8
Function at 0x10009ba0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x61a]
push eax
mov word [ebp - 0x61c], dx
call fcn.1000ae30
lea ecx, [ebp - 0x414]
push ecx
push esi
call fcn.10024bf0
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x20
test eax, eax
je 0x10009c5f
cmp dword [ebp + 0xc], 0
je 0x10009c2d
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [ebp - 0x414]
push 0
push edx
call fcn.1001deb0
add esp, 8
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.1001cb20
add esp, 8
lea edx, [ebp - 0x414]
push edx
call edi
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push str.Uninstall:__d_s__exists_d
call fcn.1001aca0
add esp, 0x10
push 0x104
lea ecx, [ebp - 0x61c]
push ecx
push esi
call fcn.10028b70
add esp, 0xc
test eax, eax
je 0x10009ca8
lea edx, [ebp - 0x61c]
push 1
push edx
call fcn.1001cb20
add esp, 8
lea eax, [ebp - 0x414]
push eax
call edi
push eax
lea ecx, [ebp - 0x61c]
push ecx
push esi
push str.Uninstall_Random:__d_s__exists_d
call fcn.1001aca0
add esp, 0x10
test esi, esi
je 0x10009cb5
cmp esi, 0xc
jne 0x10009d5a
push esi
call fcn.10028ad0
add esp, 4
test eax, eax
je 0x10009d5a
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.1000ae30
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x104
lea edx, [ebp - 0x20c]
push 0x100420e0
push edx
call fcn.1001e290
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10009d2b
lea ecx, [ebp - 0x20c]
push ecx
call edi
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push 0x104
lea eax, [ebp - 0x20c]
push 0x100420d8
push eax
call fcn.1001e290
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call edi
push esi
call fcn.10028ba0
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
xor ecx, ebp
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x10009f10
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.1000ae30
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
add esp, 0xc
push 0x104
push esi
lea edx, [ebp - 0x414]
push edx
call edi
push 0x104
lea eax, [ebp - 0x414]
push 0x1004218c
push eax
call fcn.1001e290
add esp, 0xc
lea ecx, [ebp - 0x664]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x1000a0c4
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
push esi
lea edx, [ebp - 0x20c]
push edx
call edi
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call ebx
mov ecx, dword [ebp - 0x664]
mov eax, ecx
and eax, 0x10
jne 0x1000a005
test cl, 4
jne 0x1000a005
lea edx, [ebp - 0x20c]
push 1
push edx
call fcn.1001cb20
add esp, 8
jmp 0x1000a090
test eax, eax
je 0x1000a090
mov ecx, 0x10042188
lea eax, [ebp - 0x638]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000a03e
test dx, dx
je 0x1000a03a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000a03e
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000a018
xor eax, eax
jmp 0x1000a043
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000a090
mov ecx, 0x10042180
lea eax, [ebp - 0x638]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000a078
test dx, dx
je 0x1000a074
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000a078
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000a052
xor eax, eax
jmp 0x1000a07d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000a090
lea eax, [ebp - 0x20c]
push eax
call fcn.10009f10
add esp, 4
mov edx, dword [ebp - 0x668]
lea ecx, [ebp - 0x664]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10009fa0
push eax
push esi
call fcn.1001cb20
mov eax, dword [ebp - 0x668]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1000a1b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.1000ae30
add esp, 0xc
push 0x104
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1000a205
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov ecx, 0x10051334
call fcn.1001b4a0
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x20c]
push edx
call fcn.10009f10
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 4
mov eax, 1
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1000ae1e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004f0a8]
jne 0x1000ae28
repz ret
jmp fcn.1000d2a9

Function at 0x1000f503
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1000f52a
call fcn.1000f5d7
mov dword [eax], esi
call fcn.1000f5c4
push 0x16
pop esi
mov dword [eax], esi
call fcn.1000f036
mov eax, esi
jmp 0x1000f57f
test dword [ebp + 0xc], 0xfffffff9
jne 0x1000f510
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000f557
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000f5ea
pop ecx
call fcn.1000f5c4
mov eax, dword [eax]
jmp 0x1000f57f
test al, 0x10
jne 0x1000f57d
test al, 1
je 0x1000f57d
test byte [ebp + 0xc], 2
je 0x1000f57d
call fcn.1000f5d7
mov dword [eax], 5
call fcn.1000f5c4
mov dword [eax], 0xd
jmp 0x1000f54e
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10012d11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000e975
and dword [ebp - 0x14], 0
cmp dword [0x100520c8], 0
mov dword [ebp - 0x18], eax
jne 0x10012dc4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10012e6c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1004395c
push ebx
call edi
test eax, eax
je 0x10012e6c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100520c8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100520cc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100520d0], eax
call edi
push eax
call esi
mov dword [0x100520d8], eax
test eax, eax
je 0x10012dc4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100520d4], eax
mov eax, dword [0x100520d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10012e1d
cmp dword [0x100520d8], ecx
je 0x10012e1d
push eax
call esi
push dword [0x100520d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10012e1d
test ebx, ebx
je 0x10012e1d
call edi
test eax, eax
je 0x10012e14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10012e14
test byte [ebp - 8], 1
jne 0x10012e1d
or dword [ebp + 0x10], 0x200000
jmp 0x10012e50
mov eax, dword [0x100520cc]
cmp eax, dword [ebp - 0x18]
je 0x10012e50
push eax
call esi
test eax, eax
je 0x10012e50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10012e50
mov eax, dword [0x100520d0]
cmp eax, dword [ebp - 0x18]
je 0x10012e50
push eax
call esi
test eax, eax
je 0x10012e50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100520c8]
call esi
test eax, eax
je 0x10012e6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10012e6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ae1e
leave
ret

Function at 0x1001ac20
Capabilities:
Check os version
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x1001ac80
cmp dword [ebp - 0x114], 6
jb 0x1001ac80
push 0x104
push esi
push str._USERPROFILE_AppDataLocalLowDTLog.txt
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
push 0x104
push str.C:DTLog.txt
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
Function at 0x1001aca0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2104
call fcn.1000aeb0
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
call fcn.1001abf0
add esp, 4
test eax, eax
je 0x1001aeff
push str.977B4CC2_9D55_4B84_B7E3_FBABFCDB022B
push 0
mov ecx, 0x10052320
call fcn.10021f00
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
test ebx, ebx
je 0x1001aeff
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1001aef8
push 0x1ffe
push eax
lea ecx, [ebp - 0x2102]
push ecx
mov word [ebp - 0x2104], ax
call fcn.1000ae30
add esp, 0xc
cmp byte [0x10052100], 0
jne 0x1001ad31
push 0x10052100
call fcn.1001ac20
add esp, 4
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x102]
push eax
mov word [ebp - 0x104], dx
call fcn.1000ae30
lea ecx, [ebp - 0x104]
push ecx
call fcn.10034612
push eax
push 0x10044318
lea edx, [ebp - 0x104]
push 0x80
push edx
call fcn.1000c6df
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x2104]
push 0x1000
push ecx
call fcn.1000c8da
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x102]
push eax
mov word [ebp - 0x104], dx
call fcn.1000ae30
lea ecx, [ebp - 0x104]
push ecx
call fcn.1003452d
push eax
push 0x10044318
lea edx, [ebp - 0x104]
push 0x80
push edx
call fcn.1000c6df
add esp, 0x4c
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x2104]
push 0x1000
push ecx
call fcn.1000c8da
xor edx, edx
push 0xfe
push edx
lea eax, [ebp - 0x102]
push eax
mov word [ebp - 0x104], dx
call fcn.1000ae30
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x100442f8
lea ecx, [ebp - 0x104]
push 0x80
push ecx
call fcn.1000c6df
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x2104]
push 0x1000
push eax
call fcn.1000c8da
lea eax, [ebp - 0x2104]
add esp, 0x24
lea edx, [eax + 2]
jmp 0x1001ae50
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001ae50
sub eax, edx
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
sar eax, 1
mov ecx, 0x1000
push 0xffffffffffffffff
sub ecx, eax
push ecx
lea edx, [ebp + eax*2 - 0x2104]
push edx
call fcn.10011da4
push 0x100442f4
lea eax, [ebp - 0x2104]
push 0x1000
push eax
call fcn.1000c8da
push 0x100442f0
push 0x10052100
call fcn.10034456
mov esi, eax
add esp, 0x28
test esi, esi
je 0x1001aef1
lea ecx, [ebp - 0x2104]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x1001aec5
xor eax, eax
jmp 0x1001aee1
lea edi, [eax + eax]
mov eax, edi
call fcn.1000c680
mov eax, esp
push 3
push edi
lea edx, [ebp - 0x2104]
push edx
push eax
call fcn.10002080
push esi
push eax
call fcn.10034294
push esi
call fcn.1001a6b4
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [ebp - 0x2110]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret