joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426a30
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.00414290
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x426b1f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x426bc3
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x426b58
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x426b50
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x426bc0
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x426bda
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x426b92
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x426b92
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x426b92
Function at 0x100456e0
Capabilities:
Encode data using xor

Disassembly:
jnp 0x100456a7
or byte [eax], al
mov ebx, 0xed813bb5
sahf
xchg edx, eax
out 0xa3, al
mov eax, edi
push ss
dec edx
ror byte [edi + 0x4b90613d], 0x6f
inc eax
dec ecx
invalid

Function at 0x10045980
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov esp, 0x448bb6eb
or dword [ecx], ebx
je 0x100459d2
iretd
invalid

Function at 0x1053a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1053a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1053a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1053a06a
add dl, dl
jne 0x1053a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1053a0dc
xor eax, eax
add dl, dl
jne 0x1053a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1053a17d
add dl, dl
jne 0x1053a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1053a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1053a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1053a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1053a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1053a075
mov eax, 1
add dl, dl
jne 0x1053a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1053a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1053a0e1
sub eax, ebx
mov ebx, 1
jne 0x1053a128
mov ecx, 1
add dl, dl
jne 0x1053a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1053a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1053a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1053a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1053a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1053a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1053a136
cmp eax, 0x7d00
jae 0x1053a16d
cmp eax, 0x500
jb 0x1053a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1053a075
cmp eax, 0x7f
ja 0x1053a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1053a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1053a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1053a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x449ead
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x449ebc
pop dword [ebp - 0x20]
mov eax, 0x49734ec7
add eax, 0xb6d14ff5
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x458ad
push 0
mov eax, 0x5c75ff54
sub eax, 0x5c2f9e94
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x30cf7cf8
add ecx, 0xcf30c15f
mov edx, eax
mov ebx, 0xc4ca7ca7
add ebx, 0x3b806b59
add ebx, dword [ebp - 0x20]
mov edi, 0x56c87760
add edi, 0x2fb16ef2
sub dword [ebp - 0x1c], 0xd86113f3
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0xff7de6ad
sub esi, edi
sub dword [ebp - 0x18], ebx
mov dword [edx], esi
xor dword [ebp - 0x10], eax
add edx, 0x4eefa44d
add edx, 0xb1105bb7
add ebx, 4
loop 0x449f1b
add eax, 0x4bed491f
sub eax, 0x4bec5cf0
mov ebx, eax
add eax, 0x3ba79c31
sub eax, 0x3ba79c2c
mov ecx, 0x343a15c5
sub ecx, 0x33fa15c5
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005127
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x101e37f8
call fcn.100431e8
sub esp, 0x434
cmp dword [0x102798d4], 0
je 0x1000514a
mov eax, dword [0x102798d0]
jmp 0x100052f8
push ebx
push esi
push edi
push 1
pop eax
mov esi, 0x20019
mov dword [0x102798d4], eax
mov dword [0x102798d0], eax
call fcn.10070e70
test eax, eax
je 0x1000516d
mov esi, 0x20219
lea ecx, [ebp - 0x18]
call fcn.1006af30
and dword [ebp - 4], 0
push esi
push str.softwareTECOcular.3Agent
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x18]
call fcn.1006b050
push 4
test eax, eax
pop ebx
je 0x100051ee
mov esi, str.RunAs
push ebx
push esi
lea ecx, [ebp - 0x18]
call fcn.1006d500
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.1006b1f0
movzx eax, al
test eax, eax
jne 0x100051be
and dword [0x102798d0], eax
jmp 0x100051de
push 2
pop ecx
cmp eax, ecx
jne 0x100051cd
mov dword [0x102798d0], ecx
jmp 0x100051de
push 3
pop ecx
cmp eax, ecx
je 0x100051c5
cmp eax, ebx
jne 0x100051de
mov dword [0x102798d0], ebx
lea ecx, [ebp - 0x18]
call fcn.1006b0a0
test edi, edi
jne 0x100052e1
and word [ebp - 0x238], 0
mov edx, 0x81
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x236]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x43e]
mov word [ebp - 0x440], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x440]
push 0x104
push eax
call fcn.10076f80
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], esi
add esp, 0xc
mov dword [ebp - 0x24], str.ingress_sdm.exe
mov dword [ebp - 0x20], str.ist.exe
mov dword [ebp - 0x1c], str.OGuard.exe
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 3
lea esi, [ebp - 0x24]
mov ebx, 0x103
push dword [esi]
lea eax, [ebp - 0x440]
push eax
push 0x1023b350
lea eax, [ebp - 0x238]
push ebx
push eax
call fcn.10043276
add esp, 0x14
lea eax, [ebp - 0x238]
push eax
call edi
cmp eax, 0xffffffff
je 0x100052c7
lea eax, [ebp - 0x440]
push str.winrdlv3.exe
push eax
push 0x1023b350
lea eax, [ebp - 0x238]
push ebx
push eax
call fcn.10043276
add esp, 0x14
lea eax, [ebp - 0x238]
push eax
call edi
cmp eax, 0xffffffff
je 0x100052d5
inc dword [ebp - 0x10]
add esi, 4
cmp dword [ebp - 0x10], 3
jb 0x1000526c
jmp 0x100052e1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [0x102798d0], eax
mov esi, dword [0x102798d0]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.1006afd0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x1000a80f
Capabilities:
Get disk information

Disassembly:
mov eax, 0x101e3d30
call fcn.100431e8
sub esp, 0x22c
and dword [ebp - 0x20], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov dword [ebp - 0x1c], ecx
je 0x1000aa51
mov ecx, dword [ebp + 0xc]
push esi
call fcn.1005c7b0
push esi
call fcn.10042d96
cmp eax, 1
pop ecx
jl 0x1000aa51
mov ax, word [esi]
cmp ax, 0x61
jb 0x1000a85c
cmp ax, 0x7a
jbe 0x1000a870
cmp ax, 0x41
jb 0x1000aa51
cmp ax, 0x5a
ja 0x1000aa51
cmp word [esi + 2], 0x3a
jne 0x1000aa51
mov ecx, dword [0x101ff094]
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
movzx eax, ax
push eax
lea eax, [ebp - 0x14]
push 0x10240d38
push eax
call fcn.1005f4e0
mov eax, dword [0x101ff094]
add esp, 0xc
mov dword [ebp - 0x10], eax
mov esi, dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov byte [ebp - 4], 1
mov ebx, 0x103
and word [ebp - 0x238], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x236]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x238]
push ebx
push eax
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x238]
push eax
call fcn.10042d96
test eax, eax
pop ecx
jbe 0x1000a90b
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x14]
push eax
call fcn.1005c7b0
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x10]
push eax
call fcn.1005c7b0
jmp 0x1000a8b4
lea ecx, [ebp - 0x30]
call fcn.1000ac82
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp dword [eax - 8], 0
jne 0x1000a9b5
lea eax, [ebp - 0x14]
push 0x5c
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1005dc00
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.1000acbd
lea ecx, [ebp - 0x30]
call fcn.1000adad
test eax, eax
je 0x1000aa21
and word [ebp - 0x238], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x236]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x238]
push ebx
push eax
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x238]
push eax
call fcn.10042d96
test eax, eax
pop ecx
jbe 0x1000a9a9
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x14]
push eax
call fcn.1005c7b0
lea eax, [ebp - 0x238]
lea ecx, [ebp - 0x10]
push eax
call fcn.1005c7b0
jmp 0x1000a952
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.1005c4d0
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
call fcn.1005ba50
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 4
push dword [ebp - 0x18]
call fcn.1000aa65
test eax, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
je 0x1000a9f2
call fcn.1005c4d0
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
call fcn.1005ba50
jmp 0x1000a9c1
call fcn.1005c4d0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 8], 0
je 0x1000aa2d
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push eax
push 0x10240d2c
push dword [ebp + 0xc]
call fcn.1005f4e0
add esp, 0x10
mov dword [ebp - 0x20], 1
jmp 0x1000aa2d
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.1005c4d0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.1000acb2
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.1005c4d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1005c4d0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1000d21b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x101e410c
call fcn.100431e8
sub esp, 0x224
push ebx
mov ebx, ecx
push esi
push edi
lea eax, [ebx + 0x14]
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.1003f07c
and dword [ebp - 4], 0
mov esi, 0x1024225c
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
push dword [esi]
call fcn.1000d420
test eax, eax
je 0x1000d2f1
and word [ebp - 0x230], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x22e]
rep stosd dword es:[edi], eax
push 0
push dword [ebp - 0x10]
stosw word es:[edi], ax
lea eax, [ebp - 0x230]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000d2f1
lea eax, [ebp - 0x230]
push eax
call fcn.10042d96
cmp word [ebp + eax*2 - 0x232], 0x5c
pop ecx
lea eax, [ebp - 0x230]
push eax
jne 0x1000d2b7
call fcn.10042d96
jmp 0x1000d2d3
call fcn.10042d96
mov word [ebp + eax*2 - 0x230], 0x5c
lea eax, [ebp - 0x230]
push eax
call fcn.10042d96
pop ecx
pop ecx
mov word [ebp + eax*2 - 0x230], 0x2a
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
lea edx, [ebp - 0x230]
push edx
push eax
call fcn.10063850
add esi, 4
cmp esi, str..LNK
jb 0x1000d247
lea esi, [ebx + 4]
mov edi, 0x10242220
mov eax, dword [edi]
mov ecx, dword [esi + 4]
push eax
push ecx
mov ecx, esi
call fcn.10063850
add edi, 4
cmp edi, 0x1024225c
jb 0x1000d308
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push str.CSIDL_PROGRAM_FILES
mov ecx, ebx
call fcn.1000d420
test eax, eax
je 0x1000d401
and word [ebp - 0x230], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x22e]
rep stosd dword es:[edi], eax
push 0
push dword [ebp - 0x18]
stosw word es:[edi], ax
lea eax, [ebp - 0x230]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1000d401
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x10]
push eax
call fcn.1005bc60
push 0x5c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1005ffc0
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.1005d6e0
cmp eax, 0xffffffff
je 0x1000d3f5
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.1005eca0
lea eax, [ebp - 0x14]
push 0x1024231c
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.1005cc30
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.1005c680
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.1005c4d0
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, esi
call fcn.10063940
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1005c4d0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.1005c4d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1003f0b8
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000d4ef
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
mov ebx, ecx
cmp dword [esi + 4], edi
jle 0x1000d524
mov eax, dword [esi]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1000d51e
mov eax, dword [esi]
mov ecx, ebx
push dword [eax + edi*4]
call fcn.1000d486
test eax, eax
je 0x1000d52d
inc edi
cmp edi, dword [esi + 4]
jl 0x1000d4ff
push 1
pop eax
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
jmp 0x1000d527

Function at 0x1000fe15
Capabilities:
Find taskbar
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
lea eax, [ebx + ebx]
xor esi, esi
push eax
push esi
push dword [ebp + 8]
call fcn.100432f0
add esp, 0xc
call fcn.10070f00
test eax, eax
je 0x1000fee7
push 0x31
xor eax, eax
pop ecx
lea edi, [ebp - 0xc6]
mov word [ebp - 0xc8], si
push esi
rep stosd dword es:[edi], eax
push str.Shell_TrayWnd
push esi
push esi
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_FindWindowExW]
cmp eax, esi
je 0x1000fe78
lea ecx, [ebp - 0xc8]
push ecx
push eax
call fcn.1000ff4f
lea eax, [ebp - 0xc8]
push eax
call fcn.10042d96
test eax, eax
pop ecx
jne 0x1000fec0
push 0x41
push esi
push 1
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopW]
mov edi, eax
cmp edi, esi
jne 0x1000fea6
xor eax, eax
jmp 0x1000ff4a
lea eax, [ebp - 0xc8]
push eax
push fcn.1000ff4f
push edi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push edi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea eax, [ebp - 0xc8]
push eax
call fcn.10042d96
cmp eax, ebx
pop ecx
jae 0x1000fe9f
lea eax, [ebp - 0xc8]
push eax
push dword [ebp + 8]
call fcn.10042d71
pop ecx
pop ecx
push 1
pop eax
jmp 0x1000ff4a
push 0x31
xor eax, eax
pop ecx
lea edi, [ebp - 0xc6]
mov word [ebp - 0xc8], si
mov dword [ebp + 0xc], 0x64
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov edi, eax
cmp edi, esi
je 0x1000ff38
lea eax, [ebp - 0xc8]
push eax
call fcn.10042d96
cmp eax, ebx
pop ecx
jae 0x1000fe9f
lea eax, [ebp - 0xc8]
jmp 0x1000fed7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x1000ff48
push 1
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010489
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.10043ef0
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x100104c1
push 1
pop eax
jmp 0x10010568
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x1001052c
cmp byte [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x100104e7
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x100104e3
cmp byte [edi + 0x2e], 0
je 0x10010544
test al, al
je 0x10010544
push ecx
call fcn.10043ef0
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x10010544
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.10043e10
push 0x10242bf8
push esi
call fcn.10043e10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.10010489
add esp, 0x20
mov byte [ebx + esi - 1], 0x2a
and byte [ebx + esi], 0
mov dword [ebp + 8], eax
jmp 0x10010544
push dword [ebp + 0x14]
and byte [ebx + esi - 1], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov byte [ebx + esi - 1], 0x2a
cmp dword [ebp + 8], 0
je 0x1001055c
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100104c8
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001062b
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.10042d96
mov edi, dword [ebp + 0xc]
mov ebx, eax
pop ecx
mov eax, 0x1f3
sub eax, ebx
push edi
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
jne 0x10010663
push 1
pop eax
jmp 0x10010717
mov dword [ebp + 8], 1
test byte [edi], 0x10
je 0x100106d8
cmp word [edi + 0x2c], 0x2e
lea ecx, [edi + 0x2c]
jne 0x1001068f
mov ax, word [edi + 0x2e]
cmp ax, 0x2e
jne 0x1001068a
cmp word [edi + 0x30], 0
je 0x100106f3
test ax, ax
je 0x100106f3
push ecx
call fcn.10042d96
inc eax
pop ecx
cmp dword [ebp - 4], eax
jb 0x100106f3
and word [esi + ebx*2 - 2], 0
lea eax, [edi + 0x2c]
push eax
push esi
call fcn.10042d47
push 0x1023dacc
push esi
call fcn.10042d47
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push esi
call fcn.1001062b
add esp, 0x20
mov word [esi + ebx*2 - 2], 0x2a
and word [esi + ebx*2], 0
mov dword [ebp + 8], eax
jmp 0x100106f3
push dword [ebp + 0x14]
and word [esi + ebx*2 - 2], 0
lea eax, [edi + 0x2c]
push eax
push esi
call dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov word [esi + ebx*2 - 2], 0x2a
cmp dword [ebp + 8], 0
je 0x1001070b
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1001066a
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010ef0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10011080
push ebx
call fcn.10042d96
test eax, eax
pop ecx
je 0x10011080
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x10011080
test al, 1
je 0x10010f38
and al, 0xfe
push eax
push ebx
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test byte [ebp + 8], 0x10
je 0x10011064
and word [ebp - 0x660], 0
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x65e]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x660]
push eax
call fcn.10042d71
lea eax, [ebp - 0x660]
push 0x1023dacc
push eax
call fcn.10042d47
and dword [ebp - 0x250], 0
mov ecx, 0x93
xor eax, eax
lea edi, [ebp - 0x24c]
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1001105a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x224]
push 0x10242c2c
push eax
call edi
test eax, eax
je 0x10011039
lea eax, [ebp - 0x224]
push 0x10242c28
push eax
call edi
test eax, eax
je 0x10011039
and word [ebp - 0x458], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x456]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x458]
push ebx
push eax
call fcn.10042d71
lea eax, [ebp - 0x458]
push 0x1023b44c
push eax
call fcn.10042d47
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.10042d47
push dword [ebp + 0xc]
lea eax, [ebp - 0x458]
push eax
call fcn.10010ef0
add esp, 0x20
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10010fb3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
jmp 0x1001106b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10011082
cmp dword [ebp + 0xc], eax
je 0x10011082
push 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x10011082
xor eax, eax
pop ebx
leave
ret