joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12e072b0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x220
push ebx
mov eax, dword [esp + 0x228]
push ebp
xor ebp, ebp
push esi
push ebp
push 0x80
push 3
push ebp
push 3
xor esi, esi
push SysReAllocStringLen
push eax
mov dword [esp + 0x38], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x12e074d1
lea ecx, [esp + 0x14]
push edi
push ecx
push ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
cmp ecx, ebp
ja 0x12e07316
cmp eax, 0x200
jbe 0x12e074bb
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x10]
push ebp
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x38]
push 0x20
push eax
push ebx
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x12e074bb
cmp dword [esp + 0x10], 0x20
jne 0x12e074bb
mov ecx, dword [0x130e1fac]
mov edi, str.OCULAR3454E43525950
lea esi, [esp + 0x30]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x12e074bb
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x4c]
test edi, edi
mov dword [esp + 0x24], eax
ja 0x12e073f4
jb 0x12e0738b
cmp dword [esp + 0x14], 0x10020
ja 0x12e073f4
mov esi, dword [esp + 0x14]
sub esi, 0x20
sbb edi, 0
jne 0x12e0739f
test esi, esi
jbe 0x12e074a1
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x38]
push 0x200
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x12e074a1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x12e074a1
sub esi, eax
push eax
lea eax, [esp + 0x34]
push eax
push ebp
sbb edi, 0
call fcn.12ffee60
add esp, 0xc
mov ebp, eax
test edi, edi
ja 0x12e0739f
jb 0x12e074a1
test esi, esi
ja 0x12e0739f
jmp 0x12e074a1
mov dword [esp + 0x1c], 0
mov esi, 0x8000
xor edi, edi
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x38]
push 0x200
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x12e07447
mov eax, dword [esp + 0x10]
test eax, eax
je 0x12e07447
sub esi, eax
push eax
lea eax, [esp + 0x34]
push eax
push ebp
sbb edi, 0
call fcn.12ffee60
add esp, 0xc
mov ebp, eax
test edi, edi
ja 0x12e07403
jb 0x12e07447
test esi, esi
ja 0x12e07403
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x12e0748f
lea ecx, [esp + 0x2c]
push 2
push ecx
push 0xffff8000
push ebx
mov dword [esp + 0x38], 0xffff8000
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub ecx, 0x8000
sbb edx, 0
cmp eax, ecx
jne 0x12e074a1
mov eax, dword [esp + 0x2c]
cmp eax, edx
jne 0x12e074a1
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 2
mov dword [esp + 0x1c], eax
jl 0x12e073fc
or esi, edi
jne 0x12e074bb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
xor ebp, ecx
cmp eax, ebp
jne 0x12e074bb
mov dword [esp + 0x20], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret
Function at 0x12e09830
Capabilities:
Check if file exists
Get file attributes
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.12f5d910
push edi
mov edi, dword [esp + 0x1014]
test edi, edi
je 0x12e099e6
mov eax, dword [esp + 0x1018]
test eax, eax
je 0x12e099e6
push eax
push edi
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12e099e6
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
push edi
mov ebx, 5
call esi
mov ebp, eax
cmp ebp, 0xffffffff
je 0x12e099a1
mov eax, dword [esp + 0x1024]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x12e099c0
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x14]
push ebx
push ecx
lea edx, [esp + 0x20]
push 0x1000
push edx
push ebp
mov dword [esp + 0x28], ebx
call edi
test eax, eax
je 0x12e09928
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x12e09928
lea ecx, [esp + 0x10]
push ebx
push ecx
lea edx, [esp + 0x20]
push eax
push edx
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x12e09928
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x12e098de
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call edi
cmp esi, 0xffffffff
je 0x12e09940
push esi
call edi
test ebx, ebx
jne 0x12e09966
mov ecx, dword [esp + 0x1020]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x12e09966
mov edx, dword [esp + 0x1024]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, dword [esp + 0x1020]
mov eax, dword [0x13199068]
test eax, eax
je 0x12e09994
mov eax, dword [esp + 0x1024]
push eax
push edi
push ebx
push str.TReadWriteFile__err_:__d___src_:__s___desk_:__s_
push str.DoEncrypt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
pop esi
mov eax, ebx
pop ebp
pop ebx
pop edi
add esp, 0x100c
ret
mov eax, dword [0x13199068]
test eax, eax
je 0x12e09994
push str.TReadWriteFile_OpenSrc_Failed
push str.DoEncrypt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12e0996d
mov eax, dword [0x13199068]
test eax, eax
je 0x12e0992f
push str.TReadWriteFile_OpenDest_Failed
push str.DoEncrypt
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
jmp 0x12e0992f
mov eax, 6
pop edi
add esp, 0x100c
ret
Function at 0x12e0acc0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, 0x131a9198
jmp 0x12e0acf0
push 0xffffffffffffffff
push 0x1305bf13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 4], edi
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], edi
call fcn.12f55c40
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x14], 1
mov dword [esi + 0x30], edi
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x12e0dcc0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
mov esi, dword [esp + 0x224]
xor ebp, ebp
cmp esi, ebp
je 0x12e0de79
mov ebx, dword [esp + 0x228]
cmp ebx, ebp
je 0x12e0de79
cmp dword [esp + 0x22c], ebp
je 0x12e0de79
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1e]
mov word [esp + 0x1c], bp
mov dword [esp + 0x18], ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, ebp
je 0x12e0de6a
cmp eax, 0x104
jae 0x12e0de6a
push esi
call fcn.12f5c51d
add esp, 4
mov edi, esi
xor ecx, ecx
cmp eax, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
jbe 0x12e0de1e
mov ebx, esi
lea edx, [esi + 4]
lea edi, [esi + 2]
add esi, 6
cmp word [ebx], 0x2e
jne 0x12e0dde4
mov ebp, eax
sub ebp, ecx
dec ebp
cmp ebp, 2
jb 0x12e0ddc5
mov bp, word [edi]
cmp bp, 0x2e
jne 0x12e0dd9b
cmp word [edx], 0x5c
jne 0x12e0dd9b
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x10], esi
inc ebp
add ecx, 2
add ebx, 4
add esi, 4
add edi, 4
mov dword [esp + 0x14], ebp
add edx, 4
jmp 0x12e0ddb2
cmp bp, 0x5c
jne 0x12e0dde4
mov dword [esp + 0x10], edx
inc ecx
add ebx, 2
add esi, 2
add edi, 2
add edx, 2
inc ecx
add ebx, 2
add esi, 2
add edi, 2
add edx, 2
cmp ecx, eax
jb 0x12e0dd5a
jmp 0x12e0dde4
sub eax, ecx
dec eax
cmp eax, 1
jb 0x12e0dde4
mov eax, dword [esp + 0x228]
cmp word [eax + ecx*2 + 2], 0x5c
jne 0x12e0dde4
lea ecx, [eax + ecx*2 + 4]
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x14]
test edi, edi
je 0x12e0de13
xor esi, esi
test edi, edi
jbe 0x12e0de6a
lea edx, [esp + 0x1c]
push 0x5c
push edx
call fcn.12f5c984
add esp, 8
test eax, eax
je 0x12e0de6a
inc esi
mov word [eax], 0
cmp esi, edi
jb 0x12e0ddf2
test eax, eax
je 0x12e0de6a
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x22c]
push edi
call fcn.12f5c51d
mov esi, eax
lea eax, [esp + 0x20]
push eax
call fcn.12f5c51d
lea ecx, [esi + eax + 1]
mov eax, dword [esp + 0x238]
add esp, 8
cmp ecx, eax
jae 0x12e0de6a
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.12f5c935
push 0x130c4ed0
push ebx
call fcn.12f5c935
push edi
push ebx
call fcn.12f5c935
add esp, 0x18
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret

Function at 0x12e0e890
Capabilities:
Get hostname

Disassembly:
push ecx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x131a9630]
test ecx, ecx
je 0x12e0e8b2
cmp eax, ecx
jb 0x12e0e8b2
add ecx, 0x36ee80
cmp ecx, eax
jae 0x12e0e8f0
mov dword [0x131a9630], eax
lea eax, [esp + 4]
lea ecx, [esi + 0x18]
push eax
push ecx
mov dword [esp + 0xc], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
lea eax, [esi + 0x14]
je 0x12e0e8f3
push eax
mov word [eax], 0x5c
mov word [esi + 0x16], 0x5c
call fcn.12f5c51d
add esp, 4
mov word [esi + eax*2 + 0x14], 0x5c
lea eax, [esi + 0x14]
pop esi
pop ecx
ret
Function at 0x12e0f660
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
lea eax, [esp + 8]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push str.softwareTECOcular.3Agent
push reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x12e0f6f6
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edi
push edx
push edi
push str.DisableFP
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
call esi
test eax, eax
jne 0x12e0f6f6
mov ecx, dword [esp + 0x14]
mov eax, 4
cmp ecx, eax
jne 0x12e0f6f6
cmp dword [esp + 0x10], eax
jne 0x12e0f6f6
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push edi
push edi
push str.DisableFP
push eax
mov dword [esp + 0x30], edi
call esi
test eax, eax
jne 0x12e0f6f6
cmp dword [esp + 0x18], 1
jne 0x12e0f6f6
mov ebx, 1
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x12e0f705
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x12e10600
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x131a9668]
sub esp, 0x208
test eax, eax
jne 0x12e10619
mov dword [0x131a9668], 1
mov eax, dword [0x131a966c]
test eax, eax
jne 0x12e10759
call fcn.12f9c5b0
test eax, eax
je 0x12e10658
push 0
push 0x104
push 0x131a9670
call fcn.12f7a5b0
add esp, 0xc
push 0x104
push 0x131a9878
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x12e10705
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
lea ecx, [esp + 0x110]
push 0x104
push ecx
call fcn.12f7a4b0
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x103
not ecx
dec ecx
push 0x131a9670
lea edx, [esp + 0x10]
push ecx
push edx
push eax
push eax
call esi
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
push 0x103
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x131a9878
lea eax, [esp + 0x114]
push ecx
push eax
push 0
push 0
call esi
pop edi
pop esi
push 0x131a9670
call fcn.12f615c4
push 0x131a9878
call fcn.12f615c4
push 0x131a9670
call fcn.12f5c51d
push 0x131a9878
mov dword [0x131a9a80], eax
call fcn.12f5c51d
mov dword [0x131a9a84], eax
mov eax, dword [0x131a9a80]
add esp, 0x10
test eax, eax
jbe 0x12e10754
mov eax, 1
mov dword [0x131a966c], eax
add esp, 0x208
ret
mov eax, dword [0x131a966c]
add esp, 0x208
ret
Function at 0x12e10ab0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
cmp esi, ebx
jne 0x12e10ac7
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0x2e
push esi
call fcn.12f5c984
add esp, 8
cmp eax, ebx
jne 0x12e10ade
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push str..lnk
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
je 0x12e10af8
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
xor eax, eax
mov byte [esp + 8], 0x4c
mov dword [esp + 0x11], eax
mov byte [esp + 9], bl
mov word [esp + 0x15], ax
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov byte [esp + 0xa], bl
mov byte [esp + 0xb], bl
mov byte [esp + 0xc], 1
mov byte [esp + 0xd], 0x14
mov byte [esp + 0xe], 2
mov byte [esp + 0x10], bl
mov dword [esp + 0x1c], ebx
push ebx
je 0x12e10b49
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push 7
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x12e10b7d
push ebx
push 3
push ebx
push 3
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x12e10b7d
lea eax, [esp + 0x1c]
push ebx
push eax
lea ecx, [esp + 0x18]
push 7
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 7
lea edi, [esp + 0xc]
lea esi, [esp + 0x14]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
mov eax, edx
pop edi
pop esi
pop ebx
sete al
add esp, 0x10
ret
Function at 0x12e12990
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x114
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
xor ebp, ebp
cmp ebx, ebp
jne 0x12e129b0
pop ebp
xor eax, eax
pop ebx
add esp, 0x114
ret
mov eax, dword [0x131a9db4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebp
push edi
je 0x12e129dd
call esi
cmp eax, dword [0x131a9db4]
jb 0x12e129dd
call esi
mov ecx, dword [0x131a9db4]
add ecx, 0x493e0
cmp ecx, eax
jae 0x12e129fe
mov ecx, 0xc8
xor eax, eax
mov edi, 0x131a9a8c
mov dword [0x131a9db0], ebp
rep stosd dword es:[edi], eax
mov dword [0x131a9dac], ebp
call esi
mov dword [0x131a9db4], eax
mov esi, dword [0x131a9dac]
mov dword [esp + 0x14], ebp
cmp esi, 0x64
jbe 0x12e12a18
mov esi, 0x64
mov dword [0x131a9dac], esi
xor edi, edi
cmp esi, ebp
jbe 0x12e12a3f
mov ebp, 0x131a9a8c
push ebp
push ebx
call fcn.12f5e02c
add esp, 8
test eax, eax
je 0x12e12b4f
inc edi
add ebp, 8
cmp edi, esi
jb 0x12e12a23
xor ebp, ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebp
push ebp
push SysReAllocStringLen
mov dword [esp + 0x24], ebp
call esi
test eax, eax
jne 0x12e12b40
mov ecx, 0x40
lea edi, [esp + 0x21]
mov byte [esp + 0x20], al
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
push str._sShellNew
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x20], ebp
push eax
call fcn.12f5cf6d
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push 0x20019
push ebp
push edx
push eax
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x12e12b39
mov ecx, dword [esp + 0x18]
push ecx
call ebp
mov edx, dword [0x131a9dac]
mov dword [esp + 0x14], 1
cmp edx, 0x64
jae 0x12e12b39
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx*8 + 0x131a9a8c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc edx
mov dword [0x131a9dac], edx
mov byte [ecx + edx*8 + 0x131a9a84], al
mov eax, dword [0x13199068]
test eax, eax
je 0x12e12b39
push edx
push str.IsShellNewExtension_2_match_g_dwShellNewExtNum__d_
push str.ShellNew
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
mov eax, dword [0x13199068]
test eax, eax
je 0x12e12b6c
push str.IsShellNewExtension_1_match
push str.ShellNew
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x114
ret
Function at 0x12e12c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
test ebx, ebx
jne 0x12e12c77
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0x2f
mov word [esp + 0x10], 0x22
mov word [esp + 0x12], 0x3a
mov word [esp + 0x14], 0x2a
mov word [esp + 0x16], 0x3f
mov word [esp + 0x18], 0x3c
mov word [esp + 0x1a], 0x3e
mov word [esp + 0x1c], 0x7c
xor esi, esi
lea edi, [esp + 0xc]
mov ax, word [edi]
push eax
push ebx
call fcn.12f5d099
add esp, 8
test eax, eax
jne 0x12e12c6e
inc esi
add edi, 2
cmp esi, 9
jb 0x12e12cbc
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x12e1ba30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1305c5f8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ecx, dword [0x131aa2fc]
xor ebx, ebx
cmp ecx, ebx
je 0x12e1ba72
cmp eax, ecx
jb 0x12e1ba72
add ecx, 0x493e0
cmp ecx, eax
ja 0x12e1bb29
mov ecx, 0x82
xor eax, eax
mov edi, 0x131aa0f4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
call fcn.12e9bf00
push 1
push ebx
push ecx
mov dword [esp + 0x4c], ebx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.password_restriction_messagetext
call fcn.12f46b50
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c], bl
call fcn.12e9c110
lea ecx, [esp + 0x14]
call fcn.12e9c180
test eax, eax
je 0x12e1bb11
push 0x131912a8
lea ecx, [esp + 0x14]
call fcn.12f46b50
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
mov byte [esp + 0x44], 2
call fcn.12e9c840
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
cmp eax, ebx
je 0x12e1bb04
push 0x103
push eax
lea ecx, [esp + 0x18]
call fcn.12f47fc0
push eax
push 0x131aa0f4
call fcn.12f5c57b
add esp, 0xc
lea ecx, [esp + 0x10]
mov byte [esp + 0x40], bl
call fcn.12f472f0
call esi
mov dword [0x131aa2fc], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x40], 0xffffffff
call fcn.12e9c070
xor edx, edx
cmp word [0x131aa0f4], bx
setne dl
mov ebp, edx
cmp ebp, ebx
je 0x12e1bb70
mov esi, dword [esp + 0x48]
cmp esi, ebx
je 0x12e1bb70
mov edx, dword [esp + 0x4c]
cmp edx, ebx
jle 0x12e1bb70
lea ecx, [edx + edx]
xor eax, eax
mov ebx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
push edx
push 0x131aa0f4
rep stosb byte es:[edi], al
push esi
call fcn.12f5c57b
add esp, 0xc
mov ecx, dword [esp + 0x38]
pop edi
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret
Function at 0x12e22970
Capabilities:
Get file attributes
Get graphical window text

Disassembly:
sub esp, 0x208
push ebp
push esi
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x13199068]
cmp eax, ebp
je 0x12e229a0
push esi
push str.GetPathFromForegroundWindow_1__Hwnd_:_0x_08x_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x10
push ebx
cmp esi, ebp
push edi
je 0x12e22b4c
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push 0x103
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [0x13199068], ebp
je 0x12e229f0
lea ecx, [esp + 0x10]
push ecx
push str.GetPathFromForegroundWindow_2__HwndName_:__s_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x10
mov eax, dword [str.CabinetWClass]
lea edx, [esp + 0x10]
push edx
push eax
call fcn.12f5e2a4
add esp, 8
test eax, eax
jne 0x12e22b4c
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, 0x130783d4
mov ecx, dword [edi]
push 0
push ecx
push 0
push esi
call ebx
mov esi, eax
test esi, esi
je 0x12e22a31
add edi, 4
cmp edi, str.Enable_DDE_Re_Broadcast
jb 0x12e22a16
mov eax, dword [0x13199068]
test eax, eax
je 0x12e22a4f
push esi
push str.GetPathFromForegroundWindow_3__DstHwnd_:__d_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x10
test esi, esi
je 0x12e22b4c
lea edx, [esp + 0x10]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x10]
push 0x103
push edx
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x10]
push 0x13102e9c
push eax
call fcn.12f5c53a
mov esi, eax
mov eax, dword [0x13199068]
add esp, 8
test eax, eax
je 0x12e22ab7
test esi, esi
mov eax, esi
jne 0x12e22a9d
mov eax, 0x131912a8
lea ecx, [esp + 0x10]
push eax
push ecx
push str.GetPathFromForegroundWindow_4__szName_:__s___Dir_:__s_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x14
test esi, esi
jne 0x12e22b08
lea edx, [esp + 0x10]
push 0x13102e24
push edx
call fcn.12f5c53a
mov esi, eax
add esp, 8
test esi, esi
je 0x12e22ad6
sub esi, 2
mov eax, dword [0x13199068]
test eax, eax
je 0x12e22b04
test esi, esi
mov eax, esi
jne 0x12e22aea
mov eax, 0x131912a8
push eax
lea eax, [esp + 0x14]
push eax
push str.GetPathFromForegroundWindow_5__DstHwndName:_s___Dir2:_s_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x14
test esi, esi
je 0x12e22b4c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e22b30
push ebx
push esi
push str.GetPathFromForegroundWindow_6__Dir:_s___Attr:0x_08x_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x14
cmp ebx, 0xffffffff
je 0x12e22b4c
test bl, 0x10
je 0x12e22b4c
mov ecx, dword [esp + 0x21c]
push esi
call fcn.12f47570
mov ebp, 1
mov eax, dword [0x13199068]
pop edi
test eax, eax
pop ebx
je 0x12e22b76
mov ecx, dword [esp + 0x214]
mov edx, dword [ecx]
push edx
push ebp
push str.GetPathFromForegroundWindow__ret_:__d___Dir:_s_
push str.udisk
push 4
call fcn.12dad750
add esp, 0x14
mov eax, ebp
pop esi
pop ebp
add esp, 0x208
ret
Function at 0x12e282d0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x44]
push ebx
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x50]
push ebp
mov dword [esp + 0x24], eax
push esi
lea eax, [esp + 0xc]
push edi
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x40]
push eax
push 0x12e28180
mov dword [esp + 0x20], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov edi, 1
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x12e283f5
call fcn.12e28220
test eax, eax
je 0x12e283f5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.12e5c5e0
add esp, 4
test eax, eax
je 0x12e283f5
mov ebp, dword [sym.imp.USER32.dll_GetPropW]
cmp edi, 0x14
jg 0x12e283f5
push 0x12c
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x12e283bf
push str.ddeconv
push ebx
call ebp
mov esi, eax
mov eax, dword [0x13199068]
test eax, eax
je 0x12e283bb
push esi
push str.HandlerBroadcastMessage_GetPropW_0x_x__r_n
push str.DDELimit
push 4
call fcn.12dad750
add esp, 0x10
test esi, esi
jne 0x12e283f5
mov eax, dword [0x13199068]
test eax, eax
je 0x12e283dd
push edi
push str.HandlerBroadcastMessage_Time__d__r_n
push str.DDELimit
push 4
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x12e28180
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x12e2837a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret