joyce8/EMBER2024-capa huggingface dataset:
Function at 0x106e740
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov byte [eax], bl
mov eax, dword [ebp + 0xc]
push edi
mov byte [eax], bl
lea eax, [ebp - 4]
push eax
push 0x2000000
push ebx
mov edi, 0x1013a28
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
je 0x106e7fa
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 4
cmp esi, ebx
je 0x106e798
push esi
push 0xfb3013b
jmp 0x106e8a9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
mov edi, 0x10139f8
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x106e7f2
cmp dword [ebp - 0xc], 4
jne 0x106e807
cmp dword [ebp - 8], ebx
je 0x106e807
push 4
lea eax, [ebp - 8]
push eax
push 4
push ebx
push edi
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x106e7ea
push esi
push 0xfc7013b
jmp 0x106e8a9
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x106e807
push eax
push 0xfcf013b
jmp 0x106e801
push 2
push 0xfd5013b
push edi
call fcn.0108c53e
cmp dword [ebp - 4], ebx
je 0x106e818
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x2000000
push ebx
mov edi, 0x1013970
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
je 0x106e8c1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 4
cmp esi, ebx
je 0x106e857
push esi
push 0xfec013b
jmp 0x106e8a9
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
mov edi, 0x10073b8
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x106e8b9
cmp dword [ebp - 0xc], 4
jne 0x106e8ce
test dword [ebp - 8], 8
je 0x106e8ce
and dword [ebp - 8], 0xfffffff7
push 4
lea eax, [ebp - 8]
push eax
push 4
push ebx
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
je 0x106e8b1
push esi
push 0x1001013b
push edi
call fcn.0108c53e
jmp 0x106e8d0
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
jmp 0x106e8ce
push eax
push 0x1009013b
jmp 0x106e8c8
push 2
push 0x100f013b
push edi
call fcn.0108c53e
xor esi, esi
cmp esi, 5
jne 0x106e8dc
push 0xb0c
jmp 0x106e8ef
mov eax, dword [ebp + 8]
cmp byte [eax], bl
jne 0x106e8ea
mov eax, dword [ebp + 0xc]
cmp byte [eax], bl
je 0x106e901
push 0xb0a
call fcn.0108bbbd
push eax
push 0x1001d34
call fcn.0109c1c3
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x106e90f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.01091ee9
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x106e921
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
cmp byte [ebp + 8], 0
jne 0x106e93c
cmp byte [ebp + 0xc], 0
je 0x106ea65
push ebx
push esi
push edi
push 0xb0b
call fcn.0108bbbd
push eax
push 0x1001d34
call fcn.0109c1c3
cmp byte [ebp + 8], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop ecx
pop ecx
mov esi, 0x2000000
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
je 0x106e9d2
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0x1013a28
push ebx
call edi
test eax, eax
je 0x106e98c
push eax
push 0x104b013b
push 0x1013a28
jmp 0x106e9ba
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x10139f8
push dword [ebp - 4]
mov dword [ebp + 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x106e9bf
push eax
push 0x1057013b
push 0x10139f8
call fcn.0108c53e
cmp dword [ebp - 4], 0
je 0x106e9d2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
cmp byte [ebp + 0xc], 0
je 0x106ea53
lea ecx, [ebp - 4]
push ecx
push esi
xor eax, eax
push eax
mov esi, 0x1013970
push esi
push ebx
mov dword [ebp - 8], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], 4
call edi
test eax, eax
je 0x106ea02
push eax
push 0x1070013b
jmp 0x106ea4d
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov esi, 0x10073b8
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x106ea2b
push eax
push 0x1079013b
jmp 0x106ea4d
or dword [ebp + 8], 8
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x106ea53
push eax
push 0x1083013b
push esi
call fcn.0108c53e
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x106ea65
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x10791ea
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push 0xa0
mov eax, 0x10c1171
call fcn.01077dad
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x107920d
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 8], ebx
je 0x1079254
push ebx
push SysReAllocString
push dword [ebp + 8]
call fcn.0102ebba
test eax, eax
jge 0x1079254
push 0x80070057
push 0x1014840
push 0x89
push 0x10147b8
lea ecx, [ebp - 0x90]
call fcn.0102f190
push 0x10c2bec
lea eax, [ebp - 0x90]
push eax
call sub.msvcrt.dll__CxxThrowException
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
push 0xf0000040
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10792a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01078671
push eax
push 0x1014940
push 0x92
push 0x10147b8
lea ecx, [ebp - 0x58]
call fcn.0102f190
push 0x10c2bec
lea eax, [ebp - 0x58]
jmp 0x107924e
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x10792ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01078671
push eax
push 0x10148d8
push 0x95
push 0x10147b8
lea ecx, [ebp - 0x74]
call fcn.0102f190
push 0x10c2bec
lea eax, [ebp - 0x74]
jmp 0x107924e
push 0x10
call fcn.0107796d
pop ecx
mov ecx, eax
mov dword [ebp + 8], ecx
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x1079313
push 1
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0107d94b
jmp 0x1079315
xor eax, eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jne 0x107934f
push 0x8007000e
push 0x10142b8
push 0x98
push 0x10147b8
lea ecx, [ebp - 0xac]
call fcn.0102f190
push 0x10c2bec
lea eax, [ebp - 0xac]
jmp 0x107924e
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call fcn.01078d82
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
call fcn.01077e61
ret 0x10
Function at 0x10860d4
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x108612b
call fcn.01091f1e
push dword [ebp + 8]
mov edi, eax
push edi
push 0x103
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0108b4c7
push edi
push 0xd200ca
call fcn.0108c503
jmp 0x108617f
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x108616c
call fcn.01091f1e
push dword [ebp + 8]
mov edi, eax
push edi
push 0x11e
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0108b4c7
push edi
push 0xdf00ca
call fcn.0108c503
jmp 0x1086173
mov dword [ebp - 4], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
jne 0x1086186
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x18

Function at 0x1086e9d
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 2
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x1086ed1
call fcn.01091f1e
mov edi, eax
push edi
push 0xabf00ca
call fcn.0108c503
jmp 0x1086f3c
push esi
xor esi, esi
cmp dword [ebp - 0x10], esi
jbe 0x1086f3b
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1086f0c
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jne 0x1086f04
add eax, 8
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1086f1b
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x1086ed9
jmp 0x1086f3b
call fcn.01091f1e
mov edi, eax
push edi
push 0xac700ca
jmp 0x1086f36
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
jne 0x1086f3b
call fcn.01091f1e
mov edi, eax
push edi
push 0xad500ca
call fcn.0108c503
pop esi
mov eax, edi
pop edi
leave
ret 8
Function at 0x10870b9
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [esi], ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x108710d
call fcn.01091f1e
push eax
push 0xb6b00ca
mov dword [ebp - 8], eax
call fcn.0108c503
jmp 0x10871b1
cmp dword [ebp - 0xc], ebx
je 0x10871b1
cmp dword [ebp - 4], ebx
je 0x10871b1
push edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
push 0xc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x108714a
call fcn.01091f1e
push eax
push 0xb7a00ca
jmp 0x108719a
cmp dword [ebp - 0x24], ebx
jbe 0x10871b0
xor edi, edi
cmp dword [ebp - 0x24], ebx
jbe 0x10871ab
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x108718f
mov eax, dword [ebp - 0x10]
mov cl, byte [eax]
cmp cl, bl
je 0x1087176
cmp cl, 1
jne 0x1087187
push dword [ebp + 0xc]
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x10871a4
inc edi
cmp edi, dword [ebp - 0x24]
jb 0x1087156
jmp 0x10871ab
call fcn.01091f1e
push eax
push 0xb8500ca
mov dword [ebp - 8], eax
call fcn.0108c503
jmp 0x10871b0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
pop edi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret 0xc
Function at 0x1088da4
Capabilities:
Get user security identifier

Disassembly:
push 0x320
mov eax, 0x10c22fe
call fcn.01077de8
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x31c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x31c]
push eax
push 2
call fcn.0108d9f6
mov esi, eax
test esi, esi
je 0x1088de9
push esi
push 0x80600ca
jmp 0x1088eaa
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x31c]
mov dword [ebp - 0x324], 0x100
push 0
mov dword [ebp - 0x328], 0x104
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1088e4c
call fcn.01091f1e
mov esi, eax
push esi
push 0x81600ca
push dword [ebp - 0x31c]
call fcn.0108c53e
jmp 0x1088eaf
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.010ad19c
test eax, eax
jne 0x1088e72
call fcn.01091f1e
mov esi, eax
push esi
push 0x81c00ca
jmp 0x1088eaa
push edi
push dword [ebp - 0x320]
push 0x101b250
call fcn.010b3e03
mov esi, eax
test esi, esi
je 0x1088e91
push esi
push 0x82300ca
jmp 0x1088eaa
push ebx
push 0
push 0x101b0d8
call fcn.010b3e03
mov esi, eax
test esi, esi
je 0x1088eaf
push esi
push 0x82900ca
call fcn.0108c503
cmp dword [ebp - 0x320], 0
je 0x1088ec4
push dword [ebp - 0x320]
call dword [sym.imp.KERNEL32.dll_LocalFree]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call fcn.01030aff
mov eax, esi
call fcn.01077e7a
ret 8
Function at 0x108a638
Capabilities:
Hide graphical window

Disassembly:
push 0x10
mov eax, 0x10c23f7
call fcn.01077d75
xor edi, edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], edi
call fcn.010b3ce7
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x20], edi
setne al
cmp byte [esi + 0x19], 0
mov dword [ebp + 0x20], eax
je 0x108a66c
or dword [ebp + 0x20], 2
push 0x7f02
push edi
mov edi, dword [sym.imp.USER32.dll_LoadCursorW]
call edi
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp + 0x20]
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 0x10]
call sub.certcli.dll_Ordinal_210
push 0x7f00
push 0
mov dword [ebp + 0x20], eax
call edi
push eax
call ebx
cmp dword [ebp + 0x20], 0
je 0x108a6c3
push dword [ebp + 0x20]
and dword [ebp - 0x14], 0
push 0x1f300ce
call fcn.0108c503
mov ecx, dword [ebp + 0x24]
xor eax, eax
cmp eax, dword [ebp - 0x14]
sbb eax, eax
neg eax
push eax
push dword [ebp + 0x14]
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ebx, dword [ebp + 0x18]
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x108a5e4
push 0xfffffffffffffffc
push ebx
call edi
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x1c]
push 0xffffffffffffffeb
push ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
call edi
push esi
push 0xffffffffffffffeb
push dword [ebp + 0x1c]
call edi
push 0x3ce
lea ecx, [ebp - 0x1c]
call fcn.010b3cf6
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x108a72c
mov eax, 0x1002060
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov edi, 0x3cf
push edi
push dword [ebp + 0x10]
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push edi
push dword [ebp + 0x10]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp - 0x10], 0
je 0x108a762
push dword [ebp - 0x10]
call sub.CRYPTUI.dll_CryptUIDlgFreeCAContext
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010b3b70
xor eax, eax
call fcn.01077e61
ret 0x20
Function at 0x108a77d
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
xor edi, edi
push edi
push edi
push 0xe
push dword [ebp + 8]
mov dword [eax], edi
call esi
mov ebx, eax
test ebx, ebx
jle 0x108a85c
lea eax, [ebx + ebx + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x108a7c4
mov eax, 0x8007000e
push eax
push 0x5f00ce
jmp 0x108a7df
push edi
lea eax, [ebx + 1]
push eax
push 0xd
push dword [ebp + 8]
call esi
cmp ebx, eax
je 0x108a7e8
mov eax, 0x80070018
push eax
push 0x6500ce
mov esi, eax
call fcn.0108c503
jmp 0x108a85e
mov eax, edi
mov ebx, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x108a7ef
sub eax, edx
sar eax, 1
lea esi, [edi + eax*2 - 2]
jmp 0x108a819
movzx eax, word [esi]
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
je 0x108a81d
xor eax, eax
mov word [esi], ax
dec esi
dec esi
cmp esi, edi
ja 0x108a803
cmp edi, esi
ja 0x108a85c
movzx eax, word [ebx]
xor ecx, ecx
cmp cx, ax
je 0x108a83d
push eax
call dword [sym.imp.msvcrt.dll_iswspace]
pop ecx
test eax, eax
je 0x108a83d
inc ebx
inc ebx
cmp ebx, esi
jbe 0x108a821
cmp esi, ebx
jb 0x108a85c
sub esi, ebx
shr esi, 1
lea eax, [esi + esi + 4]
push eax
push ebx
push edi
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [eax], edi
xor edi, edi
xor esi, esi
test edi, edi
je 0x108a869
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x108a877
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x10d0640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x420], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, eax
xor eax, eax
inc eax
mov dword [ebp - 0x41c], ecx
cmp ecx, ebx
je 0x108a8ca
cmp ecx, eax
je 0x108a8ca
push ecx
push 0xf000ce
call fcn.0108c503
jmp 0x108a9ba
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x147
push dword [esi + 0xc]
mov dword [ebp - 0x420], eax
xor eax, eax
mov dword [ebp - 0x41c], ebx
mov dword [esi + 0x14], 5
mov word [ebp - 0x20c], ax
call edi
push ebx
push eax
push 0x149
push dword [esi + 0xc]
mov dword [ebp - 0x424], eax
call edi
mov ebx, 0x104
cmp eax, ebx
jae 0x108a92a
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x424]
push 0x148
push dword [esi + 0xc]
call edi
xor eax, eax
mov word [ebp - 0x414], ax
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor edi, edi
cmp word [ebp - 0x20c], di
je 0x108a9a4
cmp word [ebp - 0x414], di
je 0x108a9a4
push edi
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.010af74c
mov dword [ebp - 0x41c], eax
cmp eax, edi
jne 0x108a9ba
mov eax, dword [ebp - 0x418]
test eax, eax
je 0x108a9d8
mov ecx, dword [eax + 4]
mov dword [esi + 0x14], ecx
push dword [eax + 4]
call fcn.01066ac0
test eax, eax
je 0x108a9a0
push 5
jmp 0x108a9a5
push 0
jmp 0x108a9a5
push edi
push 0x3cf
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp - 0x418], 0
je 0x108a9cf
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x420], 0
je 0x108a9de
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01077d0b
leave
ret 4
Function at 0x108d12a
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x10d0640]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x94], edi
cmp dword [esi], edi
jne 0x108d16a
mov esi, 0x80070057
push esi
push 0x783019a
jmp 0x108d2ad
push 0xf0000000
push 1
push 0x1012830
push edi
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x108d19a
call fcn.01091f1e
mov esi, eax
push esi
push 0x792019a
jmp 0x108d2ad
lea eax, [ebp - 0x94]
push eax
push edi
push edi
push 0x8004
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x108d1ca
call fcn.01091f1e
mov esi, eax
push esi
push 0x79a019a
jmp 0x108d2ad
push edi
push dword [esi]
push dword [esi + 4]
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x108d1f2
call fcn.01091f1e
mov esi, eax
push esi
push 0x7a2019a
jmp 0x108d2ad
push edi
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x18]
push eax
push 2
push dword [ebp - 0x94]
mov dword [ebp - 0x9c], 0x14
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x108d22c
call fcn.01091f1e
mov esi, eax
push esi
push 0x7a9019a
jmp 0x108d2ad
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x9c]
mov dword [ebp - 0xa0], 0x78
push 1
call fcn.01091b77
mov esi, eax
cmp esi, edi
je 0x108d263
push esi
push 0x7b3019a
jmp 0x108d2ad
xor edx, edx
lea eax, [ebp - 0x90]
mov ecx, eax
cmp dx, word [ebp - 0x90]
je 0x108d28f
movzx edx, word [ecx]
push 0x20
pop esi
cmp si, dx
je 0x108d286
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
xor edx, edx
cmp dx, word [ecx]
jne 0x108d276
xor ecx, ecx
mov word [eax], cx
push ebx
lea eax, [ebp - 0x90]
push eax
call fcn.01091ad0
mov esi, eax
cmp esi, edi
je 0x108d2b2
push esi
push 0x7cb019a
call fcn.0108c503
cmp dword [ebp - 0x94], edi
je 0x108d2c6
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x98], edi
je 0x108d2db
push edi
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01077d0b
leave
ret 8
Function at 0x108d862
Capabilities:
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10d0640]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.msvcrt.dll_iswalpha]
je 0x108d8b1
movzx eax, word [esi]
push eax
call edi
pop ecx
test eax, eax
je 0x108d8b1
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x108d8b1
xor eax, eax
cmp ax, word [esi + 4]
jne 0x108d8b1
mov eax, 0x800700a1
push eax
push 0xa29019a
jmp 0x108d8fc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x108d8de
call fcn.01091f1e
mov edi, eax
push edi
push 0xa32019a
jmp 0x108d8fe
cmp dword [ebp + 0xc], 0
je 0x108d972
cmp dword [ebp - 0x418], 0
jne 0x108d904
mov eax, 0x800700a1
push eax
push 0xa39019a
mov edi, eax
push esi
jmp 0x108d9d6
push dword [ebp - 0x20c]
lea esi, [ebp - 0x20c]
call edi
pop ecx
push 0x5c
pop edx
test eax, eax
je 0x108d939
push 0x3a
pop eax
cmp ax, word [ebp - 0x20a]
jne 0x108d939
mov eax, edx
cmp ax, word [ebp - 0x208]
jne 0x108d939
lea esi, [ebp - 0x206]
jmp 0x108d953
mov eax, edx
cmp ax, word [ebp - 0x20c]
jne 0x108d953
cmp ax, word [ebp - 0x20a]
jne 0x108d953
lea esi, [ebp - 0x208]
mov ecx, dword [ebp - 0x418]
cmp ecx, esi
jbe 0x108d96d
lea eax, [ecx - 2]
cmp dx, word [eax]
jne 0x108d96d
mov ecx, eax
mov dword [ebp - 0x418], ecx
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x101b534
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x108d9b1
call fcn.01091f1e
push 0x80070005
mov edi, eax
push edi
push 0xa51019a
lea eax, [ebp - 0x20c]
push eax
call fcn.0108c457
jmp 0x108d9df
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x108d9dd
call fcn.01091f1e
mov edi, eax
push edi
push 0xa57019a
lea eax, [ebp - 0x414]
push eax
call fcn.0108c53e
jmp 0x108d9df
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01077d0b
leave
ret 8