joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a7173
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100a71bd
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100a7164
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100a7173
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x104ace16
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100a71c4
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1008e03a
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100a7263
add edi, 4
add eax, 2
dec ecx
jne 0x100a71a9
call 0x100a7210
loope 0x100a7206
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100a7260
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100a7271
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x100a7224
cmp eax, ecx
ja 0x100a7224
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100a72ae
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100a72a4
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1008e519
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1002e1ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1002e1bd
pop dword [ebp - 0x18]
mov eax, 0xa3e11b6b
sub eax, 0x93de39ae
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x40377
push 0
mov eax, 0x3b3128d0
add eax, 0xd4d5d81c
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x849318fd
add ecx, 0x7b6d2741
mov ebx, eax
mov edx, 0x10185c00
add edx, dword [ebp - 0x18]
mov edi, 0x73772f69
xor dword [ebp - 0x10], 0x7f0de7c7
mov esi, dword [edx]
add dword [ebp - 4], 0x348089df
add esi, edi
sub dword [ebp - 4], 0x2e93c917
mov dword [ebx], esi
xor dword [ebp - 0xc], edi
add ebx, 0x91a1c5b1
sub ebx, 0x91a1c5ad
add edx, 4
loop 0x1002e210
add eax, 0x208d4d06
sub eax, 0x208c593b
mov ebx, eax
add eax, 0xbbabcc69
sub eax, 0xbbabcc64
mov ecx, 0x3713763a
sub ecx, 0x2713763a
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x100696fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x10069780
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1006974a
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1006974a
cmp edi, ebx
jge 0x1006974a
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1006977a
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1006977a
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x10069792
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x10069a28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x1016c088], al
je 0x10069a5f
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10069ac3
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1002e1ae
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1002e1ae
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.1002e1ae
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e864
leave
ret 0x10
Function at 0x10069ad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10069b00
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10069b31
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10069b2f
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1002e1ae
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10069b31
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006e864
leave
ret 8

Function at 0x10069bcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
mov eax, dword [ebp + 8]
je 0x10069bf4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10069c0e
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1002e1ae
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1006e864
leave
ret 4

Function at 0x1006e864
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b1980]
jne 0x1006e86e
repz ret
jmp fcn.1006ef63
Function at 0x42653a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x42654b
mov dword [edi], ebx
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x42668e
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x13c4], ebx
cmp ecx, ebx
je 0x42668e
mov eax, dword [ebp + 0x14]
cmp eax, ebx
jl 0x42668e
cmp byte [esi + 0x1390], bl
je 0x42658d
cmp edi, ebx
je 0x426581
or dword [edi], 0xffffffff
or dword [esi + 0x13c4], 0xffffffff
jmp 0x4266a1
cmp eax, ebx
jne 0x4265a2
cmp edi, ebx
je 0x426597
mov dword [edi], ebx
mov dword [esi + 0x13c4], ebx
jmp 0x4266a1
mov dword [esi + 0x13a8], eax
mov dword [esi + 0x13a4], ecx
jmp 0x426639
cmp dword [esi + 0x1398], ebx
jne 0x426605
push dword [esi]
call fcn.00426395
pop ecx
test al, al
jne 0x426605
push dword [esi]
lea ebx, [esi + 4]
push 0x1388
push 1
push ebx
call fcn.0043084e
push dword [esi]
mov dword [ebp + 8], eax
call fcn.00430cb6
add esp, 0x14
test eax, eax
jne 0x426672
mov eax, dword [ebp + 8]
mov dword [esi + 0x1394], ebx
mov dword [esi + 0x138c], eax
mov dword [esi + 0x1398], eax
xor ebx, ebx
lea eax, [esi + 0x1394]
push eax
call fcn.00426257
cmp eax, ebx
jne 0x426654
push dword [esi]
call fcn.00426395
pop ecx
test al, al
je 0x426631
cmp dword [esi + 0x1398], ebx
jne 0x426631
cmp dword [esi + 0x13a8], ebx
ja 0x426679
cmp dword [esi + 0x13a8], ebx
je 0x42667d
push dword [esi]
call fcn.00430cb6
pop ecx
test eax, eax
je 0x4265b3
push 0xfffffffffffffffa
pop eax
cmp edi, ebx
je 0x42669b
mov dword [edi], eax
jmp 0x42669b
push 4
pop ecx
cmp eax, ecx
jne 0x42664c
cmp edi, ebx
je 0x426661
mov dword [edi], ecx
mov eax, dword [ebp + 0x14]
sub eax, dword [esi + 0x13a8]
mov dword [esi + 0x13c4], ecx
jmp 0x4266a3
push 0xfffffffffffffffa
pop eax
test edi, edi
jmp 0x42664e
push 0xfffffffffffffff9
jmp 0x42664b
cmp edi, ebx
je 0x426683
mov dword [edi], ebx
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x13c4], ebx
jmp 0x4266a3
push 0xfffffffffffffffe
pop eax
cmp edi, ebx
je 0x426697
mov dword [edi], eax
cmp esi, ebx
je 0x4266a1
mov dword [esi + 0x13c4], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x42ac65
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
dec ecx
mov esi, edx
sub esi, eax
sub edi, eax
mov dword [ebp - 8], ecx
sub ebx, eax
mov dword [ebp - 4], 0x40
mov ecx, dword [eax]
mov edx, dword [edi + eax]
xor edx, ecx
and edx, dword [ebp - 8]
xor ecx, edx
mov dword [esi + eax], ecx
mov ecx, dword [edi + eax]
xor ecx, edx
mov dword [ebx + eax], ecx
add eax, 4
dec dword [ebp - 4]
jne 0x42ac86
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x40500d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40501c
pop dword [ebp - 0x14]
mov eax, 0x2f806ff6
add eax, 0xd0bfe026
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xb05d9c25
add dword [ebp - 0x24], 0x9df4a926
mov dword [ebp - 0x20], 0xe159b0c
sub dword [ebp - 0x20], 0xdbe24ec7
mov dword [ebp - 0x1c], 0x90878a10
add dword [ebp - 0x1c], 0xbbc4ba1e
mov dword [ebp - 0x18], 0xfcd30e6f
sub dword [ebp - 0x18], 0xfcd30e6f
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x46707d12
sub dword [ebp - 0x24], 0xd1fe13bc
mov dword [ebp - 0x20], 0xc123ad29
sub dword [ebp - 0x20], 0x7fb74bb4
mov dword [ebp - 0x1c], 0xc2e42aaf
add dword [ebp - 0x1c], 0xa08b41bd
mov dword [ebp - 0x18], 0x9bd834c0
add dword [ebp - 0x18], 0x6427cb40
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xc6aec2fe
sub eax, 0xc66df2b6
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x39460
push 0
call eax
mov ecx, 0x472e
xor esi, esi
add esi, eax
mov edi, 0xf18be252
add edi, 0xeb5cdae
add edi, dword [ebp - 0x14]
mov edx, 0x61c7ba76
add edx, 0xcdfadaad
add dword [ebp - 0x10], 0x542d2673
mov ebx, dword [edi]
add dword [ebp - 0x10], 0x8726ea2d
sub ebx, edx
mov dword [esi], ebx
xor dword [ebp - 8], eax
add esi, 0x3db4eed7
add esi, 0xc24b112d
add edi, 0x260ba3b0
sub edi, 0x260ba3ac
loop 0x405135
add eax, 0x10f8b
xor ebx, ebx
add ebx, eax
add eax, 0x3f0d55c5
add eax, 0xc0f2aa40
mov ecx, 0xae09721d
add ecx, 0x52368de3
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10109d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x1c]
push ebx
push esi
push edi
test edx, edx
je 0x10109fc
cmp word [edx], 0
jne 0x10109e0
mov dword [ebp + 0x1c], 0xe
jmp 0x1010a03
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10109e5
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp + 0x1c], eax
jmp 0x1010a03
mov dword [ebp + 0x1c], 0xa
mov ebx, 0x1001958
test edx, edx
je 0x1010a19
cmp word [edx], 0
jne 0x1010a1b
mov edx, 0x1001964
jmp 0x1010a1b
mov edx, ebx
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x1010a45
cmp word [edi], 0
jne 0x1010a2c
push 0xe
jmp 0x1010a47
mov eax, edi
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1010a31
sub eax, esi
sar eax, 1
lea ecx, [eax + eax + 2]
jmp 0x1010a48
push 0xa
pop ecx
test edi, edi
je 0x1010a5d
cmp word [edi], 0
jne 0x1010a59
mov eax, 0x1001964
jmp 0x1010a5f
mov eax, edi
jmp 0x1010a5f
mov eax, ebx
push 0
push 4
lea esi, [ebp + 0x24]
push esi
push 4
lea esi, [ebp + 0x20]
push esi
push dword [ebp + 0x1c]
push edx
push ecx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push 0x2b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x107d19c]
add esp, 0x38
pop edi
pop esi
pop ebx
pop ebp
ret 0x20
Function at 0x10185b0
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x106e2e2
call fcn.0100dba4
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, dword [esi + 0x2d8]
mov dword [ebp - 4], 0x12
test ecx, ecx
je 0x1018452
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x2d4]
mov byte [ebp - 4], 0x11
test ecx, ecx
je 0x1018467
mov eax, dword [ecx]
push 1
call dword [eax + 0x38]
mov eax, dword [esi + 0x2bc]
mov byte [ebp - 4], 0x10
test eax, eax
je 0x101847b
push eax
call fcn.010557a8
mov eax, dword [esi + 0x294]
mov byte [ebp - 4], 0xf
test eax, eax
je 0x101848f
push eax
call fcn.010557a8
mov eax, dword [esi + 0x268]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x10184a3
push eax
call fcn.010557a8
mov eax, dword [esi + 0x240]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x10184b7
push eax
call fcn.010557a8
mov eax, dword [esi + 0x218]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x10184cb
push eax
call fcn.010557a8
mov eax, dword [esi + 0x1f0]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x10184df
push eax
call fcn.010557a8
mov eax, dword [esi + 0x1c8]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x10184f3
push eax
call fcn.010557a8
mov eax, dword [esi + 0x1a0]
mov byte [ebp - 4], 9
test eax, eax
je 0x1018507
push eax
call fcn.010557a8
mov eax, dword [esi + 0x178]
mov byte [ebp - 4], 8
test eax, eax
je 0x101851b
push eax
call fcn.010557a8
mov eax, dword [esi + 0x150]
mov byte [ebp - 4], 7
test eax, eax
je 0x101852f
push eax
call fcn.010557a8
mov eax, dword [esi + 0x128]
mov byte [ebp - 4], 6
test eax, eax
je 0x1018543
push eax
call fcn.010557a8
mov eax, dword [esi + 0x100]
mov byte [ebp - 4], 5
test eax, eax
je 0x1018557
push eax
call fcn.010557a8
mov eax, dword [esi + 0xd8]
mov byte [ebp - 4], 4
test eax, eax
je 0x101856b
push eax
call fcn.010557a8
mov eax, dword [esi + 0xb0]
mov byte [ebp - 4], 3
test eax, eax
je 0x101857f
push eax
call fcn.010557a8
mov eax, dword [esi + 0x88]
mov byte [ebp - 4], 2
test eax, eax
je 0x1018593
push eax
call fcn.010557a8
mov eax, dword [esi + 0x60]
mov byte [ebp - 4], 1
test eax, eax
je 0x10185a4
push eax
call fcn.010557a8
mov eax, dword [esi + 0x38]
mov byte [ebp - 4], 0
test eax, eax
je 0x10185b5
push eax
call fcn.010557a8
mov esi, dword [esi + 0x14]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10185c6
push esi
call fcn.010557a8
call fcn.0100dc90
ret

Function at 0x1019ef7
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x106e810
call fcn.0100dbdc
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x1019f42
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x1019f42
mov dword [ebp + 0xc], ebx
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.0101711d
push eax
call fcn.01018e78
mov esi, eax
cmp esi, ebx
jge 0x1019f05
push dword [ebp + 0xc]
call fcn.0101472a
mov eax, esi
jmp 0x1019f47
cmp dword [ebp + 0xc], ebx
jne 0x1019f17
push ebx
call fcn.0101472a
mov eax, 0x80004003
jmp 0x1019f47
mov ecx, dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
mov byte [ebp - 4], 1
call dword [eax + 0x18]
mov dword [edi], eax
jmp 0x1019ef9
mov eax, 0x80070057
call fcn.0100dc90
ret 8
Function at 0x101e347
Capabilities:
Get common file path
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov edx, 0xfffffff
mov ecx, edx
sub ecx, eax
cmp ecx, dword [ebp + 8]
jae 0x101e273
call fcn.0101e0fc
mov ecx, eax
shr ecx, 1
cmp ecx, 8
jae 0x101e27f
push 8
pop ecx
cmp dword [ebp + 8], ecx
jae 0x101e28d
sub edx, ecx
cmp eax, edx
ja 0x101e28d
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [esi + 0xc]
add eax, ecx
push 0
push eax
shr edi, 2
call fcn.0101d33f
mov ecx, dword [esi + 4]
mov dword [ebp - 4], eax
mov ebx, edi
shl ebx, 2
push esi
add eax, ebx
push eax
mov eax, dword [esi + 8]
lea eax, [ecx + eax*4]
push eax
add ecx, ebx
push ecx
call fcn.010653e6
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], eax
cmp edi, edx
ja 0x101e302
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
sub edx, edi
push edx
push esi
push dword [ebp - 0xc]
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.010653e6
push eax
call fcn.01065414
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 4]
call fcn.01065414
add esp, 0x18
jmp 0x101e33a
push esi
mov edi, edx
push eax
shl edi, 2
lea eax, [edi + ecx]
push eax
push ecx
call fcn.010653e6
mov eax, dword [esi + 4]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 8]
lea ecx, [eax + ebx]
push esi
push dword [ebp - 4]
add edi, eax
push ecx
push edi
call fcn.010653e6
push eax
call fcn.01065414
add esp, 0xc
mov eax, dword [esi + 4]
pop edi
pop ebx
test eax, eax
je 0x101e34a
push eax
call fcn.0100d684
pop ecx
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
add dword [esi + 8], eax
pop esi
leave
ret 4

Function at 0x101e7f1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1080960
push 0x1c
call fcn.0100d7ab
xor esi, esi
pop ecx
pop ecx
cmp eax, esi
je 0x101e7f2
mov dword [eax + 4], esi
mov dword [eax], 0x1002c28
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], esi
jmp 0x101e7f4
xor eax, eax
push eax
call fcn.0105dff3
cmp eax, esi
pop esi
jne 0x101e806
mov eax, 0x8007000e
jmp 0x101e80d
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 4
Function at 0x101ebcc
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp + 8], ebx
je 0x101ed01
push edi
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call edi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x101ed00
push ebx
call edi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x101ecf7
mov edi, dword [sym.imp.GDI32.dll_SetLayout]
push 1
push dword [ebp - 8]
call edi
cmp eax, 0xffffffff
je 0x101ecee
push 1
push dword [ebp - 4]
call edi
cmp eax, 0xffffffff
je 0x101ecee
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x101ecee
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x101ece4
push esi
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
push eax
push 0x18
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [ebp - 0x24]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, eax
call edi
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
cmp esi, ebx
je 0x101ece3
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x101ece3
push ebx
push 1
push 1
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x101ecd4
push dword [ebp - 0x10]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 4]
call esi
mov edi, dword [sym.imp.USER32.dll_DrawIconEx]
push 2
push ebx
push ebx
push dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x44]
push dword [ebp + 8]
push ebx
push ebx
push dword [ebp - 8]
call edi
push 1
push ebx
push ebx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp + 8]
push ebx
push ebx
push dword [ebp - 4]
call edi
push dword [ebp - 0x18]
push dword [ebp - 8]
call esi
push dword [ebp - 0x1c]
push dword [ebp - 4]
call esi
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0xc], ebx
je 0x101ece3
push dword [ebp - 0xc]
call edi
pop esi
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
mov eax, dword [ebp - 0x18]
pop ebx
leave
ret 4
Function at 0x101edf4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esi, [ebp + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0101e9a4
test al, al
je 0x101ee1f
mov esi, dword [sym.imp.USER32.dll_IsRectEmpty]
lea eax, [ebp + 0xc]
push eax
call esi
test eax, eax
jne 0x101ee1f
lea eax, [ebp + 0x1c]
push eax
call esi
test eax, eax
jne 0x101ee1f
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x24]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x2c]
sub eax, ecx
lea esi, [eax + edx]
add eax, ecx
add eax, edx
mov dword [ebx], esi
mov dword [ebx + 8], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x28

Function at 0x101ef5c
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x107d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 0x23c], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push 7
pop ecx
mov dword [ebp - 0x218], eax
xor eax, eax
push 0x206
lea edi, [ebp - 0x238]
push eax
rep stosd dword es:[edi], eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.01055b42
xor edi, edi
add esp, 0xc
mov dword [ebp - 0x214], edi
cmp dword [ebp - 0x218], edi
jne 0x101eeca
mov dword [ebp - 0x210], 0x80070057
jmp 0x101efc1
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push 0x11
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp eax, edi
mov dword [ebp - 0x210], eax
jl 0x101efa2
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], 0x20b
cmp dword [ebp + 0xc], edi
je 0x101ef27
mov dword [ebp - 0x22c], 0x420b
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov ebx, eax
cmp ebx, edi
jne 0x101ef46
mov dword [ebp - 0x210], 1
jmp 0x101efa4
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x101ef88
mov dword [ebp - 0x210], 0x800700a1
mov eax, dword [0x107d1a4]
cmp eax, 0x107d1a4
je 0x101efa4
test byte [eax + 0x1c], 1
je 0x101efa4
push 0x1002cc0
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101099b
jmp 0x101efa4
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call fcn.01011fe0
mov dword [ebp - 0x210], eax
jmp 0x101efa4
mov ebx, edi
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x214], edi
je 0x101efba
push dword [ebp - 0x214]
call esi
cmp ebx, edi
je 0x101efc1
push ebx
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100db8f
leave
ret 0x10