joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4185ec
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407be0
mov eax, dword [0x42d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004149e5
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41862e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x41878a
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00421a10
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x48f140]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00418a12
mov ecx, dword [esi*4 + 0x48f140]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x418783
cmp eax, dword [edi + ecx + 0x24]
jne 0x418783
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418783
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00418a12
add esp, 0x14
test edx, edx
jl 0x418783
jg 0x4186f9
test eax, eax
jb 0x418783
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x418783
jl 0x418713
cmp dword [ebp - 0x1008], eax
ja 0x418783
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x418731
test ebx, ebx
je 0x41876a
cmp ecx, edi
jae 0x41876a
mov al, byte [ecx]
cmp al, 0xd
jne 0x41874b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x418757
cmp byte [ecx + 1], 0xa
jne 0x418757
inc ecx
jmp 0x418757
movzx eax, al
movsx eax, byte [eax + 0x42d9b0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x418731
cmp edx, ebx
jne 0x418731
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x418788
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406ca2
leave
ret
Function at 0x41ed7c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x48f140]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41edbc
cmp byte [ebx], 0xa
jne 0x41edbc
or byte [eax + edi + 0x28], 4
jmp 0x41edc1
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x41eebf
mov al, byte [edx]
cmp al, 0x1a
je 0x41eea1
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x41edf0
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x41ee15
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x41ee1f
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x41edd2
jmp 0x41eebf
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ee9c
cmp dword [ebp - 0xc], 0
je 0x41ee9c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x48f140]
test byte [eax + edi + 0x28], 0x48
je 0x41ee76
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41ee61
mov byte [esi], dl
jmp 0x41ee72
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x48f140]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41eebf
cmp byte [ebp - 1], 0xa
jne 0x41ee85
cmp esi, ebx
jne 0x41ee85
mov byte [esi], 0xa
jmp 0x41eebe
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00418a30
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41eebf
mov byte [esi], 0xd
jmp 0x41eebe
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x48f140]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41eebb
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41eebf
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41eec8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x48f140]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41ef0b
cmp word [esi], dx
jne 0x41ef0b
or byte [edi + eax + 0x28], 4
jmp 0x41ef10
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x41f063
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x41f043
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x41ef52
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41ef88
cmp eax, edx
jae 0x41ef94
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x41ef2a
jmp 0x41f063
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41f03f
cmp dword [ebp - 0x14], 0
je 0x41f03f
mov eax, dword [ebx*4 + 0x48f140]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x41f017
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x41efe0
mov word [esi], cx
jmp 0x41f013
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x48f140]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x48f140]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x48f140]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x41f063
pop ebx
cmp word [ebp - 4], bx
jne 0x41f028
cmp esi, dword [ebp + 0xc]
jne 0x41f028
mov word [esi], bx
jmp 0x41f060
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00418a30
add esp, 0x10
cmp word [ebp - 4], bx
je 0x41f063
push 0xd
jmp 0x41f05c
mov ecx, dword [ebx*4 + 0x48f140]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41f05a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41f063
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x101ebd0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 1
push 0x269
push 0x1003850
lea ecx, [ebp - 0x24]
call fcn.01055826
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor edi, edi
cmp dword [esi + 0x20], edi
jne 0x101ec2f
push edi
push edi
push 1
push edi
call ebx
mov dword [esi + 0x20], eax
cmp eax, edi
jne 0x101ec23
call fcn.0105d3b8
mov dword [ebp - 0x24], eax
mov eax, 0x270
mov word [ebp - 0x1e], ax
jmp 0x101ecfa
mov eax, 0x270
mov dword [ebp - 0x24], edi
mov word [ebp - 0x20], ax
cmp dword [esi + 0x24], edi
jne 0x101ec5d
push edi
push edi
push 1
push edi
call ebx
mov dword [esi + 0x24], eax
cmp eax, edi
jne 0x101ec51
call fcn.0105d3b8
mov dword [ebp - 0x24], eax
mov eax, 0x276
jmp 0x101ec1a
mov eax, 0x276
mov dword [ebp - 0x24], edi
mov word [ebp - 0x20], ax
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0xfa0
lea eax, [esi + 4]
push eax
call ebx
test eax, eax
jne 0x101ec81
call fcn.0105d3b8
mov dword [ebp - 0x24], eax
mov eax, 0x279
jmp 0x101ec1a
mov eax, 0x279
mov word [ebp - 0x20], ax
push 0xfa0
lea eax, [esi + 0x54]
push eax
mov dword [ebp - 0x24], edi
call ebx
test eax, eax
jne 0x101ecae
call fcn.0105d3b8
mov dword [ebp - 0x24], eax
mov eax, 0x27a
jmp 0x101ec1a
mov eax, 0x27a
mov dword [ebp - 0x24], edi
mov word [ebp - 0x20], ax
cmp dword [esi + 0x1c], edi
jne 0x101ecf4
push edi
push edi
push esi
push 0x101eba4
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
cmp eax, edi
jne 0x101ece8
call fcn.0105d3b8
mov dword [ebp - 0x24], eax
mov eax, 0x27f
jmp 0x101ec1a
mov eax, 0x27f
mov dword [ebp - 0x24], edi
mov word [ebp - 0x20], ax
mov dword [esi], 1
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x101f1c2
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4fc
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 1
push 0x2fc
push 0x10038e8
lea ecx, [ebp - 0x4fc]
mov dword [ebp - 0x4d4], eax
call fcn.01055826
xor edi, edi
push 0x2b0
lea eax, [ebp - 0x2b4]
push edi
push eax
mov dword [ebp - 0x2b8], edi
call sub.msvcrt.dll_memset
push 0x214
lea eax, [ebp - 0x4cc]
push edi
push eax
mov dword [ebp - 0x4d8], 0x100
mov dword [ebp - 0x4d0], edi
call sub.msvcrt.dll_memset
add esp, 0x18
cmp esi, edi
je 0x101f241
mov dword [esi], edi
mov eax, 0x306
cmp dword [ebp - 0x4d4], edi
jne 0x101f264
mov dword [ebp - 0x4fc], 0x80070057
mov word [ebp - 0x4f6], ax
jmp 0x101f315
mov word [ebp - 0x4f8], ax
mov eax, 0x307
cmp esi, edi
je 0x101f24e
mov dword [ebp - 0x4fc], edi
mov word [ebp - 0x4f8], ax
cmp dword [ebp + 0x10], edi
je 0x101f290
mov dword [ebp - 0x4d8], 0x101
push dword [ebp - 0x4d8]
lea eax, [ebp - 0x2b8]
push 0x2b4
push eax
push edi
push dword [ebp - 0x4d4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x101f307
lea eax, [ebp - 0x4d0]
push eax
xor eax, eax
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0x4d0], 0x218
setne al
or eax, 0x100
push eax
push 8
call dword [sym.imp.SHELL32.dll_SHGetStockIconInfo]
mov dword [ebp - 0x4fc], eax
cmp eax, edi
mov eax, 0x315
jge 0x101f2f8
mov dword [ebp - 0x4fc], 0x80004005
jmp 0x101f258
mov word [ebp - 0x4f8], ax
mov eax, dword [ebp - 0x4cc]
jmp 0x101f30d
mov eax, dword [ebp - 0x2b8]
mov dword [esi], eax
mov dword [ebp - 0x2b8], edi
cmp dword [ebp - 0x2b8], edi
je 0x101f32f
push dword [ebp - 0x2b8]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 0x2b8], edi
mov esi, dword [ebp - 0x4fc]
lea ecx, [ebp - 0x4fc]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01054fa7
leave
ret 0xc
Function at 0x10204b4
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
push 0x41e
push 0x10039a8
lea ecx, [ebp - 0x460]
mov dword [ebp - 0x43c], eax
call fcn.01055826
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 7
mov eax, 0x1010420
pop ecx
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x42c], eax
xor eax, eax
mov dword [ebp - 0x480], esi
lea edi, [ebp - 0x47c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x420], esi
lea edi, [ebp - 0x41c]
stosd dword es:[edi], eax
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x418]
push eax
push edi
push esi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x418], esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov dword [ebp - 0x460], eax
cmp eax, esi
mov eax, 0x429
jge 0x10205a3
mov word [ebp - 0x45a], ax
jmp 0x10206ec
push 0x104
mov word [ebp - 0x45c], ax
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.01061581
mov dword [ebp - 0x460], eax
cmp eax, esi
mov eax, 0x42e
jl 0x1020597
push dword [ebp + 0x14]
mov edx, dword [0x1077408]
lea ecx, [ebp - 0x438]
mov word [ebp - 0x45c], ax
call fcn.0106478e
mov dword [ebp - 0x460], eax
cmp eax, esi
mov eax, 0x433
jl 0x1020597
mov word [ebp - 0x45c], ax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x480]
push eax
mov dword [ebp - 0x41c], edi
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x470], 0x40
mov dword [ebp - 0x46c], 0x101501f
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov edi, eax
cmp edi, esi
je 0x10206ec
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10206e5
lea edx, [ebp - 0x20c]
lea ecx, [ebp - 0x42c]
call fcn.0106470b
mov dword [ebp - 0x460], eax
cmp eax, esi
mov eax, 0x444
jl 0x1020597
push 0x5c
pop edx
lea ecx, [ebp - 0x42c]
mov word [ebp - 0x45c], ax
call fcn.0106469a
mov dword [ebp - 0x460], eax
cmp eax, esi
mov eax, 0x445
jl 0x1020597
push dword [ebp - 0x42c]
mov word [ebp - 0x45c], ax
push dword [ebp - 0x43c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
call dword [sym.imp.SHELL32.dll_ILFree]
cmp dword [ebp - 0x418], esi
je 0x1020700
push dword [ebp - 0x418]
call dword [sym.imp.SHELL32.dll_ILFree]
mov esi, dword [ebp - 0x460]
lea ecx, [ebp - 0x42c]
call fcn.010635b3
lea ecx, [ebp - 0x438]
call fcn.010635b3
lea ecx, [ebp - 0x460]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 0x14
Function at 0x1026808
Capabilities:
Check if file exists
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 1
push 0xa84
push 0x1004588
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x2c], eax
call fcn.01055826
or dword [ebp - 0x28], 0xffffffff
xor eax, eax
push 7
mov word [ebp - 0x24], ax
pop ecx
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
xor esi, esi
stosw word es:[edi], ax
mov dword [ebp - 0x54], 0x10
mov dword [ebp - 0x60], 0x1010420
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
cmp ebx, esi
je 0x10268a1
mov eax, 0xa8d
mov word [ebp - 0x4c], ax
inc eax
mov dword [ebx], esi
cmp dword [ebp - 0x2c], esi
je 0x10268a6
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x50], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x10268b3
call fcn.0105d3b8
mov dword [ebp - 0x50], eax
mov eax, 0xa90
jmp 0x10268ad
mov eax, 0xa8d
mov dword [ebp - 0x50], 0x80070057
mov word [ebp - 0x4a], ax
jmp 0x102692b
mov edx, dword [ebp - 0x2c]
push esi
push esi
push esi
push esi
push esi
push esi
mov eax, 0xa90
push esi
mov word [ebp - 0x4c], ax
push esi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x50], esi
call fcn.01064650
mov dword [ebp - 0x50], eax
cmp eax, esi
mov eax, 0xa91
jl 0x10268ad
push esi
push esi
push 3
push esi
push 3
push 0x80000000
push dword [ebp - 0x60]
mov word [ebp - 0x4c], ax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp eax, 0xffffffff
jne 0x1026925
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x1026917
call edi
cmp eax, 3
jne 0x1026925
mov eax, 0xa99
mov dword [ebp - 0x50], esi
mov word [ebp - 0x4c], ax
jmp 0x102692b
mov dword [ebx], 1
cmp dword [ebp - 0x28], 0xffffffff
mov edi, dword [ebp - 0x50]
je 0x1026942
cmp dword [ebp - 0x28], esi
je 0x1026942
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x60]
call fcn.010635b3
lea ecx, [ebp - 0x50]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 0xc
Function at 0x10285aa
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push 0x134f
push 0x1004854
lea ecx, [ebp - 0x470]
mov dword [ebp - 0x44c], eax
call fcn.01055826
xor eax, eax
mov edi, 0x206
xor ebx, ebx
push edi
mov word [ebp - 0x448], ax
lea eax, [ebp - 0x446]
push ebx
push eax
mov dword [ebp - 0x474], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push edi
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x23e]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x30
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x36]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
push dword [ebp - 0x44c]
push esi
call fcn.0102446e
mov dword [ebp - 0x470], eax
cmp eax, ebx
mov eax, 0x1357
jl 0x10287c5
mov word [ebp - 0x46c], ax
cmp dword [esi + 0x128], ebx
jne 0x10287cc
push dword [esi + 0x130]
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
je 0x1028681
mov eax, 0x4c3
jmp 0x10287a2
push dword [esi + 0x130]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x102869b
mov eax, 0x4c2
jmp 0x10287a2
mov esi, dword [esi + 0x130]
mov edi, 0x104
push edi
lea eax, [ebp - 0x448]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x10286ce
call fcn.0105d3b8
mov dword [ebp - 0x470], eax
mov eax, 0x1366
jmp 0x10287c5
mov eax, 0x1366
mov word [ebp - 0x46c], ax
push edi
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x448]
push eax
mov dword [ebp - 0x470], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x102870e
call fcn.0105d3b8
mov dword [ebp - 0x470], eax
mov eax, 0x1367
jmp 0x10287c5
push 0x19
mov eax, 0x1367
mov word [ebp - 0x46c], ax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x474]
push eax
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x240]
push eax
mov dword [ebp - 0x470], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1028754
call fcn.0105d3b8
mov dword [ebp - 0x470], eax
mov eax, 0x1368
jmp 0x10287c5
mov eax, 0x1368
mov word [ebp - 0x46c], ax
mov dword [ebp - 0x470], ebx
mov ecx, 0x1003738
lea eax, [ebp - 0x38]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1028794
cmp dx, bx
je 0x1028790
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1028794
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x102876e
xor eax, eax
jmp 0x1028799
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10287cc
mov eax, 0x899
push ebx
push 0x30
push 0x499
push eax
push dword [ebp - 0x44c]
call fcn.0102f95b
mov dword [ebp - 0x470], 0x80004005
mov eax, 0x1374
mov word [ebp - 0x46a], ax
mov esi, dword [ebp - 0x470]
lea ecx, [ebp - 0x470]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 8
Function at 0x102889d
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 1
push 0x13e9
push 0x10048a0
lea ecx, [ebp - 0x30]
call fcn.01055826
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
mov dword [ebp - 0xc], 0x1010420
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], edi
je 0x102892c
push edi
push 0x428
push dword [ebp + 0xc]
call esi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push edi
push 0x429
push dword [ebp + 0xc]
call esi
push eax
call ebx
push edi
mov edi, 0x46e
push edi
push dword [ebp + 0xc]
call esi
push eax
call ebx
push 0
push edi
push dword [ebp + 0xc]
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
push 0x88c
push dword [ebp + 0xc]
call esi
push eax
call edi
jmp 0x10289cb
push 1
push 0x428
push dword [ebp + 0xc]
call esi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 1
push 0x429
push dword [ebp + 0xc]
call esi
push eax
call ebx
push 1
mov edi, 0x46e
push edi
push dword [ebp + 0xc]
call esi
push eax
call ebx
push 5
push edi
push dword [ebp + 0xc]
call esi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
push edi
push dword [ebp + 0xc]
mov dword [ebp + 0x10], 0x88f
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x102898e
mov dword [ebp + 0x10], 0x88d
push dword [ebp + 0x10]
mov edx, dword [0x1077408]
lea ecx, [ebp - 0xc]
call fcn.0106478e
mov edi, 0x88c
test eax, eax
jl 0x10289c0
push dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
test eax, eax
je 0x10289c0
push 1
jmp 0x10289c2
push 0
push edi
push dword [ebp + 0xc]
call esi
push eax
call ebx
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0xc]
call fcn.010635b3
lea ecx, [ebp - 0x30]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x102aa45
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 1
push 0x179e
push 0x1004b98
lea ecx, [ebp - 0x3c]
call fcn.01055826
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x18], 0x1010420
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x128], edi
jne 0x102aa99
mov edx, dword [esi + 0x130]
lea ecx, [ebp - 0x18]
call fcn.0106470b
jmp 0x102ab34
cmp dword [esi + 0x124], edi
je 0x102ab89
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x11c]
add eax, 4
push eax
call fcn.01022046
lea eax, [ebp - 0xc]
push eax
mov eax, dword [esi + 0x120]
add eax, 4
push eax
call fcn.01022046
cmp dword [ebp - 8], 1
jne 0x102aae4
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x11c]
add eax, 4
push eax
call fcn.01025416
cmp dword [ebp - 0xc], 1
jne 0x102ab0d
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x102aafa
push eax
mov dword [ebp - 4], edi
call fcn.0101acf9
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x120]
add eax, 4
push eax
call fcn.01025416
push edi
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
add eax, 8
push eax
call fcn.01056b4e
mov dword [ebp - 0x3c], eax
cmp eax, edi
mov eax, 0x17ba
jge 0x102ab30
mov word [ebp - 0x36], ax
jmp 0x102ab99
mov word [ebp - 0x38], ax
push 1
push edi
push edi
push dword [ebp - 0x18]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
jne 0x102ab99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x102ab5d
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x102ab99
test dword [eax + 0x1c], 0x200
je 0x102ab99
push ecx
push 0x1003b90
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010111c5
jmp 0x102ab99
mov eax, 0x17c0
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], ax
mov esi, dword [ebp - 0x3c]
cmp dword [ebp - 4], edi
je 0x102aba9
push dword [ebp - 4]
call fcn.0101acf9
lea ecx, [ebp - 0x18]
call fcn.010635b3
lea ecx, [ebp - 0x3c]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
leave
ret 8