joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020cb
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
cmp dword [0x10040d8], esi
push edi
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
jne 0x1002143
cmp dword [0x10040dc], esi
jne 0x1002143
cmp ebx, 0x10
je 0x100227b
cmp ebx, 0x8000
je 0x100225b
cmp dword [0x10040e0], esi
jne 0x1002143
mov eax, 0x104
cmp ebx, eax
ja 0x1002192
je 0x10021cf
cmp ebx, 0x18
je 0x1002184
cmp ebx, 0x1c
je 0x100217f
cmp ebx, 0x20
je 0x1002170
cmp ebx, 0x48
je 0x1002139
cmp ebx, 0x100
jmp 0x100213d
cmp dword [ebp + 0x10], 3
je 0x10021cf
cmp ebx, dword [0x10040f0]
jne 0x10022a6
cmp ebx, esi
je 0x10022a6
push esi
push esi
push 0x10
push dword [ebp + 8]
call edi
xor eax, eax
cmp dword [0x10040e8], esi
setne al
jmp 0x10022b6
push esi
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
inc eax
jmp 0x10022b6
cmp dword [ebp + 0x10], esi
jmp 0x100213d
cmp dword [ebp + 0x10], esi
je 0x1002143
push esi
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x1002143
mov eax, ebx
sub eax, 0x200
je 0x1002203
dec eax
je 0x10021cf
sub eax, 3
je 0x10021cf
sub eax, 3
je 0x10021cf
sub eax, 0x11
jne 0x1002143
cmp dword [ebp + 0x10], 6
jb 0x10021cf
cmp dword [ebp + 0x10], 8
jbe 0x10021c5
cmp dword [ebp + 0x10], 0xa
je 0x10021dd
cmp dword [ebp + 0x10], 0x12
jne 0x10021cf
test byte [ebp + 0x14], 1
jne 0x1002143
push esi
push esi
push 0x10
push dword [ebp + 8]
call edi
jmp 0x1002143
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.dll_GetSystemPowerStatus
test eax, eax
je 0x10021ef
mov al, byte [ebp - 0x14]
jmp 0x10021f1
or al, 0xff
cmp al, byte [0x10040a8]
mov byte [0x10040a8], al
jne 0x10021cf
jmp 0x1002143
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 8]
sub ecx, dword [0x1004150]
je 0x100221e
cmp ecx, esi
jge 0x100221e
neg ecx
mov eax, dword [ebp - 4]
sub eax, dword [0x1004154]
je 0x100222f
cmp eax, esi
jge 0x100222f
neg eax
add eax, ecx
cmp eax, dword [0x10040a4]
jbe 0x1002143
push esi
push esi
push 0x10
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 8]
mov dword [0x1004150], eax
mov eax, dword [ebp - 4]
mov dword [0x1004154], eax
jmp 0x1002143
cmp dword [0x1004100], esi
je 0x1002143
mov eax, dword [0x10040e8]
cmp eax, esi
je 0x1002177
push dword [ebp + 8]
call eax
jmp 0x10022b6
cmp dword [0x1004100], esi
je 0x1002143
push dword [ebp + 8]
call fcn.01001fa9
test eax, eax
jne 0x1002143
push 0x1004150
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
jmp 0x10022b6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10022c2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x1004100], esi
je 0x1002366
cmp dword [0x10040e4], esi
je 0x10022e6
call fcn.0100208d
lea eax, [ebp - 4]
push eax
push 0x10011e4
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1002366
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.ScreenSaveUsePassword
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100235d
cmp dword [ebp - 0xc], esi
je 0x100235d
push str.PASSWORD.CPL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
mov dword [0x10040e4], eax
je 0x100235d
push str.VerifyScreenSavePwd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [0x10040e8], eax
je 0x1002358
push 1
call fcn.01001d21
jmp 0x100235d
call fcn.0100208d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x100282e
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x10012f8
call fcn.010029b0
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1002869
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002869
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1002881
cmp eax, 0x20b
je 0x100286e
mov dword [ebp - 0x1c], edi
jmp 0x1002895
cmp dword [ecx + 0x84], 0xe
jbe 0x1002869
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x100288f
cmp dword [ecx + 0x74], 0xe
jbe 0x1002869
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1004158], 0xffffffff
or dword [0x100415c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004118]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1004114]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1004160], eax
call fcn.01002a3c
cmp dword [0x10040b4], edi
jne 0x10028f0
push fcn.01002a3c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01002a25
push 0x1004010
push 0x100400c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1004110]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100410c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1004008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002824
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1002967
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x100299c
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010029eb
ret
Function at 0x4269c9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426a08
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426a08
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426a08
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426a08
cmp dword [ecx + 0x74], 0xe
jbe 0x426a08
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x64fa2221
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4dd43484
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10311af
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x10cd0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x210]
push eax
xor esi, esi
push 0x1003280
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x210], esi
call fcn.010ab86f
push 0x5c
xor edi, edi
lea eax, [ebp - 0x290]
push esi
inc edi
push eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], 0xf233
mov dword [ebp - 0x224], 8
mov dword [ebp - 0x220], 0xf234
mov dword [ebp - 0x294], 0x60
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x294]
push eax
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x28c], esi
mov dword [ebp - 0x288], 0x18
mov dword [ebp - 0x270], 2
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x280], 0xf230
mov dword [ebp - 0x278], 0xf231
mov dword [ebp - 0x27c], 0xfffc
mov dword [ebp - 0x274], 0xf232
mov dword [ebp - 0x240], 0x1031187
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
cmp eax, esi
mov dword [ebp - 0x210], eax
jl 0x103131c
cmp dword [ebp - 0x214], edi
jne 0x103131c
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x103131c
push edi
push esi
push 0x100325c
lea eax, [ebp - 0x20c]
push eax
push 0x1003250
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x103131c
mov dword [ebp - 0x210], 0x80004005
mov esi, dword [ebp - 0x210]
lea ecx, [ebp - 0x234]
call fcn.010ab8b6
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.010aac4f
leave
ret 4
Function at 0x103216a
Capabilities:
Get file system object information

Disassembly:
push 0x2c8
mov eax, 0x10b4398
call fcn.010aacd7
xor ebx, ebx
push ebx
mov dword [ebp - 0x2cc], ecx
push 0x1004de8
lea ecx, [ebp - 0x2d4]
call fcn.010ab86f
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 4], ebx
call sub.MFC42u.dll_CString::CString_1
mov byte [ebp - 4], 1
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
mov esi, dword [eax + 0x5c0]
cmp esi, ebx
je 0x10321c0
cmp dword [esi + 0x54], ebx
je 0x10321c0
xor edi, edi
inc edi
jmp 0x10321c2
xor edi, edi
mov ecx, esi
call fcn.010424d5
cmp edi, ebx
je 0x10321db
neg eax
sbb eax, eax
and eax, 0x7e
add eax, 0xef1f
jmp 0x10321e0
mov eax, 0xef20
push eax
lea ecx, [ebp - 0x2c8]
call sub.MFC42u.dll_CString::LoadStringW
test eax, eax
je 0x103223f
cmp edi, ebx
je 0x103222e
push 0x200
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push ebx
add esi, 0x58
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 0x2c8]
test eax, eax
je 0x1032223
lea eax, [ebp - 0x2b8]
push eax
jmp 0x1032224
push esi
push 0x1003338
call sub.MFC42u.dll_CString::Replace
push dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x2cc]
call sub.MFC42u.dll_CWnd::SetWindowTextW
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], bl
call sub.MFC42u.dll_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.010ab8b6
call fcn.010aad69
ret

Function at 0x103307f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x10b6220
call fcn.010aac64
mov esi, ecx
push 0
push 0x10050f4
lea ecx, [ebp - 0x14]
call fcn.010ab86f
and dword [ebp - 4], 0
lea ebx, [esi + 0x140]
mov edi, 0xbc
cmp dword [ebx], edi
je 0x103314e
push edi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebx], edi
mov dword [esi + 0x144], 0x100
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 0xc]
push 0
push 0xa
push 0x9b
push eax
call fcn.010ad4c0
mov edi, eax
test edi, edi
je 0x1033120
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 0xc]
push 0
push edi
push eax
call fcn.010ad432
test eax, eax
je 0x1033120
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1033120
mov cl, byte [eax + 4]
mov byte [esi + 0x1ea], cl
movzx eax, word [eax + 2]
imul eax, eax, 0x14
mov dword [esi + 0x1e4], eax
jmp 0x1033131
mov byte [esi + 0x1ea], 0
mov dword [esi + 0x1e4], 0x12c
call fcn.01075e96
test eax, eax
je 0x103314e
or dword [esi + 0x144], 0x10000
xor eax, eax
inc eax
mov word [esi + 0x14a], ax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.010ab8b6
mov eax, ebx
call fcn.010aad50
ret
Function at 0x103540e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x10
mov eax, 0x10b464d
call fcn.010aac64
lea eax, [ebp - 0x10]
push eax
push 0x100571c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], 0x80004003
call fcn.010ab86f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x10354f2
push 0x74
pop edi
push edi
push ebx
push esi
mov dword [ebp - 0x10], ebx
call sub.msvcrt.dll_memset
mov dword [esi], edi
add esp, 0xc
mov dword [esi + 4], 0xe0000003
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
xor edi, edi
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 0xc]
push ebx
push 0xa
push 0x9b
push eax
call fcn.010ad4c0
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x10354a0
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 0xc]
push ebx
push dword [ebp - 0x14]
push eax
call fcn.010ad432
cmp eax, ebx
je 0x10354a0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
lea ecx, [ebp + 8]
call sub.MFC42u.dll_CString::CString_1
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
cmp edi, ebx
je 0x10354c8
movzx eax, word [edi]
imul eax, eax, 0x14
mov dword [esi + 0xc], eax
movzx eax, word [edi + 6]
push eax
call sub.MFC42u.dll_CString::LoadStringW
jmp 0x10354d9
push 0x1005710
mov dword [esi + 0xc], 0xf0
call fcn.010a96b2
push dword [ebp + 8]
add esi, 0x1a
push 0x20
push esi
call fcn.01035128
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call sub.MFC42u.dll_CString::CString
mov esi, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010ab8b6
mov eax, esi
call fcn.010aad50
ret 4

Function at 0x103cdf8
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10cd0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x1006e24
lea ecx, [ebp - 0x214]
call fcn.010ab86f
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x103ceb8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x103ceb8
mov eax, dword [section..data]
cmp eax, section..data
je 0x103ceb8
test byte [eax + 0x1c], 4
je 0x103ceb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x103ce99
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x20c]
push ecx
push eax
mov eax, dword [section..data]
push 0x1005ec8
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0103c5df
lea ecx, [ebp - 0x214]
call fcn.010ab8b6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010aac4f
leave
ret
Function at 0x103e0b9
Capabilities:
Create process on windows

Disassembly:
push 0x8b8
mov eax, 0x10b4cde
call fcn.010aacd7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x864], eax
lea eax, [ebp - 0x85c]
push eax
mov dword [ebp - 0x868], ecx
xor esi, esi
push 0x10071e0
lea ecx, [ebp - 0x870]
mov dword [ebp - 0x85c], esi
call fcn.010ab86f
xor eax, eax
push 0x40e
mov word [ebp - 0x858], ax
lea eax, [ebp - 0x856]
push esi
push eax
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memset
xor eax, eax
push 0x436
mov word [ebp - 0x448], ax
lea eax, [ebp - 0x446]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x208
lea eax, [ebp - 0x858]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x858]
push eax
push 0x10071d4
mov edi, 0x21c
lea eax, [ebp - 0x448]
push edi
push eax
call fcn.0103d988
lea eax, [ebp - 0x448]
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x103e16f
push 0x44
sub eax, ecx
pop ebx
sar eax, 1
push ebx
mov dword [ebp - 0x860], eax
lea eax, [ebp - 0x8c4]
push esi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8c4], ebx
mov ebx, dword [ebp - 0x864]
add esp, 0xc
cmp ebx, esi
je 0x103e1b9
cmp eax, 4
je 0x103e1b9
cmp eax, 5
je 0x103e1b9
cmp eax, 3
jne 0x103e1da
push eax
mov eax, dword [ebp - 0x860]
mov ecx, edi
sub ecx, eax
push 0x10071c4
push ecx
lea eax, [ebp + eax*2 - 0x448]
push eax
call fcn.0103d988
add esp, 0x10
cmp ebx, esi
je 0x103e203
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x103e203
push ebx
lea eax, [ebp - 0x448]
push eax
push 0x10071b4
push edi
push eax
call fcn.0103d988
add esp, 0x14
mov ecx, dword [ebp - 0x868]
add ecx, 0xc8
call fcn.01061c6c
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x8c4]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x103e24c
mov dword [ebp - 0x85c], 0x80004005
jmp 0x103e275
push 0x1388
push dword [ebp - 0x880]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push esi
push dword [ebp - 0x87c]
call fcn.010acc2e
push esi
push dword [ebp - 0x880]
call fcn.010acc2e
mov esi, dword [ebp - 0x85c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x870]
call fcn.010ab8b6
mov eax, esi
call fcn.010aad69
ret 8
Function at 0x103e9df
Capabilities:
Get common file path

Disassembly:
push 0x10
mov eax, 0x10b95a4
call fcn.010aac64
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x10]
push eax
xor esi, esi
push 0x10072ac
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], esi
call fcn.010ab86f
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
cmp edi, esi
jne 0x103ea2c
mov esi, 0x80070057
mov dword [ebp - 0x10], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.010ab8b6
mov eax, esi
call fcn.010aad50
ret 0xc
mov eax, dword [ebp + 8]
mov ebx, 0x104
cmp eax, esi
je 0x103ea46
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jge 0x103ea0e
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [edi], cx
cmp eax, esi
je 0x103ea64
cmp word [eax], si
je 0x103ea64
push eax
push ebx
push edi
call fcn.01035128
mov dword [ebp - 0x10], esi
cmp word [edi], si
jne 0x103ea94
cmp dword [ebp + 0xc], esi
je 0x103ea81
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
push ebx
push edi
add ecx, 0xc8
call fcn.01061579
mov dword [ebp - 0x10], eax
jmp 0x103ea88
mov dword [ebp - 0x10], 0x80004005
cmp dword [ebp - 0x10], esi
jge 0x103ea94
xor eax, eax
mov word [edi], ax
jmp 0x103eaa5
push esi
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x103eaf5
push esi
push ebx
push edi
call fcn.01076311
cmp eax, esi
mov dword [ebp - 0x10], eax
jl 0x103eac5
push esi
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x103eaf5
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
push esi
push esi
push 5
push esi
call ebx
cmp eax, esi
mov dword [ebp - 0x10], eax
jl 0x103eaeb
push esi
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
cmp eax, esi
mov dword [ebp - 0x10], eax
jge 0x103eaf5
push edi
push esi
push esi
push esi
push esi
call ebx
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
jmp 0x103ea16
Function at 0x1040781
Capabilities:
Copy file

Disassembly:
push 0x258
mov eax, 0x10b4f6b
call fcn.010aacd7
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
push 0x1007668
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x220], ebx
call fcn.010ab86f
xor eax, eax
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x224], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
jne 0x104081d
mov esi, 0x80004003
mov dword [ebp - 0x220], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.010ab8b6
mov eax, esi
call fcn.010aad69
ret 0x10
cmp edi, ebx
je 0x10407f9
cmp dword [ebp - 0x220], ebx
mov dword [edi], ebx
jl 0x1040993
mov eax, dword [esi]
push ebx
push ebx
push esi
call dword [eax + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x264]
call fcn.0103c861
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x264]
push eax
push 0x34
push 0xe851
call fcn.0103daf0
cmp eax, 6
je 0x1040872
mov dword [ebp - 0x220], 0xc6c81221
cmp dword [ebp - 0x220], ebx
jl 0x1040993
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [esi]
push 1
push ebx
push esi
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x228]
push eax
call fcn.0103f9a3
cmp eax, ebx
mov dword [ebp - 0x220], eax
jl 0x1040993
push ebx
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1040905
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10408d5
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x220], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x1040905
test byte [eax + 0x1c], 4
je 0x1040905
push dword [ebp - 0x220]
push 0x1005ec8
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0107918f
cmp dword [ebp - 0x220], ebx
jl 0x1040993
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xe00]
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 1
push ebx
push ecx
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, eax
call fcn.0108ce87
cmp eax, ebx
mov dword [ebp - 0x220], eax
jl 0x1040993
call sub.MFC42u.dll_AfxGetModuleState
mov esi, dword [eax + 0xc]
mov edi, dword [ebp - 0x224]
call sub.MFC42u.dll_AfxGetModuleState
push dword [ebp - 0x22c]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xe00]
push esi
push dword [ebp + 0xc]
mov ecx, eax
push ebx
push edi
call fcn.0108ad31
cmp eax, ebx
mov dword [ebp - 0x220], eax
jl 0x1040993
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x230]
mov dword [ecx], eax
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [ebp - 0x224]
mov esi, dword [ebp - 0x220]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x1040804
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1040804