joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102eaed
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push 0x24c
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x250]
push esi
push eax
mov dword [ebp - 0x254], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x258], eax
cmp eax, esi
jne 0x102eb6e
mov esi, 0x8007000e
push esi
push 0x114
push 0x1008608
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102eccb
push edi
push ebx
push 0x100811c
mov edi, 0x104
push edi
push eax
call fcn.0100dd8e
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x102eb95
push esi
push 0x117
jmp 0x102eca1
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x102ec85
cmp eax, 0xffffffff
je 0x102ec85
test byte [ebp - 0x254], 0x10
lea eax, [ebp - 0x228]
je 0x102ec39
push 0x1008118
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x102ec4c
lea eax, [ebp - 0x228]
push 0x1008110
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x102ec4c
lea eax, [ebp - 0x228]
push eax
push ebx
push 0x1005adc
push edi
push dword [ebp - 0x258]
call fcn.0100dd8e
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x102ec75
push dword [ebp - 0x258]
push dword [ebp - 0x25c]
call fcn.0102eaed
mov esi, eax
test esi, esi
jge 0x102ec4c
push esi
push 0x12c
jmp 0x102eca1
push dword [ebp - 0x25c]
push eax
push ebx
call fcn.0103977d
mov esi, eax
test esi, esi
jl 0x102ec7d
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102ebbf
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x102ecb5
push esi
push 0x129
jmp 0x102eca1
push esi
push 0x134
jmp 0x102eca1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102ec99
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x11a
push 0x1008608
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
push dword [ebp - 0x258]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01036539
leave
ret 8
Function at 0x102ece2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
call fcn.0102e866
mov esi, eax
test esi, esi
jge 0x102ed1b
push esi
push 0x1d8
push 0x100863c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102eda6
cmp dword [ebp - 4], 0
mov esi, 0x1008628
jne 0x102ed2b
mov esi, 0x100861c
push edi
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x102ed75
cmp eax, edi
ja 0x102ed75
push esi
push edi
push dword [ebp + 8]
call fcn.01014151
mov esi, eax
test esi, esi
jge 0x102ed59
push esi
push 0x1e6
jmp 0x102ed91
push 0x10017e4
push edi
push dword [ebp + 8]
call fcn.01014151
mov esi, eax
test esi, esi
jge 0x102eda5
push esi
push 0x1ec
jmp 0x102ed91
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102ed89
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x1df
push 0x100863c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x102ef8f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
jne 0x102efd4
mov esi, 0x8007000e
push esi
push 0x432
push 0x100873c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102f05b
push edi
mov edi, dword [ebp + 8]
mov esi, 0x400
push esi
push ebx
push dword [ebp + 0x10]
xor eax, eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x102f00f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f005
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x439
jmp 0x102f036
cmp eax, esi
jb 0x102f020
mov esi, 0x8007007a
push esi
push 0x43c
jmp 0x102f036
push ebx
push dword [ebp + 0xc]
push edi
call fcn.0100d999
mov esi, eax
test esi, esi
jge 0x102f04a
push esi
push 0x440
push 0x100873c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x102f068
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x208
push 0
mov dword [ebp - 0x260], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x258], edi
test edi, edi
jne 0x102f0cc
mov esi, 0x8007000e
push esi
push 0x4d7
push 0x100874c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102f2b0
push esi
push 0x100811c
push 0x104
push edi
call fcn.0100dd8e
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x102f105
push esi
push 0x4da
push 0x100874c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102f29b
push ebx
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
mov edi, 0x100874c
mov ebx, 0x80070000
test eax, eax
je 0x102f259
cmp eax, 0xffffffff
je 0x102f259
mov esi, 0x1006604
lea eax, [ebp - 0x228]
push 0x1008118
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x102f232
lea eax, [ebp - 0x228]
push 0x1008110
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x102f232
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x260]
push 0x1005adc
push 0x104
push dword [ebp - 0x258]
call fcn.0100dd8e
add esp, 0x14
test eax, eax
jge 0x102f1a6
push eax
push 0x4eb
jmp 0x102f226
test byte [ebp - 0x254], 1
je 0x102f1e1
push 0x80
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x102f1e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f1d7
and eax, 0xffff
or eax, ebx
test eax, eax
jge 0x102f1e1
push eax
push 0x4f2
jmp 0x102f226
test byte [ebp - 0x254], 0x10
push dword [ebp - 0x258]
je 0x102f201
call fcn.0102f068
test eax, eax
jge 0x102f232
push eax
push 0x4f7
jmp 0x102f226
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x102f232
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f21e
and eax, 0xffff
or eax, ebx
test eax, eax
jge 0x102f232
push eax
push 0x4fb
push edi
push esi
push 1
call fcn.01014247
add esp, 0x14
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102f13a
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x102f26d
xor esi, esi
jmp 0x102f29a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f27e
and eax, 0xffff
or eax, ebx
mov esi, eax
test esi, esi
jge 0x102f29a
push esi
push 0x504
push edi
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
pop ebx
push dword [ebp - 0x258]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01036539
leave
ret 4
Function at 0x102f2c7
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
push 0x24c
push eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x250]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x208
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x25c], eax
test eax, eax
jne 0x102f34d
mov esi, 0x8007000e
push esi
push 0xb5
push 0x100875c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102f4e7
lea eax, [ebp - 0x258]
push eax
push edi
push esi
call fcn.0103957d
mov esi, eax
test esi, esi
jge 0x102f36c
push esi
push 0xbb
jmp 0x102f4be
push ebx
push 0x100811c
mov edi, 0x104
push edi
push dword [ebp - 0x25c]
call fcn.0100dd8e
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x102f397
push esi
push 0xbe
jmp 0x102f4be
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x102f4a2
cmp eax, 0xffffffff
je 0x102f4a2
test byte [ebp - 0x254], 0x10
lea eax, [ebp - 0x228]
je 0x102f43f
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x1008118
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x102f452
lea eax, [ebp - 0x228]
push 0x1008110
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x102f452
cmp dword [ebp + 0x14], 0
je 0x102f452
lea eax, [ebp - 0x228]
push eax
push ebx
push 0x1005adc
push edi
push dword [ebp - 0x25c]
call fcn.0100dd8e
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x102f492
push dword [ebp - 0x25c]
push dword [ebp - 0x258]
call fcn.0102eaed
mov esi, eax
test esi, esi
jge 0x102f452
push esi
push 0xda
jmp 0x102f4be
push dword [ebp - 0x258]
push eax
push ebx
call fcn.0103977d
mov esi, eax
test esi, esi
jl 0x102f49a
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102f3c1
push dword [ebp - 0x260]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x258]
call fcn.0103932c
mov esi, eax
test esi, esi
jge 0x102f4d2
push esi
push 0xe8
jmp 0x102f4be
push esi
push 0xd7
jmp 0x102f4be
push esi
push 0xe2
jmp 0x102f4be
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f4b6
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0xc1
push 0x100875c
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
push dword [ebp - 0x25c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x258], 0
je 0x102f4fb
push dword [ebp - 0x258]
call fcn.010392f9
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01036539
leave
ret 0x10
Function at 0x102f513
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [ebp - 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
stosd dword es:[edi], eax
cmp ax, word [esi]
je 0x102f656
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102f53e
sub eax, edx
sar eax, 1
cmp eax, 4
jb 0x102f656
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x102f582
mov ebx, 0x8007000e
push ebx
push 0x3d6
jmp 0x102f68e
lea eax, [ebp - 0x10]
push eax
call fcn.0102eee3
mov ebx, eax
test ebx, ebx
jge 0x102f59c
push ebx
push 0x3d9
jmp 0x102f68e
push esi
push 0x400
push edi
call fcn.0102ef8f
mov ebx, eax
test ebx, ebx
jge 0x102f5b9
push ebx
push 0x3df
jmp 0x102f68e
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
push 0x5c
pop ebx
mov eax, ebx
cmp ax, word [edi]
jne 0x102f5f9
cmp ax, word [edi + 2]
jne 0x102f5f9
push ebx
add edi, 4
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x102f5e9
add eax, 2
push ebx
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x102f5fc
mov ebx, 0x800700a1
push ebx
push 0x3f1
jmp 0x102f68e
lea eax, [edi + 4]
push ebx
add eax, 2
push eax
jmp 0x102f64c
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x102f642
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102f62d
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
jge 0x102f63f
and eax, 0xffff
cmp eax, 0xb7
jne 0x102f688
push 0x5c
pop ebx
mov eax, ebx
mov word [edi], ax
push ebx
add edi, 2
push edi
call esi
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x102f603
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x102f670
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xc], 0
je 0x102f67f
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
push ebx
push 0x402
push 0x1008770
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x102f658
Function at 0x102ff81
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x104e070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call fcn.0102feeb
mov esi, eax
test esi, esi
jge 0x102ffbc
push esi
push 0x161
jmp 0x102fff1
push edi
push 0
push 0x10087f8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1030005
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102ffe9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x166
push 0x10087e0
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01036539
leave
ret 4
Function at 0x1030322
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
cmp word [ebx], 0x40
je 0x1030344
mov dword [ebp + 8], 1
jmp 0x10304b7
push esi
push edi
mov edi, 0x800
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x1030374
mov eax, 0x8007000e
push eax
push 0x160
jmp 0x1030472
push ebx
mov ebx, 0x400
push ebx
push eax
call fcn.0100d999
mov dword [ebp + 8], eax
test eax, eax
jge 0x1030393
push eax
push 0x163
jmp 0x1030475
push 0x1008868
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_wcstok]
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x10303ba
mov eax, 0x80070057
push eax
push 0x169
jmp 0x1030472
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x10303df
mov eax, 0x8007000e
push eax
push 0x16c
jmp 0x1030472
push ebx
push esi
push dword [ebp - 0xc]
xor eax, eax
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
ja 0x1030412
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1030407
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp + 8], eax
push 0x171
jmp 0x1030475
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
call esi
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
test eax, eax
jne 0x1030431
mov eax, 0x8007000e
push eax
push 0x175
jmp 0x1030472
push 0x1008860
push 0
call dword [sym.imp.msvcrt.dll_wcstok]
pop ecx
pop ecx
test eax, eax
jne 0x1030451
mov eax, 0x80070057
push eax
push 0x17b
jmp 0x1030472
push 0x2d
pop ecx
cmp cx, word [eax]
jne 0x103045b
inc eax
inc eax
push eax
call esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x1030489
mov eax, 0x8007000e
push eax
push 0x183
mov dword [ebp + 8], eax
push 0x1008848
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
cmp dword [ebp - 4], edi
je 0x10304a3
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
cmp dword [ebp - 8], edi
je 0x10304b5
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
pop edi
pop esi
mov eax, dword [ebp + 8]
pop ebx
leave
ret 0xc
Function at 0x10320cf
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x103211d
mov ebx, 0x8007000e
push ebx
push 0x18f
push 0x1008b60
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
jmp 0x10321c0
push edi
push dword [0x104e198]
mov edi, 0x104
push 0x1008b50
push edi
push esi
call fcn.0100dd8e
mov ebx, eax
add esp, 0x10
test ebx, ebx
jge 0x1032146
push ebx
push 0x196
jmp 0x10321ab
lea eax, [ebp - 4]
push eax
push esi
call fcn.01025f12
mov ebx, eax
test ebx, ebx
jge 0x103215e
push ebx
push 0x199
jmp 0x10321ab
mov esi, 0x1008b38
push esi
push edi
push dword [ebp - 8]
call fcn.01014151
mov ebx, eax
test ebx, ebx
jge 0x103217b
push ebx
push 0x19c
jmp 0x10321ab
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x103218e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push dword [0x104e198]
push esi
push dword [ebp - 4]
call fcn.0102f2c7
mov ebx, eax
test ebx, ebx
jge 0x10321bf
push ebx
push 0x1a5
push 0x1008b60
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
pop edi
cmp dword [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x10321de
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x10321f2
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10329fe
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, esi
jne 0x1032a49
mov esi, 0x8007000e
push esi
push 0x1c7
jmp 0x1032b92
lea eax, [ebp - 4]
push eax
push 0x1008d38
call fcn.0101484f
mov esi, eax
test esi, esi
jge 0x1032a68
push esi
push 0x1ca
jmp 0x1032b92
push dword [ebp - 4]
call fcn.010323d8
mov esi, eax
test esi, esi
jge 0x1032a81
push esi
push 0x1d0
jmp 0x1032b92
push 0x1005a2c
push dword [0x104e198]
push 0x1005adc
push 0x104
push edi
call fcn.0100dd8e
mov esi, eax
add esp, 0x14
test esi, esi
jge 0x1032ab0
push esi
push 0x1d8
jmp 0x1032b92
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.01014f71
mov esi, eax
test esi, esi
jge 0x1032acb
push esi
push 0x1db
jmp 0x1032b92
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x108]
mov esi, eax
test esi, esi
jge 0x1032af4
push esi
push 0x1e1
jmp 0x1032b92
mov eax, dword [0x104e188]
cmp dword [eax + 0xc], 0
je 0x1032ba6
push 0x208
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
jne 0x1032b29
mov esi, 0x8007000e
push esi
push 0x1e7
jmp 0x1032b92
push 0x1008178
push dword [0x104e198]
push 0x1005adc
push 0x104
push edi
call fcn.0100dd8e
mov esi, eax
add esp, 0x14
test esi, esi
jge 0x1032b55
push esi
push 0x1ef
jmp 0x1032b92
mov eax, dword [0x104e188]
mov eax, dword [eax + 0x88]
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1032b72
xor esi, esi
jmp 0x1032ba6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1032b86
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jge 0x1032ba6
push esi
push 0x1f2
push 0x1008d24
push 0x100189c
push 1
call fcn.01014247
add esp, 0x14
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 4]
test eax, eax
je 0x1032bc1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x1032bdb
push dword [ebp - 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
cmp dword [ebp - 8], 0
je 0x1032bef
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x103651e
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x10497f0
call fcn.01036844
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x104f690
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10362d9
cmp eax, esi
jne 0x10362cc
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10362dc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10362b3
xor esi, esi
inc esi
mov eax, dword [0x104f68c]
cmp eax, esi
jne 0x10362ef
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x103631e
mov eax, dword [0x104f68c]
test eax, eax
jne 0x1036318
mov dword [0x104f68c], esi
push 0x100175c
push 0x1001750
call fcn.01036215
pop ecx
pop ecx
test eax, eax
je 0x103631e
jmp 0x1036442
mov dword [0x104e1d0], esi
mov eax, dword [0x104f68c]
cmp eax, esi
jne 0x1036342
push 0x100174c
push 0x1001744
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x104f68c], 2
cmp dword [ebp - 0x20], ebx
jne 0x103634f
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x104f694], ebx
je 0x1036370
push 0x104f694
call fcn.010367b9
pop ecx
test eax, eax
je 0x1036370
push ebx
push 2
push ebx
call dword [0x104f694]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1036442
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x10363da
cmp cx, bx
je 0x1036395
cmp dword [ebp - 0x1c], ebx
jne 0x10363da
movzx ecx, word [eax]
cmp cx, bx
je 0x10363aa
cmp cx, 0x20
ja 0x10363aa
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1036395
test byte [ebp - 0x40], 1
je 0x10363b6
movzx ecx, word [ebp - 0x3c]
jmp 0x10363b9
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x104e1cc], eax
cmp dword [0x104e1c0], ebx
jne 0x103641f
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x10363eb
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x103637f
cmp dword [0x104e1d0], ebx
jne 0x103642d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x104e1cc]
jmp 0x103644e
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01036889
ret
call fcn.01036989
jmp 0x1036276