joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100488e
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x10062c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10048ce
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10048e3
sub eax, ecx
sar eax, 1
push 0x1001f78
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x100493e
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1004ac9
mov ecx, 0x1001f74
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100496f
test dx, dx
je 0x100496b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100496f
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004949
xor eax, eax
jmp 0x1004974
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004a8f
mov ecx, 0x1001f6c
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10049ad
test dx, dx
je 0x10049a9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10049ad
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004987
xor eax, eax
jmp 0x10049b2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1004a8f
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x10049f3
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.01004d4d
test eax, eax
je 0x1004a8f
cmp dword [edi + 0xc], 0
je 0x1004a6c
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.01004713
test eax, eax
je 0x1004a6c
test byte [ebp - 0x75c], 0x10
je 0x1004a8f
lea esi, [ebp - 0x30c]
call fcn.010047e6
test eax, eax
je 0x1004a8f
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.01004558
jmp 0x1004a8f
lea esi, [ebp - 0x20c]
call fcn.010047e6
test eax, eax
je 0x1004a8f
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.01004631
mov esi, eax
test esi, esi
jne 0x1004aac
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x100493e
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x1004ac7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1004ac7
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100525f
leave
ret 8
Function at 0x1005250
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1005718
call fcn.01005444
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x100b70c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1005065
cmp eax, esi
jne 0x1005058
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1005068
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100503f
xor esi, esi
inc esi
mov eax, dword [0x100b708]
cmp eax, esi
jne 0x100507b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10050b6
mov eax, dword [0x100b708]
test eax, eax
jne 0x10050b0
mov dword [0x100b708], esi
push 0x1001194
push 0x1001188
call fcn.01004fbb
pop ecx
pop ecx
test eax, eax
je 0x10050b6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1005180
mov dword [0x100639c], esi
mov eax, dword [0x100b708]
cmp eax, esi
jne 0x10050da
push 0x1001184
push 0x100117c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100b708], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10050e7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100b710], ebx
je 0x1005108
push 0x100b710
call fcn.010053b9
pop ecx
test eax, eax
je 0x1005108
push ebx
push 2
push ebx
call dword [0x100b710]
push dword [0x1006384]
push dword [0x1006388]
push dword [0x1006380]
call fcn.01002fa7
add esp, 0xc
mov dword [0x1006398], eax
cmp dword [0x100638c], ebx
jne 0x1005166
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100639c], ebx
jne 0x1005174
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1006398]
call fcn.01005489
ret
call fcn.01005591
jmp 0x100501d
Function at 0x1005738
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
push esi
and eax, 0x100
push edi
mov dword [ebp - 0x10], eax
je 0x100573a
xor eax, eax
cmp dword [ebp + 8], eax
jne 0x1005680
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x100568b
mov edx, dword [ebp + 0xc]
cmp edx, 0x7fffffff
jbe 0x1005690
mov eax, 0x80070057
test eax, eax
jl 0x100569c
test edx, edx
jne 0x1005758
and dword [ebp - 4], 0
mov esi, eax
test eax, eax
jl 0x1005732
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ebx
sub edi, eax
xor edx, edx
lea ebx, [ecx + eax*2]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0x10], edx
je 0x10056d2
cmp dword [ebp + 0x10], edx
jne 0x10056d2
mov dword [ebp + 0x10], 0x1001920
mov ecx, dword [ebp + 0x1c]
xor esi, esi
test ecx, 0xffffe000
je 0x1005768
mov esi, 0x80070057
test ecx, 0x1c00
je 0x1005713
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1005713
mov edi, dword [ebp + 8]
push ecx
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
add eax, eax
push eax
lea ebx, [ebp - 0xc]
call fcn.01007f5d
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
test esi, esi
jge 0x100571f
cmp esi, 0x8007007a
jne 0x1005731
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1005728
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x1005731
mov dword [eax], edi
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0x18
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
je 0x100574b
cmp edx, 0x7fffffff
jbe 0x1005750
mov eax, 0x80070057
test eax, eax
jl 0x100569c
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
call fcn.01005536
jmp 0x10056a0
cmp edi, 1
ja 0x100578a
mov eax, dword [ebp + 0x10]
cmp word [eax], dx
je 0x100571f
mov esi, dword [ebp + 8]
neg esi
sbb esi, esi
and esi, 0x23
add esi, 0x80070057
jmp 0x10056e8
mov dword [ebp - 0xc], edx
xor edx, edx
mov esi, edi
mov eax, ebx
test edi, edi
je 0x10057ce
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], 0x7ffffffe
sub dword [ebp - 8], edi
sub ecx, ebx
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp - 8]
add ecx, esi
je 0x10057c7
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + eax]
test cx, cx
je 0x10057c7
mov word [eax], cx
inc eax
inc eax
dec esi
inc edx
test esi, esi
jne 0x10057a9
mov ecx, dword [ebp + 0x1c]
test esi, esi
jne 0x10057d8
dec eax
dec eax
dec edx
mov dword [ebp - 0xc], 0x8007007a
xor esi, esi
mov word [eax], si
mov esi, dword [ebp - 0xc]
sub edi, edx
lea ebx, [ebx + edx*2]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edi
test esi, esi
jl 0x10056e8
test ecx, 0x200
je 0x100571f
cmp edi, 1
jbe 0x100571f
lea eax, [edi + edi]
cmp eax, 2
jbe 0x100571f
add eax, 0xfffffffe
push eax
and ecx, 0xff
push ecx
lea eax, [ebx + 2]
push eax
call fcn.0101bc52
add esp, 0xc
jmp 0x100571f
Function at 0x1008095
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
or dword [ebp - 0xc], 0xffffffff
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.0101c6e6
cmp dword [ebp - 4], esi
jne 0x10080e8
mov eax, dword [section..data]
cmp eax, section..data
je 0x10080e0
test byte [eax + 0x1c], 1
je 0x10080e0
push 0x1001bd0
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
or eax, 0xffffffff
jmp 0x1008180
push ebx
push dword [ebp - 4]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, esi
jne 0x100812a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1008125
test byte [eax + 0x1c], 1
je 0x1008125
push 0x1001bd0
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
or eax, 0xffffffff
jmp 0x100817f
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0101c6f2
cmp dword [ebp - 8], esi
jbe 0x100816c
push edi
lea edi, [ebx + 0x30]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100815b
inc esi
add edi, 0x4c
cmp esi, dword [ebp - 8]
jb 0x100813f
jmp 0x100816b
mov edi, dword [ebp + 0xc]
imul esi, esi, 0x4c
add esi, ebx
and dword [ebp - 0xc], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xc]
pop ebx
pop esi
leave
ret 8

Function at 0x10083ca
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
xor eax, eax
push esi
mov esi, 0x7fffffff
test edx, edx
je 0x1008398
cmp edx, esi
jbe 0x100839d
mov eax, 0x80070057
mov ebx, dword [ebp + 8]
test eax, eax
jl 0x10083b5
push edi
lea edi, [ebp + 8]
mov eax, ebx
call fcn.01005536
mov ecx, dword [ebp + 8]
pop edi
jmp 0x10083b7
xor ecx, ecx
test eax, eax
jl 0x10083ce
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push esi
sub edx, ecx
push 0
lea ecx, [ebx + ecx*2]
call fcn.0100bdbf
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1008e95
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x6030
call fcn.0101bc80
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x6030], 0
and dword [ebp - 0x6020], 0
mov dword [ebp - 0x600c], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push edi
lea edi, [ebp - 0x602c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x601c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x6010], ecx
mov dword [ebp - 0x6008], 0x80004005
mov word [ebp - 0x4004], ax
mov word [ebp - 0x6004], ax
mov word [ebp - 0x2004], ax
test ebx, ebx
jne 0x1008d93
mov eax, dword [section..data]
cmp eax, section..data
je 0x1008edf
test byte [eax + 0x1c], 1
je 0x1008edf
push 0x1001bd0
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x1008edf
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x4004]
push eax
push ebx
call dword [sym.imp.USER32.dll_InternalGetWindowText]
test eax, eax
jne 0x1008db3
mov word [ebp - 0x4004], ax
push esi
lea eax, [ebp - 0x6004]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov edi, section..data
test eax, eax
jne 0x1008dec
mov eax, dword [section..data]
cmp eax, edi
je 0x1008dec
test byte [eax + 0x1c], 1
je 0x1008dec
push 0x1001bd0
push 0x28
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
lea eax, [ebp - 0x6030]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x1008e22
mov eax, dword [section..data]
cmp eax, edi
je 0x1008e22
test byte [eax + 0x1c], 1
je 0x1008e22
mov ebx, 0x1001bd0
push ebx
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x1008e27
mov ebx, 0x1001bd0
lea eax, [ebp - 0x6030]
push eax
lea eax, [ebp - 0x6020]
push eax
call fcn.0101e7e9
push dword [ebp - 0x6014]
lea eax, [ebp - 0x6004]
push dword [ebp - 0x6018]
push dword [ebp - 0x601c]
push dword [ebp - 0x6020]
push eax
mov eax, dword [ebp - 0x6010]
add eax, 0x1434
push eax
push 9
lea eax, [ebp - 0x4004]
push eax
push 0x1001c80
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.01005835
add esp, 0x2c
test eax, eax
jge 0x1008e9b
mov eax, dword [section..data]
cmp eax, edi
je 0x1008ede
test byte [eax + 0x1c], 1
je 0x1008ede
push ebx
push 0x2a
jmp 0x1008ecb
push esi
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x600c]
call fcn.01005657
test eax, eax
jge 0x1008ed8
mov eax, dword [section..data]
cmp eax, edi
je 0x1008ede
test byte [eax + 0x1c], 1
je 0x1008ede
push ebx
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x1008ede
mov dword [ebp - 0x6008], esi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x6008]
pop edi
xor ecx, ebp
pop ebx
call fcn.0101bc5d
leave
ret 0xc
Function at 0x1009b5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ebx, ecx
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0xc], ecx
lea edi, [ebp - 8]
push 0x38
stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x44]
push eax
mov esi, 0x80004005
mov dword [ebp - 0x48], ecx
call fcn.0101bc52
add esp, 0xc
mov ecx, ebx
call fcn.01008653
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp + 0x88]
mov dword [ebp - 4], eax
lea eax, [ebx + 0x23cbc]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1009b14
sub eax, ecx
sar eax, 1
add eax, 0x400
mov edi, 0x8000
cmp eax, edi
jbe 0x1009b37
mov ecx, ebx
call fcn.01008720
mov eax, dword [ebp - 4]
cmp eax, dword [ebx + 0x33cbc]
je 0x1009c20
mov ecx, ebx
call fcn.01008720
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowInfo]
test eax, eax
jne 0x1009b8f
mov eax, dword [section..data]
cmp eax, section..data
je 0x1009c39
test byte [eax + 0x1c], 1
je 0x1009c39
push 0x1001bd0
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x1009c39
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
add eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp - 0x40]
mov ecx, eax
mov eax, dword [ebp - 0x38]
add eax, edx
push 8
cdq
sub eax, edx
lea edx, [ebp + 0x8c]
push edx
push edi
lea edx, [ebx + 0x13cbc]
push edx
push dword [ebp + 0xcc]
sar eax, 1
push 0xffffffffffffffff
push dword [ebp - 8]
sar ecx, 1
push dword [ebp - 0xc]
push eax
push ecx
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.010096b5
mov esi, eax
test esi, esi
jge 0x1009c07
mov eax, dword [section..data]
cmp eax, section..data
je 0x1009c39
test byte [eax + 0x1c], 1
je 0x1009c39
movzx ecx, si
push ecx
push 0x1001bd0
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010062be
jmp 0x1009c39
test byte [ebp + 0xd0], 1
je 0x1009c17
or dword [ebx + 0x33cc4], 1
mov eax, dword [ebp - 4]
mov dword [ebx + 0x33cbc], eax
sub esp, 0xcc
push 0x33
pop ecx
mov edi, esp
lea esi, [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.010088da
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xcc
Function at 0x100c7a2
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push dword [edi + 0x4c]
lea eax, [ebp - 0x40]
push 0x1001d7c
push 0x3c
push eax
call fcn.010067aa
mov eax, dword [esi]
add esp, 0x10
lea ecx, [ebp - 0x40]
push ecx
push 0
push 0x10023cc
push 0
push esi
call dword [eax + 0x34]
push dword [edi + 0x48]
lea eax, [ebp - 0x40]
push 0x10023bc
push 0x3c
push eax
call fcn.010067aa
mov eax, dword [esi]
add esp, 0x10
lea ecx, [ebp - 0x40]
push ecx
push 0
push 0x10023a4
push 0
push esi
call dword [eax + 0x34]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0101bc5d
leave
ret 4

Function at 0x100cf4a
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100ceb3
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [ebp + 0x10]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100cec9
sub eax, ecx
sar eax, 1
cmp dword [ebp + 0x1c], 0
mov edi, eax
je 0x100cee7
mov ecx, dword [ebp + 0x18]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
jbe 0x100cf14
mov eax, dword [section..data]
cmp eax, section..data
je 0x100cf94
test byte [eax + 0x1c], 1
je 0x100cf94
push reloc.ole32.dll_CoRegisterClassObject
push 0x87
jmp 0x100cf76
push dword [ebp + 0x10]
lea eax, [esi + eax*2]
mov esi, dword [sym.imp.msvcrt.dll_wcsstr]
push eax
call esi
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100cf94
push dword [ebp + 0x14]
add edi, edi
lea eax, [edi + ebx]
push eax
mov dword [ebp + 0x10], eax
call esi
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100cf94
sub eax, edi
sub eax, ebx
sar eax, 1
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0100c6b6
test eax, eax
jge 0x100cf83
mov eax, dword [section..data]
cmp eax, section..data
je 0x100cf94
test byte [eax + 0x1c], 1
je 0x100cf94
push reloc.ole32.dll_CoRegisterClassObject
push 0x88
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x100cf94
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0x20]
sar esi, 1
mov dword [eax], esi
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x1011326
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
test eax, eax
je 0x1011330
and dword [ecx], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop ebp
ret 4

Function at 0x101174b
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
xor edi, edi
push 0x31
mov dword [ebx], edi
call esi
push 0x32
mov dword [ebp - 8], eax
call esi
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 4], eax
push 0x4e
push edi
call dword [sym.imp.COMCTL32.dll_Ordinal_381]
mov esi, eax
cmp esi, edi
jl 0x1011787
push ebx
lea eax, [ebp - 8]
push eax
push edi
push edi
push dword [ebp + 0x10]
call fcn.0101151d
mov esi, eax
cmp esi, edi
jl 0x101177e
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x24], TlsFree
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x1c], reloc.USER32.dll_LoadIconW
call dword [sym.imp.USER32.dll_SetMenuInfo]
push 0x2c
lea eax, [ebp - 0x50]
push 0
push eax
call fcn.0101bc52
mov eax, dword [ebx]
add esp, 0xc
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x54]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x54], 0x30
push dword [ebp + 8]
mov dword [ebp - 0x50], 0x80
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_DestroyIcon]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1013dae
Capabilities:
Check if file exists
Create directory
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
xor esi, esi
push 0x2c
lea eax, [ebp - 0x30]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], esi
call fcn.0101bc52
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [0x1035b50]
push dword [0x1035b4c]
push 0xc9
push dword [0x1035924]
call dword [sym.imp.COMCTL32.dll_Ordinal_381]
mov eax, dword [0x1035924]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
push 5
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x101358d
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 0x1002bc4
call dword [sym.imp.USER32.dll_RegisterClassExW]
pop esi
leave
ret
Function at 0x1013f6e
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], esi
stosd dword es:[edi], eax
mov eax, dword [0x1035900]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x80004005
cmp eax, esi
je 0x1013e13
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 8], esi
jmp 0x1013fd8
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], 0x4004
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
jne 0x1013e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1013fe6
test byte [ecx + 0x1c], 1
je 0x1013fe6
push eax
push reloc.KERNEL32.dll_SetFilePointer
push 0x13
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010062be
jmp 0x1013fe6
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x1035924], eax
cmp eax, esi
jne 0x1013eaa
mov eax, dword [section..data]
cmp eax, section..data
je 0x1013fe6
test byte [eax + 0x1c], 1
je 0x1013fe6
push reloc.KERNEL32.dll_SetFilePointer
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010054b7
jmp 0x1013fe6
push ebx
mov dword [ebp - 4], esi
mov ebx, 0x1030038
mov esi, 0x1032100
mov edi, section..data
xor eax, eax
mov word [esi], ax
mov eax, dword [ebx]
test eax, eax
je 0x1013f19
push 0x400
push esi
push eax
push dword [0x1035924]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1013f19
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1013eee
mov eax, 0x54f
mov ecx, dword [section..data]
cmp ecx, edi
je 0x1013f14
test byte [ecx + 0x1c], 1
je 0x1013f14
push eax
push dword [ebp - 4]
push reloc.KERNEL32.dll_SetFilePointer
push 0x15
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010105fd
xor eax, eax
mov word [esi], ax
inc dword [ebp - 4]
mov dword [ebx], esi
add esi, 0x800
add ebx, 0x14
cmp dword [ebp - 4], 7
jb 0x1013ebd
mov esi, dword [ebp - 0xc]
mov ecx, esi
call fcn.01013d4a
xor ecx, ecx
pop ebx
cmp cx, ax
jne 0x1013f62
mov eax, dword [section..data]
cmp eax, edi
je 0x1013fe6
test byte [eax + 0x1c], 1
je 0x1013fe6
push reloc.KERNEL32.dll_SetFilePointer
push 0x16
jmp 0x1013e9a
mov ecx, esi
call fcn.01011339
test eax, eax
jne 0x1013f88
mov eax, dword [section..data]
cmp eax, edi
je 0x1013fe6
test byte [eax + 0x1c], 1
je 0x1013fe6
push reloc.KERNEL32.dll_SetFilePointer
push 0x17
jmp 0x1013e9a
mov ecx, esi
call fcn.0101147a
test eax, eax
jne 0x1013fae
mov eax, dword [section..data]
cmp eax, edi
je 0x1013fe6
test byte [eax + 0x1c], 1
je 0x1013fe6
push reloc.KERNEL32.dll_SetFilePointer
push 0x18
jmp 0x1013e9a
mov ecx, esi
call fcn.0101062f
test eax, eax
jne 0x1013fd4
mov eax, dword [section..data]
cmp eax, edi
je 0x1013fe6
test byte [eax + 0x1c], 1
je 0x1013fe6
push reloc.KERNEL32.dll_SetFilePointer
push 0x19
jmp 0x1013e9a
and dword [ebp - 8], 0
cmp dword [ebp + 8], 4
je 0x1013fe6
push dword [ebp + 8]
call fcn.010122a2
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 4