joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426008]
jne 0x40100a
repz ret
jmp fcn.00401c66

Function at 0x4080b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403824
and dword [ebp - 4], 0
cmp dword [0x427fe8], 0
mov ebx, eax
jne 0x408164
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408215
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408215
push eax
call fcn.004037b2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427fe8], eax
call esi
push eax
call fcn.004037b2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427fec], eax
call esi
push eax
call fcn.004037b2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x427ff0], eax
call esi
push eax
call fcn.004037b2
pop ecx
mov dword [0x427ff8], eax
test eax, eax
je 0x408164
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004037b2
pop ecx
mov dword [0x427ff4], eax
mov eax, dword [0x427ff4]
cmp eax, ebx
je 0x4081bc
cmp dword [0x427ff8], ebx
je 0x4081bc
push eax
call fcn.0040382d
push dword [0x427ff8]
mov esi, eax
call fcn.0040382d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4081bc
test edi, edi
je 0x4081bc
call esi
test eax, eax
je 0x4081b3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4081b3
test byte [ebp - 0xc], 1
jne 0x4081bc
or dword [ebp + 0x10], 0x200000
jmp 0x4081f5
mov eax, dword [0x427fec]
cmp eax, ebx
je 0x4081f5
push eax
call fcn.0040382d
pop ecx
test eax, eax
je 0x4081f5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4081f5
mov eax, dword [0x427ff0]
cmp eax, ebx
je 0x4081f5
push eax
call fcn.0040382d
pop ecx
test eax, eax
je 0x4081f5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427fe8]
call fcn.0040382d
pop ecx
test eax, eax
je 0x408215
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408217
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x108a5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x108a51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x108a507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108a506a
add dl, dl
jne 0x108a5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108a50dc
xor eax, eax
add dl, dl
jne 0x108a5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108a517d
add dl, dl
jne 0x108a50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108a50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108a50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108a50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x108a50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x108a5075
mov eax, 1
add dl, dl
jne 0x108a50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108a50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108a50e1
sub eax, ebx
mov ebx, 1
jne 0x108a5128
mov ecx, 1
add dl, dl
jne 0x108a510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x108a5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108a5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x108a5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x108a513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x108a514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108a5136
cmp eax, 0x7d00
jae 0x108a516d
cmp eax, 0x500
jb 0x108a5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x108a5075
cmp eax, 0x7f
ja 0x108a5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x108a5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x108a519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x108a5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4016d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
sub esp, 0xb8
lea eax, [esp + 0x28]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetServicesDiskEnum
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], pe_nt_image_headers32
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x401724
call sub.KERNEL32.dll_IsDebuggerPresent
test eax, eax
setne al
add esp, 0xb8
pop ebx
ret
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x2c]
lea ebx, [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 4], 0x406090
mov dword [esp], ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4017c0
mov dword [esp + 4], str.VBOX
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x401790
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 1
add esp, 0xb8
pop ebx
ret
mov dword [esp + 4], str.VMware
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401773
mov dword [esp + 4], str.QEMU
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x401773
nop
lea esi, [esi]
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
jmp 0x401712

Function at 0x401860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0x38
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 0x2d2d3d5d
mov dword [esp + 0x14], 0x205d3d2d
mov dword [esp + 0x18], 0x202d203d
mov dword [esp + 0x1c], 0x3d5d3d20
mov eax, ebx
mov dword [esp + 0x20], 0x3d202d3d
mov dword [esp + 0x24], 0x5d3d3d3d
mov dword [esp + 0x28], 0x3d2d2d20
mov dword [esp + 0x2c], 0x5d3d20
call fcn.00401460
mov dword [esp + 4], ebx
mov dword [esp], 0x4060e7
call sub.msvcrt.dll_printf
add esp, 0x38
pop ebx
ret
Function at 0x4020e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40212b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x402124
test esi, esi
je 0x402124
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402100
mov dword [esp], 0x408044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402310
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x402360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x402438
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40239e
cmp eax, 4
jne 0x4023c0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4023ae
cmp edx, 4
je 0x4023ae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402310
Function at 0x10001650
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x100ea492
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call dword [0x100f4984]
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call dword [0x100f4984]
push 0x7fff
push 0x7fff
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
mov eax, dword [esp + 8]
cmp dword [eax - 0xc], 0
jne 0x100016dc
push esi
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
mov esi, dword [esp + 8]
push 0x104
push 0x104
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
mov ecx, dword [esp + 0xc]
cmp dword [ecx - 0xc], 0
mov ecx, ebx
jne 0x1000171b
lea edx, [esp + 8]
push edx
jmp 0x10001720
lea eax, [esp + 0xc]
push eax
call dword [0x100f4988]
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x10001750
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100ebea9
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
lea ecx, [esp + 4]
mov dword [esp + 4], 0
call dword [0x100f4984]
mov eax, dword [esp + 0x18]
push 0
push eax
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBufferSetLength]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100017b5
mov ecx, dword [esp + 4]
push ecx
jmp 0x100017b7
push 0
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea ecx, [esp + 4]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x10001960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100ecf42
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 0x10]
mov dword [esp + 0x18], 0
cmp dword [edi + 0xc], esi
jbe 0x100019a4
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ebx, dword [edi + 0xc]
mov eax, dword [edi]
mov dword [esp + 0x1c], eax
cmp ebx, dword [edi + 0x10]
jbe 0x100019b8
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi]
push esi
push ecx
push ebx
push eax
lea edx, [esp + 0x34]
push edx
mov esi, edi
call fcn.10009990
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Tokenize]
mov dword [esp + 0x38], 0
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], 0
je 0x10001a3b
lea ebx, [esp + 0x14]
call fcn.100091e0
lea eax, [esp + 0x18]
push eax
push esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [ebp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Tokenize]
push eax
mov ecx, ebx
mov byte [esp + 0x3c], 1
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], 0
jne 0x100019f7
mov esi, dword [edi + 0x10]
sub esi, dword [edi + 0xc]
lea ecx, [esp + 0x14]
sar esi, 2
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001b20
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100e9e3a
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov ecx, esi
mov dword [esp + 8], 0
call dword [0x100f4984]
push 1
push 0x23
mov dword [esp + 0x1c], 0
push 0x104
mov ecx, esi
mov dword [esp + 0x14], 1
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push str.GlarysoftMalwareHunter
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10001baf
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x10002f80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100ee228
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [0x10123d90]
mov edx, dword [eax + 0x14]
mov ecx, 0x10123d90
push 0xffffffffffffffff
mov dword [esp + 0x14], ecx
call edx
lea ecx, [ebp + 8]
mov dword [esp + 0x30], 0
mov eax, dword [0x10123d88]
mov ebx, dword [0x10123d70]
push ecx
lea edx, [esp + 0x20]
push edx
mov edi, 0x10123d70
mov dword [esp + 0x20], eax
call fcn.10008f70
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x10002ff7
cmp eax, ebx
je 0x10002ffd
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x18]
cmp dword [esi + 4], eax
je 0x100030b8
lea eax, [ebp + 8]
mov esi, 0x10123d70
call fcn.10009300
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x100]
add esi, 0x100
test ecx, ecx
je 0x1000303a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov edx, dword [esi]
test edx, edx
jne 0x10003030
mov eax, dword [esi]
test eax, eax
jne 0x10003086
mov esi, dword [ebp + 8]
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push 1
mov ecx, esi
call eax
mov dword [esp + 0x30], 0xffffffff
mov edx, dword [0x10123d90]
mov eax, dword [edx + 0x1c]
mov ecx, 0x10123d90
call eax
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0x30], 0xffffffff
mov edx, dword [0x10123d90]
mov eax, dword [edx + 0x1c]
mov ecx, 0x10123d90
call eax
mov eax, 0xfffffff7
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0x30], 0xffffffff
mov edx, dword [0x10123d90]
mov eax, dword [edx + 0x1c]
mov ecx, 0x10123d90
call eax
mov eax, 0xfffffffa
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007680
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x100ebda9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea esi, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.100017e0
push eax
push ebx
mov edi, str.Log_
mov dword [esp + 0x20], 0
call fcn.10008ed0
add esp, 8
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [ebx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100076eb
mov eax, dword [ebx]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x100079a0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100ecd50
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x1012007c]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push esi
push edi
mov eax, dword [0x1012007c]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov esi, ecx
lea ebx, [esp + 0x1c]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
call fcn.10007680
push eax
lea eax, [esp + 0x18]
push eax
mov edi, 0x100f5ea0
mov dword [esp + 0x288], 0
call fcn.10008ed0
add esp, 8
mov ecx, ebx
mov byte [esp + 0x280], 2
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ebx, [esp + 0x10]
call fcn.10007600
lea ecx, [esp + 0x24]
mov byte [esp + 0x280], 3
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10007b0d
mov ebx, dword [sym.imp.MSVCR90.dll__wcsicmp]
mov esi, dword [sym.imp.MSVCR90.dll_wcsrchr]
jmp 0x10007a60
test byte [esp + 0x24], 0x10
jne 0x10007aee
lea eax, [esp + 0x50]
push 0x5c
push eax
call esi
add esp, 8
test eax, eax
jne 0x10007a81
lea eax, [esp + 0x50]
jmp 0x10007a86
add eax, 2
je 0x10007aee
push 0x2e
push eax
call esi
add esp, 8
test eax, eax
je 0x10007aee
push str..log
push eax
call ebx
add esp, 8
test eax, eax
jne 0x10007aee
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CompareNoCase]
test eax, eax
je 0x10007aee
lea eax, [esp + 0x50]
lea edx, [eax + 2]
jmp 0x10007ac0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10007ac0
sub eax, edx
sar eax, 1
cmp eax, 0x11
jne 0x10007aee
mov eax, 0x5f
cmp word [esp + 0x58], ax
jne 0x10007aee
cmp word [esp + 0x5e], ax
jne 0x10007aee
cmp word [esp + 0x64], ax
je 0x10007b54
lea edx, [esp + 0x24]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10007a60
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [esp + 0x18]
push 0
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.100e7da2
add esp, 0x274
ret
lea ebx, [esp + 0x20]
call fcn.10007680
mov esi, dword [esp + 0x18]
push eax
push esi
lea edi, [esp + 0x58]
mov byte [esp + 0x288], 4
call fcn.10008ed0
add esp, 8
mov ecx, ebx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
jmp 0x10007b17