joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1063f67
Capabilities:
Copy file
Get common file path

Disassembly:
mov eax, 0x1272f5b
call fcn.01160458
sub esp, 0x630
mov eax, dword [0x12cf8c8]
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x218]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x800e
push ebx
call esi
test eax, eax
mov edi, 0x8005
jge 0x1063fb1
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push edi
push ebx
call esi
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push 0x8037
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0x63c], eax
jge 0x1063fe7
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push edi
push ebx
call esi
cmp eax, ebx
mov dword [ebp - 0x63c], eax
jl 0x106415f
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x634], eax
mov dword [ebp - 4], ebx
push 0xf683
lea ecx, [ebp - 0x634]
call fcn.01032a72
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x630]
call fcn.01046065
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x630]
call fcn.01045236
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x630]
call fcn.01044f22
lea ecx, [ebp - 0x630]
call fcn.0104525f
test eax, eax
jge 0x1064142
push 0x104
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 1
jae 0x106406a
mov esi, 0x80004005
jmp 0x10640c5
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x638]
call fcn.01046065
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x62c]
call fcn.01045169
mov byte [ebp - 4], 3
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x638]
call fcn.01052dc4
mov esi, eax
cmp esi, ebx
jge 0x10640e6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x62c]
call fcn.01045295
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x638]
call fcn.01045295
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x630]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x634]
call fcn.010328fe
mov eax, esi
jmp 0x1064165
lea ecx, [ebp - 0x62c]
call fcn.01045236
push 0x10067c0
lea ecx, [ebp - 0x62c]
call fcn.01052ada
lea ecx, [ebp - 0x62c]
call fcn.0104525f
test eax, eax
jl 0x1064124
push 1
push dword [ebp - 0x630]
push dword [ebp - 0x62c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x62c]
call fcn.01045295
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x638]
call fcn.01045295
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x630]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x634]
call fcn.010328fe
mov eax, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0116015a
leave
ret
Function at 0x10662e2
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x127327e
call fcn.01160458
sub esp, 0x254
mov eax, dword [0x12cf8c8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x25c], ebx
mov byte [ebp - 4], 1
push ebx
push ebx
mov esi, 0xf003f
push esi
push ebx
push ebx
push eax
push SysReAllocString
lea ecx, [ebp - 0x260]
call fcn.01061aa6
cmp eax, ebx
je 0x106633d
xor esi, esi
jmp 0x106640d
push ebx
push ebx
push esi
push ebx
push ebx
push 0x10068dc
push dword [ebp - 0x260]
lea ecx, [ebp - 0x25c]
call fcn.01061aa6
cmp eax, ebx
jne 0x1066336
push 0x10068c0
push dword [edi + 0xc]
lea ecx, [ebp - 0x25c]
call fcn.01061afb
mov esi, dword [edi + 4]
jmp 0x10663b9
push esi
push 0x10068a8
lea eax, [ebp - 0x50]
push 0x1f
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x258]
push eax
lea eax, [esi + 0xe10f]
push eax
mov ecx, edi
mov word [ebp - 0x12], bx
call fcn.010662a5
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x25c]
call fcn.01044d1b
dec esi
cmp esi, ebx
jg 0x1066374
mov edi, dword [edi + 4]
lea esi, [edi + 1]
jmp 0x10663ef
push esi
push 0x10068a8
lea eax, [ebp - 0x50]
push 0x1f
push eax
call dword [sym.imp.msvcrt.dll__snwprintf]
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x25c]
mov word [ebp - 0x12], bx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
inc esi
cmp esi, 0x10
jl 0x10663c5
lea ecx, [ebp - 0x25c]
call fcn.01044c64
lea ecx, [ebp - 0x260]
call fcn.01044c64
xor esi, esi
inc esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x25c]
call fcn.01044c64
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.01044c64
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0116015a
leave
ret 4
Function at 0x106bfba
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x1272e1d
call fcn.01160458
push ecx
push esi
mov esi, ecx
call fcn.0106c0a7
test eax, eax
jge 0x106bfe3
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor al, al
jmp 0x106c095
push ebx
push 0x640000
push 0
push 0x401
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x12ce0a0]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x2bc
lea ecx, [ebp - 0x10]
call fcn.01032a72
test eax, eax
jne 0x106c01a
xor bl, bl
jmp 0x106c086
push edi
push dword [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea ebx, [esi + 4]
push dword [ebx]
call edi
test eax, eax
jne 0x106c033
xor bl, bl
jmp 0x106c085
push 0
lea eax, [ebp - 0x10]
push 0xf1f7
push eax
call fcn.010535f5
add esp, 0xc
test eax, eax
je 0x106c02f
push dword [ebp - 0x10]
push dword [esi + 0x2c]
call edi
test eax, eax
je 0x106c02f
push 0x2bd
lea ecx, [ebp - 0x10]
call fcn.01032a72
test eax, eax
je 0x106c02f
push dword [ebp - 0x10]
push dword [esi + 0x30]
call edi
push 0
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, ebx
call fcn.01032646
mov bl, 1
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.010328fe
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x106c27d
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0
mov esi, ecx
push esi
push 0x106c2c5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x38], eax
jne 0x106c2a7
xor al, al
jmp 0x106c2bd
mov ecx, 0x12d2398
call fcn.0107dc59
push eax
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, 1
pop esi
leave
ret

Function at 0x106cf9d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1273c98
call fcn.01160458
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0104e029
xor edi, edi
mov dword [ebp - 4], edi
lea ebx, [esi + 0xc]
mov ecx, ebx
call fcn.01068cd2
mov byte [ebp - 4], 1
mov dword [esi + 0x30], edi
mov dword [esi], 0x1006c28
mov dword [ebx], 0x1006c18
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov byte [ebp - 4], 2
mov dword [esi + 0x54], edi
mov byte [ebp - 4], 3
mov dword [esi + 0x68], edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x106e7a2
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov eax, esi
neg eax
sbb eax, eax
and eax, 4
push eax
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
push 0xe801
lea ecx, [edi + 0x64]
call fcn.0106cb38
push 1
lea ecx, [edi + 0x10]
call fcn.01050dbf
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x1074452
Capabilities:
Create thread

Disassembly:
mov eax, 0x12747d9
call fcn.01160458
push ecx
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 0x24]
call fcn.01033682
test eax, eax
jge 0x1074468
xor al, al
jmp 0x1074517
and dword [ebp - 0x10], 0
push ebx
push edi
and dword [ebp - 4], 0
mov eax, dword [0x12d1f58]
push 0xf147
push dword [eax + 8]
lea ecx, [ebp - 0x10]
call fcn.01044bf9
push dword [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [esi + 0x38]
call edi
test eax, eax
jne 0x107449d
xor bl, bl
jmp 0x1074506
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x10744b5
push 5
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x100355c
lea ebx, [esi + 0x3c]
push dword [ebx]
call edi
test eax, eax
je 0x1074499
push 0
mov eax, 0x4000
push eax
push eax
mov ecx, ebx
call fcn.01032b63
lea edi, [esi + 4]
push dword [edi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, edi
call fcn.01032646
lea eax, [ebp - 0x14]
push eax
xor edi, edi
push edi
push esi
push 0x1074412
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x4c], eax
je 0x1074499
mov bl, 1
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10749ab
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1274820
call fcn.01160458
sub esp, 0x218
mov eax, dword [0x12cf8c8]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 4], esi
push 0x2001f
push eax
push dword [ebx]
lea ecx, [ebp - 0x214]
call fcn.01044c82
cmp eax, esi
jne 0x1074a54
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1074a0b
lea eax, [ebp - 0x210]
push eax
call fcn.010749ab
cmp eax, esi
jne 0x1074a53
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x214]
je 0x10749fb
call fcn.01044c64
push dword [ebp - 0x21c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.01044c64
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0116015a
leave
ret 4
Function at 0x1075687
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1274883
call fcn.01160458
sub esp, 0x218
mov eax, dword [0x12cf8c8]
push ebx
mov dword [ebp - 0x10], eax
push esi
mov eax, ecx
lea esi, [eax + 0x84]
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.01046065
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x220]
push eax
push ecx
lea eax, [ebp - 0x21c]
mov ecx, esp
mov dword [ebp - 0x224], esp
push eax
call fcn.01052b7d
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
call fcn.01184124
cmp eax, ebx
jge 0x10752c6
push dword [ebp - 0x220]
call fcn.0116f1a5
pop ecx
push dword [esi]
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.01055fd3
jmp 0x10752c8
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.01045295
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov al, bl
call fcn.0116015a
pop esi
pop ebx
leave
ret
mov edi, edi
push esi
mov esi, ecx
call fcn.010754e6
test al, al
jne 0x1075697
pop esi
ret
mov ecx, esi
pop esi
jmp 0x107522c

Function at 0x107cb7f
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov ecx, dword [ebp + 0x18]
mov eax, dword [0x12cf8c8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x214], ecx
push 0x104
lea ecx, [ebp - 0x20c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x107cc2e
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [ebp - 0x21c], eax
je 0x107cc2e
add eax, 3
and eax, 0xfffffffc
call fcn.01160620
test esp, esp
mov dword [ebp - 0x210], esp
je 0x107cc2e
push esp
push dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x107cc2e
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x1007ab8
push dword [ebp - 0x210]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x107cc32
xor al, al
jmp 0x107cc58
mov eax, dword [ebp - 0x218]
movsx ecx, word [eax + 0xa]
mov dword [esi], ecx
movsx ecx, word [eax + 8]
mov dword [edi], ecx
movsx ecx, word [eax + 0xe]
mov dword [ebx], ecx
movsx eax, word [eax + 0xc]
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
mov al, 1
lea esp, [ebp - 0x230]
mov ecx, dword [ebp - 4]
call fcn.0116015a
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x107d56f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [esi + 0x90], eax
jne 0x107d594
xor al, al
jmp 0x107d5bf
lea eax, [ebp - 8]
push eax
push ebx
push esi
push 0x107c750
push ebx
push ebx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
cmp eax, ebx
setne byte [ebp - 1]
cmp byte [ebp - 1], bl
je 0x107d5bc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop esi
pop ebx
leave
ret

Function at 0x107dfac
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, 0x12752bc
call fcn.01160458
push ecx
push esi
push edi
xor edi, edi
cmp dword [0x12d2b08], edi
mov esi, 0x12d2900
jne 0x107e044
push 1
push 0x1c
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x107e044
push esi
lea ecx, [ebp - 0x10]
call fcn.01046065
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x10]
call fcn.01045236
push 0x1008218
lea ecx, [ebp - 0x10]
call fcn.01052ada
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, edi
jne 0x107e00d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x10]
call fcn.01045236
push 0x103
push dword [ebp - 0x10]
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
mov word [0x12d2b06], di
mov dword [0x12d2b08], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.01045295
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1082f4f
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 1
mov edi, ecx
call esi
mov ecx, edi
mov dword [ebp - 0xc], eax
call fcn.0104525f
test eax, eax
mov eax, dword [edi]
setge byte [ebp - 1]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x1082fa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], 0
jne 0x1082fb7
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0xc]
call esi
test ebx, ebx
je 0x1082fd2
jle 0x1082fce
and ebx, 0xffff
or ebx, 0x80070000
mov eax, ebx
jmp 0x1082fd4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10836e7
Capabilities:
Delete file

Disassembly:
mov eax, 0x1275b56
call fcn.01160458
sub esp, 0x24
mov ecx, dword [ebp + 8]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
add ecx, 0xc
call fcn.0117ec3d
test eax, eax
jl 0x10837d6
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x1083720
mov eax, 0x80004003
jmp 0x10837d6
push esi
call fcn.0117be96
test eax, eax
je 0x10837d3
mov ecx, dword [ebp - 0x10]
call fcn.0117c4ba
test eax, eax
jl 0x10837d5
mov ecx, dword [ebp - 0x10]
call fcn.0117be96
push eax
lea ecx, [ebp + 8]
call fcn.01046065
and dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0107c805
mov eax, dword [ebp + 8]
mov esi, dword [eax - 8]
lea eax, [esi + 1]
push eax
lea ecx, [ebp + 8]
call fcn.0103297b
mov edx, eax
test edx, edx
jne 0x108377a
mov esi, 0x8007000e
jmp 0x10837ad
and word [edx + esi*2], 0
push edi
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], edx
mov word [ebp - 0x20], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
pop edi
jge 0x10837bd
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01045295
mov eax, esi
jmp 0x10837d5
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.010329e8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01045295
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1084061
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
mov eax, 0x1275ca3
call fcn.01160458
sub esp, 0x250
mov eax, dword [0x12cf8c8]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x220]
call fcn.01045169
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp - 0x22c]
push ecx
push esi
call dword [eax + 0x6c]
cmp eax, edi
jge 0x10840b0
mov esi, eax
jmp 0x108425b
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x220]
call fcn.01045196
mov ecx, dword [ebp - 0x220]
xor eax, eax
cmp dword [ecx - 8], edi
setne al
cmp eax, edi
jne 0x10840dd
mov esi, 0x80004005
jmp 0x108425b
push ebx
lea ecx, [ebp - 0x220]
call fcn.0104525f
test eax, eax
lea ecx, [ebp - 0x220]
setge bl
call fcn.01082f4f
test eax, eax
jge 0x1084107
mov esi, 0xc9470099
jmp 0x108425a
lea ecx, [ebp - 0x224]
call fcn.01045169
mov byte [ebp - 4], 2
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call fcn.01052dc4
cmp eax, edi
jge 0x1084133
mov esi, eax
jmp 0x108424b
test bl, bl
mov byte [ebp - 0x219], 0
je 0x1084175
lea eax, [ebp - 0x218]
push eax
push 1
push 0x10094fc
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, edi
jne 0x1084166
mov esi, 0x80004005
jmp 0x108424b
lea edi, [ebp - 0x218]
mov byte [ebp - 0x219], 1
jmp 0x108417b
mov edi, dword [ebp - 0x220]
lea eax, [ebp - 0x230]
xor ebx, ebx
push eax
lea ecx, [esi + 0xc]
mov dword [ebp - 0x230], ebx
call fcn.0117ec3d
cmp eax, ebx
jl 0x108412c
push ebx
push dword [ebp - 0x230]
lea ecx, [ebp - 0x25c]
call fcn.0118fb90
mov byte [ebp - 4], 3
push edi
lea ecx, [ebp - 0x25c]
call fcn.0118eb71
cmp eax, ebx
jge 0x10841c0
mov esi, eax
jmp 0x108423c
lea eax, [esi + 0x2c]
push eax
push 0x17
lea eax, [ebp - 0x25c]
push eax
call fcn.0118ff79
cmp eax, ebx
jl 0x10841bc
push ebx
lea ecx, [ebp - 0x25c]
call fcn.0118f0e0
cmp byte [ebp - 0x219], 0
mov dword [ebp - 0x228], eax
je 0x1084229
push dword [ebp - 0x220]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
cmp eax, ebx
jne 0x1084218
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1084218
mov dword [ebp - 0x228], 0x8000ffff
cmp dword [ebp - 0x228], ebx
lea eax, [ebp - 0x218]
jge 0x1084294
push eax
call edi
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x44]
cmp eax, ebx
mov esi, eax
jl 0x108423c
mov esi, dword [ebp - 0x228]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x25c]
call fcn.010830ef
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.01045295
pop ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.01045295
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x22c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
call fcn.0116015a
leave
ret 4
push dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
jne 0x1084229
mov esi, 0x80004005
jmp 0x108423c
Function at 0x108445a
Capabilities:
Delete file

Disassembly:
mov eax, 0x1275ad2
call fcn.01160458
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x78]
mov eax, dword [edi]
cmp dword [eax - 8], 0
je 0x10844d0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, 0x12d2398
call fcn.0116c0a5
mov ecx, eax
test ecx, ecx
mov dword [ebp - 0x10], ecx
je 0x10844a6
push ebx
push 2
lea ebx, [esi + 0x60]
push ebx
call fcn.0117eff4
mov ecx, dword [ebp - 0x10]
push 4
push ebx
call fcn.0117eff4
pop ebx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.01083993
and dword [ebp - 4], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.01045295
mov ecx, edi
call fcn.01047cc7
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x108f3d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x12cf8c8]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [0x12d23c0]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp + 0xc]
push 0xf1
push eax
push edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
cmp eax, ebx
je 0x108f46a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x108f46a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x108f46a
push ebx
push dword [0x12d23bc]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x1c]
movzx eax, word [edi + 8]
push esi
push 0x64
push 0x64
push ebx
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push ebx
push 0x1003af0
push ebx
mov byte [ebp - 0x10], 4
mov byte [ebp - 0xf], bl
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jne 0x108f471
xor eax, eax
jmp 0x108f529
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0x14
push 0x41e
push eax
call esi
push ecx
mov ecx, dword [ebp - 0x20]
mov eax, esp
mov dword [eax], ecx
call fcn.0103d4e5
cmp al, bl
je 0x108f4ba
movzx eax, word [edi + 2]
push 0x2040
push ebx
push 0xffffffffffffffff
push 1
push eax
push dword [ebp - 0x20]
push dword [0x12d23c0]
call dword [sym.imp.COMCTL32.dll_ImageList_LoadImageW]
push eax
push ebx
push 0x430
jmp 0x108f4d1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 1
push 0x413
push dword [ebp - 0x1c]
call esi
lea eax, [ebp - 0x18]
push eax
push 1
push 0x444
push dword [ebp - 0x1c]
call esi
movzx eax, word [edi + 4]
movzx ecx, word [edi + 2]
shl eax, 0x10
or eax, ecx
push eax
push ebx
push 0x420
push dword [ebp - 0x1c]
call esi
mov ax, word [edi + 4]
mov cx, word [edi + 2]
add ax, 7
movzx eax, ax
add cx, 7
movzx ecx, cx
shl eax, 0x10
or eax, ecx
push eax
push ebx
push 0x41f
push dword [ebp - 0x1c]
call esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
call fcn.0116015a
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1090d15
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov esi, ecx
je 0x1090d33
cmp edi, 1
je 0x1090d33
cmp edi, 0xffffffff
je 0x1090d6c
xor al, al
jmp 0x1090d92
cmp edi, 0xffffffff
je 0x1090d6c
push ebx
push dword [esi + edi*4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
jne 0x1090d53
push 5
push dword [esi + edi*4]
call ebx
xor eax, eax
test edi, edi
sete al
push 0
push dword [esi + eax*4]
call ebx
cmp dword [esi + 0x1c], edi
pop ebx
je 0x1090d86
mov dword [esi + 0x1c], edi
jmp 0x1090d86
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x1090d86
xor ecx, ecx
test eax, eax
sete cl
push 5
push dword [esi + ecx*4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
mov dword [esi + 0x40], edi
call fcn.0103801b
mov al, 1
pop edi
pop esi
pop ebp
ret 4