joyce8/EMBER2024-capa huggingface dataset:
Function at 0x186570
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x245c18]
cmp dword [eax + 0x30], 0
je 0x18661a
cmp dword [ebx + 0x94], 0
jne 0x186614
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x186500
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x186614
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x1865da
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x186614
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0011bc04
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x1865e9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x18717c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x1871b1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00104b90
jmp 0x1871be
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00104af4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x1882c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x188309
mov eax, esi
call fcn.0016d6bc
test al, al
je 0x188309
mov eax, dword [ebx + 0x84]
call fcn.0016d3b8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x188309
push 0
mov eax, dword [ebx + 0x84]
call fcn.0016d3b8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x189828
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x189852
cmp dword [ebx + 0x64], 0
jne 0x189852
cmp dword [ebx + 0x6c], 0
jne 0x189852
mov edi, esi
jmp 0x1898d9
cmp edi, 0xffffffff
jne 0x18985a
dec edi
jmp 0x1898d9
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x1898d9
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00188c1c
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x1898a7
mov cx, word [esp]
sub cx, si
jmp 0x1898a9
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x189890
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x1898cf
mov cx, word [esp]
sub cx, si
jmp 0x1898d1
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x1898b8
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x189936
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.001895c4
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x189921
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x189936
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x189832
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x18fb8c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x245c48
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x18fbae
shr eax, 1
xor eax, 0xedb88320
jmp 0x18fbb0
shr eax, 1
dec edx
jne 0x18fb9c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x18fb95
mov byte [0x246048], 1
pop esi
pop ebx
ret

Function at 0x18fbcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x246048], 0
jne 0x18fbe6
call fcn.0018fb8c
mov eax, edi
dec eax
test eax, eax
jl 0x18fc0f
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x245c48]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x18fbf0
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x19224c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x19227f
dec al
je 0x1922bb
dec al
je 0x1922ff
dec al
je 0x192370
jmp 0x1923fe
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x1923fe
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x19228f
jmp 0x1923fe
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x1923fe
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x1922cb
jmp 0x1923fe
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x1923fe
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jae 0x19232e
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x192343
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [ebp - 8], edx
add eax, dword [ebp - 8]
sar eax, 1
jns 0x19234d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x19230f
jmp 0x1923fe
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x1923fe
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x1923cc
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
mov dword [ebp - 8], edx
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [ebp - 0xc], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [ebp - 4], edx
mov cl, byte [ebp - 0xc]
push eax
mov al, byte [ebp - 8]
pop edx
call fcn.0018fc18
add al, byte [ebp - 4]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x192386
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x197780
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x11877c]
call fcn.001054d4
xor eax, eax
push ebp
push 0x1978c4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x24255c], 0
jne 0x1977d3
mov ecx, dword [0x24452c]
mov dl, 1
mov eax, dword [0x108348]
call fcn.0010d534
call fcn.00104438
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.001033ac
mov eax, ebx
call fcn.00105324
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x1978d4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00106740
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00105334
test eax, eax
jle 0x19786b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x197864
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00104d44
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00104d10
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00109218
test eax, eax
jne 0x197864
mov ebx, 0x15
jmp 0x197870
mov ebx, 0x10
jmp 0x197870
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x24255c]
call fcn.001976d8
mov eax, dword [ebp - 8]
call fcn.001976d8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00106758
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1978cb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00104ac4
lea eax, [ebp - 0x10]
mov edx, dword [0x11877c]
call fcn.001055a4
ret

Function at 0x19b448
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x19b476
mov eax, ebx
call fcn.0019befc
cmp dword [ebx + 0x40], 0
je 0x19b46f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x19b4e7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x19b4d9
cmp dword [ebx + 8], 0
je 0x19b498
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x19b4aa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x19b4d9
cmp dword [ebx + 8], 0
je 0x19b48b
cmp eax, 3
je 0x19b4bd
dec eax
jne 0x19b48b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x19b48b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x19b48b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x19b505
cmp dword [ebx + 0x14], 0xcc
je 0x19b505
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0019b510
pop ebx
ret
Function at 0x1acb04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x14], 0x242ec8
xor edx, edx
push ebp
push 0x1acb84
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x1acb7a
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x246080]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
test eax, eax
jne 0x1acb6b
mov al, byte [ebp - 0xd]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1acb9b
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x24607c]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1acb8e
inc byte [ebp - 0xd]
add dword [ebp - 0x14], 4
cmp byte [ebp - 0xd], 0x25
jne 0x1acb1f
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1ad674
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x1ad782
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push dword [ebx + 0x8c]
push dword [ebx + 0x88]
push 0
push 0x1ad79c
mov eax, ebx
call fcn.001795d8
lea edx, [ebp - 8]
call fcn.00109658
push dword [ebp - 8]
push dword [ebx + 8]
push 0x1ad7a8
lea eax, [ebp - 4]
mov edx, 4
call fcn.00104e3c
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov dx, word [ebx + 0x60]
mov eax, dword [ebx + 0x30]
call fcn.0017bfbc
mov esi, eax
mov dl, byte [ebx + 0x48]
mov eax, esi
call fcn.00179430
mov dl, byte [ebx + 0x38]
mov eax, esi
call fcn.001794b0
mov dl, 1
mov eax, esi
call fcn.0017a660
mov dl, byte [ebx + 0x3a]
mov eax, esi
call fcn.001796f8
mov dl, byte [ebx + 0x39]
mov eax, esi
call fcn.00179504
mov dl, byte [ebx + 0x3f]
mov eax, esi
call fcn.0017957c
mov eax, dword [ebx + 0x54]
mov dword [esi + 0x54], eax
mov dl, byte [ebx + 0x3d]
mov eax, esi
call fcn.00179ba4
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov dl, byte [ebx + 0x3e]
mov eax, esi
call fcn.00179620
mov edx, dword [ebx + 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [ebx + 0x40]
mov eax, esi
call fcn.00179630
lea eax, [esi + 0x58]
mov edx, dword [ebx + 0x58]
call fcn.00104af4
mov eax, ebx
call fcn.001795c0
mov edx, eax
mov eax, esi
call fcn.00179a5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1ad789
lea eax, [ebp - 8]
mov edx, 2
call fcn.00104ac4
ret
Function at 0x1ae720
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1ae830
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0x30]
mov eax, esi
call fcn.00109100
test eax, eax
jne 0x1ae75a
mov eax, esi
call fcn.00104d7c
test eax, eax
jg 0x1ae815
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x30]
call fcn.00104b38
lea eax, [ebx + 0x30]
mov edx, esi
call fcn.00104af4
mov eax, dword [ebx + 0x30]
call fcn.00104d7c
test eax, eax
jne 0x1ae790
lea eax, [ebp - 4]
push eax
push 0x11
mov eax, ebx
call fcn.001ad054
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x1ae79d
mov edx, dword [ebx + 0x30]
xor eax, eax
call fcn.001b036c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1ae7d1
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 8]
call fcn.00104af4
lea eax, [ebp - 0xc]
mov ecx, esi
mov edx, 0x1ae848
call fcn.00104dc8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x1ac7bc]
call fcn.0010d478
call fcn.00104438
mov eax, dword [ebx + 0x30]
call fcn.00104d7c
test eax, eax
jle 0x1ae7fc
mov eax, dword [ebx + 0x30]
call fcn.00104d7c
mov edx, dword [ebx + 0x30]
cmp byte [edx + eax - 1], 0x5c
je 0x1ae7fc
lea eax, [ebx + 0x30]
mov edx, 0x1ae868
call fcn.00104d84
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.001ae86c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x24607c]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1ae837
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00104ac4
ret

Function at 0x1aedd4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x1aedf0
mov eax, ebx
call fcn.001ae674
jmp 0x1aedfa
mov edx, esi
mov eax, dword [ebx + 0x34]
call fcn.001b0214
push 0x4009
push 0x160
lea edx, [ebp - 0x160]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x15c]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1aee20
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
mov ebx, eax
push 0x4009
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.001ae674
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x15c]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1aee58
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
mov ebx, eax
push 0x400b
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.001ae674
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x15c]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1af1dc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
mov word [ebp - 2], 0
push 0x4009
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 2]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebp - 0x160]
mov esp, ebp
pop ebp
ret
Function at 0x1af214
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov ebx, edx
mov word [ebp - 2], 0
push 0x208
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 2]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, ebx
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00104d10
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1afd4c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x68], 0
jne 0x1afd80
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x1afe14
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
jmp 0x1afd9f
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x1afe14
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
mov eax, ebx
call fcn.001afe18
test al, al
je 0x1afdb5
mov edx, esi
mov eax, ebx
call fcn.0017444c
jmp 0x1afe0c
mov ecx, ebx
mov dl, 1
mov eax, dword [0x16310c]
call fcn.001740f0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1afe05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x42], 1
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0017444c
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00175118
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1afe0c
mov eax, dword [ebp - 4]
call fcn.00103ba8
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1b2774
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1b27f3
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebx + 0x30]
mov edi, dword [eax]
call dword [edi + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00104d7c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00104fdc
push ebx
push 0x1b2050
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x1b1140]
call fcn.001b28e4
mov dword [eax + 0x40], 0xffffffff
mov edx, esi
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1b27fa
lea eax, [ebp - 4]
call fcn.00104aa0
ret
Function at 0x1b2a24
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 0x144]
xor eax, eax
push ebp
push 0x1b2b59
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
lea eax, [ebp - 0x148]
mov ecx, 0x1b2b70
mov edx, esi
call fcn.00104dc8
mov eax, dword [ebp - 0x148]
call fcn.00104f7c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x1b2b30
xor eax, eax
push ebp
push 0x1b2b29
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [edi], 0x10
je 0x1b2aef
cmp byte [edi + 0x2c], 0x2e
jne 0x1b2ab1
mov al, byte [edi + 0x2d]
test al, al
je 0x1b2b04
sub al, 0x2e
je 0x1b2b04
push esi
lea eax, [ebp - 0x150]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00104d10
push dword [ebp - 0x150]
push 0x1b2b7c
lea eax, [ebp - 0x14c]
mov edx, 3
call fcn.00104e3c
mov edx, dword [ebp - 0x14c]
mov eax, ebx
call fcn.001b2a24
jmp 0x1b2b04
mov eax, dword [edi + 0x1c]
mov edx, eax
neg eax
add eax, dword [edi + 0x20]
xor edx, edx
add dword [ebx + 0x48], eax
adc dword [ebx + 0x4c], edx
inc dword [ebx + 0x50]
push edi
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x1b2a9b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1b2b30
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1b2b60
lea eax, [ebp - 0x150]
call fcn.00104aa0
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00104ac4
ret

Function at 0x1cf6fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
call fcn.00102be8
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x105]
push eax
mov eax, 0xffff
call fcn.001033cc
push eax
push 0x1cf758
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.00104d10
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1cf75c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00104f6c
xor eax, eax
push ebp
push 0x1cf836
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.001cf6fc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x1cf84c
call fcn.00104dc8
mov dl, 1
mov eax, dword [0x1198dc]
call fcn.00103b78
mov esi, eax
push 0x1cf85c
push dword [ebp - 4]
push 0x1cf878
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00104e3c
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, 0x1cf884
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x74]
push 0
push 0x1cf88c
push 0x1cf88c
mov eax, dword [ebp - 8]
call fcn.00104f7c
push eax
push 0x1cf890
mov eax, dword [0x244ac0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, 0x1f4
call fcn.001cf6b8
mov eax, dword [ebp - 8]
call fcn.00109d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1cf83d
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00104ac4
ret