joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102a063
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea eax, [esi + 8]
push edi
mov dword [ebp - 0x18], 0x3f6
mov dword [ebp - 0x14], 0x3f7
mov dword [ebp - 0x10], 0x3f8
mov dword [ebp - 0xc], 0x3f9
mov dword [ebp - 8], 0x3fa
xor ebx, ebx
lea edi, [esi + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x102a0bb
push 0
push dword [ebp + ebx*4 - 0x18]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x102a0e7
mov eax, dword [ebp + ebx*4 - 0x18]
push 5
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 4]
push dword [edi]
push 0
push dword [ebp + ebx*4 - 0x18]
push dword [ebp + 8]
call fcn.010575de
add dword [ebp - 4], 4
inc ebx
add edi, 8
cmp ebx, 5
jb 0x102a09b
push 1
push dword [esi + 0x4c]
push 0x10022b0
push 0x3fe
push dword [ebp + 8]
call fcn.0105773e
push 1
push dword [esi + 0x50]
push 0x10021e8
push 0x3ff
push dword [ebp + 8]
call fcn.0105773e
mov ecx, dword [esi + 0x4c]
xor eax, eax
pop edi
pop ebx
test ecx, ecx
jbe 0x102a137
mov eax, dword [esi + 0x50]
imul eax, eax, 0x64
xor edx, edx
div ecx
push 1
push eax
push 0x1002138
push 0x400
push dword [ebp + 8]
call fcn.0105773e
leave
ret 4

Function at 0x102a1ba
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x5c], 0x3f1
mov dword [ebp - 0x58], 0x3f2
mov dword [ebp - 0x54], 0x3f3
mov dword [ebp - 0x50], 0x3f4
mov dword [ebp - 0x4c], 0x3f5
call fcn.0102a063
xor edi, edi
lea ebx, [esi + 8]
cmp dword [ebx], 0
jne 0x102a222
push 0
push dword [ebp + edi*4 - 0x5c]
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x102a256
mov eax, dword [ebp + edi*4 - 0x5c]
push 5
push eax
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x20
lea eax, [ebp - 0x44]
push eax
push dword [ebx]
call fcn.0102d572
lea eax, [ebp - 0x44]
push eax
push dword [ebp + edi*4 - 0x5c]
push dword [ebp - 0x48]
call fcn.01057528
inc edi
add ebx, 4
cmp edi, 5
jb 0x102a205
mov edi, dword [ebp - 0x48]
push 0x10026a0
push 0x404
push edi
call fcn.01057528
xor ebx, ebx
inc ebx
push ebx
push dword [esi + 0x54]
push 0x10025e8
push 0x401
push edi
call fcn.0105773e
push ebx
push dword [esi + 0x58]
push 0x1002538
push 0x402
push edi
call fcn.0105773e
cmp byte [esi + 0x60], 0
push ebx
jne 0x102a2ac
mov eax, dword [esi + 0x5c]
neg eax
push eax
jmp 0x102a2af
push dword [esi + 0x5c]
push 0x1002498
push 0x403
push edi
call fcn.0105773e
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01034b69
leave
ret 4
Function at 0x102a2d5
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x64], 0x3f1
mov dword [ebp - 0x60], 0x3f2
mov dword [ebp - 0x5c], 0x3f3
mov dword [ebp - 0x58], 0x3f4
mov dword [ebp - 0x54], 0x3f5
call fcn.0102a063
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
add esi, 8
mov dword [ebp - 0x4c], esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 0
jne 0x102a34a
push 0
push dword [ebp + ebx*4 - 0x64]
push dword [ebp - 0x48]
call esi
push eax
call edi
jmp 0x102a379
mov eax, dword [ebp + ebx*4 - 0x64]
push 5
push eax
push dword [ebp - 0x48]
call esi
push eax
call edi
push 0x20
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x4c]
push dword [eax]
call fcn.0102d656
lea eax, [ebp - 0x44]
push eax
push dword [ebp + ebx*4 - 0x64]
push dword [ebp - 0x48]
call fcn.01057528
add dword [ebp - 0x4c], 4
inc ebx
cmp ebx, 5
jb 0x102a332
mov edi, dword [ebp - 0x48]
push 0x10028f8
push 0x404
push edi
call fcn.01057528
mov esi, dword [ebp - 0x50]
push 0x20
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x54]
call fcn.0102d656
lea eax, [ebp - 0x44]
push eax
push 0x1002868
push 0x401
push edi
call fcn.01057582
push 0x20
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x58]
call fcn.0102d656
lea eax, [ebp - 0x44]
push eax
push 0x10027d0
push 0x402
push edi
call fcn.01057582
push 0x20
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x5c]
call fcn.0102d656
lea eax, [ebp - 0x44]
push eax
push 0x1002750
push 0x403
push edi
call fcn.01057582
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01034b69
leave
ret 4
Function at 0x102d572
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10970a0], 0
push esi
mov esi, dword [ebp + 0xc]
jne 0x102d5ec
push edi
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x24], 0x31
lea edi, [ebp - 0x20]
push 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push 0x1010
push 0x400
mov byte [0x10970a0], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
pop edi
test eax, eax
jne 0x102d5d6
push 0x1005f40
push 0x20001
call fcn.01054776
pop ecx
pop ecx
push 0xa
lea eax, [ebp - 0x24]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
mov dword [0x108e180], eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x102d5fb
push eax
push 0x1005f38
jmp 0x102d634
mov ecx, dword [0x108e180]
neg eax
sub ecx, 0
push eax
je 0x102d62f
dec ecx
dec ecx
je 0x102d628
dec ecx
je 0x102d621
dec ecx
je 0x102d61a
push 0x1005f30
jmp 0x102d634
push 0x1005f24
jmp 0x102d634
push 0x1005f1c
jmp 0x102d634
push 0x1005f10
jmp 0x102d634
push 0x1005f04
push 0xffffffffffffffff
push dword [ebp + 0x10]
push esi
call sub.msvcrt.dll__snwprintf_s
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop esi
call fcn.01034b69
leave
ret 0xc
Function at 0x102d656
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10970a8], 0
mov ecx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x28], ecx
mov esi, 0x108e188
jne 0x102d734
push ebx
push edi
push 7
pop ecx
push 6
push esi
xor eax, eax
mov dword [ebp - 0x24], 0x31
lea edi, [ebp - 0x20]
push 0x14
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, 0x400
push ebx
mov byte [0x10970a8], 1
call edi
test eax, eax
jne 0x102d6c3
push 0x1006188
push 0x20001
call fcn.01054776
pop ecx
pop ecx
push 0x10
lea eax, [ebp - 0x24]
push eax
push 0x1c
push ebx
call edi
test eax, eax
jne 0x102d6e3
push 0x1005f40
push 0x20001
call fcn.01054776
pop ecx
pop ecx
push 0xa
lea eax, [ebp - 0x24]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
push 0x10
mov dword [0x108e184], eax
lea eax, [ebp - 0x24]
push eax
push 0x1b
push ebx
call edi
pop edi
pop ebx
test eax, eax
jne 0x102d71b
push 0x10060f0
push 0x20001
call fcn.01054776
pop ecx
pop ecx
push 0xa
lea eax, [ebp - 0x24]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov dword [0x10970a4], eax
mov eax, dword [ebp + 8]
test eax, eax
jl 0x102d77a
mov edx, dword [0x10970a4]
dec edx
je 0x102d76e
dec edx
je 0x102d762
dec edx
je 0x102d756
push eax
push esi
push 0x10060e0
jmp 0x102d84a
push esi
push eax
push 0x10060d4
jmp 0x102d84a
push eax
push esi
push 0x10060c8
jmp 0x102d84a
push esi
push eax
push 0x10060bc
jmp 0x102d84a
mov edx, dword [0x108e184]
cmp edx, 0xf
ja case.0x102d789.1
jmp dword [edx*4 + 0x102d86a]
neg eax
push eax
push esi
push 0x10060ac
jmp 0x102d84a
neg eax
push eax
push esi
push 0x10060a0
jmp 0x102d84a
neg eax
push eax
push esi
push 0x1006094
jmp 0x102d84a
push esi
neg eax
push eax
push 0x1006084
jmp 0x102d84a
push esi
neg eax
push eax
push 0x1006078
jmp 0x102d84a
push esi
neg eax
push eax
push 0x100606c
jmp 0x102d84a
push esi
neg eax
push eax
push 0x1006060
jmp 0x102d84a
push esi
neg eax
push eax
push 0x1006050
jmp 0x102d84a
neg eax
push eax
push esi
push 0x1006040
jmp 0x102d84a
push esi
neg eax
push eax
push 0x1006030
jmp 0x102d84a
neg eax
push eax
push esi
push 0x1006020
jmp 0x102d84a
neg eax
push eax
push esi
push 0x1006010
jmp 0x102d84a
push esi
neg eax
push eax
push 0x1006000
jmp 0x102d84a
neg eax
push eax
push esi
push 0x1005ff0
jmp 0x102d84a
push esi
neg eax
push eax
push 0x1005fe0
jmp 0x102d84a
neg eax
push eax
push esi
push 0x1005fd4
push 0xffffffffffffffff
push dword [ebp + 0x10]
push ecx
call sub.msvcrt.dll__snwprintf_s
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop esi
call fcn.01034b69
leave
ret 0xc
Function at 0x1034b28
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1089480
call fcn.01034f84
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x109b7bc
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10348df
cmp eax, esi
jne 0x10348d2
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10348e2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10348b9
xor esi, esi
inc esi
mov eax, dword [0x109b7b8]
cmp eax, esi
jne 0x10348f5
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1034924
mov eax, dword [0x109b7b8]
test eax, eax
jne 0x103491e
mov dword [0x109b7b8], esi
push 0x1001804
push 0x10017f8
call fcn.0103481e
pop ecx
pop ecx
test eax, eax
je 0x1034924
jmp 0x1034a4c
mov dword [0x10970e8], esi
mov eax, dword [0x109b7b8]
cmp eax, esi
jne 0x1034948
push 0x10017f4
push 0x1001724
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x109b7b8], 2
test ebx, ebx
jne 0x1034954
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x109b7c8], 0
je 0x1034978
push 0x109b7c8
call fcn.01034ef9
pop ecx
test eax, eax
je 0x1034978
push 0
push 2
push 0
call dword [0x109b7c8]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x10349d4
test al, al
je 0x1034992
cmp dword [ebp - 0x1c], 0
jne 0x10349d4
mov al, byte [esi]
test al, al
je 0x10349a2
cmp al, 0x20
ja 0x10349a2
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1034992
test byte [ebp - 0x3c], 1
je 0x10349ae
movzx eax, word [ebp - 0x38]
jmp 0x10349b1
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x10970e4], eax
cmp dword [0x10970d8], 0
jne 0x1034a28
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10349e3
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10349f6
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x103497f
cmp dword [0x10970e8], 0
jne 0x1034a37
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10970e4]
jmp 0x1034a58
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01034fc9
ret
call fcn.010350c9
jmp 0x103487f
Function at 0x1035ba2
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
mov edi, 0xfffe
mov esi, 0x385
cmp byte [0x1097420], bl
je 0x1035c3f
push 0x1009e1c
push 0x1009e10
push 0x244
push 0x10
call fcn.01054409
add esp, 0x10
cmp byte [0x109750b], bl
jne 0x1035c26
push ebx
push ebx
push ebx
push edi
push 1
push 0x373
push esi
call fcn.010571e4
lea eax, [ebp - 0x10]
push eax
push dword [0x1097430]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 4
push dword [0x108e278]
push dword [0x108e274]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
push dword [0x1097430]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1035c2e
mov eax, dword [0x10974ac]
mov byte [eax + 0x6d], bl
push ebx
call fcn.0103df5f
test al, al
je 0x1035c3f
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
push 0x1009db8
push 0x1009e10
push 0x25d
push 0x10
call fcn.01054409
add esp, 0x10
push ebx
push ebx
push ebx
push edi
push 1
push 0x37d
push esi
call fcn.010571e4
movzx eax, byte [0x109750b]
push eax
call fcn.01054e55
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10367df
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
push 0x1009f44
push 0x10
call fcn.01054776
xor ebx, ebx
add esp, 0xc
cmp byte [0x109750b], bl
je 0x1036813
mov eax, dword [0x1097504]
cmp eax, ebx
je 0x1036813
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x1097430]
cmp eax, ebx
je 0x103682e
push eax
call sub.WTSAPI32.dll_WTSUnRegisterSessionNotification
push dword [0x1097430]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor edi, edi
inc edi
push edi
call dword [sym.imp.USER32.dll_ShowCursor]
push dword [0x1097448]
call fcn.0103479e
mov eax, dword [0x1097424]
pop ecx
mov dword [0x1097448], ebx
cmp eax, ebx
je 0x1036859
push eax
call sub.gdiplus.dll_GdiplusShutdown
call fcn.010457ad
mov ecx, dword [0x1097438]
cmp ecx, ebx
je 0x103687c
call fcn.0105c8ec
mov ecx, dword [0x1097438]
cmp ecx, ebx
je 0x103687c
mov eax, dword [ecx]
push edi
call dword [eax]
mov ecx, dword [0x10974ac]
mov dword [0x1097438], ebx
cmp ecx, ebx
je 0x1036892
push edi
call fcn.01035a45
mov ecx, dword [0x1098294]
mov dword [0x10974ac], ebx
cmp ecx, ebx
je 0x10368a8
push edi
call fcn.010367b9
mov ecx, dword [0x10982d8]
mov dword [0x1098294], ebx
cmp ecx, ebx
je 0x10368be
push edi
call fcn.01035a6b
mov ecx, dword [0x10974b8]
mov dword [0x10982d8], ebx
cmp ecx, ebx
je 0x10368d4
push edi
call fcn.01035a91
mov ecx, dword [0x1098298]
mov dword [0x10974b8], ebx
cmp ecx, ebx
je 0x10368ea
push edi
call fcn.01035ab7
mov ecx, dword [0x109744c]
mov dword [0x1098298], ebx
cmp ecx, ebx
je 0x1036900
push edi
call fcn.01035add
mov dword [0x109744c], ebx
call fcn.01045ade
xor esi, esi
cmp dword [0x108e230], ebx
jbe 0x103693a
mov eax, dword [0x108e23c]
push dword [eax + esi*4]
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
mov eax, dword [0x108e23c]
push dword [eax + esi*4]
call fcn.0103479e
inc esi
pop ecx
cmp esi, dword [0x108e230]
jb 0x1036915
push dword [0x1097428]
mov dword [0x108e230], ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
movzx eax, byte [0x109750b]
push eax
call fcn.01054e55
mov ecx, dword [0x1097440]
cmp ecx, ebx
je 0x103696f
push edi
call fcn.0102afe8
push dword [ebp + 8]
mov dword [0x1097440], ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x103d4d3
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 1]
push eax
mov byte [ebp - 1], 0
call fcn.0103c9de
push dword [0x1097430]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x103d521
mov al, byte [0x1097531]
or al, byte [ebp - 1]
push 0
pop eax
sete al
lea eax, [eax + eax + 3]
push eax
push dword [0x1097430]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x1097430]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, 1
leave
ret
Function at 0x104291b
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
xor edi, edi
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x104293d
sub eax, edx
sar eax, 1
mov ecx, edi
je 0x104295f
cmp word [ebx + ecx*2], 0x3a
je 0x10429f7
inc ecx
cmp ecx, eax
jb 0x104294f
movzx eax, word [ebx]
cmp ax, 0x2e
je 0x1042a2f
cmp ax, 0x2f
je 0x1042a2f
cmp ax, 0x5c
je 0x1042a2f
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push edi
push edi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x414]
push eax
call esi
mov eax, dword [ebp + 0xc]
and eax, 0x28
cmp al, 0x28
jne 0x10429ff
push 0x100d474
call esi
test eax, eax
jne 0x10429ff
lea eax, [ebp - 0x20c]
push eax
call esi
jmp 0x1042a42
push ebx
push 0x100d420
jmp 0x1042a35
push 0x100d400
call esi
test eax, eax
je 0x10429ec
push dword [0x1097428]
call esi
test eax, eax
je 0x10429ec
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea eax, [ebp - 0x20c]
push eax
je 0x10429f3
call esi
xor eax, eax
inc eax
jmp 0x1042a44
push ebx
push 0x100d398
push 0x80
call fcn.01054776
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01034b69
leave
ret 8
Function at 0x105424d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
lea esi, [ebp - 0x24]
cmp edi, 0x40
ja 0x10542cd
je 0x10542c6
mov eax, edi
dec eax
je 0x10542bf
dec eax
je 0x10542b5
dec eax
dec eax
je 0x10542ab
sub eax, 4
je 0x10542a1
sub eax, 8
je 0x1054297
sub eax, 0x10
jne 0x10542f5
mov esi, 0x1011d50
jmp 0x1054343
mov esi, 0x1011d40
jmp 0x1054343
mov esi, 0x1011d24
jmp 0x1054343
mov esi, 0x1011d0c
jmp 0x1054343
mov esi, 0x1011cf4
jmp 0x1054343
mov esi, 0x1011ce4
jmp 0x1054343
mov esi, 0x1011cd4
jmp 0x1054343
cmp edi, 0x80
je 0x105433e
cmp edi, 0x100
je 0x1054337
cmp edi, 0x200
je 0x1054330
cmp edi, 0x400
je 0x1054329
cmp edi, 0x800
je 0x1054322
mov eax, dword [0x1098370]
test eax, eax
je 0x105430a
push edi
call eax
mov esi, eax
test esi, esi
jne 0x1054343
lea esi, [ebp - 0x24]
push edi
push 0x1011cc0
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push 0x10
push eax
call sub.msvcrt.dll__snwprintf_s
add esp, 0x14
jmp 0x1054343
mov esi, 0x1011cb4
jmp 0x1054343
mov esi, 0x1011ca8
jmp 0x1054343
mov esi, 0x1011c90
jmp 0x1054343
mov esi, 0x1011c80
jmp 0x1054343
mov esi, 0x1011c6c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1054348
sub eax, edx
sar eax, 1
mov edi, eax
cmp byte [ebp + 0x10], cl
je 0x10543c7
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
cmp eax, 2
je 0x10543b8
and dword [ebp - 0x30], 0
push 0x80
push 3
lea eax, [ebp - 0x34]
push eax
push 2
push 0xc0000000
push 0x1011c5c
mov dword [ebp - 0x34], 0xc
mov dword [ebp - 0x2c], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
test ebx, ebx
je 0x10543d9
push 0
lea eax, [ebp - 0x28]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10543d9
lea eax, [ebp - 0x28]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x10543d9
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + edi]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01034b69
leave
ret 0xc
Function at 0x1054bb8
Capabilities:
Get session user name

Disassembly:
push 0x14
mov eax, 0x1088117
call fcn.01034b7e
and dword [ebp - 0x14], 0
push 0x1002ba8
lea ecx, [ebp - 0x20]
call fcn.01055719
mov edi, dword [ebp + 0xc]
xor ecx, ecx
push 2
xor esi, esi
pop edx
inc esi
mov eax, edi
mul edx
seto cl
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], edi
neg ecx
or ecx, eax
push ecx
call fcn.0103472f
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1054c0c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.010556c4
jmp 0x1054c4a
lea eax, [ebp - 0x10]
push eax
push ebx
push 3
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x1054c2e
lea eax, [ebp - 0x10]
push eax
push ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1054c37
push ebx
lea ecx, [ebp - 0x20]
call fcn.010558c3
push ebx
call fcn.0103479e
pop ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.010556c4
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0
call fcn.010558b4
mov eax, dword [ebp + 8]
call fcn.01034c2c
ret 8

Function at 0x1054e55
Capabilities:
Check if file exists
Create process on windows
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
jne 0x1054e76
xor al, al
jmp 0x1054ef3
push esi
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0xf
pop ecx
mov esi, 0x1011df0
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
push 0x104
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x44]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop edi
pop esi
test eax, eax
je 0x1054e72
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1054e72
push 1
push ebx
push ebx
lea eax, [ebp - 0x24c]
push eax
push 0x1001fc4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov al, cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01034b69
leave
ret 4

Function at 0x1055187
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x12
call esi
movzx ebx, ax
push 0x11
shr ebx, 0xf
call esi
movzx edi, ax
shr edi, 0xf
push 0x10
and edi, ebx
call esi
movzx eax, ax
shr eax, 0xf
and eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x10552f9
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 4]
push ecx
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
inc edi
cmp dword [ebp - 4], edi
jle 0x105535f
mov edx, dword [ebp + 8]
mov ecx, dword [eax + edi*4]
mov si, word [ecx]
cmp si, word [edx]
jne 0x105534c
cmp si, bx
je 0x1055348
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x105534c
add ecx, 4
add edx, 4
cmp si, bx
jne 0x1055326
xor ecx, ecx
jmp 0x1055351
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
je 0x105535d
inc edi
cmp edi, dword [ebp - 4]
jl 0x1055320
jmp 0x105535f
mov bl, 1
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4

Function at 0x1055374
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
jle 0x10553b2
mov ecx, dword [esi + eax*4]
movzx ecx, word [ecx]
cmp cx, 0x2f
je 0x10553ac
cmp cx, 0x2d
jne 0x10553b9
inc eax
cmp eax, dword [ebp - 4]
jl 0x105539a
xor al, al
pop esi
leave
ret 8
cmp dword [ebp + 8], 0
je 0x10553d0
push dword [esi + eax*4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x10553b4

Function at 0x10562bd
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 1
push 0
push 0
neg eax
push 0xfffe
sbb eax, eax
push 1
add eax, 0x178a
push eax
push 0x1788
call fcn.010571e4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]