joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a0d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x134], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46a299
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
call fcn.00403a3c
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x46a279
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x30]
push eax
call sub.USER32.dll_IsWindow
test eax, eax
je 0x46a12e
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x28], eax
jmp 0x46a160
mov esi, dword [ebx + 4]
mov eax, esi
mov edx, dword [0x42644c]
call fcn.00402f28
test al, al
je 0x46a14e
mov eax, esi
call fcn.0042f8f8
mov dword [ebp - 0x28], eax
jmp 0x46a160
mov eax, dword [0x4759e0]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
call fcn.0042f8f8
mov dword [ebp - 0x28], eax
mov al, byte [ebx + 0x45]
cmp al, 1
jne 0x46a16e
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x46a18d
lea edx, [ebp - 0x24]
push edx
and eax, 0x7f
mov eax, dword [eax*4 + 0x474efc]
push eax
mov eax, dword [0x4759e0]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebx + 0x34]
call fcn.00403e28
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x2c]
call fcn.00403e28
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor esi, esi
mov eax, esi
mov edx, eax
cmp dl, 7
ja 0x46a1ba
and edx, 0x7f
bt dword [ebx + 0x44], edx
jae 0x46a1c9
and eax, 0x7f
mov eax, dword [eax*4 + 0x474ee4]
or dword [ebp - 0x18], eax
inc esi
cmp esi, 6
jne 0x46a1aa
mov eax, 0x4695e0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
call fcn.00403a3c
mov byte [ebx + 0x50], 0
lea eax, [ebx + 0x3c]
mov edx, dword [ebx + 0x40]
call fcn.00403a3c
lea eax, [ebp - 0x28]
push eax
call sub.SHELL32.dll_SHBrowseForFolder
mov dword [ebp - 8], eax
cmp byte [ebx + 0x50], 0
jne 0x46a1ea
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x46a259
lea eax, [ebp - 0x12d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.SHELL32.dll_SHGetPathFromIDList
lea edx, [ebp - 0x134]
lea eax, [ebp - 0x12d]
call fcn.00408304
mov edx, dword [ebp - 0x134]
lea eax, [ebx + 0x3c]
call fcn.00403a3c
lea eax, [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
call fcn.00403a3c
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x38], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a280
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, dword [ebp - 0x24]
push eax
call sub.ole32.dll_CoTaskMemFree
ret

Function at 0x46d888
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov edx, dword [eax + 4]
mov ecx, dword [0x475b14]
mov dword [ecx], edx
lea esi, [eax + 0x28]
mov ebx, 0x708d
mov eax, 0x10000
call fcn.00402ad0
xor word [esi], ax
add esi, 2
dec ebx
jne 0x46d89d
pop esi
pop ebx
ret
Function at 0x68149d
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [fcn.006810c4]
push eax
call dword [fcn.00681008]
test eax, eax
jne 0x6814c0
xor eax, eax
leave
ret
lea eax, [ebp - 0xc]
push eax
push 0x6811cc
push 0
call dword [fcn.00681004]
test eax, eax
jne 0x6814e0
push dword [ebp - 4]
call dword [fcn.00681054]
jmp 0x6814bc
mov eax, dword [ebp - 0xc]
push esi
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 4]
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], 2
call dword [section..text]
test eax, eax
jne 0x681515
xor esi, esi
push dword [ebp - 4]
call dword [fcn.00681054]
mov eax, esi
pop esi
leave
ret

Function at 0x681528
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [fcn.006810c4]
push eax
call dword [fcn.00681008]
test eax, eax
jne 0x681549
leave
ret
push esi
lea eax, [ebp - 0xc]
push eax
push 0x6811cc
xor esi, esi
push esi
call dword [fcn.00681004]
test eax, eax
jne 0x68156e
push dword [ebp - 4]
call dword [fcn.00681054]
xor eax, eax
pop esi
leave
ret
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push esi
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], 2
call dword [section..text]
test eax, eax
jne 0x6815a7
push dword [ebp - 4]
call dword [fcn.00681054]
mov eax, esi
jmp 0x68156b
xor esi, esi
inc esi
jmp 0x68159a
Function at 0x2354058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.023541a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x235407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x235406a
add dl, dl
jne 0x2354089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x23540dc
xor eax, eax
add dl, dl
jne 0x2354096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x235417d
add dl, dl
jne 0x23540a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x23540b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x23540bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x23540c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x23540d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2354075
mov eax, 1
add dl, dl
jne 0x23540ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x23540f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x23540e1
sub eax, ebx
mov ebx, 1
jne 0x2354128
mov ecx, 1
add dl, dl
jne 0x235410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2354119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2354105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2354075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x235413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x235414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2354136
cmp eax, 0x7d00
jae 0x235416d
cmp eax, 0x500
jb 0x2354168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2354075
cmp eax, 0x7f
ja 0x2354170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2354075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x235419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2354075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10077270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e0
mov eax, dword [0x100e1694]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0x24]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x128], eax
mov eax, dword [edi]
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x11c], edi
cmp eax, ecx
jae 0x10077fc6
movzx ebx, byte [eax]
inc eax
mov dword [ebp - 0x120], ebx
mov dword [edi], eax
cmp eax, ecx
jae 0x10077fc6
movzx ecx, byte [eax]
inc eax
mov dword [ebp - 0x104], ecx
mov dword [edi], eax
lea ebx, [eax + ecx]
mov dword [ebp - 0x124], ebx
cmp ebx, dword [ebp + 0x18]
ja 0x10077fc6
push ecx
push dword [ebp - 0x120]
push str.tag:_0x_02x_len_d_n
push 0x38
push edx
call sub.avutil_56.dll_av_log
mov eax, dword [esi + 0xb0]
add esp, 0x14
mov ecx, dword [ebp + 0x10]
cmp dword [eax + 4], 0
je 0x1007732d
mov eax, dword [esi + 0x1a4]
cmp dword [eax + 0x48], 0
jle 0x10077349
cmp ecx, 6
jne 0x10077349
push 0x100d0b88
push dword [ebp - 0x120]
push esi
call fcn.10079ba0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [ebp - 0x120]
add eax, 0xfffffffe
cmp eax, 0xfb
ja 0x100774e8
movzx eax, byte [eax + 0x1007801c]
jmp dword [eax*4 + 0x10077fe4]
mov dword [edi], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001348
mov esp, ebp
pop ebp
ret
call fcn.10077d99
invalid

Function at 0x10078640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x1007865a
push dword [ebp + 0x14]
call fcn.10077d5e
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
test dword [ecx + edi*8 - 0x7a380001], ecx
jl 0x1007865f
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
invalid
Function at 0x1288ca1
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x1351ecc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x1c]
mov esi, ecx
push edi
push eax
mov dword [ebp - 0x2d4], esi
call fcn.01289671
pop ecx
cmp dword [eax + 0x14], 8
jb 0x1288cd1
mov eax, dword [eax]
push 0x4001
push 0x2b4
lea ecx, [ebp - 0x2d0]
xor ebx, ebx
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ebx
push 1
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.01286f50
test edi, edi
jne 0x1288d04
xor al, al
jmp 0x1288dba
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push edi
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov eax, dword [esi + 0x28]
push edi
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x1109
push dword [eax]
call ebx
push 0
push 0
push 8
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov edi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x180
mov dword [esi], eax
push dword [0x1355000]
call edi
push eax
push 0xffffffffffffffff
push dword [esi]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
call esi
push 0x180
push dword [0x1355000]
call edi
push eax
mov eax, dword [ebp - 0x2d4]
push 0xffffffffffffffff
push dword [eax]
call esi
push 0x181
push dword [0x1355000]
call edi
push eax
mov eax, dword [ebp - 0x2d4]
push 0xffffffffffffffff
push dword [eax]
call esi
push 0x182
push dword [0x1355000]
call edi
mov edi, dword [ebp - 0x2d4]
push eax
push 0xffffffffffffffff
push dword [edi]
call esi
push dword [edi]
mov ecx, dword [edi + 0x28]
push 2
push 0x1109
push dword [ecx]
call ebx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.012b0511
mov esp, ebp
pop ebp
ret
Function at 0x128959b
Capabilities:
Get common file path

Disassembly:
push 0x68
mov eax, 0x131f645
call fcn.012b0d90
mov eax, dword [ecx + 0x28]
and dword [ebp - 0x6c], 0
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push dword [eax]
and dword [ebp - 0x74], 0
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x6c]
push ecx
push dword [ebp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x1289601
push eax
push str.SHGetSpecialFolderLocation___failed.__d_
push str.MicroAgent::CFolderTree::GetSpecialFolderName
push 0x21e
push str.FolderTreeFolderTree.cpp
push 1
push 2
call fcn.012a4bb5
add esp, 0x1c
mov ecx, esi
push 0x1326140
call fcn.0128449c
jmp 0x1289667
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.std::_Func_impl_class__lambda_580f07ad592bce8a5a2fc5281e25840d___class_std::allocator_int___void__void__.0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x68]
and dword [ebp - 4], 0
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x70]
call fcn.012884ac
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 1
call fcn.0128a922
push dword [ebp - 0x40]
push edi
push esi
call fcn.01289258
add esp, 0xc
cmp dword [ebp - 0x40], 0
mov dword [ebp - 4], 2
je 0x128965f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x68]
call fcn.01288841
lea ecx, [ebp - 0x68]
call fcn.0128a922
mov eax, esi
call fcn.012b0d3a
ret 0xc

Function at 0x1289671
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1351ecc]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 8]
push 0x208
push 0
push eax
call fcn.012d1ed0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x12896e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetWindowsDirectoryW___failed.__d_
push str.MicroAgent::_anonymous_namespace::GetSystemDrivePath
push 0xda
push str.FolderTreeFolderTree.cpp
push 1
push 2
call fcn.012a4bb5
add esp, 0x1c
jmp 0x12896ed
xor eax, eax
mov word [ebp - 0x206], ax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.0128449c
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.012b0511
mov esp, ebp
pop ebp
ret
Function at 0x1289ad8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1351ecc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.012d1ed0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x1289b4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.SHGetPathFromIDList___failed.__s___d_
push str.MicroAgent::_anonymous_namespace::IsNetworkDriveOrNoRootDir
push 0xcd
push str.FolderTreeFolderTree.cpp
push 1
push 2
call fcn.012a4bb5
add esp, 0x20
xor al, al
jmp 0x1289b91
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
lea eax, [ebp - 0x20c]
push esi
push eax
push str.GetDriveType_____s___u_
push str.MicroAgent::_anonymous_namespace::IsNetworkDriveOrNoRootDir
push 0xd1
push str.FolderTreeFolderTree.cpp
push 1
push 8
call fcn.012a4bb5
add esp, 0x20
cmp esi, 4
je 0x1289b8c
cmp esi, 1
jne 0x1289b8f
xor ebx, ebx
inc ebx
mov al, bl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.012b0511
mov esp, ebp
pop ebp
ret

Function at 0x128a940
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x1351ecc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2b8]
push edi
mov edi, 0x2b4
push edi
push 0
push eax
call fcn.012d1ed0
add esp, 0xc
lea eax, [ebp - 0x2b8]
push dword [ebp + 0xc]
push edi
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2b4]
xor ecx, ebp
pop edi
pop esi
call fcn.012b0511
mov esp, ebp
pop ebp
ret
Function at 0x128c593
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 8
mov eax, 0x131fad1
call fcn.012b0d5c
mov edi, ecx
mov eax, dword [edi + 0x498]
mov esi, dword [ebp + 8]
push 2
pop ecx
cmp eax, ecx
je 0x128c5b6
cmp eax, 6
jne 0x128c5c2
cmp dword [esi + 0x30], 1
jne 0x128c5c2
inc dword [edi + 0x49c]
mov eax, dword [0x1351020]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov dword [ebp + 8], eax
cmp dword [esi + 0x34], 1
mov byte [ebp - 4], 1
jne 0x128c5f0
mov eax, dword [edi + 0x498]
cmp eax, ecx
je 0x128c5ea
cmp eax, 6
jne 0x128c63e
cmp dword [esi + 0x30], 1
jne 0x128c63e
mov dword [edi + 0x410], ecx
lea ebx, [edi + 0x450]
push esi
push dword [ebx]
mov ecx, ebx
call fcn.0128ae6e
jmp 0x128c617
mov eax, dword [ebx]
mov ecx, ebx
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.01292c04
cmp dword [edi + 0x454], 0x64
ja 0x128c608
mov ecx, dword [edi + 0x414]
test ecx, ecx
je 0x128c63e
push 1
push 0
call fcn.0129aa09
mov ecx, dword [edi + 0x414]
call fcn.0129a78b
cmp byte [edi + 0x409], 0
je 0x128c750
cmp byte [ebp + 0xc], 0
jne 0x128c750
cmp dword [esi + 0x34], 1
je 0x128c750
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x135489c]
cmp eax, 0x1388
jb 0x128c750
call ebx
cmp dword [esi + 0x14], 8
mov dword [0x135489c], eax
jb 0x128c689
mov eax, dword [esi]
jmp 0x128c68b
mov eax, esi
push eax
lea ecx, [ebp - 0x14]
call fcn.0128bb20
lea eax, [esi + 0x18]
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x128c6a3
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0xc]
call fcn.0128bb20
cmp dword [esi + 0x40], 0
mov byte [ebp - 4], 3
je 0x128c6c3
push 0xeb
lea ecx, [ebp + 0xc]
call fcn.01289c1f
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push dword [ebp - 0x14]
lea eax, [ebp + 8]
push 0x84
push eax
call fcn.0128d629
add esp, 0x10
test eax, eax
jne 0x128c6f6
push 0x132a708
push 0x132a7b4
push 0x6a5
jmp 0x128c716
push 0x83
lea ecx, [ebp - 0x10]
call fcn.01289c1f
test eax, eax
jne 0x128c729
push 0x132a7e0
push 0x132a7b4
push 0x6ac
push str.MainDlg.cpp
push 1
push 4
call fcn.012a4bb5
add esp, 0x18
jmp 0x128c740
push 0
push 0x2710
push 2
push dword [ebp + 8]
lea ecx, [edi + 0x28]
push dword [ebp - 0x10]
call fcn.012903d7
lea ecx, [ebp + 0xc]
call fcn.01288762
lea ecx, [ebp - 0x14]
call fcn.01288762
lea ecx, [ebp + 8]
call fcn.01288762
lea ecx, [ebp - 0x10]
call fcn.01288762
call fcn.012b0d25
ret 8

Function at 0x128ca02
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1351ecc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x110
xor ebx, ebx
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.012d1ed0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x128ca63
cmp dword [ebp - 0x114], 5
jae 0x128ca66
cmp dword [ebp - 0x114], 4
jne 0x128ca63
cmp dword [ebp - 0x110], 0x5a
jae 0x128ca66
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.012b0511
mov esp, ebp
pop ebp
ret
Function at 0x128d2bf
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xc
mov eax, 0x131fb41
call fcn.012b0d5c
mov esi, ecx
mov eax, dword [0x1351020]
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x458]
push ebx
mov dword [esi + 0x410], 3
mov ecx, edi
push dword [edi]
mov byte [ebp - 4], 1
call fcn.0128ae9f
jmp 0x128d30e
mov eax, dword [edi]
mov ecx, edi
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.01292c3b
cmp dword [esi + 0x45c], 0x64
ja 0x128d2ff
mov ecx, dword [esi + 0x414]
test ecx, ecx
je 0x128d335
push 1
push 2
call fcn.0129aa09
mov ecx, dword [esi + 0x414]
call fcn.0129a7bd
cmp byte [ebp + 0xc], 0
jne 0x128d44e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x13548a0]
cmp eax, 0x1388
jb 0x128d44e
call edi
mov dword [0x13548a0], eax
lea eax, [ebx + 0x34]
cmp dword [eax + 0x14], 8
jb 0x128d36a
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0xc]
call fcn.0128bb20
lea eax, [ebx + 0x4c]
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x128d382
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x18]
call fcn.0128bb20
lea eax, [ebx + 0x64]
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x128d39a
mov eax, dword [eax]
push eax
lea ecx, [ebp + 8]
call fcn.0128bb20
push dword [ebp + 8]
mov edi, 0x132ad00
mov byte [ebp - 4], 4
push dword [ebp - 0x18]
mov ebx, str.MainDlg.cpp
push dword [ebp + 0xc]
push 0x132ac90
push edi
push 0x749
push ebx
push 1
push 4
call fcn.012a4bb5
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push 0x16d
push eax
call fcn.0128d629
add esp, 0x30
test eax, eax
jne 0x128d3f4
push 0x132ad30
push edi
push 0x74f
jmp 0x128d410
push 0x16c
lea ecx, [ebp - 0x14]
call fcn.01289c1f
test eax, eax
jne 0x128d41f
push 0x132ade0
push edi
push 0x756
push ebx
push 1
push 4
call fcn.012a4bb5
add esp, 0x18
jmp 0x128d436
push 0
push 0x2710
push 2
push dword [ebp - 0x10]
lea ecx, [esi + 0x28]
push dword [ebp - 0x14]
call fcn.012903d7
lea ecx, [ebp + 8]
call fcn.01288762
lea ecx, [ebp - 0x18]
call fcn.01288762
lea ecx, [ebp + 0xc]
call fcn.01288762
lea ecx, [ebp - 0x10]
call fcn.01288762
lea ecx, [ebp - 0x14]
call fcn.01288762
call fcn.012b0d25
ret 8
Function at 0x128e746
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0xffffffffffffffff
push 0
mov esi, ecx
call fcn.0128d466
push 1
push 0
push 0x3021
lea ecx, [esi + 0x3f0]
call fcn.01290c95
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10

Function at 0x128e777
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x408], 0
jne 0x128e790
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x128e7c4
mov eax, dword [esi + 0x440]
test eax, eax
je 0x128e7a1
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
mov dword [0x1354998], 1
call fcn.0129ee7b
pop ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
pop esi
ret 0x10

Function at 0x128ee78
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0128c920
mov ecx, esi
call fcn.0129008d
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10

Function at 0x128ee98
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x54], 0
je 0x128eeae
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x128eeb8
movzx eax, word [ebp + 0xc]
push eax
call fcn.0129983d
xor eax, eax
pop ebp
ret 0x10

Function at 0x128fa16
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x58
mov eax, 0x131fdee
call fcn.012b0d90
cmp dword [0x1351084], 0x10
lea ecx, [ebp - 0x28]
mov eax, 0x1351070
cmovae eax, dword [0x1351070]
push eax
call fcn.0128446d
push 0x20019
lea eax, [ebp - 0x28]
xor ebx, ebx
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 4], ebx
push 0x80000002
push eax
call fcn.012a4a49
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.01286efb
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x128fae3
push 4
pop esi
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x60], ebx
push ecx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x5c], ebx
push ecx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x64], esi
push ecx
push ebx
push str.enableUserTriggerODS
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x128fae3
test eax, eax
je 0x128fac3
push eax
push str.RegQueryValueExA___failed.___d_
push str.MicroAgent::CMainDlg::QueryScanFeatureToggle
push 0x866
push str.MainDlg.cpp
push 1
push esi
call fcn.012a4bb5
add esp, 0x1c
jmp 0x128fae3
cmp dword [ebp - 0x5c], esi
je 0x128fadc
push dword [ebp - 0x5c]
push str.Reg_value_type_is_not_REG_DWORD.___d_
push str.MicroAgent::CMainDlg::QueryScanFeatureToggle
push 0x86b
jmp 0x128fab1
cmp dword [ebp - 0x60], 0
setne bl
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 7
test eax, eax
je 0x128fafa
push eax
lea ecx, [ebp - 0x58]
call fcn.0128c24b
lea ecx, [ebp - 0x58]
call fcn.01292402
mov al, bl
call fcn.012b0d3a
ret