joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b673
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x68c], eax
je 0x42b64f
invalid
invalid
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
inc dword [eax]
je 0x42b64f
invalid
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
invalid
invalid

Function at 0x42fafb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004287a9
and dword [ebp - 4], 0
cmp dword [0x9411c0], 0
mov ebx, eax
jne 0x42fbac
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42fc5d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42fc5d
push eax
call fcn.00428737
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x9411c0], eax
call esi
push eax
call fcn.00428737
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x9411c4], eax
call esi
push eax
call fcn.00428737
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x9411c8], eax
call esi
push eax
call fcn.00428737
pop ecx
mov dword [0x9411d0], eax
test eax, eax
je 0x42fbac
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00428737
pop ecx
mov dword [0x9411cc], eax
mov eax, dword [0x9411cc]
cmp eax, ebx
je 0x42fc04
cmp dword [0x9411d0], ebx
je 0x42fc04
push eax
call fcn.004287b2
push dword [0x9411d0]
mov esi, eax
call fcn.004287b2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42fc04
test edi, edi
je 0x42fc04
call esi
test eax, eax
je 0x42fbfb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42fbfb
test byte [ebp - 0xc], 1
jne 0x42fc04
or dword [ebp + 0x10], 0x200000
jmp 0x42fc3d
mov eax, dword [0x9411c4]
cmp eax, ebx
je 0x42fc3d
push eax
call fcn.004287b2
pop ecx
test eax, eax
je 0x42fc3d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42fc3d
mov eax, dword [0x9411c8]
cmp eax, ebx
je 0x42fc3d
push eax
call fcn.004287b2
pop ecx
test eax, eax
je 0x42fc3d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x9411c0]
call fcn.004287b2
pop ecx
test eax, eax
je 0x42fc5d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42fc5f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40474b
Capabilities:
Encode data using xor

Disassembly:
jg 0x4047ae
lodsb al, byte [esi]
daa
cmc
sar byte [edi - 0x725495d9], cl
mov dword [0xd15ad7ae], eax
mov dword [0x83a4864], ebp
xor esp, ecx
push esi
pushfd
lodsd eax, dword [esi]
jl 0x404751
lodsd eax, dword [esi]
jmp 0x4047bc
mov dword [0x1a73b788], eax
cmc
or dl, al
pop esp
cmp esp, dword [esi]
add al, 0x6f
int3
and edi, dword [ebx - 0x23504301]
inc esi
and dword [esi], esi
scasb al, byte es:[edi]
dec ecx
or edx, edx
push ds
mov al, 0x4d
mov eax, cs
popal
pop esi
mov bl, 0x20
xor al, byte [ecx + 0x1d]
stosb byte es:[edi], al
mov edx, dword [edx]
out dx, al
xchg ebx, eax
add byte [edx], 0x8a
movsb byte es:[edi], byte [esi]
jb 0x404787
out dx, eax
imul ebx, edi, 0x91b90f29
test ecx, esp
invalid
Function at 0x4125ec
Capabilities:
Terminate process

Disassembly:
call fcn.004125f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401cbf
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi

Function at 0x405073
Capabilities:
Read file on windows

Disassembly:
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x43ddf6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00425812
add esp, 0x10
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 8]
pop edi
pop esi
jmp 0x40506f
Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
Function at 0x40fe40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
add byte [eax], al
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
sub esp, 0x10
mov dword [esp + 0x28], ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x30], 3
mov edx, dword [edi]
mov eax, dword [eax + edx*4]

Function at 0x4149c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x30], ebx

Function at 0x415e58
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415e80
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415e72
pop edi
pop esi
pop ebp
ret 4
Function at 0x43562b
Capabilities:
Encode data using xor

Disassembly:
push eax
call 0x76422f9f
in al, 0xf6
inc esi
or al, 0x83
je 0x4355f1
xor dword [eax - 0xa], 0x46
or al, 8
test byte [esi + 0xc], 8
div byte [ecx + ebx*2 - 0x75]
push es
cmp eax, dword [0xdd4c00a8]
cmp eax, 0xb6e85007
fnstsw word [0xb6e85007]
fsin
jne 0x4355ce
mov eax, dword [esi + 4]
cmp eax, dword [0xdd4c00ac]
cmp eax, 0xa4e85007
dec esp
fnstsw word [0xa4e85007]
fsin
jne 0x4355e0
mov eax, dword [esi + 8]
cmp eax, dword [0xdd4c00b0]
cmp eax, 0x92e85007
fnstsw word [0x92e85007]
fsin
jne 0x4355f2
mov eax, dword [esi + 0x30]
cmp eax, dword [0xdd4c00d8]
cmp eax, 0x80e85007
fnstsw word [0x80e85007]
fsin
jne 0x435604
mov eax, dword [esi + 0x34]
cmp eax, dword [0xdd4c00dc]
cmp eax, 0x6ee85007
push eax
call 0x76422f9f
invalid
test byte [esi + 0xc], 0x83
je 0x435658
test byte [esi + 0xc], 8
test byte [edi], 0x84
outsb dx, byte [esi]
add eax, dword [eax]
add bh, bh
jbe 0x43564b
call 0x76422f9f
or al, 0xf7
sti
jne 0x435659
idiv ebx
dec dword [ebx - 0x27]
invalid
inc ebx
fsin
jne 0x435669
not dword [eax]
call 0x76422f9f
or al, 0xf7
adc al, 0xe8
xor ebx, ecx
invalid
fsin
jne 0x435679
neg dword [eax]
call 0x76422f9f
or al, 0x36
call 0x76422f9f
or al, 0xf7
and al, ch
sbb al, 0xd9
invalid
invalid
Function at 0x46a0e3
Capabilities:
Encode data using xor

Disassembly:
inc edi
add edi, esi
mov eax, 0x205c
call fcn.00431bbe
cmp byte [0x4c6280], 0x6a
adc al, byte [esi]
push edi
mov edi, ecx
jne 0x3baca1fa
add dword [edi + 0x850ff8], edi
add dword [edi], ecx
test bl, ch
sbb al, 0x48
mov ecx, dword [eax]
xor eax, 0x48f910
lea eax, [ebp + 0x138dfa8]
mov ebx, 0x39100f59
push ebx
push eax
push 0x66
push dword [0x4c6278]
push esi
salc
lea eax, [ebp + 0x138dfa8]
push eax
les ecx, [ebp + 8]
cmp esi, dword [esi + ebx*8]
stc
les ecx, [ebx - 0x20577a73]
cmp byte [ecx], al
push eax
invalid
Function at 0x100075f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1022101c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x10], eax
mov esi, ebx
push edi
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x1000761f
mov esi, dword [ebx]
lea edi, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x10007641
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10007630
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0x18]
and eax, edx
mov edx, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov dword [ebp - 8], esi
mov ecx, dword [edx + eax*8]
add eax, eax
mov edi, dword [edx + eax*4]
inc eax
mov dword [ebp - 0x14], edi
lea eax, [edx + eax*4]
mov dword [ebp - 0x18], eax
cmp edi, esi
jne 0x1000766c
mov eax, esi
jmp 0x10007670
mov eax, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
je 0x10007736
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x10007682
mov eax, dword [ebx]
mov esi, dword [ecx + 0x1c]
lea edi, [ecx + 8]
mov dword [ebp - 0x1c], esi
cmp esi, 8
mov esi, dword [ebp - 8]
jb 0x10007696
mov edi, dword [ecx + 8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x20], edx
cmp edx, dword [ebp - 0xc]
jne 0x1000770e
mov esi, edx
test edx, edx
je 0x100076c1
sub edi, eax
nop dword [eax]
mov dx, word [eax + edi]
cmp dx, word [eax]
jne 0x1000770b
add eax, 2
sub esi, 1
jne 0x100076b0
cmp dword [ebp - 0x1c], 8
lea edx, [ecx + 8]
jb 0x100076cc
mov edx, dword [edx]
cmp dword [ebx + 0x14], 8
jb 0x100076d4
mov ebx, dword [ebx]
mov esi, dword [ebp - 0xc]
cmp esi, dword [ebp - 0x20]
jne 0x1000771b
test esi, esi
je 0x1000771e
sub ebx, edx
mov ax, word [edx + ebx]
cmp ax, word [edx]
jne 0x1000771b
add edx, 2
sub esi, 1
jne 0x100076e2
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101b075c
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 8]
mov ecx, dword [ecx]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x10007664
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101b075c
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.101b075c
mov esp, ebp
pop ebp
ret 8
Function at 0x10009020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
push esi
lea esi, [eax + 8]
mov dword [ebp - 8], eax
mov ebx, ecx
mov ecx, dword [esi + 0x10]
jb 0x10009044
mov esi, dword [esi]
xor edx, edx
push edi
mov edi, 0x811c9dc5
add ecx, ecx
je 0x10009066
mov eax, ecx
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x10009052
mov eax, dword [ebp - 8]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
pop edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x1000909d
cmp ecx, eax
jne 0x10009095
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x100090a5
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x100090a5
cmp ecx, eax
jne 0x100090a5
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.100079c0
mov eax, dword [ebp - 0xc]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000a820
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3490
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1022101c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102211a4], 0
mov esi, dword [ebp + 8]
je 0x1000a920
push 0
mov ecx, 0x102211a0
call fcn.10017b00
mov eax, dword [0x102211a4]
cmp byte [eax + 0x54], 0
je 0x1000a920
cmp dword [eax + 0x58], 4
jb 0x1000a920
mov bl, byte [eax + 0x5c]
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push str.download_task_failed_urlid___d
push eax
call fcn.100851e0
add esp, 0xc
lea eax, [ebp - 0x28]
mov ecx, 0x102211a0
push 0x130
push str.RC::RCFileAssocDownloadMgr::OnDownloadTaskFailed
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_fileassociate_src_associatelogic_rcfileassocdownloadmgr.cpp
push eax
push 4
call fcn.10018770
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bl, bl
je 0x1000a90a
lea eax, [ebp - 0x28]
mov ecx, 0x102211a0
push eax
call fcn.10018ab0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 2
call fcn.10003c80
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x28]
push 0x101d6804
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10003cf0
sub esp, 8
mov dword [ebp - 4], 6
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov ecx, edi
movsd qword [esp], xmm0
push eax
push 6
push esi
call fcn.1000ae20
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 7
call fcn.10003c80
lea eax, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
lea ecx, [edi + 8]
call fcn.1000b770
mov esi, dword [ebp - 0x2c]
cmp esi, dword [edi + 8]
je 0x1000a9b7
lea ecx, [esi + 0x80]
call fcn.100a4fe0
mov byte [esi + 0x128], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101b075c
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f2b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3a90
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1022101c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xc], 0
mov edi, dword [ebp + 8]
je 0x1000f41a
push edi
lea ecx, [ebp - 0x44]
call fcn.10005840
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.10084f10
push edi
mov ecx, esi
call fcn.10011280
mov eax, dword [esi + 0xc]
mov ecx, esi
add eax, 0x58
push eax
call fcn.10011cf0
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x1000f34a
lea ecx, [ebx + 0x58]
call fcn.10003c80
lea ecx, [ebx + 0x40]
call fcn.10003c80
lea ecx, [ebx + 0x28]
call fcn.10003c80
lea ecx, [ebx + 0x10]
call fcn.10003c80
push 0x74
push ebx
call fcn.101b079d
add esp, 8
mov dword [esi + 0xc], 0
cmp dword [0x102211a4], 0
je 0x1000f403
push 0
mov ecx, 0x102211a0
call fcn.10017b00
mov eax, dword [0x102211a4]
cmp byte [eax + 0x54], 0
je 0x1000f403
cmp dword [eax + 0x58], 2
jb 0x1000f403
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 1
cmp dword [edi + 0x14], 8
jb 0x1000f3a6
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x2c]
push str.notify_recommend_end_softname___s
push eax
call fcn.100851e0
add esp, 0xc
lea eax, [ebp - 0x2c]
mov ecx, 0x102211a0
push 0x188
push str.RC::RCFileAssocProcessor::NotifyRecommendEnd
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_fileassociate_src_associatelogic_rcfileassocprocessor.cpp
push eax
push 2
call fcn.10018770
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bl, bl
je 0x1000f3fb
lea eax, [ebp - 0x2c]
mov ecx, 0x102211a0
push eax
call fcn.10018ab0
lea ecx, [ebp - 0x2c]
call fcn.10003c80
push 0
push 0
push 0x12
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
lea ecx, [ebp - 0x44]
call fcn.10003c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101b075c
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f440
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1022101c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x102211a4], 0
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x30], eax
je 0x1000f519
push 0
mov ecx, 0x102211a0
call fcn.10017b00
mov eax, dword [0x102211a4]
cmp byte [eax + 0x54], 0
je 0x1000f519
cmp dword [eax + 0x58], 4
jb 0x1000f519
mov bl, byte [eax + 0x5c]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push dword [ebp - 0x30]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push str.update_ui_download_install_status
push eax
call fcn.100851e0
add esp, 0xc
lea eax, [ebp - 0x2c]
mov ecx, 0x102211a0
push 0x190
push str.RC::RCFileAssocProcessor::UpdateUIDownloadInstallStatus
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_fileassociate_src_associatelogic_rcfileassocprocessor.cpp
push eax
push 4
call fcn.10018770
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bl, bl
je 0x1000f511
lea eax, [ebp - 0x2c]
mov ecx, 0x102211a0
push eax
call fcn.10018ab0
lea ecx, [ebp - 0x2c]
call fcn.10003c80
push 0
push esi
push 0x401
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101b075c
mov esp, ebp
pop ebp
ret 4
Function at 0x10010c30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1022101c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10010c6b
xor al, al
jmp 0x10010d6a
mov eax, dword [edi + 4]
xor esi, esi
cmp eax, 3
jne 0x10010c7a
lea esi, [eax - 1]
jmp 0x10010c8f
cmp eax, 4
jne 0x10010c84
lea esi, [eax + 5]
jmp 0x10010c8f
cmp eax, 5
mov ecx, 8
cmove esi, ecx
cmp dword [0x102211a4], 0
je 0x10010d53
push 0
mov ecx, 0x102211a0
call fcn.10017b00
mov eax, dword [0x102211a4]
cmp byte [eax + 0x54], 0
je 0x10010d53
cmp dword [eax + 0x58], 2
jb 0x10010d53
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x2d], al
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea eax, [edi + 8]
cmp dword [eax + 0x14], 8
jb 0x10010ce9
mov eax, dword [eax]
push esi
push dword [edi + 4]
push eax
lea eax, [ebp - 0x2c]
push str.softname___s__operation___d__endtype___d
push eax
call fcn.100851e0
add esp, 0x14
lea eax, [ebp - 0x2c]
mov ecx, 0x102211a0
push 0x2e8
push str.RC::RCFileAssocProcessor::CloseDirectly
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_fileassociate_src_associatelogic_rcfileassocprocessor.cpp
push eax
push 2
call fcn.10018770
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [ebp - 0x2d], 0
je 0x10010d44
lea eax, [ebp - 0x2c]
mov ecx, 0x102211a0
push eax
call fcn.10018ab0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.10003c80
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x10010d5d
mov dword [eax + 4], esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
call fcn.1000f2b0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101b075c
mov esp, ebp
pop ebp
ret 4
Function at 0x10011080
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3d48
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1022101c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1001125a
cmp dword [esi + 0xc], 0
je 0x1001125a
lea edi, [ebx + 8]
mov byte [ebp - 0x45], 1
push edi
lea ecx, [ebp - 0x44]
call fcn.10005840
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.10084f10
mov eax, dword [esi + 0xc]
xor ecx, ecx
cmp dword [ebx + 4], 9
setne cl
inc ecx
test eax, eax
je 0x100110f8
mov dword [eax + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0xc]
cmp ecx, 1
je 0x10011105
cmp ecx, 3
jne 0x1001117e
add eax, 0x10
cmp dword [eax + 0x10], 0
jne 0x10011114
mov byte [ebp - 0x45], 0
jmp 0x1001117e
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], cx
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x10011134
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x2c]
push 0x101e2124
push eax
call fcn.100851e0
add esp, 0xc
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push 1
push 0x101d6804
push eax
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
seta byte [ebp - 0x45]
call fcn.10003c80
cmp dword [0x102211a4], 0
je 0x10011242
push 0
mov ecx, 0x102211a0
call fcn.10017b00
mov eax, dword [0x102211a4]
cmp byte [eax + 0x54], 0
je 0x10011242
cmp dword [eax + 0x58], 2
jb 0x10011242
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x46], al
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 8
jb 0x100111d6
mov edi, dword [edi]
mov eax, dword [esi + 0xc]
push dword [eax + 0xc]
lea eax, [ebp - 0x2c]
push dword [ebx + 4]
push edi
push str.softname___s__operation___d__notifytype___d
push eax
call fcn.100851e0
add esp, 0x14
lea eax, [ebp - 0x2c]
mov ecx, 0x102211a0
push 0x348
push str.RC::RCFileAssocProcessor::OnErrDlgClicked
push str.d:jenkinsworkspacepc_2345softmgr_build_softmgrmain_src_fileassociate_src_associatelogic_rcfileassocprocessor.cpp
push eax
push 2
call fcn.10018770
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [ebp - 0x46], 0
je 0x10011236
lea eax, [ebp - 0x2c]
mov ecx, 0x102211a0
push eax
call fcn.10018ab0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.10003c80
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.1000f2b0
lea ecx, [ebp - 0x44]
call fcn.10003c80
mov al, byte [ebp - 0x45]
jmp 0x1001125c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101b075c
mov esp, ebp
pop ebp
ret 4