joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Get windows directory from kuser_shared_data

Disassembly:
mov eax, dword [0x95d408]
sub esp, 0x110
push ebp
mov ebp, ecx
push esi
push edi
test eax, eax
je 0x401b5d
cmp dword [0x95d40c], 0
jne 0x401b49
xor eax, eax
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], al
lea eax, [esp + 0x20]
push eax
call fcn.004042c0
add esp, 0xc
xor edi, edi
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x401a00
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b0d4]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x401a10
xor esi, esi
xor edi, edi
xor edx, edx
lea eax, [esi + 1]
movzx esi, al
mov cl, byte [esp + esi + 0x18]
movzx eax, cl
add eax, edi
movzx edi, al
movzx eax, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
movzx ecx, cl
add ecx, eax
movzx eax, cl
movzx eax, byte [esp + eax + 0x18]
xor al, byte [edx + 0x41b0d8]
mov byte [esp + edx + 0xc], al
inc edx
cmp edx, 0xb
jb 0x401a45
push 0x104
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004042c0
mov edx, 0x7ffe0030
add esp, 0xc
xor ecx, ecx
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x401aa4
sub edx, esi
sar edx, 1
je 0x401b5d
mov esi, ebp
lea edi, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x401ac0
sub esi, edi
add edx, 0xc
add edx, esi
cmp edx, 0x104
ja 0x401b5d
xor eax, eax
push ebx
test edx, edx
je 0x401af8
movzx ebx, word [eax + eax + 0x7ffe0030]
test bx, bx
je 0x401af8
mov byte [esp + eax + 0x1c], bl
inc ecx
inc eax
cmp eax, edx
jb 0x401ae1
xor eax, eax
test edx, edx
je 0x401b12
mov edi, edi
mov bl, byte [esp + eax + 0x10]
test bl, bl
je 0x401b12
mov byte [esp + ecx + 0x1c], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401b00
xor eax, eax
test edx, edx
je 0x401b2f
lea ecx, [esp + ecx + 0x1c]
lea esp, [esp]
mov bl, byte [eax + ebp]
test bl, bl
je 0x401b2f
mov byte [ecx], bl
inc eax
inc ecx
cmp eax, edx
jb 0x401b20
push 8
push 0
lea eax, [esp + 0x24]
push eax
call dword [0x95d408]
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x110
ret
push 0x800
push 0
push ebp
call eax
pop edi
pop esi
pop ebp
add esp, 0x110
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x110
ret
Function at 0x402c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x95d54c]
sub esp, 0x11c
test eax, eax
jne 0x402d4c
push ebx
push esi
push edi
push 0x100
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov word [esp + 0x2c], ax
lea eax, [esp + 0x30]
push eax
call fcn.004042c0
add esp, 0xc
xor edi, edi
xor eax, eax
lea ebx, [ebx]
mov byte [esp + eax + 0x28], al
inc eax
cmp eax, 0x100
jb 0x402ca0
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x28]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + 0x41b100]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x28]
mov byte [esp + esi + 0x28], al
inc esi
mov byte [esp + edi + 0x28], dl
cmp esi, 0x100
jb 0x402cb0
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [esp + edi + 0x28]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [esp + ebx + 0x28]
mov byte [esp + edi + 0x28], al
mov byte [esp + ebx + 0x28], cl
movzx eax, byte [esp + edi + 0x28]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x28]
xor al, byte [esi + 0x41b104]
mov byte [esp + esi + 0xc], al
inc esi
cmp esi, 0x1a
jb 0x402ce5
lea edx, [esp + 0xc]
call fcn.004012e0
pop edi
pop esi
pop ebx
test eax, eax
je 0x402d47
mov eax, dword [eax + 0x18]
test eax, eax
je 0x402d47
mov dword [0x95d54c], eax
add esp, 0x11c
ret
mov eax, dword [0x95d54c]
add esp, 0x11c
ret
Function at 0x403c70
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x95d548
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403d99
cmp dword fs:[0xc0], eax
je 0x403c9b
mov dword [0x95d544], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x95d42c], eax
mov eax, dword [esi + 0xa8]
mov dword [0x95d430], eax
movzx edx, word [esi + 0xac]
mov dword [0x95d434], edx
mov eax, dword [esi + 0xb0]
mov dword [0x95d438], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x403cfb
push 0x7f
push eax
push 0x95d43c
call fcn.004042f0
mov edx, dword [0x95d434]
add esp, 0xc
jmp 0x403d03
xor eax, eax
mov word [0x95d43c], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x95d53c], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x95d53e], ax
movzx eax, word [0x7ffe02d0]
mov word [0x95d540], ax
mov ecx, eax
mov byte [0x95d542], 0
cmp byte [0x7ffe0268], 0
je 0x403d4a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x95d542], bl
cmp ebx, 1
pop ebx
jne 0x403d64
and ecx, 0xffef
mov word [0x95d540], cx
test edx, edx
jne 0x403d99
call fcn.00403c70
cmp dword [0x95d42c], 6
ja 0x403d99
jb 0x403d81
cmp dword [0x95d430], 4
jae 0x403d99
call fcn.00403c70
cmp dword [0x95d42c], 0xa
jae 0x403d99
mov dword [0x95d434], 1
ret
Function at 0x41ae92
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x2a9d7135
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x562a7c8f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1035818
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [edi + 0x30], eax
jne 0x1035839
xor eax, eax
jmp 0x103584c
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x103577a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret

Function at 0x1035c59
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x1035c78
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dl, byte [eax]
xor dl, byte [ebp + 0x14]
inc eax
mov byte [ecx], dl
inc ecx
dec esi
jne 0x1035c6c
pop esi
pop ebp
ret 0x10

Function at 0x1037538
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
mov esi, ecx
je 0x10375e5
mov eax, dword [0x1113528]
add eax, 0x74
mov dword [ebp - 8], eax
push ebx
push dword [edi + 0x100266c]
call fcn.01035b8c
test eax, eax
je 0x10375d8
mov ecx, dword [ebp - 8]
lea eax, [edi + 0x1002678]
push dword [eax + 4]
push dword [eax]
call fcn.01063ebe
test eax, eax
je 0x10375d8
lea eax, [ebp - 4]
push eax
push dword [edi + 0x100266c]
mov eax, esi
neg eax
lea ecx, [esi + 0xc]
sbb eax, eax
and eax, ecx
push eax
call fcn.01062266
test eax, eax
jl 0x10375d8
mov eax, dword [esi + 0x38]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x10375cf
lea ebx, [esi + 0x34]
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.0105f73b
mov ecx, dword [eax + 0x14]
cmp ecx, dword [ebp - 4]
je 0x10375c8
cmp dword [ebp + 0xc], 0
jne 0x10375ad
jmp 0x10375cf
mov dword [eax + 0x28], 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add edi, 0x14
cmp edi, 0x3c
jb 0x103755b
pop ebx
mov edi, dword [ebp + 8]
test edi, edi
jne 0x103765a
push 0x20019
push edi
push reloc.WSOCK32.dll_accept
push 0x1001bd0
lea ecx, [ebp - 0x24]
call fcn.01064063
mov eax, dword [esi + 0x80]
push dword [eax*4 + 0x10026bc]
lea ecx, [ebp - 0x24]
push 0x1001f0c
call fcn.01063ebe
mov ecx, dword [esi + 0x80]
mov edx, dword [ecx*4 + 0x10026bc]
cmp eax, edx
ja 0x103763f
cmp ecx, 5
mov edi, edx
jae 0x1037641
inc ecx
mov dword [esi + 0x80], ecx
jmp 0x1037641
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7530
div ecx
lea ecx, [ebp - 0x24]
add edi, edx
call fcn.0106409d
push 0
push edi
push 0x67
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
leave
ret 8
Function at 0x1037692
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x111121c]
push ebx
push esi
mov dword [ebp - 4], eax
mov esi, ecx
mov eax, dword [esi + 0x38]
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x298]
push eax
xor ebx, ebx
push 0x101
mov dword [ebp - 0x29c], ebx
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x103784b
push 0x104
lea eax, [ebp - 0x108]
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x10377ba
lea eax, [ebp - 0x108]
push eax
call sub.WSOCK32.dll_gethostbyname
cmp eax, ebx
je 0x10377ba
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call fcn.01037673
test eax, eax
je 0x10377ba
cmp dword [ebp - 0x2a0], ebx
je 0x10377ba
push edi
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [esi + 0x34]
call fcn.0105f73b
cmp dword [eax + 0x28], ebx
je 0x10377ad
mov ecx, dword [0x1113528]
cmp dword [ecx + 0x5f0], ebx
jne 0x10377ad
mov edi, dword [eax + 0x14]
mov eax, dword [edi]
lea ecx, [ebp - 0x2a8]
push ecx
push edi
call dword [eax + 0x30]
test eax, eax
jl 0x10377ad
cmp dword [ebp - 0x2a8], 1
jne 0x10377ad
mov eax, dword [edi]
push ebx
push ebx
push edi
call dword [eax + 0x4c]
test eax, eax
jge 0x10377a3
mov eax, dword [0x1113528]
push ebx
push ebx
push edi
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x2a4], eax
call fcn.01062b3a
mov ecx, dword [ebp - 0x29c]
push eax
push 0x400
push edi
call fcn.0104afbe
mov ecx, dword [ebp - 0x2a4]
push eax
call fcn.0104ec05
mov dword [ebp - 0x29c], 1
cmp dword [ebp - 0x2a0], ebx
jne 0x1037721
pop edi
call sub.WSOCK32.dll_WSACleanup
cmp dword [ebp - 0x29c], ebx
je 0x103784b
push 0x67
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x20019
push ebx
push reloc.WSOCK32.dll_accept
push 0x1001bd0
lea ecx, [ebp - 0x2c4]
call fcn.01064063
mov eax, dword [esi + 0x80]
push dword [eax*4 + 0x10026bc]
lea ecx, [ebp - 0x2c4]
push 0x1001f0c
call fcn.01063ebe
mov ecx, dword [esi + 0x80]
mov ecx, dword [ecx*4 + 0x10026bc]
cmp eax, ecx
ja 0x1037821
mov eax, ecx
push ebx
push eax
push 0x67
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0x80]
cmp eax, 5
jae 0x1037840
inc eax
mov dword [esi + 0x80], eax
lea ecx, [ebp - 0x2c4]
call fcn.0106409d
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0105ec09
leave
ret
Function at 0x103914f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0x81000323
push esi
mov esi, ecx
je 0x103922a
cmp dword [ebp + 8], 0x81000347
je 0x103922a
mov eax, dword [esi + 0x38]
test eax, eax
mov dword [ebp + 8], eax
je 0x103922a
push edi
lea eax, [ebp + 8]
push eax
lea ecx, [esi + 0x34]
call fcn.0105f73b
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x14]
jne 0x103921f
push 0x20019
push 0
push reloc.WSOCK32.dll_accept
push 0x1001bd0
lea ecx, [ebp - 0x1c]
mov dword [eax + 0x28], 1
call fcn.01064063
mov eax, dword [esi + 0x80]
push dword [eax*4 + 0x10026bc]
lea ecx, [ebp - 0x1c]
push 0x1001f0c
call fcn.01063ebe
mov ecx, dword [esi + 0x80]
mov edx, dword [ecx*4 + 0x10026bc]
cmp eax, edx
ja 0x10391f6
cmp ecx, 5
mov edi, edx
jae 0x10391f8
inc ecx
mov dword [esi + 0x80], ecx
jmp 0x10391f8
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7530
div ecx
lea ecx, [ebp - 0x1c]
add edi, edx
call fcn.0106409d
push 0
push edi
push 0x67
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [ebp + 8], 0
jne 0x1039183
pop edi
pop esi
leave
ret 8

Function at 0x103a46f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
call fcn.01036a0a
xor ebx, ebx
cmp dword [esi + 0x7c], ebx
je 0x103a4a8
lea eax, [ebp - 0x10]
push eax
push 0x65
mov ecx, esi
mov dword [esi + 0x7c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.01039b40
jmp 0x103a57a
mov eax, dword [ebp + 8]
cmp eax, 0x81000301
jl 0x103a57a
cmp eax, 0x81000302
jle 0x103a4cf
cmp eax, 0x8100030d
je 0x103a4cf
cmp eax, 0x8100031d
jne 0x103a57a
mov eax, dword [esi + 0x38]
cmp eax, ebx
push edi
mov dword [ebp + 8], eax
je 0x103a4fe
lea edi, [esi + 0x34]
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.0105f73b
mov ecx, dword [eax + 0x14]
cmp ecx, dword [ebp + 0xc]
je 0x103a4f7
cmp dword [ebp + 8], ebx
jne 0x103a4dd
jmp 0x103a4fe
mov dword [eax + 0x28], 1
push 0x20019
push ebx
push reloc.WSOCK32.dll_accept
push 0x1001bd0
lea ecx, [ebp - 0x1c]
call fcn.01064063
mov eax, dword [esi + 0x80]
push dword [eax*4 + 0x10026bc]
lea ecx, [ebp - 0x1c]
push 0x1001f0c
call fcn.01063ebe
mov ecx, dword [esi + 0x80]
mov edx, dword [ecx*4 + 0x10026bc]
cmp eax, edx
ja 0x103a551
cmp ecx, 5
mov edi, edx
jae 0x103a553
inc ecx
mov dword [esi + 0x80], ecx
jmp 0x103a553
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7530
div ecx
lea ecx, [ebp - 0x1c]
add edi, edx
call fcn.0106409d
push ebx
push edi
push 0x67
push dword [esi + 0x48]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
push ebx
call fcn.0103f271
pop esi
pop ebx
leave
ret 8
Function at 0x103ca64
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x111121c]
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x418], eax
xor esi, esi
xor eax, eax
mov word [ebp - 0x414], si
mov ecx, 0x81
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push 5
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
mov esi, 0x104
push esi
jne 0x103cacc
push 0x1002e70
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffW]
jmp 0x103cafe
lea eax, [ebp - 0x20c]
push eax
call fcn.0103f05b
mov edi, eax
test edi, edi
jl 0x103caf5
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x103cafa
mov edi, 0x80004005
test edi, edi
jl 0x103cb48
and word [ebp - 0x20c], 0
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x20c]
push eax
push 0xa227
push dword [0x1112f58]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor edi, edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0105ec09
leave
ret 8
Function at 0x103d3df
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
mov edi, 0x80004005
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x103d54d
push esi
lea ecx, [ebp - 8]
push ecx
push 0x24
push 0x1002d20
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x103d544
cmp dword [ebp - 8], 0x24
jne 0x103d544
mov eax, dword [ebx]
lea ecx, [ebp - 0x10]
push ecx
push ebx
mov dword [ebp - 0x10], esi
call dword [eax + 0x7c]
mov edi, eax
cmp edi, esi
jl 0x103d544
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 0xc], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov edi, eax
cmp edi, esi
jl 0x103d513
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x28]
push edx
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x103d50a
mov eax, dword [ebp - 0x20]
lea edx, [ebp + 8]
push edx
push 0x1009d18
mov dword [ebp + 8], esi
mov ecx, dword [eax]
push eax
call dword [ecx]
mov edi, eax
cmp edi, esi
jl 0x103d4f9
push dword [ebp + 8]
call fcn.01060c73
test eax, eax
je 0x103d4f0
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push esi
mov dword [ebp - 4], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x54]
mov edi, eax
cmp edi, esi
jl 0x103d4f0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
cmp dword [ebp - 0x18], esi
je 0x103d4e7
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.0103d119
mov edi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, esi
jge 0x103d46d
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, esi
jl 0x103d544
push esi
lea eax, [ebp - 8]
push eax
push 0xe
push 0x1002e00
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x103d53f
cmp dword [ebp - 8], 0xe
je 0x103d544
mov edi, 0x80004005
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x103f3e2
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
cmp dword [esi + 0x10], eax
push edi
mov dword [ebp - 4], 0x80004005
mov edi, 0x10043e8
mov ebx, 0x1048
jne 0x103f434
push edi
push ebx
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 0x10], eax
je 0x103f434
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x103f434
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
cmp dword [esi + 0x10], 0
jne 0x103f448
push edi
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 0x10], eax
mov esi, dword [esi + 0x10]
test esi, esi
je 0x103f49f
push ebx
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
mov eax, 0x824
je 0x103f488
cmp dword [ebp + 0xc], eax
jae 0x103f470
mov eax, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
and dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x103f49f
cmp dword [ebp + 0xc], eax
jae 0x103f490
mov eax, dword [ebp + 0xc]
push eax
push 0x1001bc8
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x103fcf6
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x111121c]
push esi
push 0x1001bc8
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
call fcn.0103f4ae
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x103fdde
push ebx
mov ebx, 0x104
push edi
mov ax, word [esi]
test ax, ax
je 0x103fddc
cmp ax, 0x20
jne 0x103fd4a
inc esi
inc esi
jmp 0x103fdd4
cmp ax, 0x22
jne 0x103fd95
inc esi
push 0x100440c
inc esi
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov edi, eax
test edi, edi
je 0x103fdd4
sub eax, esi
sar eax, 1
inc eax
cmp eax, ebx
jbe 0x103fd6f
mov eax, ebx
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.0103fc99
lea esi, [edi + 2]
jmp 0x103fdd4
xor edi, edi
test ax, ax
je 0x103fda7
inc edi
mov ax, word [esi + edi*2]
cmp ax, 0x20
jne 0x103fd97
lea eax, [edi + 1]
cmp eax, ebx
jbe 0x103fdb0
mov eax, ebx
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.0103fc99
lea esi, [esi + edi*2]
test esi, esi
jne 0x103fd31
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0105ec09
leave
ret
Function at 0x10414bf
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x111121c]
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
push 0
push 0xffffffffffffffff
push dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0x760], eax
call ebx
push 1
push dword [edi + 0xb04]
mov dword [ebp - 0x768], eax
push eax
push dword [esi + 4]
call fcn.01062eb7
cmp eax, 1
jne 0x1041684
mov eax, dword [ebp - 0x760]
test eax, eax
je 0x1041529
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
jmp 0x10415a9
push dword [edi + 0xb04]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea ecx, [ebp - 0x75c]
call fcn.010d7088
push 0xa1eb
lea ecx, [ebp - 0x75c]
call fcn.010d5e4d
push 0xa1f4
lea ecx, [ebp - 0x75c]
call fcn.010d5e93
push 0xa1fd
lea ecx, [ebp - 0x75c]
call fcn.010d5f41
lea ecx, [edi + 0x28]
call fcn.010896df
push eax
lea ecx, [ebp - 0x75c]
call fcn.010d5e1e
push 0
lea eax, [ebp - 0x760]
push eax
push dword [edi + 0xb04]
lea ecx, [ebp - 0x75c]
call fcn.010d80b3
lea ecx, [ebp - 0x75c]
call fcn.010d71b9
xor eax, eax
cmp dword [ebp - 0x760], eax
mov dword [ebp - 0x764], eax
je 0x1041684
push eax
push 1
push eax
push 0xffffffffffffffff
push 1
lea ecx, [ebp - 0x764]
push ecx
mov ecx, dword [0x1113528]
push eax
push 1
push dword [ebp - 0x760]
call fcn.0104d6ed
test eax, eax
jl 0x1041678
mov edi, dword [ebp - 0x764]
mov ecx, edi
call fcn.01040e4f
test eax, eax
je 0x1041611
push 0
push 0
push 0x40
push 0x9edb
push dword [edi + 0x2614]
call fcn.01062b69
jmp 0x1041678
test edi, edi
je 0x1041678
xor edi, edi
cmp dword [ebp - 0x768], edi
jbe 0x1041678
cmp edi, 0xa
jae 0x1041678
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [esi + 4]
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x10
je 0x104166f
cmp eax, 0xffffffff
je 0x104166f
mov ecx, dword [0x1113528]
test ecx, ecx
je 0x104166f
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x760]
push dword [ebp - 0x764]
call fcn.0104d5cc
inc edi
cmp edi, dword [ebp - 0x768]
jb 0x104161f
mov eax, dword [ebp - 0x760]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0105ec09
leave
ret 8

Function at 0x10423cb
Capabilities:
Find taskbar

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
push esi
push 0x100598c
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, esi
je 0x1042425
push edi
push esi
push 0x1005970
push esi
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov edi, eax
cmp edi, esi
je 0x1042424
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x10]
push eax
push edi
call esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
pop edi
pop esi
leave
ret 4