joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102e101
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 1
push 0x6f
push 0x10055dc
lea ecx, [ebp - 0x28]
call fcn.01055826
push 8
pop ecx
push 0x80000000
xor esi, esi
push 0x10055bc
xor eax, eax
mov dword [ebp - 0x4c], esi
lea edi, [ebp - 0x48]
push esi
rep stosd dword es:[edi], eax
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
jne 0x102e15a
call fcn.0105d3b8
push 0x77
mov dword [ebp - 0x28], eax
pop eax
mov word [ebp - 0x22], ax
jmp 0x102e1e2
push 0x77
pop eax
push 4
push 0x10055a8
push ebx
mov dword [ebp - 0x28], esi
mov word [ebp - 0x24], ax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
jne 0x102e189
call fcn.0105d3b8
push 0x7a
mov dword [ebp - 0x28], eax
pop eax
mov word [ebp - 0x22], ax
jmp 0x102e1d2
push 0x7a
pop eax
mov word [ebp - 0x24], ax
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x4c]
push eax
push esi
push edi
mov dword [ebp - 0x28], esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x102e1b2
call fcn.0105d3b8
push 0x7c
jmp 0x102e17f
cmp dword [ebp - 0x48], 4
je 0x102e1c6
mov dword [ebp - 0x28], 1
mov eax, 0x80
jmp 0x102e1ce
mov dword [ebp - 0x28], esi
mov eax, 0x83
mov word [ebp - 0x24], ax
cmp edi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x102e1df
push edi
call esi
push ebx
call esi
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x102e246
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push 1
push 0x106
push 0x10055f8
lea ecx, [ebp - 0x24]
call fcn.01055826
mov esi, 0xffff
mov eax, 0x10a
cmp dword [ebp + 0x10], esi
jbe 0x102e27f
mov dword [ebp - 0x24], 0x80070057
mov word [ebp - 0x1e], ax
jmp 0x102e2d2
cmp dword [ebp + 8], 0
mov word [ebp - 0x20], ax
mov eax, 0x10b
je 0x102e272
and dword [ebp - 0x24], 0
push 0
mov word [ebp - 0x20], ax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x102e2d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x102e2c2
and eax, esi
or eax, 0x80070000
mov dword [ebp - 0x24], eax
test eax, eax
mov eax, 0x111
jl 0x102e279
mov word [ebp - 0x20], ax
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x102e378
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push 1
push 0x13f
push 0x1005620
lea ecx, [ebp - 0x24]
call fcn.01055826
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
jne 0x102e3b7
call fcn.0105d3b8
mov dword [ebp - 0x24], eax
mov eax, 0x144
mov word [ebp - 0x1e], ax
jmp 0x102e3d6
and dword [ebp - 0x24], 0
mov ecx, 0x144
mov word [ebp - 0x20], cx
mov ecx, dword [ebp + 0x10]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x102f651
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
xor edi, edi
inc edi
push edi
push 0x30a
push 0x1005814
lea ecx, [ebp - 0x3c]
call fcn.01055826
xor esi, esi
mov eax, 0x1010420
push 0x38
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x74]
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x78], esi
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov eax, 0x310
cmp edx, esi
jne 0x102f6b8
mov dword [ebp - 0x3c], 0x80070057
mov word [ebp - 0x36], ax
jmp 0x102f7a8
mov word [ebp - 0x38], ax
mov eax, 0x311
cmp dword [ebp + 0x14], esi
je 0x102f6a8
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x38], ax
call fcn.01064179
mov dword [ebp - 0x3c], eax
cmp eax, esi
mov eax, 0x313
jl 0x102f6af
push dword [ebp + 0x14]
mov edx, 0x1002b58
lea ecx, [ebp - 0x18]
mov word [ebp - 0x38], ax
call fcn.01064722
mov dword [ebp - 0x3c], eax
cmp eax, esi
mov eax, 0x315
jl 0x102f6af
mov word [ebp - 0x38], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x74], 0x540
mov dword [ebp - 0x78], 0x3c
mov dword [ebp - 0x70], eax
cmp dword [ebp + 0xc], esi
je 0x102f725
mov dword [ebp - 0x6c], 0x1005808
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x5c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x102f7a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x102f756
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [0x1075318]
cmp eax, 0x1075318
je 0x102f783
test dword [eax + 0x1c], 0x200
je 0x102f783
push ecx
push 0x1005330
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010111c5
cmp dword [ebp - 0x3c], 0x800704c7
jne 0x102f796
mov dword [ebp - 0x3c], edi
mov eax, 0x32a
jmp 0x102f7a4
cmp dword [ebp - 0x3c], esi
mov eax, 0x32e
jl 0x102f6af
mov word [ebp - 0x38], ax
cmp dword [ebp - 0x40], esi
je 0x102f7b9
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x40], esi
mov esi, dword [ebp - 0x3c]
lea ecx, [ebp - 0xc]
call fcn.010635b3
lea ecx, [ebp - 0x18]
call fcn.010635b3
lea ecx, [ebp - 0x3c]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
leave
ret 0x10
Function at 0x1034249
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 1
push 0x41c
push 0x1006748
lea ecx, [ebp - 0x5c]
call fcn.01055826
xor ebx, ebx
mov eax, 0x1010420
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], ebx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, 0x104
mov edx, esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
call fcn.01063a55
mov dword [ebp - 0x5c], eax
cmp eax, ebx
mov eax, 0x424
jge 0x10342bc
mov word [ebp - 0x56], ax
jmp 0x1034431
mov edi, dword [ebp + 8]
push esi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f0
push dword [edi + 0x64]
mov word [ebp - 0x58], ax
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.010635ee
cmp dword [ebp - 0xc], ebx
jne 0x1034316
push ebx
mov eax, 0x3f8
push eax
push eax
push dword [edi + 0x64]
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, 0x42b
mov dword [ebp - 0x5c], ebx
mov word [ebp - 0x58], ax
jmp 0x1034431
mov edx, 0x10063c4
lea ecx, [ebp - 0x10]
call fcn.010634f5
cmp eax, 0xffffffff
je 0x1034332
mov eax, 0x867
jmp 0x10343c6
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x20
je 0x1034346
mov ecx, dword [ebp - 0xc]
cmp word [eax + ecx*2 - 2], 0x20
jne 0x103434d
mov eax, 0x868
jmp 0x10343c6
mov edx, 0x1004628
mov ecx, eax
mov di, word [ecx]
cmp di, word [edx]
jne 0x103437a
cmp di, bx
je 0x1034376
mov di, word [ecx + 2]
cmp di, word [edx + 2]
jne 0x103437a
add ecx, 4
add edx, 4
cmp di, bx
jne 0x1034354
xor ecx, ecx
jmp 0x103437f
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, ebx
je 0x10343b7
mov ecx, 0x100466c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10343ae
cmp dx, bx
je 0x10343aa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10343ae
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x1034388
xor eax, eax
jmp 0x10343b3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1034413
mov edi, dword [ebp + 8]
mov eax, 0x86a
mov dword [ebp - 4], 1
mov edx, dword [0x1077408]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0106478e
mov dword [ebp - 0x5c], eax
cmp eax, ebx
mov eax, 0x44c
jl 0x10342b3
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
push ebx
push 0x1503
push 0x3f0
push dword [edi + 0x64]
mov dword [ebp - 0x38], 0x10
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x103441d
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 1
push dword [ebp - 4]
push 0x3f8
push dword [edi + 0x64]
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x1c]
call fcn.010635b3
lea ecx, [ebp - 0x28]
call fcn.010635b3
lea ecx, [ebp - 0x10]
call fcn.010635b3
lea ecx, [ebp - 0x5c]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x1036924
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 1
push 0x645
push 0x1006aac
lea ecx, [ebp - 0x24]
call fcn.01055826
cmp dword [ebp + 0x10], 0
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
jne 0x103698a
push 0
push 0x479
push dword [ebp + 0xc]
call esi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x8ae
push dword [ebp + 0xc]
call esi
push eax
call edi
push 0
push 0x47b
push dword [ebp + 0xc]
call esi
push eax
call edi
jmp 0x103699f
push 1
push 0x479
push dword [ebp + 0xc]
call esi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push dword [ebp + 0x14]
push 0x47a
push dword [ebp + 0xc]
call esi
push eax
call ebx
xor eax, eax
cmp dword [ebp + 0x18], eax
je 0x10369e7
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x34], eax
jne 0x10369e7
cmp dword [ecx + 0x38], eax
je 0x10369e7
push 1
push 0x493
push dword [ebp + 0xc]
call esi
push eax
call ebx
push 1
push 1
push 0x17c5
push dword [ebp + 0xc]
call fcn.0106140f
push 1
jmp 0x1036a06
push eax
push 0x493
push dword [ebp + 0xc]
call esi
push eax
call ebx
push 0
push 0x17c5
push dword [ebp + 0xc]
call esi
push eax
call edi
push 0
push 0x17c6
push dword [ebp + 0xc]
call esi
push eax
call edi
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x103701e
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push 0xec8
push 0x1006bc4
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x60], ebx
call fcn.01055826
xor eax, eax
push 7
mov word [ebp - 0x24], ax
pop ecx
lea edi, [ebp - 0x22]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], edx
stosw word es:[edi], ax
mov dword [ebp - 0x58], 0x10
mov dword [ebp - 0x5c], edx
cmp ebx, edx
je 0x10370f5
mov eax, 0xed2
mov dword [ebx], edx
mov dword [ebp - 0x54], edx
mov word [ebp - 0x50], ax
mov eax, dword [0x1075318]
mov edi, 0x1075318
cmp eax, edi
je 0x10370b0
test dword [eax + 0x1c], 0x8000000
je 0x10370b0
push 0x1006a74
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016edb
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp - 0x28]
push edx
push 0x100e944
push dword [esi + 0xc]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x54], eax
test eax, eax
mov eax, 0xed6
jl 0x1037101
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x103710a
call fcn.0105d3b8
mov dword [ebp - 0x54], eax
mov eax, 0xed8
jmp 0x1037101
mov dword [ebp - 0x54], 0x80070057
mov eax, 0xed2
mov word [ebp - 0x4e], ax
jmp 0x103719f
and dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x28]
mov eax, 0xed8
mov word [ebp - 0x50], ax
mov eax, dword [esi + 0x28c]
mov eax, dword [eax + 0x18]
mov edx, dword [ecx]
lea ebx, [ebp - 0x24]
push ebx
push eax
push ecx
call dword [edx + 0x4c]
mov dword [ebp - 0x54], eax
test eax, eax
mov eax, 0xedb
jl 0x1037101
lea edx, [ebp - 0x30]
push edx
mov word [ebp - 0x50], ax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
lea edx, [ebp - 0x2c]
push edx
push eax
call dword [ecx + 0x68]
mov dword [ebp - 0x54], eax
test eax, eax
mov eax, 0xedc
jl 0x1037101
cmp dword [ebp - 0x2c], 0
mov word [ebp - 0x50], ax
je 0x1037197
xor ebx, ebx
inc ebx
mov eax, dword [0x1075318]
cmp eax, edi
je 0x103719a
test dword [eax + 0x1c], 0x8000000
je 0x103719a
mov ecx, dword [esi + 0x28c]
push dword [ecx + 0x18]
push 0x1006a74
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01016f01
jmp 0x103719a
mov ebx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov dword [eax], ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0105e9f1
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x54]
test eax, eax
je 0x10371bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x54]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 8
Function at 0x103fe89
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
xor ebx, ebx
inc ebx
push ebx
push 0x1a4
push 0x1007744
lea ecx, [ebp - 0x2c]
call fcn.01055826
xor edi, edi
push 0x5c
lea eax, [ebp - 0x9c]
push edi
push eax
mov dword [ebp - 0xa0], edi
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], 0x1010420
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 8], edi
mov eax, 0x1ad
cmp esi, edi
jne 0x103fefc
mov dword [ebp - 0x2c], 0x80070057
mov word [ebp - 0x26], ax
jmp 0x1040028
cmp dword [esi], 0x4b0
mov word [ebp - 0x28], ax
mov eax, 0x1ae
jne 0x103feec
mov word [ebp - 0x28], ax
mov eax, dword [esi + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [0x1077408]
mov dword [ebp - 0x98], eax
movzx eax, word [esi + 4]
mov dword [ebp - 0x8c], eax
push edi
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x20]
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0xa0], 0x60
mov dword [ebp - 0x94], 0x1a03
mov dword [ebp - 0x90], 8
call fcn.0101f1c2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x88], eax
lea eax, [esi + 0x22a]
push 0x10075a4
push eax
mov dword [ebp - 0x84], 0x860
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
test eax, eax
lea eax, [esi + 0x288]
pop ecx
push eax
lea eax, [ebp - 0x38]
jne 0x1040044
push 0x866
mov dword [esi + 0x14], edi
push dword [0x1077408]
push eax
call fcn.01064856
add esp, 0x10
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov eax, 0x1c1
jl 0x103fef3
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x40]
push eax
push edi
push esi
push 0x103f9b6
push edi
mov dword [ebp - 0x4c], 0x103fa8c
mov dword [ebp - 0x48], esi
push edi
mov dword [esi + 0x4a4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
push edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov eax, 0x1d2
jl 0x103fef3
cmp dword [ebp - 4], 2
mov word [ebp - 0x28], ax
jne 0x1040028
add eax, 4
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x28], ax
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x38]
call fcn.010635b3
lea ecx, [ebp - 0x2c]
call fcn.01055a3c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
push 0x861
mov dword [esi + 0x14], ebx
push dword [0x1077408]
push eax
call fcn.01064856
add esp, 0x10
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov eax, 0x1c6
jmp 0x103ffb8
Function at 0x1042669
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push 0x914
push 0x1007bfc
lea ecx, [ebp - 0x128]
call fcn.01055826
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x168]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xec], ebx
lea edi, [ebp - 0xe8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
mov eax, 0x1010420
push 0x1a
mov dword [ebp - 0x104], eax
mov dword [ebp - 0xf8], eax
mov eax, 0x1007b90
pop ecx
mov esi, eax
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1a
pop ecx
mov esi, eax
lea edi, [ebp - 0xdc]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x16c], 0x44
call fcn.01064179
mov dword [ebp - 0x128], eax
cmp eax, ebx
mov eax, 0x91f
jge 0x1042736
mov word [ebp - 0x122], ax
jmp 0x10427b2
lea edx, [ebp - 0xdc]
lea ecx, [ebp - 0xf8]
mov word [ebp - 0x124], ax
call fcn.01064179
mov dword [ebp - 0x128], eax
cmp eax, ebx
mov eax, 0x920
jl 0x104272d
mov word [ebp - 0x124], ax
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x16c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xf8]
push dword [ebp - 0x104]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10427a0
call fcn.0105d3b8
mov dword [ebp - 0x128], eax
mov eax, 0x92b
jmp 0x104272d
mov eax, 0x92b
mov dword [ebp - 0x128], ebx
mov word [ebp - 0x124], ax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xe8], ebx
je 0x10427ce
push dword [ebp - 0xe8]
call esi
mov dword [ebp - 0xe8], ebx
cmp dword [ebp - 0xec], ebx
je 0x10427e4
push dword [ebp - 0xec]
call esi
mov dword [ebp - 0xec], ebx
mov esi, dword [ebp - 0x128]
lea ecx, [ebp - 0xf8]
call fcn.010635b3
lea ecx, [ebp - 0x104]
call fcn.010635b3
lea ecx, [ebp - 0x128]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret
Function at 0x1044aac
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 1
push 0x67e
push 0x1007dd8
lea ecx, [ebp - 0x28]
call fcn.01055826
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
mov edi, dword [ebp + 0xc]
mov eax, dword [eax + 4]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp + 8], eax
cmp edi, esi
jne 0x1044af9
call fcn.0105d3b8
mov dword [ebp - 0x28], eax
mov eax, 0x684
mov word [ebp - 0x22], ax
jmp 0x1044be9
push 5
mov eax, 0x684
push edi
mov dword [ebp - 0x28], esi
mov word [ebp - 0x24], ax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x402
push 0x43b
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x400
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea eax, [ebp - 4]
push eax
call fcn.01041717
mov esi, dword [ebp - 4]
mov dword [ebp - 0x28], eax
test eax, eax
mov eax, 0x68f
jl 0x1044af0
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
lea ecx, [esi + 0xc]
call fcn.0106470b
mov dword [ebp - 0x28], eax
test eax, eax
mov eax, 0x690
jl 0x1044af0
mov word [ebp - 0x24], ax
lea eax, [esi + 4]
mov dword [esi + 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push eax
mov dword [ebp + 8], esi
call edi
and dword [ebp - 0x28], 0
push esi
push 0xc
mov eax, 0x694
push 0x1077470
mov word [ebp - 0x24], ax
call fcn.01017371
mov dword [ebp - 0x28], eax
test eax, eax
mov eax, 0x696
jge 0x1044bb9
mov word [ebp - 0x22], ax
jmp 0x1044bdb
and dword [ebp + 8], 0
mov word [ebp - 0x24], ax
lea eax, [esi + 4]
push eax
call edi
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x1044bd8
and dword [ebx + 0x10], 0
push eax
call fcn.0101af80
mov dword [ebx + 0x10], esi
cmp dword [ebp + 8], 0
je 0x1044be9
push dword [ebp + 8]
call fcn.0101af80
mov edi, dword [ebp - 0x28]
test esi, esi
je 0x1044bf6
push esi
call fcn.0101af80
lea ecx, [ebp - 0x28]
call fcn.01055a3c
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1046f36
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push 1
push 0x2e7
push 0x1009118
lea ecx, [ebp - 0x34]
call fcn.01055826
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [esi], eax
jne 0x1046f86
mov eax, 0x2eb
mov dword [ebp - 0x34], 0x81000036
mov word [ebp - 0x2e], ax
jmp 0x1046fcf
push ebx
mov ecx, 0x2eb
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x34], eax
mov word [ebp - 0x30], cx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + eax*4 - 0x10]
push 0
push ebx
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ebx
push dword [esi]
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jb 0x1046f9d
and dword [esi + 0x14], 0
pop edi
pop ebx
mov esi, dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
call fcn.01055a3c
mov eax, esi
pop esi
leave
ret 4

Function at 0x104756a
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xbd0
mov eax, dword [0x1076530]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
inc edi
push edi
push 0xb7c
push 0x10091b0
lea ecx, [ebp - 0xbd0]
call fcn.01055826
push 0x99c
xor ebx, ebx
lea eax, [ebp - 0xba8]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0xbac]
push eax
push ebx
mov dword [ebp - 0xbac], 0x9a0
call sub.ReAgent.dll_WinReGetConfig
test eax, eax
jne 0x1047607
call fcn.0105d3b8
mov dword [ebp - 0xbd0], eax
mov eax, 0xb82
mov word [ebp - 0xbca], ax
jmp 0x10476ae
mov eax, 0xb82
mov dword [ebp - 0xbd0], ebx
mov word [ebp - 0xbcc], ax
cmp dword [ebp - 0xba8], ebx
jne 0x104762c
mov dword [ebp - 0xbd0], edi
add eax, 5
jmp 0x10476a7
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x93c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x104765c
call fcn.0105d3b8
mov dword [ebp - 0xbd0], eax
mov eax, 0xb8b
jmp 0x10475fb
mov eax, 0xb8b
push edi
mov word [ebp - 0xbcc], ax
add esi, 0x100
push esi
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0xbd0], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
jne 0x104769c
call fcn.0105d3b8
mov dword [ebp - 0xbd0], eax
mov eax, 0xb8d
jmp 0x10475fb
mov dword [ebp - 0xbd0], ebx
mov eax, 0xb8d
mov word [ebp - 0xbcc], ax
mov esi, dword [ebp - 0xbd0]
lea ecx, [ebp - 0xbd0]
call fcn.01055a3c
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01054fa7
leave
ret 4