joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1018c6f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10a3b28]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], eax
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_long_int_]
push 0x25
mov ecx, edi
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x1018ce2
mov eax, dword [edi]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1018cd4
lea ecx, [ebp - 0x214]
call dword [sym.imp.mmcbase.DLL_public:_class_mmcerror::SC____thiscall_mmcerror::SC::FromLastError_void_]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
jmp 0x1018cf0
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call sub.MFC42u.DLL_CString::operator_1
mov eax, dword [ebp - 0x214]
mov dword [esi], eax
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 4]
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
call fcn.01080a1e
leave
ret 8
Function at 0x10195fa
Capabilities:
Get common file path

Disassembly:
mov eax, 0x108c7a9
call fcn.010826d8
sub esp, 0x40
and dword [ebp - 0x10], 0
push ebx
push esi
lea ecx, [ebp - 0x1c]
call fcn.010830b9
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
push 0x5c
mov dword [ebp - 4], ebx
call fcn.01083351
cmp eax, 0xffffffff
mov esi, 0x104
jne 0x10196eb
mov ecx, dword [ebp + 0xc]
push 0x2f
call fcn.01083351
cmp eax, 0xffffffff
jne 0x10196eb
push esi
lea ecx, [ebp - 0x1c]
call fcn.010832c9
test eax, eax
jne 0x1019662
mov ecx, dword [ebp + 8]
push 0x10023cc
call fcn.01083192
jmp 0x101969e
push edi
push esi
push eax
push dword [0x10a3dd4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.01083325
test edi, edi
pop edi
je 0x1019691
push 0x5c
lea ecx, [ebp - 0x1c]
call fcn.010833f4
cmp eax, 0xffffffff
jne 0x10196a6
mov ecx, dword [ebp + 8]
push 0x10023cc
call fcn.01083192
mov dword [ebp - 0x10], ebx
jmp 0x10197de
inc eax
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x1c]
call fcn.01083890
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.010836f6
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.01083238
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.01083138
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.01083138
jmp 0x10196f6
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.01083238
lea ecx, [ebp - 0x28]
call fcn.010830b9
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.010832c9
test eax, eax
je 0x10197c4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.01083325
test esi, esi
je 0x10197c4
call fcn.010182f4
test al, al
je 0x10197c4
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10197c4
call fcn.010182af
test al, al
mov eax, 0x10024f4
jne 0x1019765
mov eax, 0x10024d4
push eax
lea ecx, [ebp - 0x34]
call fcn.01083192
push dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.01083910
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 6
call fcn.010836f6
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call fcn.01083238
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 6
call fcn.01083138
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
call fcn.01083138
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
call fcn.01083138
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.010836d2
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], bl
call fcn.01083138
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.01083138
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x102121d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x108d11c
call fcn.010826d8
sub esp, 0x22c
mov eax, dword [0x10a3b28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push ebx
push eax
lea ecx, [ebp - 0x22c]
call sub.MFC42u.DLL_CString::CString_4
xor ebx, ebx
push 0x5c
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], ebx
call sub.MFC42u.DLL_CString::ReverseFind
cmp eax, 0xffffffff
je 0x1021395
cmp eax, 3
jge 0x1021266
inc eax
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x22c]
call sub.MFC42u.DLL_CString::Left
mov eax, dword [eax]
push ebx
lea ecx, [ebp - 0x220]
push ecx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0x228]
call sub.MFC42u.DLL_CString::CString
lea eax, [ebp - 0x228]
push eax
mov ecx, 0x10a3e78
call fcn.01019bef
lea ecx, [ebp - 0x220]
push ecx
push eax
call fcn.01020b84
lea ecx, [ebp - 0x228]
mov byte [ebp - 0x221], al
call sub.MFC42u.DLL_CString::CString
cmp byte [ebp - 0x221], bl
je 0x1021395
lea eax, [ebp - 0x230]
push eax
push 0xf003f
push ebx
push 0x10032b0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x1021395
push esi
push edi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
mov esi, 0x1003284
push esi
push dword [ebp - 0x230]
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x234], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov edi, 0x100327c
jne 0x1021356
cmp dword [ebp - 0x228], 1
jne 0x1021356
push edi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1021387
push 8
push edi
push 1
push ebx
push esi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x238]
push eax
push 0x64
push 2
push 0x1003268
push ebx
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.01080a1e
leave
ret 4

Function at 0x10298bf
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.0102933a
test al, al
je 0x102991b
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x102991a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x102991a
mov eax, dword [ebp - 4]
push 0x43
push 0
push 0
push 0
shl edi, 4
push 0
mov dword [edi + eax + 0x18c], esi
push dword [sym.imp.MFC42u.DLL_CWndconstCWnd::wndTop]
mov ecx, esi
call sub.MFC42u.DLL_CWnd::SetWindowPos
push 5
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop edi
leave
ret 0xc
Function at 0x102a048
Capabilities:
Check if file exists
Delete file
Get file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0xc]
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_long_int_]
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp + 0x18]
mov dword [edi], eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x102a0a6
test al, 1
je 0x102a0a6
cmp byte [ebp + 0x14], bl
je 0x102a12f
push dword [esi]
push dword [edi]
push ebx
jmp 0x102a127
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x102a0e4
cmp byte [ebp + 0x14], bl
je 0x102a0bf
push dword [esi]
mov ecx, dword [ebp - 4]
push ebx
push 1
call fcn.01029fb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call dword [0x1001d9c]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebx
leave
ret 0x14
cmp byte [ebp + 0x10], bl
je 0x102a0cf
push ebx
lea ecx, [ebp + 0xc]
push ecx
push 2
lea ecx, [ebp + 0x10]
push ecx
push eax
mov dword [ebp + 0x10], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x102a10c
cmp dword [ebp + 0xc], 2
je 0x102a0cf
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp + 0x14], bl
je 0x102a12f
push dword [esi]
push dword [edi]
push 2
mov ecx, dword [ebp - 4]
call fcn.01029fb3
push 0x80004005
lea ecx, [ebp - 0xc]
call dword [sym.imp.mmcbase.DLL_public:_class_mmcerror::SC____thiscall_mmcerror::SC::operator_long_int_]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov eax, ecx
jmp 0x102a0dd
Function at 0x102d4c6
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push 0
lea ecx, [ebp - 0xc]
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_long_int_]
mov edi, dword [ebp + 0xc]
push 0x80070057
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.01018f06
mov ecx, dword [eax]
mov dword [ebp - 0xc], ecx
mov eax, dword [eax + 4]
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], eax
call dword [sym.imp.mmcbase.DLL_public:_bool___thiscall_mmcerror::SC::operator_bool_void_const]
test al, al
je 0x102d509
xor al, al
jmp 0x102d572
cmp dword [ebp + 0x10], 0
je 0x102d51d
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, eax
pop ecx
shl esi, 1
jmp 0x102d559
test edi, edi
je 0x102d545
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01082830
mov eax, esp
push esi
push edi
push eax
call sub.MFC42u.DLL_AfxW2AHelper
mov edi, eax
push edi
call dword [sym.imp.msvcrt.dll__mbslen]
push eax
push edi
call dword [sym.imp.msvcrt.dll__mbsnbcnt]
add esp, 0xc
mov esi, eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [ebp - 4], esi
sete al
lea esp, [ebp - 0x1c]
pop edi
pop esi
leave
ret 0xc
Function at 0x1030893
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x108dc8e
call fcn.010826d8
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esi], 0x41
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [ebp - 0x10], esi
mov dword [esi + 0x30], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 6
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], 0x8000000f
mov dword [esi + 0x54], eax
call fcn.0102e7bf
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10334a8
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 1
mov edi, ecx
call fcn.01029890
mov ecx, edi
mov esi, eax
call fcn.0102937a
mov ecx, eax
call sub.MFC42u.DLL_CFrameWnd::GetActiveView
cmp eax, esi
sete byte [ebp - 1]
cmp dword [ebp + 8], esi
je 0x103353b
test esi, esi
push ebx
jne 0x10334dd
xor ebx, ebx
jmp 0x10334e0
mov ebx, dword [esi + 0x20]
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10334fd
push 0
mov ecx, esi
call sub.MFC42u.DLL_CWnd::ShowWindow
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
push 1
call fcn.010298bf
mov ecx, edi
call fcn.01030d40
test esi, esi
pop ebx
je 0x103353b
cmp byte [ebp - 1], 0
je 0x103353b
mov ecx, dword [ebp + 8]
push 5
call sub.MFC42u.DLL_CWnd::ShowWindow
push 1
push dword [ebp + 8]
mov ecx, edi
call fcn.0102937a
mov ecx, eax
call sub.MFC42u.DLL_CFrameWnd::SetActiveView
pop edi
pop esi
leave
ret 8
Function at 0x104ea73
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 0x419
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
ret 4

Function at 0x10543c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x108f362
call fcn.010826d8
sub esp, 0x24
mov al, byte [ebp + 8]
push esi
mov esi, ecx
and dword [esi + 4], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
push edi
mov edi, 0x10023cc
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x1007430
mov byte [esi + 0x10], al
call fcn.010195d0
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x14]
call fcn.01053a25
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
push edi
lea ecx, [ebp - 0x30]
call fcn.010195d0
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.01053a25
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [esi + 0x4c]
call fcn.0103e236
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x106315a
Capabilities:
Log keystrokes via application hook

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp byte [esi + 0x55], 0
jne 0x10631b7
cmp dword [0x10a4250], 0
jne 0x10631b7
push ebx
push edi
mov dword [0x10a4250], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ebx, eax
push ebx
push 0
push 0x1063107
push 7
call edi
push ebx
push 0
push 0x1061bad
push 2
mov dword [esi + 0x14], eax
call edi
push ebx
push 0
push 0x10613ba
push 4
mov dword [esi + 0x18], eax
call edi
pop edi
mov dword [esi + 0x1c], eax
mov byte [esi + 0x55], 1
pop ebx
pop esi
ret

Function at 0x106707f
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push 0
lea ecx, [ebp - 8]
call dword [sym.imp.mmcbase.DLL_public:_void___thiscall_mmcerror::SC::constructor_long_int_]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x110]
test eax, eax
je 0x10670c1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x110]
add eax, 4
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0x60]
call fcn.0107f354
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
pop esi
leave
ret 4
Function at 0x106bde8
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x108ff87
call fcn.010826d8
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
push edi
mov ebx, ecx
call dword [sym.imp.ole32.dll_OleInitialize]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
lea eax, [esi + esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.01082830
mov dword [ebp - 0x18], esp
inc esi
push esi
push dword [ebp - 0x18]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x10023cc
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [ebp + 0x10]
test esi, esi
mov dword [ebp - 0x1c], edi
je 0x106be4f
mov eax, dword [esi]
test eax, eax
je 0x106be4f
movzx edi, word [eax]
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ecx, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, ecx
mov dword [ebp - 4], ecx
je 0x106bea2
cmp edi, ecx
je 0x106bea2
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [esi]
push dword [ebp + 0x10]
mov ecx, edi
mov edi, eax
mov eax, ecx
inc esi
shr ecx, 2
inc esi
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0x14]
push eax
push 1
push dword [ebp + 0x10]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebx + 4]
push ecx
push 0x100bbac
push ecx
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x18]
call fcn.0106bf8f
test eax, eax
mov eax, dword [ebp - 0x10]
jl 0x106bedf
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push 0x1002044
push eax
call dword [ecx]
test eax, eax
jge 0x106bf03
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 0
je 0x106beed
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x106befe
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or eax, 0xffffffff
jmp 0x106bf76
push dword [ebp - 0x1c]
push 0xffffffffffffffeb
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x106bf49
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xffffffffffffffec
push eax
call esi
mov edi, 0x10000
test edi, eax
je 0x106bf49
push 0xffffffffffffffec
push dword [ebx + 4]
call esi
or eax, edi
push eax
push 0xffffffffffffffec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 0
je 0x106bf63
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x106bf74
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10766ac
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov eax, 0x1090c14
call fcn.010826d8
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x20]
mov esi, ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x10], esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01056255
xor ebx, ebx
lea ecx, [esi + 0x7a8]
mov dword [ebp - 4], ebx
mov dword [esi], 0x100abb4
call sub.MFC42u.DLL_CString::CString_3
lea edi, [esi + 0x7ac]
mov ecx, edi
mov byte [ebp - 4], 1
call sub.MFC42u.DLL_CString::CString_3
mov al, byte [ebp + 0x1c]
mov byte [ebp - 4], 2
mov byte [esi + 0x7b4], al
mov dword [esi + 0x8c], ebx
call sub.MFC42u.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push ebx
push 0x100aaf4
push 0x100aae0
lea ecx, [ebp + 0x1c]
push ecx
mov ecx, eax
call sub.MFC42u.DLL_CWinApp::GetProfileStringW
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call sub.MFC42u.DLL_CString::operator
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42u.DLL_CString::CString
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1076760
or eax, 0x10
je 0x1076760
mov eax, dword [edi]
mov dword [esi + 0x8c], eax
lea eax, [ebp + 0x20]
push eax
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
jl 0x10767c7
lea edi, [esi + 0x398]
push edi
push dword [ebp + 0x20]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov dword [ebp + 0x1c], ebx
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 4
call fcn.0102e0e5
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea ecx, [ebp + 0x1c]
call fcn.010213c0
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [esi + 0x8c], ebx
jne 0x10767b6
mov dword [esi + 0x8c], edi
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x10767c7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [esi + 0x5a0]
xor eax, eax
mov edi, edx
mov ecx, 0x82
rep stosd dword es:[edi], eax
or dword [esi + 0x94], 0x80840
mov dword [esi + 0x7c], edx
mov dword [esi + 0x80], 0x104
call fcn.010561a4
neg eax
sbb eax, eax
and eax, 0x63
add eax, 0x66
movzx eax, ax
push 0xe136
lea edi, [esi + 0x7a8]
push edi
mov dword [esi + 0xa8], eax
mov dword [esi + 0x7b0], ebx
call fcn.01070393
test eax, eax
je 0x107682a
mov eax, dword [edi]
mov dword [esi + 0x90], eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x1c
Function at 0x108240d
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x100baa0
call fcn.01082880
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1082448
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1082448
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1082460
cmp eax, 0x20b
je 0x108244d
mov dword [ebp - 0x1c], edi
jmp 0x1082474
cmp dword [ecx + 0x84], 0xe
jbe 0x1082448
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x108246e
cmp dword [ecx + 0x74], 0xe
jbe 0x1082448
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10a4748], 0xffffffff
or dword [0x10a474c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x10a4530]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10a452c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10a4744], eax
call fcn.01082924
cmp dword [0x10a3b30], edi
jne 0x10824d1
push fcn.01082924
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0108290d
push 0x109e054
push 0x109e050
call sub.msvcrt.dll__initterm
mov eax, dword [0x10a4528]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x10a4524]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x109e04c
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x1082537
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x10825f1
mov dword [ebp - 0x20], esi
cmp word [esi], 0x22
jne 0x1082585
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x1082553
cmp ax, 0x22
jne 0x1082540
cmp word [esi], 0x22
jne 0x108255e
add esi, ebx
mov dword [ebp - 0x20], esi
mov ax, word [esi]
cmp ax, di
je 0x108256c
cmp ax, 0x20
jbe 0x1082559
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x54], 1
je 0x1082592
movzx eax, word [ebp - 0x50]
jmp 0x1082595
cmp word [esi], 0x20
jbe 0x108255e
add esi, ebx
mov dword [ebp - 0x20], esi
jmp 0x1082585
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0108c627
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], edi
jne 0x10825b6
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10825eb
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010828bb
ret