joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100021b0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x1001a0d8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100210c4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x24], 0
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10002320
push str._sybldownload.exe
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.10003b30
add esp, 8
mov eax, esp
mov byte [esp + 0x28], 1
mov dword [esp + 0x14], esp
push str._sybldownload.exe
lea ecx, [esp + 0x34]
push ecx
push eax
call fcn.10003b30
add esp, 8
mov byte [esp + 0x2c], 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.sybldownload.exe
call fcn.10003890
mov byte [esp + 0x2c], 1
call fcn.100066e0
mov edx, dword [esp + 0x14]
add esp, 8
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100022fb
mov eax, dword [0x10022104]
mov edx, dword [eax + 0xc]
mov ecx, 0x10022104
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], 3
mov eax, dword [esp + 0x2c]
push eax
push eax
mov eax, dword [0x10022c24]
push eax
lea ecx, [esp + 0x1c]
push str._s__pd___s___ps___s_
push ecx
call fcn.10004b60
mov esi, dword [esp + 0x24]
add esp, 0x14
push 0
push 1
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
push esi
call fcn.10004530
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0x34], 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov edi, esp
push eax
call fcn.10004530
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov byte [esp + 0x34], 3
call fcn.10009cc0
add esp, 0x10
mov byte [esp + 0x24], 1
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x100022fb
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002320
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10002348
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x10002560
Capabilities:
Check if file exists

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
test eax, eax
je 0x10002570
mov dword [0x10022be8], eax
lea ebx, [esp + 0x10]
call fcn.10002080
mov eax, dword [esp + 0x10]
mov esi, 1
cmp dword [eax - 4], esi
jle 0x10002596
mov eax, dword [eax - 0xc]
push eax
mov ecx, ebx
call fcn.10004200
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
call fcn.1000c841
add esp, 8
test eax, eax
jl 0x10002651
mov ecx, dword [esp + 0x10]
cmp eax, dword [ecx - 8]
jg 0x10002651
mov dword [ecx - 0xc], eax
mov edx, dword [esp + 0x10]
xor ecx, ecx
push 0xf
mov word [edx + eax*2], cx
push 0x1001d5e4
lea ecx, [esp + 0x18]
call fcn.100040b0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000262d
push 0
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x1001d2f4
mov dword [0x10022bf0], esi
call fcn.10003890
mov eax, dword [esp + 0x1c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
push eax
call fcn.10004530
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.10009cc0
add esp, 0x10
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000264d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop esi
pop ebx
pop ecx
ret
push 0x80070057
call fcn.100010f0
int3
Function at 0x100032e0
Capabilities:
Check if file exists

Disassembly:
sub esp, 8
push ebx
push esi
lea ebx, [esp + 8]
call fcn.10002080
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000345d
mov ecx, dword [esp + 8]
push 0x5c
push ecx
call fcn.1000cd99
add esp, 8
test eax, eax
jne 0x10003319
or eax, 0xffffffff
jmp 0x1000331f
sub eax, dword [esp + 8]
sar eax, 1
push eax
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.10003ab0
push eax
lea ecx, [esp + 0xc]
call fcn.10004030
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10003358
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 8]
push 0x5c
push ecx
call fcn.1000cd99
add esp, 8
test eax, eax
jne 0x10003370
or eax, 0xffffffff
jmp 0x10003376
sub eax, dword [esp + 8]
sar eax, 1
push eax
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
call fcn.10003ab0
push eax
lea ecx, [esp + 0xc]
call fcn.10004030
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100033af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 8
push str.AppData
lea ecx, [esp + 0x10]
call fcn.100040b0
mov eax, dword [esp + 8]
push 0x10003080
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.10004530
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.10007650
mov eax, dword [0x10022c0c]
xor ecx, ecx
mov edx, 0xc
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000c462
add esp, 0xc
mov dword [0x10022be0], eax
mov eax, dword [esp + 8]
push 0x10002c80
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
mov esi, esp
push eax
call fcn.10004530
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.10007650
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x10022be0]
mov edx, dword [0x10022c0c]
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
add esp, 8
mov dword [eax], edx
mov dword [0x10022c0c], 0
mov dword [0x10022c10], 0
mov eax, dword [esp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000347d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop esi
pop ebx
add esp, 8
ret
Function at 0x100053d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x10019eb8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100210c4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x10022104]
mov edx, dword [eax + 0xc]
mov ecx, 0x10022104
xor edi, edi
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edi
mov eax, dword [0x10022c28]
push 0x3e8
push eax
lea ecx, [esp + 0x18]
push str._s_d
push ecx
call fcn.10004b60
mov ebx, dword [esp + 0x20]
add esp, 0x10
push ebx
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1000545e
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
test edi, edi
jne 0x10005470
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005494
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x100054b0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x10019e88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100210c4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x10022104]
mov edx, dword [eax + 0xc]
mov ecx, 0x10022104
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
mov eax, dword [0x10022c28]
push 0x3e8
push eax
lea ecx, [esp + 0x14]
push str._s_d
push ecx
call fcn.10004b60
mov edi, dword [esp + 0x1c]
add esp, 0x10
push edi
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1000553c
push edi
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005570
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x10005850
Capabilities:
Check if file exists
Delete file
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x10019e63
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100210c4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov eax, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000589b
push eax
call edi
mov eax, dword [esi + 0x38]
test eax, eax
je 0x100058a5
push eax
call edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x100058b5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100058cd
mov eax, dword [esi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edi, [esi + 0x40]
mov dword [esp + 0x10], edi
mov eax, edi
mov byte [esp + 0x1c], 1
call fcn.100061b0
mov edi, dword [edi]
push edi
call fcn.1000c46d
mov dword [esp + 0x20], 0xffffffff
mov esi, dword [esi + 0x3c]
sub esi, 0x10
add esp, 4
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10005912
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4

Function at 0x10005930
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x100210c4]
xor eax, esp
mov dword [esp + 0x208], eax
push edi
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 4]
push ecx
lea edi, [esi + 0x3c]
push str._sProTmpFile
push edi
call fcn.10004b60
add esp, 0xc
push str.5B8F95B9_7492_443d_B10B_24DAE51CE746
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100059d9
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100059a1
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [edi]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.5B8F95B9_7492_443d_B10B_24DAE51CE746
push 0x10000
push 0
push 4
push 0
push eax
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x34]
push 0
push 0
push 0
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [esp + 0x20c]
pop edi
xor ecx, esp
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
call fcn.1000c478
add esp, 0x20c
ret
Function at 0x100066e0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10019dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x100210c4]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
push esi
push edi
mov eax, dword [0x100210c4]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov dword [esp + 0x228], 1
mov eax, dword [esp + 0x230]
mov esi, dword [0x10022bd4]
push str.FILE
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100067a4
mov byte [esp + 0x228], al
mov eax, dword [esp + 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000676f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x228], 0xffffffff
mov eax, dword [esp + 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000679d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x100068ad
mov ecx, dword [esp + 0x234]
cmp dword [ecx - 0xc], 0
jne 0x100067f8
push 0x104
lea edx, [esp + 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x1001d7f4
lea eax, [esp + 0x18]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [esp + 0x230]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x23c]
push str._s_s
push ecx
call fcn.10004b60
add esp, 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x234]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push edx
mov edi, eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
lea eax, [esp + 0x14]
push eax
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x228], 0
mov eax, dword [esp + 0x230]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000687f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x228], 0xffffffff
mov eax, dword [esp + 0x234]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100068ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1000c478
add esp, 0x21c
ret
Function at 0x10007650
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019545
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x100210c4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10003cf0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100076b9
mov dword [ebp - 0x270], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10004010
mov eax, dword [ebp - 0x270]
jmp 0x1000786f
lea ecx, [ebp - 0x14]
call fcn.10003850
mov byte [ebp - 4], 1
push 0x1001b44c
push 1
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp + 8]
call fcn.10003ab0
mov dword [ebp - 0x28c], eax
mov ecx, dword [ebp - 0x28c]
push ecx
call fcn.10007940
add esp, 8
mov byte [ebp - 0x271], al
lea ecx, [ebp - 0x278]
call fcn.10004010
movzx edx, byte [ebp - 0x271]
test edx, edx
je 0x10007719
push 0x1001b450
lea ecx, [ebp + 8]
call fcn.10003d00
mov eax, dword [ebp + 8]
push eax
push 0x1001b454
lea ecx, [ebp - 0x14]
push ecx
call fcn.10004b60
add esp, 0xc
lea edx, [ebp - 0x26c]
push edx
lea ecx, [ebp - 0x14]
call fcn.10003cf0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
push 4
push 0x1001b460
lea eax, [ebp - 0x240]
push eax
call fcn.1000d7d3
add esp, 0xc
test eax, eax
je 0x10007821
push 6
push 0x1001b464
lea ecx, [ebp - 0x240]
push ecx
call fcn.1000d7d3
add esp, 0xc
test eax, eax
je 0x10007821
mov edx, dword [ebp - 0x26c]
and edx, 0x10
je 0x100077f0
cmp dword [ebp + 0xc], 0
je 0x100077bf
push 2
push ecx
mov eax, esp
mov dword [ebp - 0x27c], esp
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp + 8]
push edx
push eax
call fcn.10003b30
add esp, 0xc
mov dword [ebp - 0x290], eax
call dword [ebp + 0xc]
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
lea edx, [ebp - 0x240]
push edx
lea eax, [ebp + 8]
push eax
push ecx
call fcn.10003b30
add esp, 0xc
mov dword [ebp - 0x294], eax
call fcn.10007650
add esp, 8
jmp 0x10007821
cmp dword [ebp + 0xc], 0
je 0x10007821
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x284], esp
lea edx, [ebp - 0x240]
push edx
lea eax, [ebp + 8]
push eax
push ecx
call fcn.10003b30
add esp, 0xc
mov dword [ebp - 0x298], eax
call dword [ebp + 0xc]
add esp, 8
lea ecx, [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10007747
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x288], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10004010
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10004010
mov eax, dword [ebp - 0x288]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000c478
mov esp, ebp
pop ebp
ret
Function at 0x10009cc0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019830
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x100210c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.10003cf0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10009d35
mov dword [ebp - 0x25c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10004010
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10004010
mov eax, dword [ebp - 0x25c]
jmp 0x10009e72
lea ecx, [ebp + 8]
call fcn.10003e00
push eax
lea ecx, [ebp + 8]
call fcn.10003cf0
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1000efca
add esp, 0xc
push 0x3c
push 0
lea ecx, [ebp - 0x258]
push ecx
call fcn.1000ef50
add esp, 0xc
mov dword [ebp - 0x258], 0x3c
lea ecx, [ebp + 8]
call fcn.10003cf0
mov dword [ebp - 0x248], eax
mov edx, dword [ebp + 0x10]
neg edx
sbb edx, edx
and edx, 5
mov dword [ebp - 0x23c], edx
lea ecx, [ebp + 0xc]
call fcn.10003cf0
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x254], 0x40
call fcn.1000a030
test eax, eax
je 0x10009dd5
mov dword [ebp - 0x24c], 0x1001b5fc
lea edx, [ebp - 0x258]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x10009e13
mov dword [ebp - 0x260], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10004010
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10004010
mov eax, dword [ebp - 0x260]
jmp 0x10009e72
cmp dword [ebp + 0x14], 0
je 0x10009e30
push 0xffffffffffffffff
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x268], eax
jmp 0x10009e3a
mov dword [ebp - 0x268], 0
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x264], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10004010
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10004010
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000c478
mov esp, ebp
pop ebp
ret
Function at 0x1000c478
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100210c4]
jne 0x1000c482
repz ret
jmp fcn.1000f2de

Function at 0x100170e9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10012734
and dword [ebp - 4], 0
cmp dword [0x10022ab4], 0
mov ebx, eax
jne 0x1001719a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001724b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001724b
push eax
call fcn.100126c2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10022ab4], eax
call esi
push eax
call fcn.100126c2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10022ab8], eax
call esi
push eax
call fcn.100126c2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10022abc], eax
call esi
push eax
call fcn.100126c2
pop ecx
mov dword [0x10022ac4], eax
test eax, eax
je 0x1001719a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100126c2
pop ecx
mov dword [0x10022ac0], eax
mov eax, dword [0x10022ac0]
cmp eax, ebx
je 0x100171f2
cmp dword [0x10022ac4], ebx
je 0x100171f2
push eax
call fcn.1001273d
push dword [0x10022ac4]
mov esi, eax
call fcn.1001273d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100171f2
test edi, edi
je 0x100171f2
call esi
test eax, eax
je 0x100171e9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100171e9
test byte [ebp - 0xc], 1
jne 0x100171f2
or dword [ebp + 0x10], 0x200000
jmp 0x1001722b
mov eax, dword [0x10022ab8]
cmp eax, ebx
je 0x1001722b
push eax
call fcn.1001273d
pop ecx
test eax, eax
je 0x1001722b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001722b
mov eax, dword [0x10022abc]
cmp eax, ebx
je 0x1001722b
push eax
call fcn.1001273d
pop ecx
test eax, eax
je 0x1001722b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10022ab4]
call fcn.1001273d
pop ecx
test eax, eax
je 0x1001724b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001724d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40249a
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push 0x18
mov eax, 0x418734
call fcn.0040b989
mov esi, ecx
mov eax, dword [esi + 0xc]
movzx ebx, word [eax + 0x14]
push 0x20
mov dword [ebp - 0x14], ebx
call fcn.0040ba64
pop ecx
mov dword [ebp - 0x10], eax
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], edi
je 0x4024cf
mov ecx, eax
call fcn.004025c8
mov edi, eax
or dword [ebp - 4], 0xffffffff
mov word [edi + 4], bx
mov eax, dword [esi + 0x10]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x18], eax
push dword [esi + 0x14]
call fcn.0040c235
mov ebx, eax
test ebx, ebx
pop ecx
je 0x4025b0
push 0x400
call fcn.00409eba
add ebx, ebx
lea ecx, [ebx + 1]
push ecx
push dword [esi + 0x14]
mov dword [ebp - 0x10], eax
push eax
call fcn.0040bed0
mov eax, dword [ebp - 0x10]
and word [ebx + eax], 0
mov ax, word [ebp - 0x14]
mov word [ebp - 0x18], ax
add esp, 0x10
xor ebx, ebx
lea eax, [ebp - 0x18]
inc ebx
push eax
mov byte [0x4357f0], bl
mov ecx, dword [esi + 0xc]
lea eax, [ebp - 0x24]
push eax
add ecx, 8
mov dword [ebp - 0x14], edi
call fcn.004023dc
push 0x10
call fcn.0040ba64
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov dword [ebp - 4], ebx
je 0x402560
push edi
mov ecx, eax
call fcn.00409a8d
jmp 0x402562
xor eax, eax
mov ecx, dword [esi + 0xc]
inc word [ecx + 0x14]
push eax
push 0
push dword [esi + 0x14]
push dword [esi + 0x10]
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
mov byte [0x4357f0], 0
jne 0x40258c
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
jmp 0x4025a1
push 2
pop eax
push dword [ebp - 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov byte [edi + 6], bl
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x10], 0
je 0x4025b0
push dword [ebp - 0x10]
call fcn.00409ebf
pop ecx
call fcn.0040ba28
ret