joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b6a50
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esp + 0x14]
push edi
mov edi, 0x32
call fcn.1009e810
mov eax, dword [esi + 4]
cmp dword [eax + 0x16], 0
je 0x100b6c1f
push ebx
push ebp
mov dword [esp + 0x14], 0
mov edi, eax
call fcn.100b3b40
cmp dword [edi + 0x12], eax
mov ebp, dword [esp + 0x1c]
setne byte [esp + 0x10]
test ebp, ebp
jle 0x100b6ada
mov ecx, dword [edi + 0x16]
push ecx
call sub.MSVCR80.dll_ftell
mov edx, dword [esi + 4]
push 2
mov edi, eax
mov eax, dword [edx + 0x16]
push 0
push eax
call sub.MSVCR80.dll_fseek
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push edx
call sub.MSVCR80.dll_ftell
mov ebx, eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x16]
push 0
push edi
push ecx
call sub.MSVCR80.dll_fseek
add esp, 0x20
cmp edi, ebx
jge 0x100b6ad8
sub ebx, edi
cmp ebp, ebx
jg 0x100b6ae0
test ebp, ebp
jge 0x100b6b6b
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x16]
push eax
call sub.MSVCR80.dll_ftell
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push 2
push 0
push edx
mov ebx, eax
call sub.MSVCR80.dll_fseek
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x16]
push ecx
call sub.MSVCR80.dll_ftell
mov edx, dword [esi + 4]
mov edi, eax
mov eax, dword [edx + 0x16]
push 0
push ebx
push eax
sub edi, ebx
call sub.MSVCR80.dll_fseek
push edi
call fcn.1009d7e0
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push edx
push edi
mov ebx, eax
push 1
push ebx
call sub.MSVCR80.dll_fread
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x12]
mov edi, dword [esp + 0x54]
add esp, 0x34
push edx
push eax
push ebx
mov ecx, edi
call fcn.1009f9d0
cmp byte [esp + 0x10], 0
mov dword [esp + 0x14], eax
je 0x100b6b60
push 3
mov ecx, edi
call fcn.1009ea40
push ebx
call fcn.1009d9f0
add esp, 4
jmp 0x100b6bc2
test ebp, ebp
je 0x100b6bc2
nop
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov ebx, dword [eax + 0x12]
mov edi, dword [eax + 0x16]
push ecx
call fcn.100b63d0
add esp, 4
sub ebp, 1
cmp eax, 0xffffffff
je 0x100b6bc2
mov ecx, dword [esp + 0x20]
push eax
call fcn.1009f8b0
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x16]
push eax
call sub.MSVCR80.dll_ferror
add esp, 4
test eax, eax
jne 0x100b6bc2
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push edx
call sub.MSVCR80.dll_feof
add esp, 4
test eax, eax
jne 0x100b6bc2
test ebp, ebp
jne 0x100b6b70
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x16]
push ecx
call sub.MSVCR80.dll_ferror
add esp, 4
test eax, eax
pop ebp
pop ebx
je 0x100b6bf3
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x16]
push eax
call sub.MSVCR80.dll_clearerr
add esp, 4
pop edi
mov eax, 0x34
pop esi
add esp, 8
ret 8
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push edx
call sub.MSVCR80.dll_feof
add esp, 4
test eax, eax
je 0x100b6c13
pop edi
mov eax, 0x33
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 8
ret 8
mov eax, edi
pop edi
pop esi
add esp, 8
ret 8
Function at 0x100b6cf0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1014be11
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x814
push edi
mov edi, ecx
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov dword [esp + 4], edi
call edx
mov edx, dword [edi + 4]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
add edx, 4
push edx
call fcn.100bb970
add esp, 0xc
test eax, eax
jne 0x100b6e7b
mov eax, dword [edi + 4]
push 0x1015e8cc
push eax
call fcn.100bb010
add esp, 8
test eax, eax
jne 0x100b6e63
mov ecx, dword [esp + 0x828]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.100b60f0
mov edx, dword [esp + 0x10]
push 0x1015e908
push edx
mov dword [esp + 0x82c], 0
call fcn.100bb010
mov esi, eax
add esp, 8
test esi, esi
jne 0x100b6e43
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 0x16]
push ebp
mov ebp, dword [ecx + 0x16]
push 2
push esi
push ebx
call sub.MSVCR80.dll_fseek
push ebx
call sub.MSVCR80.dll_ftell
push esi
push esi
push ebx
mov edi, eax
call sub.MSVCR80.dll_fseek
add esp, 0x1c
test edi, edi
je 0x100b6e05
jmp 0x100b6dc0
cmp edi, 0x800
mov esi, edi
jbe 0x100b6dcf
mov esi, 0x800
push ebx
push 1
lea edx, [esp + 0x2c]
push esi
push edx
call sub.MSVCR80.dll_fread
add esp, 0x10
test eax, eax
je 0x100b6e98
push ebp
push 1
lea eax, [esp + 0x2c]
push esi
push eax
call sub.MSVCR80.dll_fwrite
add esp, 0x10
test eax, eax
je 0x100b6e98
sub edi, esi
jne 0x100b6dc0
lea ecx, [esp + 0x14]
call fcn.100b5da0
mov esi, eax
test esi, esi
jne 0x100b6e3d
mov ecx, dword [esp + 0x18]
add ecx, 4
push ecx
call fcn.100bacc0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push edx
push eax
add ecx, 4
push ecx
call fcn.100bb990
add esp, 0x10
mov esi, eax
mov edi, dword [esp + 0x10]
pop ebp
pop ebx
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x824], 0xffffffff
call fcn.100b5bb0
mov eax, esi
pop esi
pop edi
mov ecx, dword [esp + 0x814]
mov dword fs:[0], ecx
add esp, 0x820
ret 4
mov ecx, dword [esp + 0x818]
mov eax, 0x30
pop edi
mov dword fs:[0], ecx
add esp, 0x820
ret 4
mov esi, 0x34
jmp 0x100b6e3d

Function at 0x100b7240
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x1014be99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
xor edi, edi
mov dword [esp + 8], edi
mov esi, dword [esp + 0x28]
push str.en_US
mov ecx, esi
mov dword [esp + 0x24], edi
call fcn.1009ee10
push 8
lea eax, [esp + 0x10]
push eax
push 0x59
mov dword [esp + 0x2c], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x400
mov dword [esp + 0x18], 1
call edi
test eax, eax
je 0x100b72cf
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.1009f2a0
push 8
lea edx, [esp + 0x10]
push edx
push 0x5a
push 0x400
call edi
test eax, eax
je 0x100b72cf
push 0x5f
mov ecx, esi
call fcn.1009f880
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.1009f8e0
mov ecx, dword [esp + 0x18]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x100b72f0
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x204
push 0x200
lea eax, [esp + 8]
push eax
push 0x1004
push 0x800
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
movsx ecx, byte [esp + 4]
push ecx
call sub.MSVCR80.dll_isdigit
add esp, 4
test eax, eax
je 0x100b7348
push 0x7e
lea edx, [esp + 8]
push edx
lea eax, [esp + 0xe]
push eax
call sub.MSVCR80.dll_memmove
add esp, 0xc
mov byte [esp + 4], 0x43
mov byte [esp + 5], 0x50
push esi
call fcn.100b3b30
mov esi, dword [esp + 0x20c]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.100a0af0
mov eax, esi
pop esi
add esp, 0x204
ret

Function at 0x100b7450
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100b747a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [esp + 4]
push eax
mov eax, esi
call fcn.100b73d0
add esp, 4
test eax, eax
mov dword [esp + 8], eax
je 0x100b74ac
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x100b74a4
mov eax, esi
mov dword [esp + 8], eax
jmp 0x100b74a8
mov eax, dword [esp + 8]
test eax, eax
jne 0x100b74c0
lea ecx, [esp + 4]
push ecx
push 0x100b7420
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 8]
pop esi
add esp, 8
ret
Function at 0x100b74d0
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
sub esp, 0x188
push ebp
call fcn.100b7450
mov ebp, eax
test ebp, ebp
je 0x100b760b
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x100b7515
mov edi, dword [sym.imp.USER32.dll_GetWindow]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 4
push esi
call edi
test eax, eax
jne 0x100b7511
push esi
call ebx
test eax, eax
je 0x100b7515
mov esi, eax
jmp 0x100b7501
push 0x100
lea eax, [esp + 0x9c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x100b7601
push 0x80
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x100b7601
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, esi
jne 0x100b7601
test esi, esi
je 0x100b7601
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
mov ebx, eax
call edi
push 0
push ebp
mov esi, eax
call edi
test ebx, ebx
mov edi, eax
je 0x100b7601
cmp edi, esi
je 0x100b7601
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x100b75bc
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x188
ret
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2000
call esi
push 2
lea edx, [esp + 0x18]
push edx
push 0
push 0x2001
mov dword [esp + 0x24], 0
call esi
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001
call esi
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x188
ret

Function at 0x100b7dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1014bef8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
push 1
mov esi, ecx
push str.UnitValue
mov dword [esp + 0x10], esi
call fcn.100a4010
lea edi, [esi + 0x26]
push 0x1015e990
mov ecx, edi
mov dword [esp + 0x30], 0
mov dword [esi], vtable.ScCore::UnitValueObject.1.0
mov dword [esi + 0x12], vtable.ScCore::UnitValueObject.0
call fcn.100a2580
push 0x2076616c
mov ecx, esi
mov byte [esp + 0x30], 1
mov dword [esi + 0xc], edi
call fcn.100b7b70
mov edi, eax
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x100b7e47
lea ecx, [esp + 0xc]
call fcn.100b7680
push eax
mov ecx, edi
call fcn.1009aff0
mov ecx, dword [esp + 0x24]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x100b9450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1014c088
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.100c2c40
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov word [esi + 0x30], bx
lea ecx, [esi + 0x32]
mov byte [esp + 0x14], 1
call fcn.100b0b20
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 2
call fcn.100a8cb0
fld qword [0x1015eb88]
push 0x19000
fstp qword [esi + 0x58]
mov ecx, esi
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], 0x696e6368
mov dword [esi + 0x60], ebx
mov byte [esi + 0x64], bl
call fcn.100b9400
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100bab50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
lea eax, [esp + 8]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
sete bl
test bl, bl
je 0x100babcc
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
cmp eax, 1
sete bl
test bl, bl
je 0x100bab9c
call fcn.100b4500
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.1009f9d0
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x100babc8
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test bl, bl
jne 0x100babd3
mov ecx, esi
call fcn.1009e810
mov al, bl
pop ebx
add esp, 0x10c
ret

Function at 0x100bb230
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
add eax, 0xc
push eax
call sub.MSVCR80.dll__wmkdir
add esp, 4
test eax, eax
sete cl
mov byte [esp + 4], cl
mov edx, dword [esp + 4]
mov dword [esp + 4], edx
jmp fcn.100bac70

Function at 0x100bb4c0
Capabilities:
Delete file

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
add eax, 4
push eax
lea ecx, [esp + 0x10]
call fcn.1009edd0
mov eax, dword [esp + 0xc]
add eax, 0xc
push eax
call sub.MSVCR80.dll__wremove
test eax, eax
sete cl
mov byte [esp + 8], cl
mov edx, dword [esp + 8]
push edx
call fcn.100bac70
add esp, 8
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.1009dbf0
mov eax, esi
pop esi
pop ecx
ret
Function at 0x100bb71a
Capabilities:
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1014c287
push eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
sub esp, 8
add eax, 0xffffffff
cmp eax, 8
push esi
push edi
ja case.default.0x100bb6ea
jmp dword [eax*4 + 0x100bb944]
mov eax, dword [0x10327354]
mov edi, dword [esp + 0x24]
push eax
lea ecx, [edi + 4]
call fcn.1009e420
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.WINDIR
call sub.MSVCR80.dll_getenv
add esp, 4
test eax, eax
je 0x100bb856
mov edi, dword [esp + 0x24]
push 0
push 0xffffffffffffffff
lea esi, [edi + 4]
push eax
mov ecx, esi
call fcn.1009f9d0
push str.SYSTEM32
mov ecx, esi
call fcn.1009f8e0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push 0x1015f050
lea ecx, [esp + 0x24]
call fcn.1009ee10
push 0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.100b0630
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 2
call fcn.1009dbf0
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.100af7e0
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
push eax
mov ecx, esi
mov byte [esp + 0x1c], 3
call fcn.1009e420
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 2
call fcn.1009dbf0
push 0xffffffffffffffff
push 3
mov ecx, esi
call fcn.1009f410
push str.RECYCLED
mov ecx, esi
call fcn.1009f8e0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.100afdf0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.TEMP
call sub.MSVCR80.dll_getenv
mov edi, dword [esp + 0x28]
add esp, 4
test eax, eax
je 0x100bb841
push 0
push 0xffffffffffffffff
push eax
lea ecx, [edi + 4]
call fcn.1009f9d0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea esi, [edi + 4]
mov ecx, 0x20
call fcn.100bab50
test al, al
jne 0x100bb917
pop edi
mov eax, 0x34
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
mov ecx, 0x1a
call fcn.100bab50
test al, al
jne 0x100bb917
jmp 0x100bb856
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
mov ecx, 0x23
call fcn.100bab50
test al, al
jne 0x100bb917
jmp 0x100bb873
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
mov ecx, 0x2b
call fcn.100bab50
test al, al
jne 0x100bb917
mov ecx, 0x26
call fcn.100bab50
test al, al
je 0x100bb856
push str.Common_Files
mov ecx, esi
call fcn.1009f8e0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
mov ecx, 5
call fcn.100bab50
test al, al
jne 0x100bb917
mov ecx, 0x28
call fcn.100bab50
test al, al
je 0x100bb856
push str.My_Documents
mov ecx, esi
call fcn.1009f8e0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
pop edi
mov eax, 0x20
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100bb808
Capabilities:
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1014c287
push eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
sub esp, 8
add eax, 0xffffffff
cmp eax, 8
push esi
push edi
ja case.default.0x100bb6ea
jmp dword [eax*4 + 0x100bb944]
mov eax, dword [0x10327354]
mov edi, dword [esp + 0x24]
push eax
lea ecx, [edi + 4]
call fcn.1009e420
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.WINDIR
call sub.MSVCR80.dll_getenv
add esp, 4
test eax, eax
je 0x100bb856
mov edi, dword [esp + 0x24]
push 0
push 0xffffffffffffffff
lea esi, [edi + 4]
push eax
mov ecx, esi
call fcn.1009f9d0
push str.SYSTEM32
mov ecx, esi
call fcn.1009f8e0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push 0x1015f050
lea ecx, [esp + 0x24]
call fcn.1009ee10
push 0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.100b0630
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 2
call fcn.1009dbf0
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.100af7e0
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
push eax
mov ecx, esi
mov byte [esp + 0x1c], 3
call fcn.1009e420
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 2
call fcn.1009dbf0
push 0xffffffffffffffff
push 3
mov ecx, esi
call fcn.1009f410
push str.RECYCLED
mov ecx, esi
call fcn.1009f8e0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.100afdf0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push str.TEMP
call sub.MSVCR80.dll_getenv
mov edi, dword [esp + 0x28]
add esp, 4
test eax, eax
je 0x100bb841
push 0
push 0xffffffffffffffff
push eax
lea ecx, [edi + 4]
call fcn.1009f9d0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea esi, [edi + 4]
mov ecx, 0x20
call fcn.100bab50
test al, al
jne 0x100bb917
pop edi
mov eax, 0x34
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
mov ecx, 0x1a
call fcn.100bab50
test al, al
jne 0x100bb917
jmp 0x100bb856
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
mov ecx, 0x23
call fcn.100bab50
test al, al
jne 0x100bb917
jmp 0x100bb873
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
mov ecx, 0x2b
call fcn.100bab50
test al, al
jne 0x100bb917
mov ecx, 0x26
call fcn.100bab50
test al, al
je 0x100bb856
push str.Common_Files
mov ecx, esi
call fcn.1009f8e0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edi, dword [esp + 0x24]
lea esi, [edi + 4]
mov ecx, 5
call fcn.100bab50
test al, al
jne 0x100bb917
mov ecx, 0x28
call fcn.100bab50
test al, al
je 0x100bb856
push str.My_Documents
mov ecx, esi
call fcn.1009f8e0
mov byte [edi + 8], 0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
pop edi
mov eax, 0x20
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100bbed0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x3c
lea eax, [esp + 4]
push 0
push eax
call sub.MSVCR80.dll_memset
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx + 4]
add esp, 0xc
lea eax, [esp]
add edx, 0xc
push eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x3c
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
setne cl
push ecx
call fcn.100bac40
add esp, 0x40
ret

Function at 0x100bc5b0
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1014c389
push eax
mov dword fs:[0], esp
sub esp, 0x14
cmp byte [0x10327364], 0
push edi
mov edi, 0x34
jne 0x100bc5e6
push 0
mov byte [0x10327364], 1
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
push eax
push 0x1016262c
push 1
push 0
push 0x1016263c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100bc6f4
mov ecx, dword [esp + 0x2c]
push esi
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.100bbc20
push eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x34], 0
call fcn.100badc0
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 2
call fcn.1009dbf0
mov ecx, dword [esp + 0xc]
mov esi, dword [ecx]
push 0
lea ecx, [esp + 0x18]
call fcn.1009f090
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0x50]
push edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x1016264c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x100bc6d6
mov esi, dword [esp + 0x2c]
add esi, 4
push esi
lea ecx, [esp + 0xc]
call fcn.1009edd0
push str..LNK
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.1009f8e0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
add eax, 0xc
push 1
push eax
mov eax, dword [edx + 0x18]
push ecx
call eax
test eax, eax
jl 0x100bc6bc
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.1009e420
xor edi, edi
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ecx, [esp + 8]
mov byte [esp + 0x24], 2
call fcn.1009dbf0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.1009dbf0
pop esi
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x100be8b0
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
add eax, 0xc
push eax
call sub.MSVCR80.dll__wrmdir
add esp, 4
test eax, eax
sete cl
mov byte [esp + 4], cl
mov edx, dword [esp + 4]
mov dword [esp + 4], edx
jmp fcn.100bac70
push esi
mov esi, dword [esp + 8]
push edi
push 0
push 0
mov ecx, esi
mov edi, 0x30
call fcn.100af770
movsx eax, ax
test eax, eax
je 0x100be8ec
and al, 3
cmp al, 2
pop edi
jne 0x100be8e0
mov eax, dword [esi]
pop esi
mov dword [esp + 4], eax
jmp 0x100bb260
mov ecx, dword [esi]
pop esi
mov dword [esp + 4], ecx
jmp fcn.100bb4c0
mov eax, edi
pop edi
pop esi
ret
Function at 0x100bec30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1014c7e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.100b3bf0
lea ebx, [esi + 8]
xor ebp, ebp
mov ecx, ebx
mov dword [esp + 0x1c], ebp
mov dword [esi], vtable.ScCore::UniversalEncoder.0
call fcn.1009dbc0
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push edi
push edi
add ecx, 0xc
push ecx
push str._ls_CP_ld_WINDOWS__ld
push ebx
mov byte [esp + 0x30], 1
call fcn.100a13b0
mov edx, dword [ebx]
add esp, 0x14
cmp word [edx + 0xc], 0x2c
jne 0x100beca1
push 1
push ebp
mov ecx, ebx
call fcn.1009f410
mov eax, dword [esp + 0x28]
push 0x10
mov dword [esi + 4], eax
call fcn.1009d7e0
add esp, 4
cmp eax, ebp
je 0x100becbe
mov dword [eax], vtable.ScCore::EncoderData.0
jmp 0x100becc0
xor eax, eax
cmp edi, 0xc42c
mov dword [esi + 0xc], eax
mov dword [eax + 4], edi
mov ecx, dword [esi + 0xc]
mov dword [ecx + 8], 9
mov edx, dword [esi + 0xc]
mov dword [edx + 0xc], ebp
je 0x100bed36
cmp edi, 0xc42d
je 0x100bed36
cmp edi, 0xc42e
je 0x100bed36
cmp edi, 0xc431
je 0x100bed36
cmp edi, 0xc433
je 0x100bed36
cmp edi, 0xc435
je 0x100bed36
cmp edi, 0xcec8
je 0x100bed36
cmp edi, 0xd698
je 0x100bed36
cmp edi, 0xdeaa
jl 0x100bed26
cmp edi, 0xdeb3
jle 0x100bed36
cmp edi, 0xfde8
je 0x100bed36
cmp edi, 0xfde9
jne 0x100bed42
mov eax, dword [esi + 0xc]
mov dword [eax + 0xc], ebp
mov ecx, dword [esi + 0xc]
mov dword [ecx + 8], ebp
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc