joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ab70
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jne 0x42aba4
push 0x440824
push 0x440804
push 1
call fcn.0042a430
add esp, 0xc
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x42abb2
push 0x4407f4
jmp 0x42ab8f
mov dword [eax], 0
call fcn.0042a480
test al, al
je 0x42ab9e
push esi
lea eax, [ebp - 4]
push eax
push 0x440e60
push 1
push 0
push 0x440f30
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x42abfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x4407b0
push 1
call fcn.0042a430
add esp, 0x10
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0x440784
push 0x10
call fcn.0042a430
xor edi, edi
push edi
call fcn.00419c10
add esp, 0xc
cmp eax, 5
jne 0x42ac2a
push 1
call fcn.00419c10
add esp, 4
cmp eax, 1
jge 0x42ac39
push 0
call fcn.00419c10
add esp, 4
cmp eax, 5
jle 0x42ac3e
mov edi, 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [0x44d1e0]
mov esi, eax
test esi, esi
jne 0x42ac70
push 0x440748
push 1
call fcn.0042a430
mov eax, dword [ebp - 4]
mov edx, dword [eax]
add esp, 8
push eax
mov eax, dword [edx + 8]
call eax
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0x44071c
push 0x20
call fcn.0042a430
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add esp, 8
lea edx, [ebp - 8]
push edx
push 0
push 0
push edi
push 0
push 0
push 0
push esi
push eax
mov eax, dword [ecx + 0xc]
call eax
push esi
mov edi, eax
call dword [0x44d1e4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test edi, edi
mov dword [ebp - 4], 0
jge 0x42acf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x8004100e
jne 0x42acde
push 0x4406d8
push 4
call fcn.0042a430
add esp, 8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push eax
push edi
push 0x440690
push 1
call fcn.0042a430
add esp, 0x10
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0x440660
push 0x20
call fcn.0042a430
mov edi, dword [ebp - 8]
add esp, 8
call fcn.0042a580
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42b390
Capabilities:
Hash data using djb2

Disassembly:
push esi
push edi
push eax
mov esi, 0x1505
call fcn.00403600
mov edi, eax
push edi
call dword [sym.imp.MSVCR80.dll__strlwr]
movsx eax, byte [edi]
add esp, 8
test eax, eax
mov ecx, edi
je 0x42b3c5
mov edx, esi
shl edx, 5
add ecx, 1
add edx, eax
movsx eax, byte [ecx]
add esi, edx
test eax, eax
jne 0x42b3b2
push edi
call fcn.00419830
push esi
push 0x440864
push 0
call fcn.00405920
add esp, 0x10
pop edi
pop esi
ret
Function at 0x42c280
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
xor esi, esi
call fcn.00427830
mov eax, dword [ebp + 0xc]
add esp, 4
push esi
push 0x10000080
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x42c330
push 1
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x42c2f8
push esi
push esi
push 1
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x42c2f8
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
lea esi, [ebp - 0xc]
push 0
push 0
push 0
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
call edi
test esi, esi
je 0x42c330
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [ebx + 4], eax
jne 0x42c339
push esi
call edi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov dword [ebx + 0x14], esi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100253fe
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002547f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025475
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10025456
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10025473
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1001ab3d
mov dword [eax], 0x2afd
jmp 0x1002544b
jmp 0x1002547d
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x10025497
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0x3dd
push 1
call fcn.10022e6e
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100297f4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065000
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10029837
push 0x2a0f
push 0x7f5e
push 1
call fcn.10029a17
add esp, 0xc
jmp 0x10029a06
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xa29
mov dword [ebp - 0x48], 0x100095fc
cmp dword [ebp - 0x30], 0xc91
jle 0x100298e1
and dword [ebp - 0x14], 0
jmp 0x1002986b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1de
jge 0x100298e1
and dword [ebp - 0x18], 0
jmp 0x10029881
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5035
jge 0x100298df
and dword [ebp - 0x1c], 0
jmp 0x10029897
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x8e1
jge 0x100298dd
and dword [ebp - 0x20], 0
jmp 0x100298ad
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x779
jge 0x100298db
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x1060def8
call fcn.1001a86e
jmp 0x100298a6
jmp 0x10029890
jmp 0x1002987a
jmp 0x10029864
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x100299bb
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0x47c0
mov dword [ebp - 0x44], 0x10009638
cmp dword [ebp - 0x2c], 0x4af6
jle 0x1002995a
and dword [ebp - 0x24], 0
jmp 0x10029919
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x47d1
jge 0x1002995a
and dword [ebp - 0x28], 0
jmp 0x1002992f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xf5c
jge 0x10029958
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0x1060def8
call fcn.1001a86e
jmp 0x10029928
jmp 0x10029912
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10029979
push 0x18a3
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x4596
jge 0x10029993
mov edx, dword [ebp - 0x44]
mov ecx, 0x1060def8
call fcn.1001cd79
jmp 0x100299af
or dword [ebp - 4], 0xffffffff
jmp 0x100299b9
jmp 0x100299c3
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0x6a7
jge 0x100299e0
mov edx, dword [ebp - 0x48]
mov ecx, 0x1060def8
call fcn.1001cd79
jmp 0x100299fc
or dword [ebp - 4], 0xffffffff
jmp 0x10029a06
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e952
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002e99e
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push 0x2257
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
call fcn.1002e9e2
add esp, 0x1c
jmp 0x1002e9de
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002e9d6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002e9d4
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x1002e9de
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret
Function at 0x1002f26b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065107
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002f427
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1002f409
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], 0x4a3b
mov dword [ebp - 0x48], 0x10009ddc
cmp dword [ebp - 0x28], 0x4b8d
jle 0x1002f390
and dword [ebp - 0x20], 0
jmp 0x1002f2f9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x230f
jge 0x1002f390
and dword [ebp - 0x14], 0
jmp 0x1002f313
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x341e
jge 0x1002f38b
and dword [ebp - 0x18], 0
jmp 0x1002f329
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x25e7
jge 0x1002f389
and dword [ebp - 0x1c], 0
jmp 0x1002f33f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x785b
jge 0x1002f387
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x80]
call fcn.1000d25a
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.1001a84e
push eax
call fcn.1004f3d6
pop ecx
lea ecx, [ebp - 0x80]
call fcn.1001a844
jmp 0x1002f338
jmp 0x1002f322
jmp 0x1002f30c
jmp 0x1002f2f2
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x46f2
jge 0x1002f3ac
push dword [ebp - 0x48]
call fcn.1004f3d6
pop ecx
jmp 0x1002f3c8
or dword [ebp - 4], 0xffffffff
jmp 0x1002f3d2
mov eax, dword [ebp - 0x24]
imul eax, dword [eax], 0x2cb1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
cmp dword [ebp - 0x4c], 0x2eac4530
jne 0x1002f3fb
mov dword [ebp - 0x2c], 1
jmp 0x1002f3ff
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
jmp 0x1002f425
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x1002f425
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1002f453
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
push 0x493f
push dword [ebp - 0x60]
push 0x3ae1
push 0x5216
push 0
push 0x4586
push 0x401d
call fcn.1002b15a
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003341b
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003349c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003344f
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1003349a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003347d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1003349a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1001ab3d
mov dword [eax], 0xad9ddcef
jmp 0x10033472
jmp 0x100334ea
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0x14f4
push 0x7c31
push dword [ebp - 0x20]
push 0x7da8
push dword [ebp - 0x24]
push 0x72c0
push 0x74ce
push 0x2cea
push 0x7c30
push 0x5dc2
push 0x1418
push 0
push 0x2f8c
call fcn.10031403
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x10034a6d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100651ea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10034abd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x6f7b
push 1
call fcn.10034c19
add esp, 0x10
jmp 0x10034c08
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10034bf1
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x28], 0x3e6d
mov dword [ebp - 0x3c], 0x1000a5d0
cmp dword [ebp - 0x28], 0x40a3
jle 0x10034ba1
and dword [ebp - 0x20], 0
jmp 0x10034afd
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2e1a
jge 0x10034b94
and dword [ebp - 0x18], 0
jmp 0x10034b17
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1f5a
jge 0x10034b8f
and dword [ebp - 0x1c], 0
jmp 0x10034b2d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7840
jge 0x10034b8d
and dword [ebp - 0x24], 0
jmp 0x10034b43
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x19cc
jge 0x10034b8b
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.1000d25a
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.1001a84e
push eax
call fcn.1004f3d6
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.1001a844
jmp 0x10034b3c
jmp 0x10034b26
jmp 0x10034b10
jmp 0x10034af6
push 0
push 0x150a
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10034bb3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x3e45
jge 0x10034bc9
push dword [ebp - 0x3c]
call fcn.1004f3d6
pop ecx
jmp 0x10034be5
or dword [ebp - 4], 0xffffffff
jmp 0x10034bef
jmp 0x10034c08
push 0x22be
push 0x1d57
push 0
push 0x1984
call dword [sym.imp.USER32.dll_CreateCaret]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100466ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp dword [eax + 4], 0
jne 0x100466f9
xor eax, eax
jmp 0x10046824
push 0x6da0
push 1
push 0x7244
lea eax, [ebp - 0x24]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1004660e
add esp, 0x1c
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x14], 0
jne 0x100467f8
mov dword [ebp - 0x2c], 0x6df3
mov dword [ebp - 0x30], 0x1000b6b0
cmp dword [ebp - 0x2c], 0x7119
jle 0x100467b4
and dword [ebp - 0x14], 0
jmp 0x1004674c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x19d7
jge 0x100467a7
and dword [ebp - 0x18], 0
jmp 0x10046762
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6958
jge 0x100467a5
and dword [ebp - 0x1c], 0
jmp 0x10046778
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x71bb
jge 0x100467a3
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x1060def8
call fcn.1001a86e
jmp 0x10046771
jmp 0x1004675b
jmp 0x10046745
push 0x957
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
jmp 0x10046824
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 0x14]
jbe 0x10046807
xor eax, eax
jmp 0x10046824
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp + 0xc]
lea eax, [eax + ecx*4 - 4]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax]
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047371
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 2
xor edi, edi
mov dword [ebp - 8], 0xe00f6802
pop esi
inc edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], esi
push esi
call fcn.1001aa9f
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
jmp 0x100473ad
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100473a0
mov eax, dword [ebp - 8]
mov ecx, 0xffff
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 8]
add eax, dword [ebp - 8]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
imul eax, dword [ebp - 8]
cmp eax, 0x7c694a61
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
test eax, eax
sets dl
sub edx, dword [ebp - 8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp edx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
setg cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x20]
setg cl
mov dword [ebp - 8], ecx
xor ecx, ecx
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 4]
setne cl
xor eax, eax
cmp ecx, 0xffffc9c1
mov dword [edx + 4], ecx
setl al
xor ecx, ecx
cmp eax, 0x34f1d4b0
mov eax, dword [ebp - 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x10]
jne 0x1004746c
cmp dword [ebp - 0xc], ebx
je 0x1004746c
mov eax, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0xc], ebx
jl 0x10047498
mov dword [ebp - 8], edi
cmp dword [ebp - 8], ebx
jl 0x10047493
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1004748e
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
dec dword [ebp - 8]
jns 0x1004747f
dec dword [ebp - 0xc]
jns 0x10047477
lea ecx, [ebp - 0x20]
call fcn.1001ab21
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10060825
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006b750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100529a8
mov dword [ebp - 0x14], eax
cmp dword [0x1060ef5c], esi
jne 0x10060918
push 0x800
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100608a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100609f8
push esi
push esi
push 0x1000750c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100609f8
push 0x10007524
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100609f8
push eax
call ebx
push 0x10007530
push edi
mov dword [0x1060ef5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007540
push edi
mov dword [0x1060ef60], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007554
push edi
mov dword [0x1060ef64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060ef6c], eax
test eax, eax
je 0x10060915
push 0x10007570
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1060ef68], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006093d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10060930
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10060952
push 4
pop eax
jmp 0x100609fa
cmp dword [ebp - 0x14], esi
je 0x10060952
push dword [0x1060ef5c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10060937
mov eax, dword [0x1060ef68]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100609b0
cmp dword [0x1060ef6c], edi
je 0x100609b0
push eax
call ebx
push dword [0x1060ef6c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100609b0
test eax, eax
je 0x100609b0
call ecx
test eax, eax
je 0x100609a5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100609a5
test byte [ebp - 8], 1
jne 0x100609b0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100609e0
mov eax, dword [0x1060ef60]
cmp eax, edi
je 0x100609dd
push eax
call ebx
test eax, eax
je 0x100609dd
call eax
mov esi, eax
test esi, esi
je 0x100609dd
mov eax, dword [0x1060ef64]
cmp eax, edi
je 0x100609dd
push eax
call ebx
test eax, eax
je 0x100609dd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060ef5c]
call ebx
test eax, eax
je 0x100609f8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100609fa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004febb
mov esp, ebp
pop ebp
ret