joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006771b
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x10108c5e
call fcn.100b2747
mov esi, ecx
cmp dword [ebp + 0xc], 9
jne 0x1006783b
lea eax, [ebp + 0xc]
push 0x101140fc
push eax
call fcn.1007780c
and dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.101015b0
add esp, 0x10
push dword [esi + 0x18]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.10002f20
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.10031050
test eax, eax
jne 0x10067819
mov ecx, dword [esi + 0xc]
call fcn.10068338
test al, al
je 0x100677e1
call fcn.100d56b0
lea eax, [ebp - 0x10]
push 0x101140b0
push eax
call fcn.1007780c
lea eax, [ebp - 0x10]
push eax
push 0xcb
mov byte [ebp - 4], 3
call fcn.10077655
add esp, 0xc
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x1028bd68
call fcn.10002e70
lea eax, [ebp - 0x10]
push eax
call fcn.100776e6
pop ecx
pop ecx
push 2
lea ecx, [esi - 0x5b0]
call fcn.1006703f
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10005330
push 0
push 1
push 0x8bb8
push dword [esi - 0x5ac]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10005330
jmp 0x1006788f
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10067829
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x10067821
push 0xbbc
push 0
jmp 0x100677e5
cmp dword [ebp + 0xc], 0xb
jne 0x1006784a
push 0xbbc
push 0
jmp 0x1006787e
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, dword [esi + 0x10]
mov edi, eax
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
fild qword [ebp - 0x20]
fild qword [edi + 8]
fdivp st(1)
fmul qword [0x10113fb8]
call fcn.100b2c70
push eax
push 2
push 0x8bb8
push dword [esi - 0x5ac]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
call fcn.100b281f
ret 0xc
Function at 0x1006789a
Capabilities:
Check if file exists
Delete file

Disassembly:
push 8
mov eax, 0x10108cab
call fcn.100b2747
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ebx, [esi + 0x590]
mov dword [esi], vtable.CMainDlg.5.0
mov dword [esi + 0x588], 0x10114138
mov dword [esi + 0x58c], 0x10114130
mov dword [ebx], vtable.CMainDlg.2.0
mov dword [esi + 0x5b0], 0x1011411c
mov dword [esi + 0x5b4], 0x10114114
mov ecx, dword [esi + 0x5c0]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x100678fb
mov eax, dword [ecx]
call dword [eax + 0x18]
lea edi, [esi + 0x5bc]
mov ecx, dword [edi]
test ecx, ecx
je 0x10067910
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [edi], 0
mov edi, dword [esi + 0x5c0]
test edi, edi
je 0x1006792f
mov ecx, edi
call fcn.100015a0
push edi
call fcn.100b1e2a
and dword [esi + 0x5c0], 0
pop ecx
lea eax, [ebp - 0x10]
push 0x101140b0
push eax
call fcn.1007780c
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10067955
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [esi + 0x5c8]
sub ecx, 0x10
call fcn.10005330
mov ecx, dword [esi + 0x5c4]
sub ecx, 0x10
call fcn.10005330
mov ecx, ebx
mov byte [ebp - 4], 0
call fcn.1005da66
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.1007564f
call fcn.100b281f
ret

Function at 0x100682a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1006830a
cmp dword [ebp + 0x10], 1
je 0x100682e2
cmp dword [ebp + 0x10], 2
je 0x100682e2
push 0xd
pop eax
jmp 0x1006830a
mov eax, dword [ebp - 4]
test edi, edi
je 0x10068304
test eax, eax
je 0x100682ff
test al, 1
jne 0x100682dd
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x10068304
jmp 0x100682dd
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x10069357
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 4]
push ebx
push esi
push dword [esp + 0x14]
mov esi, 0x10000000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x100693ce
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x1006939d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1006939d
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x100693a1
xor eax, eax
jmp 0x100693cd
mov ecx, dword [esp + 0x14]
push edi
push eax
lea eax, [edi + 1]
push eax
call fcn.100196b0
push eax
call fcn.100b3c60
mov ecx, dword [esp + 0x20]
add esp, 0xc
push edi
call fcn.10018340
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x100698a3
Capabilities:
Get file size
Read file on windows

Disassembly:
push 8
mov eax, 0x10108d7a
call fcn.100b2747
call fcn.10068f6b
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
xor esi, esi
cmp eax, esi
je 0x1006997d
push 0x102b0b9c
lea ecx, [ebp - 0x10]
call fcn.100035c0
mov dword [ebp - 4], esi
call fcn.10068f6b
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 0x10]
push str._s_d._s
push eax
call fcn.10004b00
add esp, 0x14
push esi
push 0x80
push 3
push esi
push 1
push connect
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1006996e
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
je 0x10069967
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0xa]
push eax
mov dword [ebp - 0x14], esi
call fcn.100196b0
push esi
lea ecx, [ebp - 0x14]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x1006995e
cmp dword [ebp - 0x14], edi
jne 0x1006995e
mov ecx, dword [ebp + 0xc]
push edi
call fcn.10018340
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10005330
xor eax, eax
inc eax
jmp 0x1006998e
mov ecx, dword [ebp + 0xc]
push esi
call fcn.10019700
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.10005330
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10069357
add esp, 0xc
call fcn.100b281f
ret
Function at 0x1006a2d4
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x48
mov eax, 0x10108e64
call fcn.100b2747
mov eax, dword [ebp + 0x80c]
mov esi, dword [ebp + 0x810]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [eax]
push 0x20019
push eax
push connect
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.10068260
test eax, eax
jne 0x1006a3bd
mov esi, dword [esi]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0x400
call fcn.100682a1
test eax, eax
jne 0x1006a3bd
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.10002e70
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1006a3b2
push 0x38
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.100b2d30
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x814]
mov dword [ebp - 0x40], eax
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov bl, 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10005330
lea ecx, [ebp - 0x18]
call fcn.10068245
mov ecx, dword [ebp + 0x814]
add ecx, 0xfffffff0
call fcn.10005330
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.100b2738
add ebp, 0x804
leave
ret 0xc
Function at 0x1006cff4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x254], 1
jne 0x1006d00c
push 0x7d6
call fcn.1006bfe1
pop esi
ret
call fcn.1006c01e
mov ecx, esi
pop esi
jmp fcn.1006c864

Function at 0x1006d579
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
call fcn.1006c01e
mov ecx, esi
pop esi
jmp fcn.1006c864
Function at 0x1006d742
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x30
mov eax, 0x10109483
call fcn.100b2747
mov esi, ecx
xor ebx, ebx
push 1
mov byte [ebp - 0xe], bl
call sub.SETUPAPI.dll_CMP_WaitNoPendingInstallEvents
mov edi, 0x102
cmp eax, edi
jne 0x1006d7b4
cmp byte [ebp - 0xe], bl
jne 0x1006d772
push ebx
mov ecx, esi
call fcn.100681af
mov byte [ebp - 0xe], 1
call fcn.100d89f0
push 1
call sub.SETUPAPI.dll_CMP_WaitNoPendingInstallEvents
cmp eax, edi
je 0x1006d765
xor edi, edi
push 1
call fcn.100d87c0
dec eax
neg eax
sbb al, al
inc al
pop ecx
jne 0x1006d8f1
cmp edi, 5
jge 0x1006d96a
push 0xc8
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006d788
mov ecx, esi
call fcn.1006d3d4
push 0x7d8
mov ecx, esi
mov dword [esi + 0x300], ebx
mov dword [esi + 0x25c], ebx
call fcn.1006bfe1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], bl
mov eax, dword [esi + 0x300]
cmp eax, ebx
je 0x1006d7fe
add eax, 0xfffffffe
cmp eax, 1
ja 0x1006d87e
mov byte [ebp - 0xd], 1
jmp 0x1006d87e
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.1002f8e0
pop ecx
pop ecx
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.10006540
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
call fcn.10006540
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10031860
test al, al
jne 0x1006d85b
lea ecx, [ebp - 0x1c]
call fcn.10031470
push eax
lea ecx, [esi + 0x280]
call fcn.10032350
mov dword [esi + 0x300], 1
jmp 0x1006d869
mov dword [esi + 0x300], 3
mov byte [ebp - 0xd], 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10031810
push dword [ebp - 0x3c]
call fcn.100b1e2a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp eax, 0x2bf20
jbe 0x1006d8bc
push 0x57b
call fcn.1005f2dd
pop ecx
mov edi, eax
call fcn.10067ca5
push edi
push 0xd7a
lea ecx, [eax + 0x50]
call fcn.1006bf98
mov dword [esi + 0x300], 3
mov byte [ebp - 0xd], 1
call fcn.100d89f0
cmp byte [ebp - 0xd], bl
je 0x1006d7df
cmp dword [esi + 0x300], 3
jne 0x1006d786
push 0x7d9
mov ecx, esi
call fcn.1006bfe1
mov ecx, dword [esi + 0x4c]
push ebx
call fcn.10068055
jmp 0x1006d99e
mov ecx, esi
mov byte [esi + 0x254], bl
call fcn.1006d1e2
cmp eax, 1
je 0x1006d955
cmp eax, 2
je 0x1006d955
cmp eax, 3
je 0x1006d955
call fcn.10067ca5
push ebx
push 0xa2c
lea ecx, [eax + 0x50]
call fcn.10063e56
call fcn.10067ca5
push ebx
push 0xbb8
lea ecx, [eax + 0x50]
call fcn.10063e56
call fcn.10067ca5
push 1
push 0xa2d
lea ecx, [eax + 0x50]
call fcn.10063e56
push 0x7d0
mov ecx, esi
call fcn.1006bfe1
jmp 0x1006d95c
mov ecx, esi
call fcn.1006c27c
mov ecx, dword [esi + 0x48]
push ebx
call fcn.10068055
jmp 0x1006d8e3
mov ecx, dword [esi + 0x48]
push ebx
call fcn.10068055
mov ecx, dword [esi + 0x4c]
push ebx
call fcn.10068055
mov ecx, esi
cmp byte [ebp - 0xe], bl
je 0x1006d994
mov dword [esi + 0x84], 0x7d0
call fcn.1006d9ca
jmp 0x1006d99e
push 0x7d0
call fcn.1006bfe1
call fcn.100b281f
ret
Function at 0x1006dfc8
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
push 0
push 0xfc
push 0x1cc
mov dword [esi + 0x58c], ecx
add ecx, 0x55
mov dword [esi + 0x588], eax
add eax, 0x78
push ecx
push eax
push dword [esi + 4]
mov dword [esi + 0x590], eax
mov dword [esi + 0x594], ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
ret 8

Function at 0x1006e024
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.10067ca5
mov ecx, eax
jmp 0x100671ab

Function at 0x1006e03b
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x100704a0
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x100704f1
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x10070502
push 0xd
pop eax
jmp 0x1007052f
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x10070505
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8

Function at 0x10070a96
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10068260
mov ebx, eax
cmp ebx, esi
je 0x10070b06
lea ecx, [ebp - 0x70]
call fcn.10068245
mov eax, ebx
mov ecx, dword [ebp + 0x198]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b2738
add ebp, 0x19c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x10070b1e
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.10070a96
cmp eax, esi
jne 0x10070b50
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x10070b0e
lea ecx, [ebp - 0x70]
call fcn.10068245
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100703eb
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.10068245
mov eax, esi
jmp 0x10070aec
Function at 0x100750ff
Capabilities:
Check os version

Disassembly:
push 0x3c
mov eax, 0x1010999a
call fcn.100b2747
push dword [ebp + 8]
xor ebx, ebx
mov byte [0x102aff18], bl
call fcn.1007471a
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push 4
and eax, 0x3ff
pop ecx
cmp cx, ax
jne 0x10075168
push 0x66
call fcn.10074874
pop ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, al
cmp eax, 5
jbe 0x1007514c
push 2
jmp 0x1007514e
push 1
call fcn.1005f2dd
pop ecx
push 0xfffffffffffffff4
push eax
call fcn.10074a34
push 0x65
call fcn.100750ab
add esp, 0xc
jmp 0x10075185
push 0x68
call fcn.10074874
push 0xfffffffffffffff4
push str.Times_New_Roman
call fcn.10074a34
push 0x69
call fcn.100750ab
add esp, 0x10
push 0x64
call fcn.10075057
pop ecx
mov dword [ebp - 0x48], 0x10114f94
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x48]
push eax
mov ecx, 0x102aff38
mov dword [ebp - 4], ebx
call fcn.1007252b
call fcn.10067ca5
cmp eax, ebx
je 0x100751ca
add eax, 0x58c
mov dword [ebp - 0x10], eax
jmp 0x100751cd
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x44]
call fcn.1007195f
push ebx
push ebx
call fcn.10067ca5
mov ecx, eax
call fcn.10074d5c
call fcn.10067ca5
cmp eax, ebx
je 0x100751fa
add eax, 0x58c
mov dword [ebp - 0x10], eax
jmp 0x100751fd
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x44]
call fcn.100719d1
call fcn.1006683d
call fcn.1006e518
lea ecx, [ebp - 0x38]
call fcn.1006e568
lea ecx, [ebp - 0x44]
call fcn.1006e568
xor eax, eax
call fcn.100b281f
ret
Function at 0x1007522b
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x101099cf
call fcn.100b2747
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.10077745
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.1006e79b
pop ecx
push esi
push dword [ebp + 8]
mov edi, 0x102aff38
push esi
mov ecx, edi
call fcn.1006ed17
mov ecx, edi
call fcn.100754d9
test eax, eax
je 0x10075374
lea eax, [ebp - 0x10]
push 0x101140fc
push eax
call fcn.1007780c
lea eax, [ebp + 8]
push 0x101140b0
push eax
mov dword [ebp - 4], esi
call fcn.1007780c
add esp, 0x10
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100752f6
lea eax, [ebp + 8]
push eax
push 0xcb
call fcn.10077655
pop ecx
pop ecx
test al, al
je 0x100752d9
push ecx
mov ecx, esp
mov dword [ebp + 0x14], esp
push 0x1028bd68
call fcn.10002e70
lea eax, [ebp + 8]
push eax
call fcn.100776e6
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10005330
xor eax, eax
jmp 0x10075383
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call sub.gdiplus.dll_GdiplusStartup
push 4
call fcn.100b2134
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 2
cmp ecx, esi
je 0x10075330
call fcn.10077eb7
jmp 0x10075332
xor eax, eax
push eax
mov byte [ebp - 4], 1
call fcn.1008140e
mov ecx, eax
call fcn.100813e4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.100750ff
pop ecx
pop ecx
push dword [ebp - 0x14]
mov esi, eax
call sub.gdiplus.dll_GdiplusShutdown
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, edi
call fcn.10072982
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
call fcn.100b281f
ret 0x10
Function at 0x10075587
Capabilities:
Hide graphical window

Disassembly:
push 0x10
mov eax, 0x10109a2d
call fcn.100b2747
mov edi, ecx
mov eax, dword [edi + 0x598]
sub eax, 0x3e8
je 0x10075633
dec eax
jne 0x1007563e
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_shuame.exe
lea ecx, [ebp - 0x18]
call fcn.10002e70
and dword [ebp - 4], 0
mov esi, 0x1028bd68
push esi
lea ecx, [ebp - 0x14]
call fcn.10002e70
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10002e70
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 2
call fcn.10077c49
add esp, 0xc
test al, al
je 0x10075610
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str._REF_rootjl
call fcn.10002e70
lea eax, [ebp - 0x10]
push eax
call fcn.100776e6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10005330
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10005330
jmp 0x1007563e
push str.http:__www.shuame.com_client_latest_rootjl_client
call fcn.10077620
pop ecx
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.100b281f
ret

Function at 0x1007582f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
xor cl, cl
mov dword [esi + 0x598], eax
sub eax, 0x3e8
push edi
mov byte [ebp - 1], cl
je 0x10075856
dec eax
jne 0x1007585c
mov byte [ebp - 1], 1
jmp 0x1007585c
mov cl, 1
mov byte [ebp - 1], 0
movzx ebx, cl
push ebx
lea edi, [esi + 0x50]
push 0xc1e
mov ecx, edi
call fcn.10063e56
push ebx
push 0xc1f
mov ecx, edi
call fcn.10063e56
push ebx
push 0xc20
mov ecx, edi
call fcn.10063e56
movzx ebx, byte [ebp - 1]
push ebx
push 0xc21
mov ecx, edi
call fcn.10063e56
push ebx
push 0xc22
mov ecx, edi
call fcn.10063e56
push ebx
push 0xc23
mov ecx, edi
call fcn.10063e56
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0
push 0x126
push 0x20c
mov dword [esi + 0x58c], ecx
add ecx, 0x2d
mov dword [esi + 0x588], eax
add eax, 0x55
push ecx
push eax
push dword [esi + 4]
mov dword [esi + 0x590], eax
mov dword [esi + 0x594], ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10077620
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push 1
xor ebx, ebx
push ebx
push ebx
push dword [esp + 0x1c]
mov edi, 0x1011401c
push edi
push ebx
call esi
cmp eax, 0x20
jg 0x10077651
push 1
push ebx
push dword [esp + 0x18]
push 0x1011575c
push edi
push ebx
call esi
pop edi
pop esi
pop ebx
ret

Function at 0x10077655
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
push edi
push 0x10115778
push eax
push dword [0x102aff20]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push dword [0x102aff20]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 8], eax
test edi, edi
jne 0x10077689
xor al, al
jmp 0x100776e3
push edi
push dword [0x102aff20]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10077685
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x80
push 2
push 0
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov edi, eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
test edi, edi
je 0x100776e1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop ebp
ret

Function at 0x100776e6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
xor esi, esi
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.100b2d30
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10005330
pop esi
leave
ret