joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006c61f
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.10078730
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.1005516d
test al, al
je 0x1006c692
push ebx
pop eax
push ecx
pop ebp
push edi
pop ecx
push ecx
pop ecx
push eax
pop esi
push ebx
push ecx
push esi
push ebx
push esp
push ebp
pop ebp
push esi
push edi
pop esp
pop ebp
push eax
pop edx
push eax
push ebp
push edi
pop esp
pop ebx
pop ebx
call fcn.10055281
test al, al
je 0x1006c6b9
pop eax
pop edi
pop ecx
pop edi
push ebp
pop esp
pop ecx
push edi
pop ebp
push ebp
pop edx
push edi
push edi
push esi
push edi
push edi
push esi
push esi
pop esi
pop ebx
push esi
pop edx
push ecx
pop edx
pop eax
push ecx
push eax
pop ebp
pop esi
push ecx
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.10054e31
test al, al
je 0x1006c6ed
push esi
pop ebx
pop ecx
push ebp
pop ecx
push ecx
push esi
pop eax
pop ebp
pop eax
push edi
push edx
push esi
push edi
push edi
pop edx
pop ebx
push eax
push edi
push ebp
push edx
pop ebp
pop ebp
push ebx
pop eax
push edx
push ebp
push ebp
push edx
push esp
push edi
cmp edi, 5
jg 0x1006c6fc
cmp esi, 2
jg 0x1006c6fc
xor eax, eax
inc eax
jmp 0x1006c6fe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d874
mov esp, ebp
pop ebp
ret

Function at 0x10071b7f
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xfa4]
push edi
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0xfa4]
push esi
push eax
call fcn.100802dd
push 0x3c
xor edi, edi
lea eax, [ebp - 0xfe0]
push edi
push eax
call fcn.10078730
add esp, 0x14
mov dword [ebp - 0xfdc], 0x200
xor eax, eax
mov dword [ebp - 0xfcc], esi
inc eax
mov ecx, 0x101f1fd0
mov dword [ebp - 0xfd4], ecx
push eax
push edi
push edi
push esi
push ecx
push edi
mov dword [ebp - 0xfc4], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x10071c11
push edi
push edi
lea eax, [ebp - 0xfa4]
push edi
push eax
call fcn.10071ce7
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x10071c21
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.100802ff
pop ecx
test eax, eax
je 0x10071cd8
push ebx
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x200]
push str.Program_FilesInternet_Exploreriexplore.exe
push eax
call fcn.100802dd
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.100803a6
push 0x3c
xor edi, edi
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.10078730
add esp, 0x1c
mov dword [ebp - 0x244], 0x200
xor ebx, ebx
mov dword [ebp - 0x234], esi
inc ebx
mov eax, 0x101f1fd0
mov dword [ebp - 0x23c], eax
push ebx
push edi
push edi
push esi
push eax
push edi
mov dword [ebp - 0x22c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x10071cd4
push edi
push edi
lea ecx, [ebp - 0x20c]
push edi
push ecx
call fcn.10071ce7
add esp, 0x10
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x10071ce7
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x101e039e
call fcn.1005d8df
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.10078730
push 0x10
lea eax, [ebp - 0x50]
mov dword [ebp - 0x94], ebx
push 0
push eax
call fcn.10078730
add esp, 0x18
xor edx, edx
xor eax, eax
mov dword [ebp - 0x18], edx
mov word [ebp - 0x28], ax
push 7
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x40], ax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
test edi, edi
je 0x10071dc5
cmp word [edi], dx
jne 0x10071d56
mov eax, edx
jmp 0x10071d5d
push edi
call fcn.100802ff
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.100026f0
cmp dword [ebp - 0x30], 0
je 0x10071dc5
mov edi, 0x101ed88c
push edi
call fcn.100802ff
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.100026f0
xor edi, edi
cmp word [esi], di
jne 0x10071d8e
mov eax, edi
jmp 0x10071d95
push esi
call fcn.100802ff
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.100042e0
mov esi, 0x101ed914
push esi
call fcn.100802ff
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.100042e0
push ebx
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10004410
jmp 0x10071de1
xor edi, edi
cmp word [esi], di
jne 0x10071dd0
mov eax, edi
jmp 0x10071dd7
push esi
call fcn.100802ff
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.100026f0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push edi
push edi
push edi
push 1
push edi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10071e0e
mov esi, edi
jmp 0x10071e39
cmp byte [ebp + 0x10], 0
je 0x10071e26
cmp dword [ebp + 0x14], 0
cmovg ebx, dword [ebp + 0x14]
push ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
xor esi, esi
inc esi
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.10002630
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.10002630
mov eax, esi
call fcn.1005d89a
ret

Function at 0x10071e57
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.100802ff
pop ecx
test eax, eax
je 0x10071eba
push ebx
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.10078730
add esp, 0xc
mov dword [ebp - 0x38], 0x200
xor ebx, ebx
mov dword [ebp - 0x28], esi
inc ebx
mov eax, 0x101f1fd0
mov dword [ebp - 0x30], eax
push ebx
push edi
push edi
push esi
push eax
push edi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x10071eb6
push edi
push edi
push edi
push esi
call fcn.10071ce7
add esp, 0x10
jmp 0x10071eb8
mov eax, ebx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10071ebf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x828]
push edi
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.10078730
mov dword [ebp - 0x828], ebx
lea eax, [ebp - 0x7e4]
push 0x10
xor ebx, ebx
push ebx
push eax
call fcn.10078730
push esi
lea eax, [ebp - 0x7d4]
push 0x1026de28
push eax
call fcn.100061a0
add esp, 0x24
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x828]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10071f74
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d874
mov esp, ebp
pop ebp
ret

Function at 0x10071f85
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x828]
push edi
mov edi, dword [ebp + 0xc]
push 0x44
pop ebx
push ebx
push 0
push eax
call fcn.10078730
mov dword [ebp - 0x828], ebx
lea eax, [ebp - 0x7e4]
push 0x10
xor ebx, ebx
push ebx
push eax
call fcn.10078730
push esi
lea eax, [ebp - 0x7d4]
push 0x1026de28
push eax
call fcn.100061a0
add esp, 0x24
mov dword [edi], ebx
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x828]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1007203d
push dword [ebp + 0x10]
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x1007204e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x82c]
push 0x44
xor ebx, ebx
push ebx
push eax
call fcn.10078730
push 0x10
lea eax, [ebp - 0x7e4]
mov dword [ebp - 0x82c], 0x44
push ebx
push eax
call fcn.10078730
push esi
lea eax, [ebp - 0x7d4]
push 0x1026de28
push eax
call fcn.100061a0
add esp, 0x24
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x7d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10072103
push 0xffffffffffffffff
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x7e8]
push eax
push dword [ebp - 0x7e4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x7e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7e0]
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x10072113
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1604
call fcn.1005d950
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.10078730
push esi
lea eax, [ebp - 0x20c]
push 0x1026de28
push eax
call fcn.100061a0
lea eax, [ebp - 0x20c]
push eax
call fcn.100802ff
add esp, 0x1c
lea ecx, [eax - 1]
test ecx, ecx
jle 0x1007217f
push 0x5c
pop ecx
cmp word [ebp + eax*2 - 0x20e], cx
je 0x1007217f
mov word [ebp + eax*2 - 0x20c], cx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xbe4]
push 0x101e3638
push eax
call fcn.100061a0
add esp, 0xc
lea eax, [ebp - 0x1604]
push eax
lea eax, [ebp - 0xbe4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10072278
push ebx
push 0x2e
pop ebx
lea eax, [ebp - 0x1604]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x10072277
cmp word [ebp - 0x15d8], bx
je 0x100721bd
cmp word [ebp - 0x15d6], 0
je 0x100721bd
cmp word [ebp - 0x15d6], bx
jne 0x100721f9
cmp word [ebp - 0x15d4], 0
je 0x100721bd
test byte [ebp - 0x1604], 0x10
je 0x10072243
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10078730
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x101e35cc
push eax
call fcn.100061a0
lea eax, [ebp - 0x414]
push eax
call fcn.10072113
add esp, 0x20
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x13b4]
push 0x101e34fc
push eax
call fcn.100061a0
add esp, 0x10
lea eax, [ebp - 0x13b4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100721bd
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x10072957
Capabilities:
Enumerate processes

Disassembly:
push 0x260
mov eax, 0x101e0468
call fcn.1005d8df
mov eax, dword [ebp + 8]
test eax, eax
je 0x10072a53
push eax
lea ecx, [ebp - 0x40]
call fcn.10002590
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.100733cd
mov edi, 0x22c
lea eax, [ebp - 0x26c]
push edi
push ebx
push eax
call fcn.10078730
add esp, 0x10
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10072a44
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10072a39
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
cmp word [ebp - 0x248], ax
jne 0x100729e3
mov eax, ebx
jmp 0x100729f0
lea eax, [ebp - 0x248]
push eax
call fcn.100802ff
pop ecx
push eax
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.100026f0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.100733cd
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002077c
test eax, eax
je 0x10072a59
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.10002630
lea eax, [ebp - 0x26c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100729c6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10002630
mov eax, esi
call fcn.1005d89a
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x264]
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.10002630
jmp 0x10072a46
Function at 0x10072e81
Capabilities:
Enumerate processes

Disassembly:
push 0x678
mov eax, 0x101e04f0
call fcn.1005d8df
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x67c]
push 0x22c
xor ebx, ebx
push ebx
push eax
call fcn.10078730
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.10078730
add esp, 0x18
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x10072ecf
xor eax, eax
jmp 0x10072f35
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x67c], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10072f27
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100802dd
lea eax, [ebp - 0x218]
push eax
call fcn.10090fe8
lea eax, [ebp - 0x218]
push eax
call fcn.10072dfd
add esp, 0x10
test al, al
jne 0x10072f3b
lea eax, [ebp - 0x67c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10072ee8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
call fcn.1005d89a
ret
push 0x208
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.10078730
add esp, 0xc
push dword [ebp - 0x674]
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push ebx
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
sub esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, esp
mov dword [ebp - 0x680], esp
push eax
call fcn.10002590
sub esp, 0x18
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.10002590
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.100719fb
xor esi, esi
mov ecx, edi
inc esi
push eax
mov dword [ebp - 4], esi
call fcn.10073718
lea ecx, [ebp - 0x450]
call fcn.10071a58
mov eax, esi
jmp 0x10072f35

Function at 0x100732f4
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.10078730
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
pop esi
jg 0x10073357
cmp dword [ebp - 0x118], 2
jg 0x10073357
xor eax, eax
inc eax
jmp 0x10073359
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x10073785
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0xe8
mov eax, 0x101e05d8
call fcn.1005d8df
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push ebx
xor eax, eax
mov dword [ebp - 0xf0], ebx
push 0x1026dd78
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.100026f0
lea ecx, [ebp - 0xe4]
mov dword [ebp - 4], ebx
call fcn.1006ad58
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100738d4
push ebx
push 1
push 4
push ebx
push 1
push connect
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10073809
push 0x1026dd78
mov ecx, esi
call fcn.10002590
jmp 0x100738df
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xe8], eax
inc eax
push eax
mov dword [ebp - 0xec], eax
call fcn.1001f34a
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1007383d
push 0x1026dd78
mov ecx, esi
call fcn.10002590
push ebx
jmp 0x100738e0
push dword [ebp - 0xec]
push 0
push ebx
call fcn.10078730
add esp, 0xc
lea eax, [ebp - 0xf4]
push 0
push eax
push dword [ebp - 0xe8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xe4]
push ebx
call fcn.1006b726
push ebx
call fcn.1001f39e
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xe4]
call fcn.1006af71
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.100610b8
pop ecx
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.1001d28d
cmp dword [ebp - 0x30], ebx
jbe 0x100738c9
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.10002900
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10002630
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.10004690
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.10002630
mov eax, esi
call fcn.1005d89a
ret

Function at 0x10073b97
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x160], ebx
jne 0x10073c2d
lea eax, [edi + 0x2c]
cmp dword [eax + 0x14], 8
jb 0x10073bc3
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x20c]
push str._sSkin_
push eax
call fcn.10021c56
add esp, 0xc
cmp word [ebp - 0x20c], bx
je 0x10073bf0
lea eax, [ebp - 0x20c]
push eax
call fcn.100802ff
pop ecx
mov ebx, eax
push esi
push ebx
lea eax, [ebp - 0x20c]
lea esi, [edi + 0x150]
push eax
mov ecx, esi
call fcn.100026f0
cmp dword [esi + 0x14], 8
jb 0x10073c10
mov eax, dword [esi]
jmp 0x10073c12
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10073c2c
cmp dword [esi + 0x14], 8
jb 0x10073c25
mov esi, dword [esi]
push esi
call fcn.10061bf5
pop ecx
pop esi
lea eax, [edi + 0x150]
cmp dword [eax + 0x14], 8
pop edi
pop ebx
jb 0x10073c3d
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x10073e65
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push 0x101f1864
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
sub eax, dword [ebp - 0x10]
pop edi
pop esi
call fcn.1005d874
mov esp, ebp
pop ebp
ret

Function at 0x10073f66
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10285294]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push 0x1007408b
push esi
push esi
mov dword [0x102951c8], esi
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push esi
push 0x101f1864
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call esi
lea eax, [ebp - 0x34]
push eax
push edi
call esi
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov edx, dword [0x102951c8]
pop edi
pop esi
cmp edx, 1
jle 0x10073ff5
test edx, edx
jle 0x10073ff5
mov ecx, 0x102951d8
cmp dword [ecx], eax
cmovg eax, dword [ecx]
lea ecx, [ecx + 0x10]
sub edx, 1
jne 0x10073fe8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005d874
mov esp, ebp
pop ebp
ret
Function at 0x100747da
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1029533c], 0
mov dword [ebp - 8], ecx
je 0x1007492d
add ecx, 8
cmp dword [ecx + 0x14], 8
jb 0x100747fb
mov ecx, dword [ecx]
push esi
push 0x101eb1ec
push ecx
push dword [0x102852e4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x1007492c
push ebx
push edi
push esi
push dword [0x102852e4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [0x102852e4]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push edi
push eax
call fcn.10077c30
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
xor esi, esi
push esi
push dword [ebp - 4]
call fcn.10028d96
pop ecx
pop ecx
test eax, eax
je 0x1007492a
mov ebx, dword [ebp - 8]
mov ecx, 0x10295340
mov dword [ebx + 4], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100746c2
mov eax, dword [ebp - 0xc]
push esi
mov dword [eax + 0x14], ebx
push dword [0x102852e4]
push esi
push dword [ebp + 8]
push esi
push esi
push esi
push connect
push 0x80880000
push esi
push dword [0x102852e0]
push 0x80020
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [sym.imp.USER32.dll_GetWindowLongW]
push 0xfffffffffffffff0
push dword [ebp + 8]
mov dword [ebx + 0x20], eax
call esi
test eax, 0x10000000
jne 0x100748ea
mov byte [ebx + 0x28], 1
jmp 0x10074910
test eax, 0x21000000
je 0x100748f7
mov byte [ebx + 0x28], 5
jmp 0x10074910
push 8
push dword [ebx + 0x20]
mov byte [ebx + 0x28], 7
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
mov ecx, ebx
call fcn.10074ea3
push 0xfffffffffffffffc
push dword [ebp + 8]
call esi
push 0x10074cb1
push 0xfffffffffffffffc
push dword [ebp + 8]
mov dword [ebx + 0x24], eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4