joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038b70
Capabilities:
Copy file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xe8], 8
jb 0x10038b84
mov eax, dword [esi + 0xd4]
jmp 0x10038b8a
lea eax, [esi + 0xd4]
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
mov ebp, 0x1017432c
push ebp
push str.ModifySetConfig
mov ebx, str.SetModify
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x10038bb8
mov eax, dword [esi + 0xd4]
jmp 0x10038bbe
lea eax, [esi + 0xd4]
push eax
push ebp
push str.ModifySetConfig64
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x10038bd9
mov eax, dword [esi + 0xd4]
jmp 0x10038bdf
lea eax, [esi + 0xd4]
push eax
push ebp
push str.TempModifySetConfig
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x10038bfa
mov eax, dword [esi + 0xd4]
jmp 0x10038c00
lea eax, [esi + 0xd4]
push eax
push ebp
push str.TempModifySetConfig64
push ebx
call edi
pop edi
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
pop ebp
pop ebx
jb 0x10038c1e
mov eax, dword [eax + 4]
jmp 0x10038c21
add eax, 4
add esi, 0x98
cmp dword [esi + 0x18], 8
jb 0x10038c32
mov esi, dword [esi + 4]
jmp 0x10038c35
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop esi
ret
Function at 0x10038c41
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x101f1dd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x244]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x232]
push ebx
push eax
mov word [ebp - 0x234], bx
call fcn.10076580
xor eax, eax
mov word [ebp - 0x2c], bx
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x18], bx
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push 0x10174330
push eax
call fcn.100048d5
movzx eax, word [ebp - 0x23e]
push eax
movzx eax, word [ebp - 0x242]
push eax
movzx eax, word [ebp - 0x244]
push eax
lea eax, [ebp - 0x18]
push str._.4d_.2d_.2d
push eax
call fcn.100048d5
add esp, 0x2c
cmp dword [esi + 0x104], 8
jb 0x10038ce8
mov eax, dword [esi + 0xf0]
jmp 0x10038cee
lea eax, [esi + 0xf0]
push eax
push ebx
mov ebx, str.LastUseDay
push ebx
mov edi, str.Setting
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [ebp - 0x244]
movzx edx, word [ebp - 0x242]
imul ecx, ecx, 0x64
add ecx, edx
movzx edx, word [ebp - 0x23e]
imul ecx, ecx, 0x64
add ecx, edx
cmp eax, ecx
je 0x10038dd3
cmp dword [esi + 0x104], 8
jb 0x10038d3a
mov eax, dword [esi + 0xf0]
jmp 0x10038d40
lea eax, [esi + 0xf0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, str.UseDayTotal
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.10076a8d
cmp dword [esi + 0x104], 8
pop ecx
pop ecx
jb 0x10038d72
mov eax, dword [esi + 0xf0]
jmp 0x10038d78
lea eax, [esi + 0xf0]
push eax
push 0
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
inc eax
push eax
lea eax, [ebp - 0x18]
push 0x10174330
push eax
call fcn.100048d5
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.10076a8d
add esp, 0x14
cmp dword [esi + 0x104], 8
jb 0x10038dba
mov esi, dword [esi + 0xf0]
jmp 0x10038dc0
add esi, 0xf0
push esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x234]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075e13
leave
ret
Function at 0x100390b9
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x101f1dd0]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp - 0x6a]
push ebx
push eax
mov esi, ecx
mov word [ebp - 0x6c], bx
call fcn.10076580
push edi
lea eax, [ebp + 0x19e]
push ebx
push eax
mov word [ebp + 0x19c], bx
call fcn.10076580
mov eax, dword [esi + 0x24]
add esp, 0x18
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x78]
call fcn.1000969b
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.1000969b
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.10004bce
test al, al
jne 0x10039278
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, str.HotKey
lea ecx, [ebp - 0x78]
call fcn.10047e32
mov eax, dword [eax + 4]
mov dword [ebp - 0x70], eax
add eax, 0xc
push eax
call fcn.10076514
test eax, eax
pop ecx
jle 0x1003924d
mov eax, dword [ebp - 0x70]
add eax, 0xc
push eax
lea eax, [ebp - 0x6c]
push str.Is_s
push eax
call fcn.100048d5
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x1003918f
mov eax, dword [esi + 0x9c]
jmp 0x10039195
lea eax, [esi + 0x9c]
push eax
push 0x104
lea eax, [ebp + 0x19c]
push eax
push 0x1017daa8
lea eax, [ebp - 0x6c]
push eax
push ebx
call edi
lea eax, [ebp + 0x19c]
push 0x1017daa8
push eax
call fcn.10076c97
test eax, eax
pop ecx
pop ecx
je 0x100391da
lea eax, [ebp + 0x19c]
push eax
call fcn.10076f89
pop ecx
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 4]
mov byte [ecx], al
mov eax, dword [ebp - 0x70]
add eax, 0xc
push eax
lea eax, [ebp - 0x6c]
push str.Use_s
push eax
call fcn.100048d5
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x10039203
mov eax, dword [esi + 0x9c]
jmp 0x10039209
lea eax, [esi + 0x9c]
push eax
push 0x104
lea eax, [ebp + 0x19c]
push eax
push str.nothing
lea eax, [ebp - 0x6c]
push eax
push ebx
call edi
lea eax, [ebp + 0x19c]
push str.nothing
push eax
call fcn.10076c97
test eax, eax
pop ecx
pop ecx
je 0x1003924d
lea eax, [ebp + 0x19c]
push eax
mov eax, dword [ebp - 0x70]
push dword [eax + 8]
call fcn.10076a8d
pop ecx
pop ecx
lea ecx, [ebp - 0x78]
call fcn.10038b21
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.1000969b
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.10004bce
test al, al
je 0x10039146
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075e13
add ebp, 0x3a8
leave
ret
Function at 0x10039290
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x3ac]
sub esp, 0x42c
mov eax, dword [0x101f1dd0]
xor eax, ebp
mov dword [ebp + 0x3a8], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x70]
call fcn.1000969b
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.1000969b
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.10004bce
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x100393d4
lea ecx, [ebp - 0x70]
call fcn.10047e32
mov ebx, dword [eax + 4]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x74], eax
mov eax, dword [ebx + 4]
cmp byte [eax], 0
lea eax, [ebp + 0x1a0]
je 0x1003930d
push 0x1017432c
jmp 0x10039312
push 0x10174114
push 0x10175610
push eax
call fcn.100048d5
add esp, 0xc
add ebx, 0xc
push ebx
lea eax, [ebp - 0x68]
push str.Is_s
push eax
mov dword [ebp - 0x80], ebx
call fcn.100048d5
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x10039349
mov eax, dword [esi + 0x9c]
jmp 0x1003934f
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
mov ebx, str.HotKey
push ebx
call edi
push dword [ebp - 0x80]
lea eax, [ebp - 0x68]
push str.Use_s
push eax
call fcn.100048d5
push dword [ebp - 0x74]
lea eax, [ebp + 0x1a0]
push 0x10175610
push eax
call fcn.100048d5
add esp, 0x18
cmp dword [esi + 0xb0], 8
jb 0x1003939c
mov eax, dword [esi + 0x9c]
jmp 0x100393a2
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
lea ecx, [ebp - 0x70]
call fcn.10038b21
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.1000969b
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.10004bce
test al, al
je 0x100392e7
cmp dword [esi + 0xe8], 8
jb 0x100393ed
mov eax, dword [esi + 0xd4]
jmp 0x100393f3
lea eax, [esi + 0xd4]
push eax
push 0x1017432c
push str.ModifyHotKey
mov ebx, str.SetModify
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x10039417
mov eax, dword [esi + 0xd4]
jmp 0x1003941d
lea eax, [esi + 0xd4]
push eax
push 0x1017432c
push str.ModifyHotKey64
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x1003943c
mov eax, dword [esi + 0xd4]
jmp 0x10039442
lea eax, [esi + 0xd4]
push eax
push 0x1017432c
push str.TempModifyHotKey
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x10039461
mov eax, dword [esi + 0xd4]
jmp 0x10039467
lea eax, [esi + 0xd4]
push eax
push 0x1017432c
push str.TempModifyHotKey64
push ebx
call edi
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
jb 0x10039486
mov eax, dword [eax + 4]
jmp 0x10039489
add eax, 4
add esi, 0x98
cmp dword [esi + 0x18], 8
jb 0x1003949a
mov esi, dword [esi + 4]
jmp 0x1003949d
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp + 0x3a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075e13
add ebp, 0x3ac
leave
ret
Function at 0x1003dafa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.100533e7
mov esi, dword [eax + 8]
push 0x10176e78
push str.PreviewSkinBK.png
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1003db8a
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call fcn.10078b70
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
push dword [ebp - 4]
call fcn.1003dadc
test eax, eax
pop ecx
pop ecx
pop ebx
je 0x1003db8a
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x12c], eax
pop edi
pop esi
leave
ret
Function at 0x1003f540
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0xc18
lea ebp, [esp - 4]
mov eax, dword [0x101f1dd0]
xor eax, ebp
mov dword [ebp + 0xc18], eax
push 0x48
mov eax, 0x1016d989
call fcn.10075e22
mov esi, ecx
mov dword [ebp - 0x14], esi
add esi, 0x120
push esi
lea ecx, [ebp]
call fcn.10003510
xor edi, edi
mov ebx, 0x206
push ebx
lea eax, [ebp + 0xa12]
push edi
push eax
mov dword [ebp - 4], edi
mov word [ebp + 0xa10], di
call fcn.10076580
push ebx
lea eax, [ebp + 0x80a]
push edi
push eax
mov word [ebp + 0x808], di
call fcn.10076580
add esp, 0x18
lea eax, [ebp + 0xa10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp dword [esi + 0x18], 8
jb 0x1003f5cc
mov esi, dword [esi + 4]
jmp 0x1003f5cf
add esi, 4
lea eax, [ebp + 0x808]
push eax
push esi
call fcn.1001e289
pop ecx
pop ecx
lea eax, [ebp + 0xa10]
push eax
lea ecx, [ebp + 0x1c]
call fcn.100015f0
lea eax, [ebp + 0x808]
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 1
call fcn.10003540
lea ecx, [ebp - 0x1c]
call fcn.100013c0
lea eax, [ebp + 0xa10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.100015f0
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
mov byte [ebp - 4], 3
jae 0x1003f62b
lea eax, [ebp + 4]
push eax
lea ecx, [ebp - 0x54]
call fcn.100015f0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.10001460
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x54]
movzx ebx, al
call fcn.100017f0
push edi
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.100017f0
cmp ebx, edi
je 0x1003f718
mov eax, dword [ebp - 0x14]
push 0x7ce
mov dword [eax + 0x11c], esi
lea eax, [ebp + 0x3a]
push edi
push eax
mov word [ebp + 0x38], di
call fcn.10076580
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [ebp + 0x34], 8
jae 0x1003f699
lea eax, [ebp + 0x20]
push eax
push str.SCSkinInst.exe
call fcn.10004cf1
mov ecx, eax
call fcn.1001b43a
push eax
lea eax, [ebp + 0x38]
push str._s_s__untie__s
push eax
call fcn.100048d5
lea eax, [ebp + 0x38]
push eax
call fcn.1001df9f
add esp, 0x18
call fcn.10004cf1
mov ecx, eax
call fcn.1001b46a
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
mov ebx, 0x1017432c
push ebx
push str.IsModifyUIStyle64
mov edi, str.SetModify
push edi
mov dword [ebp - 0x10], eax
call esi
push dword [ebp - 0x10]
push ebx
push str.IsModifyUIStyle
push edi
call esi
push dword [ebp - 0x10]
push ebx
push str.IsTempModifyUIStyle64
push edi
call esi
push dword [ebp - 0x10]
push ebx
push str.IsTempModifyUIStyle
push edi
call esi
xor esi, esi
inc esi
xor edi, edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x14]
push edi
push edi
push 0x52d
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10001450
push edi
push esi
lea ecx, [ebp + 0x1c]
call fcn.100017f0
push edi
push esi
lea ecx, [ebp]
call fcn.100017f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc18]
xor ecx, ebp
call fcn.10075e13
add ebp, 0xc1c
leave
ret
Function at 0x10040ad6
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x10040ac7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
ret
Function at 0x10041ae9
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10041ada
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi], eax
pop esi
je 0x10041b17
cmp eax, 0xffffffff
je 0x10041b17
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x100422c7
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x858
lea ebp, [esp - 4]
mov eax, dword [0x101f1dd0]
xor eax, ebp
mov dword [ebp + 0x858], eax
push 0x1c
mov eax, 0x1016de9a
call fcn.10075e22
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp + 0x242]
push ebx
push eax
mov esi, ecx
mov word [ebp + 0x240], bx
call fcn.10076580
push edi
lea eax, [ebp + 0x3a]
push ebx
push eax
mov word [ebp + 0x38], bx
call fcn.10076580
add esp, 0x18
cmp dword [esi + 0x48], 8
jb 0x10042326
mov eax, dword [esi + 0x34]
jmp 0x10042329
lea eax, [esi + 0x34]
push eax
lea eax, [ebp + 0x240]
push 0x10175610
push eax
call fcn.100048d5
add esp, 0xc
cmp dword [esi + 0x64], 8
jb 0x10042349
mov esi, dword [esi + 0x50]
jmp 0x1004234c
add esi, 0x50
push esi
mov esi, 0x10175610
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.100048d5
push edi
lea eax, [ebp + 0x652]
push ebx
push eax
mov word [ebp + 0x650], bx
call fcn.10076580
add esp, 0x18
call fcn.10004cf1
mov ecx, eax
call fcn.1001b43a
push eax
lea ecx, [ebp]
call fcn.100015f0
push str.SmartCloudInfo.ini
lea ecx, [ebp]
mov dword [ebp - 4], ebx
call fcn.10003540
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x100423a5
lea eax, [ebp + 4]
push eax
push 0x104
lea eax, [ebp + 0x650]
push eax
push 0x10174ce8
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x650]
push eax
lea ecx, [ebp + 0x1c]
call fcn.100015f0
mov eax, dword [ebp + 0x30]
cmp eax, 6
mov byte [ebp - 4], 1
jbe 0x10042412
add eax, 0xfffffffa
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x1c]
call fcn.10003610
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.10001d60
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100017f0
push edi
lea eax, [ebp + 0x44a]
push ebx
push eax
mov word [ebp + 0x448], bx
call fcn.10076580
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [ebp + 0x34], 8
jae 0x10042436
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x448]
push esi
push eax
call fcn.100048d5
lea eax, [ebp + 0x448]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x240]
push eax
call fcn.1002046f
add esp, 0x18
test eax, eax
jne 0x100424aa
push str.PushMessage::
call fcn.100247c2
pop ecx
xor esi, esi
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.100017f0
push ebx
push 1
lea ecx, [ebp]
call fcn.100017f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x858]
xor ecx, ebp
call fcn.10075e13
add ebp, 0x85c
leave
ret
xor esi, esi
inc esi
jmp 0x1004246f
Function at 0x100440b3
Capabilities:
Create thread

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call fcn.1003e602
mov ecx, eax
call fcn.1003e9cc
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x100440a4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
ret 4
Function at 0x10044e7b
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x10044e6c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
ret

Function at 0x10045848
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101f1dd0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.10076580
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100458ca
cmp dword [ebp - 0x11c], 6
jb 0x100458ca
push esi
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100458c2
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
sete cl
inc ecx
push ecx
push dword [ebp + 8]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075e13
leave
ret 8

Function at 0x10045f4d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10045f70
xor eax, eax
jmp 0x10045ff0
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 8]
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push dword [ebp + 0x10]
push eax
call fcn.10078b70
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
push dword [ebp + 0xc]
call fcn.100133b3
pop ecx
mov esi, eax
test esi, esi
pop ecx
pop edi
je 0x10045f69
mov ecx, esi
call fcn.10013331
mov ecx, esi
mov dword [ebx], eax
call fcn.10013355
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 0xc], esi
inc eax
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1004a548
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x67c
lea ebp, [esp - 4]
mov eax, dword [0x101f1dd0]
xor eax, ebp
mov dword [ebp + 0x67c], eax
push 0x30
mov eax, 0x1016e920
call fcn.10075e22
mov eax, dword [ebp + 0x688]
push eax
lea eax, [ebp + 0x26c]
push 0x10178ecc
push eax
mov esi, ecx
call fcn.100048d5
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x1004a6ee
xor edi, edi
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, edi
je 0x1004a6ee
cmp word [ebp + 0x2c], 0x2e
je 0x1004a5a8
cmp word [ebp + 0x2e], di
je 0x1004a5a8
cmp word [ebp + 0x2e], 0x2e
jne 0x1004a5d7
cmp word [ebp + 0x30], di
je 0x1004a5a8
test byte [ebp], 0x10
jne 0x1004a5a8
mov ebx, str..znpf
lea eax, [ebp + 0x2c]
push ebx
push eax
call fcn.10078b09
test eax, eax
pop ecx
pop ecx
je 0x1004a5a8
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x474]
push 0x10175610
push eax
call fcn.100048d5
push ebx
call fcn.10076514
mov ebx, eax
lea eax, [ebp + 0x474]
push eax
call fcn.10076514
sub eax, ebx
mov word [ebp + eax*2 + 0x474], di
lea eax, [ebp + 0x474]
push 0x10183194
push eax
call fcn.10076c97
add esp, 0x1c
test eax, eax
je 0x1004a5a8
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.1000d1b5
jmp 0x1004a69a
lea ecx, [ebp - 0x18]
call fcn.10004bf5
push eax
lea ecx, [ebp + 0x250]
call fcn.10003510
lea eax, [ebp + 0x474]
push eax
lea ecx, [ebp + 0x250]
mov dword [ebp - 4], edi
call fcn.100053e4
or dword [ebp - 4], 0xffffffff
test eax, eax
push edi
lea ecx, [ebp + 0x250]
push 1
je 0x1004a6e4
call fcn.100017f0
lea ecx, [ebp - 0x18]
call fcn.10004c16
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.1000d1b5
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call fcn.10004bce
test al, al
je 0x1004a653
lea eax, [ebp + 0x474]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100015f0
mov ecx, dword [esi + 8]
xor ebx, ebx
lea eax, [ebp - 0x3c]
inc ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10012b23
or dword [ebp - 4], 0xffffffff
push edi
push ebx
lea ecx, [ebp - 0x3c]
call fcn.100017f0
jmp 0x1004a5a8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x67c]
xor ecx, ebp
call fcn.10075e13
add ebp, 0x680
leave
ret 4