joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404d48
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jb 0x404d76
inc eax
xor edx, edx
mov dl, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x409210]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x404d54
pop esi
pop ebx
ret

Function at 0x404ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff90
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1070]
xor ecx, ecx
mov edx, 0x1058
call fcn.00401784
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x1070]
mov ecx, 8
call fcn.00404738
mov ecx, 8
mov eax, 0x409610
lea edx, [ebp - 0x18]
mov bl, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec ecx
jne 0x404f27
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x18]
mov ecx, 8
call fcn.0040168c
lea eax, [ebp - 0x1070]
call fcn.004048a4
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00402794
mov eax, dword [ebp + 8]
call fcn.0040274c
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0040168c
mov eax, dword [ebp + 8]
call fcn.0040274c
mov edx, eax
lea eax, [ebp - 0x1070]
mov ecx, dword [ebp - 8]
call fcn.004048bc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004024fc
test eax, eax
jle 0x404fd4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004024fc
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov al, byte [edx + eax - 1]
cmp al, 9
jae 0x404fd4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004024fc
mov edx, dword [ebp + 8]
mov edx, dword [edx]
movzx eax, byte [edx + eax - 1]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004024fc
mov edx, eax
pop eax
sub edx, eax
mov eax, dword [ebp + 8]
call fcn.00402794
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40574c
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov eax, 0x6a
lea edx, [esp + 4]
int 0x2e
ret 0x10
Function at 0x405b18
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004026ec
xor eax, eax
push ebp
push 0x405c5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 4], 0
je 0x405c3f
mov esi, dword [ebp - 4]
mov ecx, esi
mov eax, ecx
cmp word [eax], 0x5a4d
jne 0x405c3f
cmp dword [eax + 0x3c], 0
je 0x405c3f
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x4550
jne 0x405c3f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x78]
test eax, eax
je 0x405c3f
lea eax, [esi + eax]
mov edx, dword [eax + 0x20]
lea edx, [esi + edx]
mov dword [ebp - 0x18], edx
mov edx, dword [eax + 0x24]
lea edx, [esi + edx]
mov dword [ebp - 0x1c], edx
mov edx, dword [eax + 0x1c]
lea edx, [esi + edx]
mov dword [ebp - 0x20], edx
mov edi, dword [eax + 0x18]
dec edi
test edi, edi
jl 0x405c3f
inc edi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*4]
add eax, esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + ebx*2]
mov edx, dword [ebp - 0xc]
sub edx, 1
jb 0x405bf3
je 0x405c04
dec edx
je 0x405c12
jmp 0x405c3f
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 0x14]
add eax, dword [edx + 0x34]
mov dword [ebp - 0x28], eax
jmp 0x405c1b
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4]
add eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
jmp 0x405c1b
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
call fcn.00402484
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 8]
call fcn.00402648
jne 0x405c3b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
jmp 0x405c3f
inc ebx
dec edi
jne 0x405bd2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c64
lea eax, [ebp - 0x2c]
call fcn.00402338
lea eax, [ebp - 8]
call fcn.00402338
ret

Function at 0x405c70
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x405c7f
or edx, 0x200
test eax, 0x20000000
je 0x405cb3
test eax, 0x40000000
je 0x405c9e
test eax, 0x80000000
je 0x405c99
or edx, 0x40
jmp 0x405cda
or edx, 0x20
jmp 0x405cda
test eax, 0x80000000
je 0x405cad
or edx, 0x80
jmp 0x405cda
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x405ccb
test eax, 0x80000000
je 0x405cc6
or edx, 4
jmp 0x405cda
or edx, 2
jmp 0x405cda
test eax, 0x80000000
je 0x405cd7
or edx, 8
jmp 0x405cda
or edx, 1
mov eax, edx
ret
Function at 0x40707c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4071bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x220]
call fcn.00403bd8
lea eax, [ebp - 0x220]
mov edx, 0x4071d4
call fcn.00402504
mov eax, dword [ebp - 0x220]
xor ecx, ecx
mov edx, 0x10
call fcn.00404d7c
lea eax, [ebp - 0xc]
call fcn.00403c6c
lea eax, [ebp - 0xc]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00402754
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x105
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004026fc
push eax
call sub.kernel32.dll_GetVolumeInformationA
lea edx, [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.0040168c
lea eax, [ebp - 0x10]
call fcn.0040274c
mov dl, byte [ebp - 8]
mov byte [eax + 3], dl
lea eax, [ebp - 0x10]
call fcn.0040274c
mov dl, byte [ebp - 7]
mov byte [eax + 6], dl
lea eax, [ebp - 0x10]
call fcn.0040274c
mov dl, byte [ebp - 6]
mov byte [eax + 9], dl
lea eax, [ebp - 0x10]
call fcn.0040274c
mov dl, byte [ebp - 5]
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x10]
call fcn.0040274c
mov edx, ebx
mov ecx, 8
call fcn.0040168c
lea eax, [ebp - 0x10]
call fcn.0040274c
add eax, 8
mov edx, esi
mov ecx, 8
call fcn.0040168c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4071c4
lea eax, [ebp - 0x220]
call fcn.00402338
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040235c
ret
Function at 0x1003647
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x1018054]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10193c0], 0
push esi
push edi
mov esi, 0x10193c0
jne 0x100370e
mov edi, 0x104
push edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1003697
push 0x100138c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10037a5
push 0x1001384
lea eax, [ebp - 0x120]
push eax
push 0x100137c
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.0100360c
add esp, 0x14
test eax, eax
jns 0x10036c3
push 0x1001358
jmp 0x100368c
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10036ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10036ea
push 0x1001328
jmp 0x100368c
push 0x1001314
push 0x1001310
lea eax, [ebp - 0x120]
push eax
push 0x1001308
push edi
push esi
call fcn.0100360c
add esp, 0x18
test eax, eax
js 0x10036bc
push 0x1001304
push esi
call fcn.01007642
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100372b
push 0x10012d8
jmp 0x100368c
lea eax, [ebp - 0x1c]
push eax
call fcn.01007548
lea eax, [ebp - 0x10]
push eax
call fcn.01007478
pop ecx
pop ecx
lea eax, [ebp - 0x10]
test ebx, ebx
je 0x100376c
push ebx
push 0x10012d0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x10012c0
lea eax, [ebp - 0x47c]
push 0x258
push eax
call fcn.0100360c
add esp, 0x1c
jmp 0x100378f
push 0x10012d0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x10012ac
lea eax, [ebp - 0x47c]
push 0x258
push eax
call fcn.0100360c
add esp, 0x18
lea eax, [ebp - 0x47c]
push esi
push eax
call fcn.01007285
push esi
call fcn.01007204
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100765e
leave
ret
Function at 0x1003803
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1018054]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10194c8], 0
push esi
push edi
mov esi, 0x10194c8
jne 0x10038ca
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1003853
push 0x100138c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10038f7
push 0x1001384
lea eax, [ebp - 0x108]
push eax
push 0x100137c
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0100360c
add esp, 0x14
test eax, eax
jns 0x100387f
push 0x1001358
jmp 0x1003848
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10038a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10038a6
push 0x1001328
jmp 0x1003848
push 0x10013bc
push 0x1001310
lea eax, [ebp - 0x108]
push eax
push 0x1001308
push edi
push esi
call fcn.0100360c
add esp, 0x18
test eax, eax
js 0x1003878
push 0x1001304
push esi
call fcn.01007642
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10038e7
push 0x10012d8
jmp 0x1003848
push esi
push ebx
call fcn.01007285
push esi
call fcn.01007204
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100765e
leave
ret

Function at 0x1003df6
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 4]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x1003e46
push esi
call fcn.01003d50
test eax, eax
jne 0x1003e35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1001708
call fcn.010037b8
add esp, 0xc
jmp 0x1003e42
push esi
push 0x10016c0
call fcn.010037b8
pop ecx
pop ecx
xor eax, eax
jmp 0x1003ebb
push edi
call fcn.0100782b
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x1003e73
push 0x10016a4
push ebx
push ebx
push 0x100168c
push 0x158
push 0x10015cc
call fcn.0100390a
add esp, 0x18
jmp 0x1003e42
push edi
push ebx
push esi
call fcn.01007860
add esp, 0xc
push esi
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1003eb9
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001674
push 0x100168c
push 0x161
push 0x10015cc
call fcn.0100390a
push esi
call fcn.0100781b
add esp, 0x1c
jmp 0x1003e42
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1003f72
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x1001838
push 0x80000002
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
je 0x1003fc7
push ebx
push eax
push 0x1001824
push 0x1001810
push 0x194
push 0x10017dc
call fcn.0100390a
add esp, 0x18
xor eax, eax
jmp 0x1004086
push esi
push edi
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push 0x10017d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, 0x1001810
mov esi, 0x10017dc
cmp eax, ebx
jne 0x1004045
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push 0x10012d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x100405e
push ebx
push eax
push 0x10017c4
push edi
push 0x19d
push esi
call fcn.0100390a
add esp, 0x18
push 0x10017bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x100405b
cmp eax, 2
je 0x100405b
push ebx
push eax
push 0x10017a8
push edi
push 0x1a1
jmp 0x1004052
push ebx
push eax
push 0x10017c4
push edi
push 0x1a7
push esi
call fcn.0100390a
add esp, 0x18
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x1004081
push ebx
push eax
push 0x1001798
push edi
push 0x1ac
push esi
call fcn.0100390a
add esp, 0x18
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1004090
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x1001838
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100413b
push ebx
push 0x10012d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, 0x10017a8
mov edi, 0x1001874
mov esi, 0x10017dc
test eax, eax
je 0x10040f2
cmp eax, 2
je 0x10040f2
push 0
push eax
push ebx
push edi
push 0x1cd
push esi
call fcn.0100390a
add esp, 0x18
push 0x10017bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x100411c
cmp eax, 2
je 0x100411c
push 0
push eax
push ebx
push edi
push 0x1d2
push esi
call fcn.0100390a
add esp, 0x18
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
test eax, eax
je 0x100415a
push 0
push eax
push 0x1001864
push edi
push 0x1d6
push esi
jmp 0x1004152
push 0
push eax
push 0x1001854
push 0x1001874
push 0x1d8
push 0x10017dc
call fcn.0100390a
add esp, 0x18
pop edi
pop esi
leave
ret
Function at 0x1004629
Capabilities:
Get common file path
Get file size
Print debug messages
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1018054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x41
pop esi
push 0x104
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1004679
push 0x1001a30
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
jmp 0x100479c
push 0x1001314
push 0x1001310
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0100445b
test eax, eax
jne 0x10046a1
push 0x10019f0
jmp 0x100466c
push edi
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x218], edi
cmp edi, 0xffffffff
je 0x1004795
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x100476a
push esi
call fcn.0100782b
pop ecx
mov dword [ebp - 0x210], eax
cmp eax, ebx
je 0x100476a
push ebx
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 0x210]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100476a
push 0x10019d8
push dword [ebp - 0x210]
call fcn.01007790
pop ecx
pop ecx
cmp eax, ebx
je 0x100476a
mov esi, 0x10019cc
push esi
push eax
call fcn.01007790
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x100476a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
push 0x20
push edi
call fcn.010076c0
pop ecx
pop ecx
cmp eax, ebx
je 0x100474c
mov byte [eax], bl
push edi
call fcn.01007c58
pop ecx
mov ecx, eax
mov eax, 0x3ff
add ecx, eax
shr ecx, 0xa
add ecx, eax
shr ecx, 0xa
mov dword [ebp - 0x214], ecx
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x210], ebx
je 0x100478a
push dword [ebp - 0x210]
call fcn.0100781b
pop ecx
push 0x41
pop eax
cmp dword [ebp - 0x214], eax
jb 0x100479b
mov eax, dword [ebp - 0x214]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0100765e
leave
ret
Function at 0x100495a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x534
mov eax, dword [0x1018054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
xor edi, edi
lea eax, [ebp - 0x123]
push edi
push eax
mov byte [ebp - 0x124], 0
call fcn.01007860
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1004ae4
lea eax, [ebp - 0x124]
push eax
push 0x1001b4c
call fcn.010044b1
test eax, eax
je 0x10049df
lea eax, [ebp - 0x124]
push eax
push 0x1001b3c
call fcn.010044b1
test eax, eax
jne 0x1004b08
push 0x1001b20
jmp 0x10049e4
push 0x1001b08
lea eax, [ebp - 0x20]
push 0xd
push eax
call fcn.01007d09
add esp, 0xc
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x1001af4
push edi
push edi
mov ebx, 0x1001ae8
push ebx
push 0x28a
mov edi, 0x10017dc
push edi
call fcn.0100390a
add esp, 0x1c
push esi
lea eax, [ebp - 0x32c]
push eax
push 0xd9
push dword [0x10196d4]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1004a62
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10019bc
push ebx
push 0x28d
push edi
call fcn.0100390a
push 0x1001ac4
lea eax, [ebp - 0x32c]
push esi
push eax
call fcn.01007d09
add esp, 0x24
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x534]
push esi
push eax
call fcn.01007ce8
add esp, 0x10
push esi
lea eax, [ebp - 0x32c]
push eax
push 0x64
push dword [0x10196d4]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1004ac5
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10019bc
push ebx
push 0x293
push edi
call fcn.0100390a
push 0x1001a88
lea eax, [ebp - 0x32c]
push esi
push eax
call fcn.01007d09
add esp, 0x24
push 0x10
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x534]
push eax
push dword [0x10196e8]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
jmp 0x1004b08
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001aac
push 0x1001ae8
push 0x286
push 0x10017dc
call fcn.0100390a
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100765e
leave
ret
Function at 0x10052de
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 0xbb9
push dword [ecx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
movzx eax, word [ebp + 8]
shl eax, 0x10
push eax
push 0
push 0x401
push edi
call esi
push 0
push 0
push 0x402
push edi
call esi
push 0
push 1
push 0x404
push edi
call esi
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10055b2
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
cmp eax, edi
je 0x10055d9
push edi
push edi
push 0x46b
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x100554d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
cmp eax, edi
jne 0x100561b
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f4c
push 0x1001f38
push 0xce
push 0x1001f04
call fcn.0100390a
add esp, 0x18
xor eax, eax
jmp 0x100561e
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x1005afd
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1018054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101803c]
cmp eax, 0xffffffff
je 0x1005b2a
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1005be9
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1005bba
push 0x1002020
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005a3f
xor esi, esi
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.010044b1
test eax, eax
je 0x1005be0
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01003ec7
test eax, eax
je 0x1005ba7
cmp dword [ebp - 0x134], 0x50001
jne 0x1005be0
mov eax, dword [ebp - 0x130]
shr eax, 0x10
mov ecx, 0xa28
cmp ax, cx
jne 0x1005be0
xor eax, eax
inc eax
mov dword [0x101803c], eax
jmp 0x1005be8
push 0x10018e0
push esi
push esi
push 0x1002010
push 0xa2
jmp 0x1005bd3
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001ff8
push 0x1002010
push 0xa5
push 0x1001fc4
call fcn.0100390a
add esp, 0x18
mov dword [0x101803c], esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100765e
leave
ret
Function at 0x1005bfa
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1018054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1018040]
cmp eax, 0xffffffff
je 0x1005c27
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1005cd3
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1005ca4
push 0x1002020
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005a3f
xor esi, esi
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.010044b1
test eax, eax
je 0x1005cca
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01003ec7
test eax, eax
je 0x1005c91
cmp dword [ebp - 0x134], 0x50002
jne 0x1005cca
xor eax, eax
inc eax
mov dword [0x1018040], eax
jmp 0x1005cd2
push 0x10018e0
push esi
push esi
push 0x1002030
push 0xbd
jmp 0x1005cbd
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001ff8
push 0x1002030
push 0xc0
push 0x1001fc4
call fcn.0100390a
add esp, 0x18
mov dword [0x1018040], esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100765e
leave
ret

Function at 0x1005d80
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1018054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1018048]
cmp eax, 0xffffffff
je 0x1005daa
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1005e02
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x1005dfb
cmp dword [ebp - 0x94], 4
jne 0x1005dfb
cmp dword [ebp - 0x90], 0xa
jne 0x1005dfb
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
je 0x1005dfb
call fcn.01005ce4
test eax, eax
jne 0x1005dfb
inc eax
jmp 0x1005dfd
xor eax, eax
mov dword [0x1018048], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100765e
leave
ret

Function at 0x1005e13
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1018054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101804c]
cmp eax, 0xffffffff
je 0x1005e3d
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1005ea3
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x1005e9c
cmp dword [ebp - 0x94], 4
jne 0x1005e9c
cmp dword [ebp - 0x90], 0xa
jne 0x1005e9c
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
je 0x1005e9c
mov eax, 0x8ae
cmp word [ebp - 0x8c], ax
jb 0x1005e9c
call fcn.01005ce4
test eax, eax
jne 0x1005e9c
inc eax
jmp 0x1005e9e
xor eax, eax
mov dword [0x101804c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100765e
leave
ret