joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100353d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ecx + eax + 0x78]
mov ecx, dword [ecx + eax + 0x7c]
mov esi, dword [edi + eax + 0x1c]
mov edx, dword [edi + eax + 0x24]
mov dword [ebp - 0xe0], ecx
mov ecx, dword [edi + eax + 0x20]
add esi, eax
add ecx, eax
add edx, eax
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], edx
test ebx, 0xffff0000
je 0x1003543e
cmp dword [edi + eax + 0x18], 0
mov dword [ebp - 0xd0], 0
jg 0x10035526
mov ecx, dword [edi + eax + 0x10]
cmp ebx, ecx
jb 0x100355ab
mov edx, dword [edi + eax + 0x14]
lea edx, [edx + ecx - 1]
cmp ebx, edx
ja 0x100355ab
sub ebx, ecx
mov esi, dword [esi + ebx*4]
add esi, eax
lea ecx, [eax + edi]
cmp esi, ecx
jb 0x10035598
add eax, dword [ebp - 0xe0]
add eax, edi
cmp esi, eax
ja 0x10035598
push 0x63
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call fcn.1006b580
push 0x63
lea ecx, [ebp - 0xcb]
push 0
push ecx
mov byte [ebp - 0xcc], 0
call fcn.1006b580
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x18
push esi
lea edx, [ebp - 0x68]
push edx
call edi
lea eax, [ebp - 0x68]
push 0x2e
push eax
call fcn.1006b7e0
add esp, 8
test eax, eax
je 0x10035598
mov byte [eax], 0
inc eax
push eax
lea ecx, [ebp - 0xcc]
push ecx
call edi
push str..dll
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10035598
lea ecx, [ebp - 0xcc]
push ecx
push eax
call fcn.100353d0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0xd0]
mov ecx, dword [ecx + edx*4]
mov esi, ebx
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x10035553
test dl, dl
je 0x1003554f
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x10035553
add ecx, 2
add esi, 2
test dl, dl
jne 0x10035533
xor ecx, ecx
jmp 0x10035558
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x1003557a
mov ecx, dword [ebp - 0xd0]
inc ecx
mov dword [ebp - 0xd0], ecx
cmp ecx, dword [edi + eax + 0x18]
jl 0x10035520
mov esi, dword [ebp - 0xd4]
jmp 0x1003543e
mov edx, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xd8]
movzx ecx, word [ecx + edx*2]
mov edx, dword [ebp - 0xd4]
mov esi, dword [edx + ecx*4]
jmp 0x1003545f
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x10035f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ecx]
cmp al, 0x50
jne 0x10035f77
cmp byte [ecx + 1], 0x4b
jne 0x10035f77
mov dword [ebp - 0x18], 0x6e6f435b
mov dword [ebp - 0x14], 0x746e6574
mov dword [ebp - 0x10], 0x7079545f
mov dword [ebp - 0xc], 0x2e5d7365
mov word [ebp - 8], 0x6d78
mov byte [ebp - 6], 0x6c
xor eax, eax
mov dl, byte [ecx + eax + 0x1e]
cmp dl, byte [ebp + eax - 0x18]
jne 0x10035fa5
inc eax
cmp eax, 0x13
jl 0x10035f54
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
cmp al, 0xd0
jne 0x10035fa5
cmp byte [ecx + 1], 0xcf
jne 0x10035fa5
cmp byte [ecx + 2], 0x11
jne 0x10035fa5
cmp byte [ecx + 3], 0xe0
jne 0x10035fa5
cmp byte [ecx + 4], 0xa1
jne 0x10035fa5
cmp byte [ecx + 5], 0xb1
jne 0x10035fa5
cmp byte [ecx + 6], 0x1a
jne 0x10035fa5
cmp byte [ecx + 7], 0xe1
je 0x10035f64
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10066b1b
mov esp, ebp
pop ebp
ret

Function at 0x100360d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x44], esp
mov dword [ebp - 0x4c], eax
xor edi, edi
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
push 0x26
mov eax, str.26142993_7E66_49BC_B3B6_1407026BD513
mov word [esi], cx
call fcn.10003a30
lea ecx, [ebp - 0x3c]
call fcn.10035fe0
add esp, 0x1c
cmp dword [eax + 0x14], 8
jb 0x10036120
mov eax, dword [eax]
push eax
push 0xa
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp dword [ebp - 0x28], 8
mov esi, eax
jb 0x10036143
mov edx, dword [ebp - 0x3c]
push edx
call fcn.10066b10
add esp, 4
xor eax, eax
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], edi
mov word [ebp - 0x3c], ax
cmp esi, edi
jne 0x10036168
push 0x100958f0
mov ecx, 0x100aa2d0
call fcn.100057b0
jmp 0x100361e6
push edi
push edi
push edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov word [ebp - 0x20], cx
mov ecx, eax
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x10], edi
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x10036190
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x20]
call fcn.10003a30
mov eax, dword [ebp - 0x20]
mov esi, 8
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0xc], esi
jae 0x100361be
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x48]
push edx
push 0x10095910
push eax
call fcn.10067bd8
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
mov dword [ecx], eax
cmp dword [ebp - 0xc], esi
jb 0x100361e9
mov edx, dword [ebp - 0x20]
push edx
call fcn.10066b10
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x10036440
Capabilities:
Check os version
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x118
lea eax, [ebp - 0x11c]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x12c], esi
call fcn.1006b580
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1003658c
cmp dword [ebp - 0x11c], 6
jb 0x100365a1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, edi
je 0x100365a1
cmp dword [ebp - 0x11c], 6
jne 0x100365a1
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x1003651f
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x10095928
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
lea ebx, [ebx]
mov edx, 0x1d38
cmp dx, word [ecx + eax]
je 0x10036519
inc ecx
cmp ecx, 0x300
jb 0x100364f0
mov eax, dword [ebp - 0x124]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
mov esi, dword [ecx + eax + 2]
jmp 0x10036554
cmp eax, 1
jne 0x100365a1
push str.KernelBase.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x128], esi
test esi, esi
je 0x1003658c
push str.KernelBaseGetGlobalData
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10036581
call eax
test eax, eax
je 0x10036581
lea esi, [eax + 0x30]
test esi, esi
je 0x1003657b
mov eax, dword [ebp - 0x12c]
push 0
push 0
push eax
push ebx
push 0
push 0
push edi
mov byte [esi], 1
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x124], eax
mov byte [esi], 0
mov esi, dword [ebp - 0x128]
test esi, esi
je 0x1003658c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x124]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
push 0
push 0
push esi
push ebx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x1003abf0
Capabilities:
Create thread

Disassembly:
mov ecx, dword [eax + 4]
push esi
mov esi, dword [ecx + 0x1c]
mov dl, byte [esi + 0x2c]
test dl, dl
je 0x1003ac05
mov al, 1
movzx eax, al
pop esi
ret
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x10059530
push 0
push 0
call fcn.10080d82
add esp, 0x18
test eax, eax
mov dword [esi + 4], eax
setne cl
mov byte [esi + 0x2c], cl
movzx eax, byte [esi + 0x2c]
pop esi
ret
Function at 0x1003cf10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0x13
mov esi, str.9A0A9575_9946_46e0_8EFC_F71D130A9C8C
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x25a]
push ecx
movsw word es:[edi], word [esi]
mov word [ebp - 0x25c], ax
call fcn.1006b580
mov eax, dword [0x100aca00]
add esp, 0xc
test eax, eax
jne 0x1003cfd0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x25c]
push str._s_d
push eax
mov edx, 0x104
call fcn.1004b9b0
lea ecx, [ebp - 0x25c]
push ecx
call fcn.100210f0
add esp, 0x14
lea edx, [ebp - 0x25c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1003cfc4
push 0x100961ec
call fcn.100210f0
add esp, 4
mov dword [0x100aca00], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100aca00]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
Function at 0x10040a10
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083d68
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100a5c90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor edi, edi
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], edi
push edi
mov word [ebx], ax
push esi
or eax, 0xffffffff
mov ecx, ebx
call fcn.10003850
mov dword [ebp - 4], edi
mov ecx, dword [esi + 0x1c]
mov dword [ebx + 0x1c], ecx
mov edx, dword [esi + 0x20]
mov dword [ebx + 0x20], edx
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov ecx, dword [esi + 0x28]
mov dword [ebx + 0x28], ecx
mov dx, word [esi + 0x2c]
mov word [ebx + 0x2c], dx
fld qword [esi + 0x30]
fstp qword [ebx + 0x30]
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov ecx, dword [esi + 0x3c]
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x3c], ecx
add esi, 0x40
lea edi, [ebx + 0x40]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax + 0x60]
mov dword [ebx + 0x60], edx
lea esi, [eax + 0x64]
lea edi, [ebx + 0x64]
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x12c]
mov dword [ebx + 0x12c], ecx
mov edx, dword [eax + 0x130]
mov dword [ebx + 0x130], edx
mov ecx, dword [eax + 0x134]
mov dword [ebx + 0x134], ecx
mov edx, dword [eax + 0x138]
mov dword [ebx + 0x138], edx
mov ecx, dword [eax + 0x13c]
mov dword [ebx + 0x13c], ecx
mov edx, dword [eax + 0x140]
mov dword [ebx + 0x140], edx
mov cx, word [eax + 0x144]
mov word [ebx + 0x144], cx
lea esi, [eax + 0x146]
lea edi, [ebx + 0x146]
mov ecx, 0x35
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax + 0x21c]
add eax, 0x220
push eax
lea eax, [ebx + 0x220]
push eax
mov dword [ebx + 0x21c], edx
call fcn.1004b4a0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10049e10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086713
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push str.MyOleIsCurrentClipboard
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x100a6d3c]
test eax, eax
je 0x10049f7b
cmp eax, 1
je 0x10049e7c
call fcn.1000f210
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
test eax, eax
je 0x10049ea9
mov dword [0x100a6d3c], 1
mov eax, dword [0x100aa1c0]
test eax, eax
jne 0x10049ec6
push 0x1e8
call fcn.10067232
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x10049eb8
mov ecx, eax
call fcn.10011d60
jmp 0x10049eba
mov dword [0x100a6d3c], 0
jmp 0x10049f7b
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x100aa1c0], eax
lea ecx, [eax + 0x194]
mov eax, dword [ecx + 0x10]
push 0x10093318
mov edi, 2
call fcn.10004240
test eax, eax
jne 0x10049f7b
cmp dword [ebx + 0x858], eax
je 0x10049f7b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
lea ecx, [ebp - 0x2c]
call fcn.1005b130
xor edi, edi
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1c], edi
jbe 0x10049f52
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
push edi
lea eax, [ebp - 0x2c]
xor edx, edx
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], edi
or eax, 0xffffffff
mov word [ecx], dx
call fcn.10003850
add ebx, 0x850
push ebx
call fcn.1004bef0
cmp eax, edi
je 0x10049f52
lea ecx, [ebp - 0x2c]
call fcn.10003710
lea eax, [edi + 1]
jmp 0x10049f85
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 8
jb 0x10049f6b
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10066b10
add esp, 4
xor edx, edx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x2c], dx
mov eax, dword [ebp - 0x34]
push eax
call dword [0x100ac8a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret 4
Function at 0x1004ab80
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100866d5
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x100a5c90]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100a57c4]
mov edx, dword [eax + 0xc]
mov edi, ecx
mov ecx, 0x100a57c4
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x438], 0x428
call edx
add eax, 0x10
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x438]
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1004ad21
lea eax, [ebp - 0x418]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1004ac00
sub eax, edx
lea ecx, [ebp - 0x418]
sar eax, 1
push ecx
lea edx, [ebp - 0x43c]
push edx
mov ebx, eax
call fcn.1000dc10
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x43c]
cmp ecx, eax
jae 0x1004ac9f
mov edx, dword [esi]
cmp edx, ecx
ja 0x1004ac9f
mov ebx, ecx
mov ecx, dword [esi + 8]
sub ebx, edx
sar ebx, 2
cmp eax, ecx
jne 0x1004ac88
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x1004ad71
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x1004ac88
mov edx, ecx
shr edx, 1
mov edi, 0x3fffffff
sub edi, edx
cmp edi, ecx
jae 0x1004ac72
xor ecx, ecx
jmp 0x1004ac74
add ecx, edx
cmp ecx, eax
jae 0x1004ac7a
mov ecx, eax
push ecx
mov ecx, esi
call fcn.1004b600
mov edi, dword [ebp - 0x440]
mov edx, dword [esi]
lea eax, [edx + ebx*4]
mov ebx, dword [esi + 4]
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1004ad03
mov eax, dword [eax]
sub eax, 0x10
jmp 0x1004acf9
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x1004ace5
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x1004ad71
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x1004ace5
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x1004acd5
xor ecx, ecx
jmp 0x1004acd7
add ecx, edx
cmp ecx, eax
jae 0x1004acdd
mov ecx, eax
push ecx
mov ecx, esi
call fcn.1004b600
mov ebx, dword [esi + 4]
mov byte [ebp - 4], 2
test ebx, ebx
je 0x1004ad03
mov eax, dword [ebp - 0x43c]
add eax, 0xfffffff0
call fcn.1004b890
add eax, 0x10
mov dword [ebx], eax
lea eax, [ebp - 0x438]
push eax
mov byte [ebp - 4], 0
add dword [esi + 4], 4
push edi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1004abf4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x43c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004ad51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.1005efb6
int3
Function at 0x1004aeb0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085999
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100a5c90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
xor edi, edi
mov eax, 0x10093c0c
mov byte [esi], bl
call fcn.10003960
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 4], ebx
mov edi, 1
push eax
mov dword [ebp - 0x1c], edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
je 0x1004b039
mov eax, dword [esi + 0x10]
cmp ecx, eax
ja 0x1004af2f
or eax, 0xffffffff
call fcn.10003fa0
jmp 0x1004af39
push ebx
mov ebx, ecx
sub ebx, eax
call fcn.1000a9e0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1005f071
mov edx, dword [0x100a57c4]
mov ebx, eax
mov eax, dword [edx + 0xc]
add esp, 4
mov ecx, 0x100a57c4
mov dword [ebp - 0x18], ebx
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, 0x10097300
mov dword [ebp - 4], edi
test ecx, 0xffff0000
jne 0x1004af8b
mov edx, ecx
movzx edi, dx
call fcn.1000b0c0
test eax, eax
je 0x1004af9b
push eax
mov eax, edi
lea edi, [ebp - 0x10]
call fcn.1000b3a0
jmp 0x1004af9b
mov ebx, 0x10097300
lea eax, [ebp - 0x10]
call fcn.1000a160
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x14]
push eax
push 0
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1004b00d
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x20]
push eax
push ecx
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1004b00d
mov eax, dword [ebp - 0x20]
movzx edx, word [eax + 0xc]
movzx ecx, word [eax + 0xe]
push edx
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push edx
push eax
push 0x10092cfc
push ebx
call fcn.10067896
mov eax, ebx
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004aff8
sub eax, edx
mov edi, eax
mov eax, ebx
call fcn.10003960
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.10066b10
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1004b039
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1004b050
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100826fb
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x100a5c90]
xor eax, esp
mov dword [esp + 0x45c], eax
push esi
push edi
mov eax, dword [0x100a5c90]
xor eax, esp
push eax
lea eax, [esp + 0x470]
mov dword fs:[0], eax
push 0x206
xor edi, edi
lea ecx, [esp + 0x262]
xor eax, eax
push edi
push ecx
mov word [esp + 0x268], ax
call fcn.1006b580
add esp, 0xc
push edi
push 0x1c
lea edx, [esp + 0x264]
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esp + 0x25c]
push eax
mov ecx, eax
push 0x10097304
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004b1db
and eax, 0x10
je 0x1004b1db
lea eax, [esp + 0x25c]
push eax
mov ecx, eax
push str._s.
push ecx
call esi
add esp, 0xc
xor edx, edx
lea eax, [esp + 0x25c]
mov word [esp + 0x10], dx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1004b130
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x260]
lea esi, [esp + 0x14]
call fcn.10003a30
mov dword [esp + 0x478], edi
mov eax, dword [esp + 0x10]
mov edi, 8
cmp dword [esp + 0x24], edi
jae 0x1004b168
mov eax, esi
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.1006b8ce
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x1004b18a
cmp dword [esp + 0x24], edi
jb 0x1004b1db
mov edx, dword [esp + 0x10]
push edx
jmp 0x1004b1d3
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.1006b9f5
add esp, 8
test eax, eax
jne 0x1004b1c8
lea esp, [esp]
lea ecx, [esp + 0x50]
push ecx
mov eax, str.WPS_Cloud
call fcn.100263b0
add esp, 4
test eax, eax
jne 0x1004b200
lea edx, [esp + 0x2c]
push edx
push esi
call fcn.1006b9f5
add esp, 8
test eax, eax
je 0x1004b1a0
cmp dword [esp + 0x24], edi
jb 0x1004b1db
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10066b10
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x45c]
xor ecx, esp
call fcn.10066b1b
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x24], edi
jb 0x1004b213
mov eax, dword [esp + 0x10]
push eax
call fcn.10066b10
add esp, 4
mov eax, 1
jmp 0x1004b1dd
Function at 0x10050190
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x30
mov dword [esi + 8], 0
call fcn.10067232
add esp, 4
test eax, eax
je 0x1005020f
mov dword [esi + 4], eax
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov ecx, dword [esi + 4]
mov al, 1
mov byte [ecx + 0x2c], al
mov edx, dword [esi + 4]
mov byte [edx + 0x2d], al
mov eax, str._temp_
lea edx, [esi + 0x10]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100501d4
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x1c
lea eax, [esi + 0x218]
push eax
push 0
call edi
push 0
push 0x23
lea ecx, [esi + 0x420]
push ecx
push 0
call edi
mov eax, esi
pop edi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
push edx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.10066dc7
push 0x10099a10
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], vtable.std::bad_alloc.0
call fcn.1006752f
int3