joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a170
Capabilities:
Check if file exists
Create directory
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100427b0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1005545c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0x3c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a1b0
push eax
push dword [esi + 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000a282
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 8]
push edi
push dword [esi + 0x38]
push str._s_s
push eax
call fcn.1000a610
add esp, 0x10
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000a28c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push edi
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
push dword [esi + 0x3c]
push str._s_s
push eax
call fcn.1000a610
mov esi, dword [ebp + 8]
add esp, 0x10
mov edi, dword [ebp - 0x10]
push 3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
neg eax
mov byte [ebp - 4], 0
lea edx, [esi - 0x10]
sbb ebx, ebx
or esi, 0xffffffff
neg ebx
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000a250
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x1000a26c
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10001f00
push 0x80004005
call fcn.10001f00
int3
Function at 0x1000aed0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1005545c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000af84
cmp word [esi], 0
je 0x1000af84
test eax, eax
je 0x1000af2e
cmp word [eax], 0
je 0x1000af2e
push 0
push 0
push eax
push esi
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x1000af84
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f332
mov esp, ebp
pop ebp
ret 8
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10023f50
add esp, 0xc
lea eax, [ebp - 0x414]
push 0
push 0
push 0x104
push eax
push esi
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToCacheFileW]
test eax, eax
js 0x1000af84
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f332
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.1001f332
mov esp, ebp
pop ebp
ret 8

Function at 0x1000afa0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x1000afbe
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebp + 0x14], 0
je 0x1000b0a5
push 0x1418
call fcn.1001f947
mov ecx, dword [ebp + 8]
mov edi, eax
push 0x1000
push 0
lea esi, [edi + 4]
mov dword [edi], ecx
push esi
mov dword [edi + 0x1414], 1
call fcn.10023f50
push 0x800
push ebx
push esi
call fcn.10031659
push 0x410
lea esi, [edi + 0x1004]
push 0
push esi
call fcn.10023f50
mov eax, dword [ebp + 0x10]
add esp, 0x28
test eax, eax
je 0x1000b02b
push 0x208
push eax
push esi
call fcn.10031659
add esp, 0xc
lea eax, [esp + 0x18]
mov dword [esp + 0x10], vtable.CSimpleThread.0
push eax
push 0
push edi
push 0x1000ae70
push 0
push 0
mov dword [esp + 0x40], 0x1000ae70
mov dword [esp + 0x44], edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
call fcn.100315c6
add esp, 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CSimpleThread.0
test eax, eax
je 0x1000b0ae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp + 0x10]
push ebx
call fcn.1000aed0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1000b370
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x1000b395
test byte [ebp - 4], 7
je 0x1000b395
mov eax, 1
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b450
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.100201c0
mov eax, dword [0x1005545c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0x10]
push 0x4000
push 0
push eax
call fcn.10023f50
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x1000b54b
test edi, edi
je 0x1000b54b
lea eax, [ebp - 0x4008]
push eax
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
je 0x1000b54b
cmp eax, 0x3fff
ja 0x1000b54b
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1000b54b
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x1004f2a4
lea eax, [ebp - 0x4004]
push eax
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1000b54b
mov esi, dword [ebp + 0x14]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.10023f50
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.1000bc30
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f332
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1001f332
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000c7f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100422a6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1005545c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 0
mov dword [edi + 0x24], vtable.ILayerWindow.0
mov dword [edi], vtable.CLayerWindowBase_class_CRightWnd__class_ATL::CWinTraits__2046689280__524288__.0
mov dword [edi + 0x24], vtable.CLayerWindowBase_class_CRightWnd__class_ATL::CWinTraits__2046689280__524288__.1.0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 2
lea esi, [edi + 0x48]
mov dword [edi + 0x38], 1
mov dword [edi + 0x3c], 0xff
mov dword [edi + 0x40], 1
mov dword [edi + 0x44], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10006df0
mov dword [esi], eax
mov byte [ebp - 4], 3
mov dword [edi + 0x50], 0
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000ca4a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x54], eax
mov byte [ebp - 4], 4
push 0xa4
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 1
mov dword [edi + 0x6c], 0
call fcn.1001f947
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.10010aa0
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x44], eax
mov dword [edi + 0x70], vtable.IHttpTaskCallback.0
mov dword [edi], vtable.CPopBaseWnd_class_CRightWnd_.2.0
mov dword [edi + 0x24], vtable.CPopBaseWnd_class_CRightWnd_.1.0
mov dword [edi + 0x70], vtable.CPopBaseWnd_class_CRightWnd_.0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0x64
mov dword [edi + 0xa8], 0xffffffff
mov dword [edi + 0xac], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xb4], 0
mov dword [edi + 0xb8], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xc8], 0
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000ca54
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [edi + 0xd0]
mov dword [edi + 0xcc], eax
call fcn.1000ade0
mov dword [edi + 0xe8], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001f00
push 0x80004005
call fcn.10001f00
int3
Function at 0x1000cd50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push eax
je 0x1000cdd4
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000cdcf
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000cdcf
push edi
mov edi, dword [esi + 0x80]
test edi, edi
je 0x1000cdce
mov edi, dword [edi + 0xc]
test edi, edi
je 0x1000cdce
cmp dword [edi + 4], 2
je 0x1000cd97
cmp dword [esi + 0xe8], eax
je 0x1000cdc4
push 8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0xe8], 0
je 0x1000cdc4
push 0x1f4
mov ecx, esi
call fcn.1000d5e0
cmp dword [edi + 4], 2
je 0x1000cdc4
mov ecx, esi
call fcn.1000d4c0
mov dword [esi + 0xe8], 0
pop edi
pop esi
pop ebp
ret 4
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000cdcf
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
Function at 0x1000d060
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042968
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1005545c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x78]
test eax, eax
je 0x1000d0b1
mov ecx, dword [esi + 0xa8]
test ecx, ecx
jne 0x1000d0a2
mov dword [eax + 0xe8], ecx
jmp 0x1000d0b1
cmp ecx, 1
jne 0x1000d0b1
mov dword [eax + 0xec], 0
mov ecx, esi
call fcn.1000d4c0
mov eax, dword [esi + 0x78]
test eax, eax
je 0x1000d0e0
mov ecx, dword [esi + 0xa8]
test ecx, ecx
jne 0x1000d0d1
mov dword [eax + 0xe8], ecx
jmp 0x1000d0e0
cmp ecx, 1
jne 0x1000d0e0
mov dword [eax + 0xec], 0
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x80]
test eax, eax
je 0x1000d1d8
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1000d1d8
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000d1f4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov eax, dword [edi]
add eax, 0x186a0
push eax
push str.click
lea eax, [ebp - 0x14]
push str._s__d
push eax
call fcn.1000a610
add esp, 0x10
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000d1fe
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.nav_ad
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10001780
test al, al
jne 0x1000d181
push 6
push str.nav_ad
lea ecx, [ebp - 0x10]
call fcn.100018b0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0xd0]
call fcn.1000b0e0
mov byte [ebp - 4], 0
or edi, 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000d1b9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1000d1d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.1000d760
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.10001f00
push 0x80004005
call fcn.10001f00
int3
Function at 0x1000d4c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100429a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1005545c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x1000d5b6
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1000d5b6
lea ecx, [ebp - 0x14]
call fcn.10003750
mov dword [ebp - 4], 0
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000d5c8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x10]
push dword [edi]
push 0x1004f604
push eax
call fcn.1000a610
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x18], 0
push 4
push eax
push 4
push esi
push dword [ebp - 0x14]
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [edi]
push dword [ebx + 0xa8]
push str.show_wnd__pos__d___id__d_
call fcn.10001490
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
add esp, 0xc
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000d597
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1000d5b6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001f00
int3
Function at 0x1000df60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100422a6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1005545c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 0
mov dword [edi + 0x24], vtable.ILayerWindow.0
mov dword [edi], vtable.CLayerWindowBase_class_CTopWnd__class_ATL::CWinTraits__2046689280__524288__.0
mov dword [edi + 0x24], vtable.CLayerWindowBase_class_CTopWnd__class_ATL::CWinTraits__2046689280__524288__.1.0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 2
lea esi, [edi + 0x48]
mov dword [edi + 0x38], 1
mov dword [edi + 0x3c], 0xff
mov dword [edi + 0x40], 1
mov dword [edi + 0x44], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10006df0
mov dword [esi], eax
mov byte [ebp - 4], 3
mov dword [edi + 0x50], 0
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000e1ba
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x54], eax
mov byte [ebp - 4], 4
push 0xa4
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 1
mov dword [edi + 0x6c], 0
call fcn.1001f947
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.10010aa0
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x44], eax
mov dword [edi + 0x70], vtable.IHttpTaskCallback.0
mov dword [edi], vtable.CPopBaseWnd_class_CTopWnd_.2.0
mov dword [edi + 0x24], vtable.CPopBaseWnd_class_CTopWnd_.1.0
mov dword [edi + 0x70], vtable.CPopBaseWnd_class_CTopWnd_.0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0x64
mov dword [edi + 0xa8], 0xffffffff
mov dword [edi + 0xac], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xb4], 0
mov dword [edi + 0xb8], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xc8], 0
call fcn.10001c90
mov ecx, eax
test ecx, ecx
je 0x1000e1c4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [edi + 0xd0]
mov dword [edi + 0xcc], eax
call fcn.1000ade0
mov dword [edi + 0xe8], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10001f00
push 0x80004005
call fcn.10001f00
int3
Function at 0x100133d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042d3e
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1005545c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0
jne 0x10013405
xor eax, eax
jmp 0x1001354e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001341a
xor eax, eax
jmp 0x1001354e
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.10014500
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.10014340
push eax
lea ecx, [ebp - 0x28]
call fcn.100130e0
movzx ecx, al
test ecx, ecx
je 0x1001344d
xor eax, eax
jmp 0x1001354e
push 0x10
call fcn.1001f947
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x10013474
mov ecx, dword [ebp - 0x18]
call fcn.10012f40
mov dword [ebp - 0x1c], eax
jmp 0x1001347b
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1001354c
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
push 0x14
call fcn.1001f947
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x20], 0
je 0x100134db
mov ecx, dword [ebp - 0x20]
call fcn.10015230
mov dword [ebp - 0x24], eax
jmp 0x100134e2
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
je 0x1001351f
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 4]
call fcn.10015b60
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.10015b00
mov ecx, dword [ebp - 0x10]
mov dword [ecx], 1
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100124d0
push eax
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.10012db0
mov eax, 1
jmp 0x1001354e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10015910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1005545c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, word [ebp + 8]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1001595e
xor eax, eax
jmp 0x10015a7c
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1001597c
xor eax, eax
jmp 0x10015a7c
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100159a1
xor eax, eax
jmp 0x10015a7c
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x100159c7
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x10015a7c
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x100159f5
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x10015a7c
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.10023450
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.100150d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x1c]
call fcn.10015370
push eax
push 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x10015a5a
push 0
lea ecx, [ebp - 0x1c]
call fcn.10010840
push eax
call fcn.100157b0
add esp, 8
mov dword [ebp - 0x28], eax
jmp 0x10015a64
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100152c0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001b243
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1001b292
mov esi, dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push edi
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001b292
cmp esi, dword [ebp + 0x10]
je 0x1001b28d
push 0x1004e62c
push 1
push edi
push edi
call fcn.1001a8d6
jmp 0x1001b2a0
xor eax, eax
inc eax
jmp 0x1001b2a5
mov eax, 0x1004e62c
push eax
push eax
push edi
push edi
call fcn.1001a923
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret