joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003dd1d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, 0x104
push esi
call fcn.10062191
mov ebx, eax
xor edi, edi
cmp ebx, edi
pop ecx
je 0x1003dd45
push esi
push edi
push ebx
call fcn.10085bc0
add esp, 0xc
jmp 0x1003dd47
xor ebx, ebx
push dword [ebp + 8]
push ebx
call fcn.10086120
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x1003dc8d
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1003dd81
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, 0x104
push esi
call fcn.10062191
mov ebx, eax
xor edi, edi
cmp ebx, edi
pop ecx
je 0x1003dda9
push esi
push edi
push ebx
call fcn.10085bc0
add esp, 0xc
jmp 0x1003ddab
xor ebx, ebx
push dword [ebp + 8]
push ebx
call fcn.10086120
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x1003dcd5
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1003def9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x24
call fcn.10062191
mov esi, eax
xor edi, edi
cmp esi, edi
pop ecx
je 0x1003df19
lea ecx, [esi + 8]
call fcn.10005a18
jmp 0x1003df1b
xor esi, esi
push dword [ebp + 8]
lea ecx, [esi + 8]
call fcn.10001740
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1003de02
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi]
push 1
mov ecx, esi
call fcn.1003deb3
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x1003df67
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x20
mov edi, ecx
call fcn.10062191
mov esi, eax
xor ebx, ebx
cmp esi, ebx
pop ecx
je 0x1003df8a
lea ecx, [esi + 4]
call fcn.10005a18
jmp 0x1003df8c
xor esi, esi
push dword [ebp + 8]
lea ecx, [esi + 4]
call fcn.10001740
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x1003de4f
push ebx
mov dword [esi], ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
push 1
mov ecx, esi
mov dword [edi + 8], eax
call fcn.1003ded6
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10041a4c
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
xor eax, eax
push eax
push esi
push 0x10041a2b
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x10042404
Capabilities:
Copy file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xe8], 8
jb 0x10042418
mov eax, dword [esi + 0xd4]
jmp 0x1004241e
lea eax, [esi + 0xd4]
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
mov ebp, 0x1018636c
push ebp
push str.ModifySetConfig
mov ebx, str.SetModify
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x1004244c
mov eax, dword [esi + 0xd4]
jmp 0x10042452
lea eax, [esi + 0xd4]
push eax
push ebp
push str.ModifySetConfig64
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x1004246d
mov eax, dword [esi + 0xd4]
jmp 0x10042473
lea eax, [esi + 0xd4]
push eax
push ebp
push str.TempModifySetConfig
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x1004248e
mov eax, dword [esi + 0xd4]
jmp 0x10042494
lea eax, [esi + 0xd4]
push eax
push ebp
push str.TempModifySetConfig64
push ebx
call edi
pop edi
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
pop ebp
pop ebx
jb 0x100424b2
mov eax, dword [eax + 4]
jmp 0x100424b5
add eax, 4
add esi, 0x98
cmp dword [esi + 0x18], 8
jb 0x100424c6
mov esi, dword [esi + 4]
jmp 0x100424c9
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop esi
ret

Function at 0x100424d5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x244]
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x232]
push ebx
push eax
mov word [ebp - 0x234], bx
call fcn.10085bc0
xor eax, eax
mov word [ebp - 0x2c], bx
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x18], bx
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
push 0x10186370
push eax
call fcn.10004df5
movzx eax, word [ebp - 0x23e]
push eax
movzx eax, word [ebp - 0x242]
push eax
movzx eax, word [ebp - 0x244]
push eax
lea eax, [ebp - 0x18]
push str._.4d_.2d_.2d
push eax
call fcn.10004df5
add esp, 0x2c
cmp dword [esi + 0x104], 8
jb 0x1004257c
mov eax, dword [esi + 0xf0]
jmp 0x10042582
lea eax, [esi + 0xf0]
push eax
push ebx
mov ebx, str.LastUseDay
push ebx
mov edi, str.Setting
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx ecx, word [ebp - 0x244]
movzx edx, word [ebp - 0x242]
imul ecx, ecx, 0x64
add ecx, edx
movzx edx, word [ebp - 0x23e]
imul ecx, ecx, 0x64
add ecx, edx
cmp eax, ecx
je 0x100425f0
cmp dword [esi + 0x104], 8
jb 0x100425ca
mov esi, dword [esi + 0xf0]
jmp 0x100425d0
add esi, 0xf0
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x234]
push str.UseDayTotal
push eax
call fcn.100860cd
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
leave
ret
Function at 0x10042913
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x428
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
push ebx
push esi
push edi
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp - 0x6a]
push ebx
push eax
mov esi, ecx
mov word [ebp - 0x6c], bx
call fcn.10085bc0
push edi
lea eax, [ebp + 0x19e]
push ebx
push eax
mov word [ebp + 0x19c], bx
call fcn.10085bc0
mov eax, dword [esi + 0x24]
add esp, 0x18
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x78]
call fcn.1001d93c
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.1001d93c
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.10054d99
test al, al
jne 0x10042ad2
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, str.HotKey
lea ecx, [ebp - 0x78]
call fcn.10054ee4
mov eax, dword [eax + 4]
mov dword [ebp - 0x70], eax
add eax, 0xc
push eax
call fcn.10085b54
test eax, eax
pop ecx
jle 0x10042aa7
mov eax, dword [ebp - 0x70]
add eax, 0xc
push eax
lea eax, [ebp - 0x6c]
push str.Is_s
push eax
call fcn.10004df5
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x100429e9
mov eax, dword [esi + 0x9c]
jmp 0x100429ef
lea eax, [esi + 0x9c]
push eax
push 0x104
lea eax, [ebp + 0x19c]
push eax
push 0x1018fe5c
lea eax, [ebp - 0x6c]
push eax
push ebx
call edi
lea eax, [ebp + 0x19c]
push 0x1018fe5c
push eax
call fcn.100862d7
test eax, eax
pop ecx
pop ecx
je 0x10042a34
lea eax, [ebp + 0x19c]
push eax
call fcn.100865c9
pop ecx
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 4]
mov byte [ecx], al
mov eax, dword [ebp - 0x70]
add eax, 0xc
push eax
lea eax, [ebp - 0x6c]
push str.Use_s
push eax
call fcn.10004df5
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x10042a5d
mov eax, dword [esi + 0x9c]
jmp 0x10042a63
lea eax, [esi + 0x9c]
push eax
push 0x104
lea eax, [ebp + 0x19c]
push eax
push str.nothing
lea eax, [ebp - 0x6c]
push eax
push ebx
call edi
lea eax, [ebp + 0x19c]
push str.nothing
push eax
call fcn.100862d7
test eax, eax
pop ecx
pop ecx
je 0x10042aa7
lea eax, [ebp + 0x19c]
push eax
mov eax, dword [ebp - 0x70]
push dword [eax + 8]
call fcn.100860cd
pop ecx
pop ecx
lea ecx, [ebp - 0x78]
call fcn.100423b5
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x80]
call fcn.1001d93c
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x78]
call fcn.10054d99
test al, al
je 0x100429a0
mov ecx, dword [ebp + 0x3a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x3a8
leave
ret
Function at 0x10042aea
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x3ac]
sub esp, 0x42c
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x3a8], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
push edi
push eax
mov eax, dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x70]
call fcn.1001d93c
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.1001d93c
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.10054d99
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x10042c2e
lea ecx, [ebp - 0x70]
call fcn.10054ee4
mov ebx, dword [eax + 4]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x74], eax
mov eax, dword [ebx + 4]
cmp byte [eax], 0
lea eax, [ebp + 0x1a0]
je 0x10042b67
push 0x1018636c
jmp 0x10042b6c
push 0x10186140
push 0x10187268
push eax
call fcn.10004df5
add esp, 0xc
add ebx, 0xc
push ebx
lea eax, [ebp - 0x68]
push str.Is_s
push eax
mov dword [ebp - 0x80], ebx
call fcn.10004df5
add esp, 0xc
cmp dword [esi + 0xb0], 8
jb 0x10042ba3
mov eax, dword [esi + 0x9c]
jmp 0x10042ba9
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
mov ebx, str.HotKey
push ebx
call edi
push dword [ebp - 0x80]
lea eax, [ebp - 0x68]
push str.Use_s
push eax
call fcn.10004df5
push dword [ebp - 0x74]
lea eax, [ebp + 0x1a0]
push 0x10187268
push eax
call fcn.10004df5
add esp, 0x18
cmp dword [esi + 0xb0], 8
jb 0x10042bf6
mov eax, dword [esi + 0x9c]
jmp 0x10042bfc
lea eax, [esi + 0x9c]
push eax
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
lea ecx, [ebp - 0x70]
call fcn.100423b5
mov eax, dword [esi + 0x24]
push eax
push dword [eax + 4]
lea ecx, [ebp - 0x7c]
call fcn.1001d93c
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
call fcn.10054d99
test al, al
je 0x10042b41
cmp dword [esi + 0xe8], 8
jb 0x10042c47
mov eax, dword [esi + 0xd4]
jmp 0x10042c4d
lea eax, [esi + 0xd4]
push eax
push 0x1018636c
push str.ModifyHotKey
mov ebx, str.SetModify
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x10042c71
mov eax, dword [esi + 0xd4]
jmp 0x10042c77
lea eax, [esi + 0xd4]
push eax
push 0x1018636c
push str.ModifyHotKey64
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x10042c96
mov eax, dword [esi + 0xd4]
jmp 0x10042c9c
lea eax, [esi + 0xd4]
push eax
push 0x1018636c
push str.TempModifyHotKey
push ebx
call edi
cmp dword [esi + 0xe8], 8
jb 0x10042cbb
mov eax, dword [esi + 0xd4]
jmp 0x10042cc1
lea eax, [esi + 0xd4]
push eax
push 0x1018636c
push str.TempModifyHotKey64
push ebx
call edi
lea eax, [esi + 0xb4]
cmp dword [eax + 0x18], 8
jb 0x10042ce0
mov eax, dword [eax + 4]
jmp 0x10042ce3
add eax, 4
add esi, 0x98
cmp dword [esi + 0x18], 8
jb 0x10042cf4
mov esi, dword [esi + 4]
jmp 0x10042cf7
add esi, 4
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp + 0x3a8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008545e
add ebp, 0x3ac
leave
ret
Function at 0x100473bf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov dword [ebp - 8], ecx
call fcn.10062a91
mov esi, dword [eax + 8]
push 0x1018fa14
push str.PreviewSkinBK.png
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1004744f
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call fcn.10088150
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 4]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
push dword [ebp - 4]
call fcn.100473a1
test eax, eax
pop ecx
pop ecx
pop ebx
je 0x1004744f
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x12c], eax
pop edi
pop esi
leave
ret

Function at 0x100486dc
Capabilities:
Check for foreground window switch

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, ecx
xor ebp, ebp
call edi
mov ebx, str.FullScreen__d
jmp 0x1004870b
cmp ebp, 0x2d0
jge 0x10048726
push 0x2710
inc ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
push ebp
push ebx
mov dword [esp + 0x18], eax
call fcn.100293b4
push dword [esp + 0x18]
call fcn.1001d3c4
add esp, 0xc
test eax, eax
jne 0x100486f5
push str.PushMessage_Show
call fcn.100293b4
pop ecx
push 5
mov ecx, esi
call fcn.10074ff6
push 0x10
call fcn.10062191
pop ecx
lea ecx, [esi + 0x10c]
mov dword [ecx], eax
mov dword [eax], 0x100481e6
mov dword [eax + 8], esi
mov eax, dword [ecx]
xor edi, edi
inc edi
mov dword [eax + 0xc], edi
mov eax, dword [ecx]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
call fcn.10046ccb
push 0
push 0x3e8
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x10049069
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0xc18
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0xc18], eax
push 0x48
mov eax, 0x1017f7c2
call fcn.1008546d
mov esi, ecx
mov dword [ebp - 0x14], esi
add esi, 0x120
push esi
lea ecx, [ebp]
call fcn.100035e0
xor edi, edi
mov ebx, 0x206
push ebx
lea eax, [ebp + 0xa12]
push edi
push eax
mov dword [ebp - 4], edi
mov word [ebp + 0xa10], di
call fcn.10085bc0
push ebx
lea eax, [ebp + 0x80a]
push edi
push eax
mov word [ebp + 0x808], di
call fcn.10085bc0
add esp, 0x18
lea eax, [ebp + 0xa10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp dword [esi + 0x18], 8
jb 0x100490f5
mov esi, dword [esi + 4]
jmp 0x100490f8
add esi, 4
lea eax, [ebp + 0x808]
push eax
push esi
call fcn.1001ca5e
pop ecx
pop ecx
lea eax, [ebp + 0xa10]
push eax
lea ecx, [ebp + 0x1c]
call fcn.100015f0
lea eax, [ebp + 0x808]
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 1
call fcn.10003640
lea ecx, [ebp - 0x1c]
call fcn.100013c0
lea eax, [ebp + 0xa10]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.100015f0
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
mov byte [ebp - 4], 3
jae 0x10049154
lea eax, [ebp + 4]
push eax
lea ecx, [ebp - 0x54]
call fcn.100015f0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.10001460
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x54]
movzx ebx, al
call fcn.100017c0
push edi
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.100017c0
cmp ebx, edi
je 0x10049241
mov eax, dword [ebp - 0x14]
push 0x7ce
mov dword [eax + 0x11c], esi
lea eax, [ebp + 0x3a]
push edi
push eax
mov word [ebp + 0x38], di
call fcn.10085bc0
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [ebp + 0x34], 8
jae 0x100491c2
lea eax, [ebp + 0x20]
push eax
push str.SCWBSkinInst.exe
call fcn.100052f9
mov ecx, eax
call fcn.10019925
push eax
lea eax, [ebp + 0x38]
push str._s_s__untie__s
push eax
call fcn.10004df5
lea eax, [ebp + 0x38]
push eax
call fcn.1001c7f7
add esp, 0x18
call fcn.100052f9
mov ecx, eax
call fcn.10019971
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
mov ebx, 0x1018636c
push ebx
push str.IsModifyUIStyle64
mov edi, str.SetModify
push edi
mov dword [ebp - 0x10], eax
call esi
push dword [ebp - 0x10]
push ebx
push str.IsModifyUIStyle
push edi
call esi
push dword [ebp - 0x10]
push ebx
push str.IsTempModifyUIStyle64
push edi
call esi
push dword [ebp - 0x10]
push ebx
push str.IsTempModifyUIStyle
push edi
call esi
xor esi, esi
inc esi
xor edi, edi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x14]
push edi
push edi
push 0x52d
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10001450
push edi
push esi
lea ecx, [ebp + 0x1c]
call fcn.100017c0
push edi
push esi
lea ecx, [ebp]
call fcn.100017c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc18]
xor ecx, ebp
call fcn.1008545e
add ebp, 0xc1c
leave
ret
Function at 0x1004a2e6
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x1004a2d7
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
ret
Function at 0x1004b286
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x1004b277
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi], eax
pop esi
je 0x1004b2b4
cmp eax, 0xffffffff
je 0x1004b2b4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
Function at 0x1004b9a1
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0x858
lea ebp, [esp - 4]
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp + 0x858], eax
push 0x1c
mov eax, 0x1017fc2f
call fcn.1008546d
mov edi, 0x206
xor ebx, ebx
push edi
lea eax, [ebp + 0x242]
push ebx
push eax
mov esi, ecx
mov word [ebp + 0x240], bx
call fcn.10085bc0
push edi
lea eax, [ebp + 0x3a]
push ebx
push eax
mov word [ebp + 0x38], bx
call fcn.10085bc0
add esp, 0x18
cmp dword [esi + 0x48], 8
jb 0x1004ba00
mov eax, dword [esi + 0x34]
jmp 0x1004ba03
lea eax, [esi + 0x34]
push eax
lea eax, [ebp + 0x240]
push 0x10187268
push eax
call fcn.10004df5
add esp, 0xc
cmp dword [esi + 0x64], 8
jb 0x1004ba23
mov esi, dword [esi + 0x50]
jmp 0x1004ba26
add esi, 0x50
push esi
mov esi, 0x10187268
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.10004df5
push edi
lea eax, [ebp + 0x652]
push ebx
push eax
mov word [ebp + 0x650], bx
call fcn.10085bc0
add esp, 0x18
call fcn.100052f9
mov ecx, eax
call fcn.10019925
push eax
lea ecx, [ebp]
call fcn.100015f0
push str.SmartCloudInfo.ini
lea ecx, [ebp]
mov dword [ebp - 4], ebx
call fcn.10003640
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x1004ba7f
lea eax, [ebp + 4]
push eax
push 0x104
lea eax, [ebp + 0x650]
push eax
push 0x10186d40
push str.Spreader
push str.AppInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp + 0x650]
push eax
lea ecx, [ebp + 0x1c]
call fcn.100015f0
mov eax, dword [ebp + 0x30]
cmp eax, 6
mov byte [ebp - 4], 1
jbe 0x1004baec
add eax, 0xfffffffa
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x1c]
call fcn.10003740
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call fcn.10001d30
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100017c0
push edi
lea eax, [ebp + 0x44a]
push ebx
push eax
mov word [ebp + 0x448], bx
call fcn.10085bc0
mov eax, dword [ebp + 0x20]
add esp, 0xc
cmp dword [ebp + 0x34], 8
jae 0x1004bb10
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x448]
push esi
push eax
call fcn.10004df5
lea eax, [ebp + 0x448]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x240]
push eax
call fcn.1001ed50
add esp, 0x18
test eax, eax
jne 0x1004bb84
push str.PushMessage::
call fcn.100293b4
pop ecx
xor esi, esi
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.100017c0
push ebx
push 1
lea ecx, [ebp]
call fcn.100017c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x858]
xor ecx, ebp
call fcn.1008545e
add ebp, 0x85c
leave
ret
xor esi, esi
inc esi
jmp 0x1004bb49
Function at 0x1004cc61
Capabilities:
Create thread

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call fcn.10047f4a
mov ecx, eax
call fcn.1004830f
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x1004cc52
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
ret 4
Function at 0x1004da29
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
push eax
xor eax, eax
push eax
push esi
push 0x1004da1a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
ret

Function at 0x1004e45b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10207390]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.10085bc0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1004e4dd
cmp dword [ebp - 0x11c], 6
jb 0x1004e4dd
push esi
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
push str.ChangeWindowMessageFilter
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004e4d5
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
sete cl
inc ecx
push ecx
push dword [ebp + 8]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008545e
leave
ret 8

Function at 0x1004ebad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1004ebd0
xor eax, eax
jmp 0x1004ec50
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 8]
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push dword [ebp + 0x10]
push eax
call fcn.10088150
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
push dword [ebp + 0xc]
call fcn.10034f15
pop ecx
mov esi, eax
test esi, esi
pop ecx
pop edi
je 0x1004ebc9
mov ecx, esi
call fcn.10034e93
mov ecx, esi
mov dword [ebx], eax
call fcn.10034eb7
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 0xc], esi
inc eax
pop esi
pop ebx
pop ebp
ret 0xc