joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70e03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp edx, 0xe10454d8
cmp edi, ebx
push 0x9585c5f5
lea esp, [esp + 0x30]
ja 0x43e75
jmp 0x40a13
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x526008], 0x8088405
inc edx
mov dword [ebx + 0x526008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf44
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf75
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf5d
add dl, dl
jne 0x41cf80
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cfd1
xor eax, eax
add dl, dl
jne 0x41cf8d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d06e
add dl, dl
jne 0x41cf9c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa7
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfb2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfbd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cfc7
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf6c
mov eax, 1
add dl, dl
jne 0x41cfdf
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfea
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfd6
sub eax, ebx
mov ebx, 1
jne 0x41d01d
mov ecx, 1
add dl, dl
jne 0x41d003
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d00e
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cffa
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41d034
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41d03f
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41d02b
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf6c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d08f
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf6c
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x50a58e
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ef
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
jmp 0x41f10e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f10e
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f180
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f169
test esi, esi
jbe 0x41f180
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f15b
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f180
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f138
jmp 0x41f180
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f180
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50a595
ret
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x50b8f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0x52854c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0x52854c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0x527378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b8fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0xf6402c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf64036
pushal
call 0xf6403c
pop ebp
sub ebp, 0x10
sub ebp, 0xb6402c
jmp 0xf64052
mov eax, 0xb6402c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c6
mov edx, 0xc48b9951
xor byte [eax], dl
inc eax
dec ecx
jne 0xf64069
jmp 0xf6407c
ficomp dword [edx + ebx*8 + 0x51516dd8]
push ecx
rcl byte [eax + 0x515151a9]
push edx
pushfd
jmp 0x524791e9
Function at 0x100010f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001109
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001144
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001140
lea ebx, [ebx]
cmp esi, eax
jae 0x10001144
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001130
cmp esi, eax
jb 0x1000114a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x100027a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x130
mov eax, dword [0x1003c360]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
mov ebx, dword [esp + 0x13c]
push ebp
mov ebp, dword [esp + 0x144]
cmp ebp, 0x46
push esi
mov esi, dword [esp + 0x140]
push edi
mov edi, dword [esp + 0x154]
jne 0x10002895
push 0x11c
lea eax, [esp + 0x24]
push 0
push eax
call fcn.10013e10
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [esp + 0x30], 2
jne 0x10002821
cmp dword [esp + 0x24], 5
je 0x10002895
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
sub ecx, dword [esp + 0x14]
sub edx, dword [esp + 0x10]
cmp edx, ecx
jle 0x10002866
cmp byte [esi + 0x8b], 0
jne 0x10002895
mov eax, dword [edi + 0x10]
mov ecx, dword [esi + 0x1b4]
sub ecx, eax
mov dword [esi + 0x1b8], eax
je 0x10002895
add dword [esi + 0x230], ecx
mov dword [esi + 0x1b4], eax
mov byte [esi + 0x224], 1
jmp 0x10002895
cmp byte [esi + 0x8b], 0
je 0x10002895
mov eax, dword [edi + 0x14]
mov ecx, dword [esi + 0x200]
sub ecx, eax
mov dword [esi + 0x204], eax
je 0x10002895
add dword [esi + 0x23c], ecx
mov dword [esi + 0x200], eax
mov byte [esi + 0x225], 1
mov eax, dword [esp + 0x150]
mov ecx, dword [esi + 0x70]
push edi
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100131c3
add esp, 0x130
ret 0x14
Function at 0x100028d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x1003c360]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, dword [esp + 0x130]
cmp ebx, 0x7e
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, dword [esp + 0x134]
jne 0x1000293d
push 0x11c
lea eax, [esp + 0x10]
push 0
push eax
call fcn.10013e10
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x1c], 2
jne 0x10002936
cmp dword [esp + 0x10], 5
je 0x1000293d
mov byte [esi + 0x8c], 0
mov edx, dword [esp + 0x140]
mov eax, dword [esp + 0x13c]
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ebx
push edi
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100131c3
add esp, 0x120
ret 0x14

Function at 0x10002980
Capabilities:
Check os version

Disassembly:
sub esp, 0x140
mov eax, dword [0x1003c360]
xor eax, esp
mov dword [esp + 0x13c], eax
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
mov ebp, dword [esp + 0x154]
cmp ebp, 0xf
push esi
mov esi, dword [esp + 0x150]
jne 0x10002a95
push 0x11c
lea eax, [esp + 0x30]
push 0
push eax
call fcn.10013e10
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x3c], 2
jne 0x100029ee
cmp dword [esp + 0x30], 5
je 0x10002a95
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x20]
push edx
push eax
call edi
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
sub edx, dword [esp + 0x20]
cmp edx, ecx
jle 0x10002a55
cmp byte [esi + 0x8b], 0
jne 0x10002a94
mov ecx, dword [esi + 0x2c]
lea eax, [esp + 0x10]
push eax
push ecx
call edi
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x194]
sub ecx, eax
mov dword [esi + 0x198], eax
je 0x10002a94
add dword [esi + 0x22c], ecx
mov dword [esi + 0x194], eax
mov byte [esi + 0x224], 1
jmp 0x10002a94
cmp byte [esi + 0x8b], 0
je 0x10002a94
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0x10]
push edx
push eax
call edi
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x1e0]
sub ecx, eax
mov dword [esi + 0x1e4], eax
je 0x10002a94
add dword [esi + 0x238], ecx
mov dword [esi + 0x1e0], eax
mov byte [esi + 0x225], 1
pop edi
mov ecx, dword [esp + 0x160]
mov edx, dword [esp + 0x15c]
mov eax, dword [esi + 0x68]
push ecx
push edx
push ebp
push ebx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [esp + 0x148]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100131c3
add esp, 0x140
ret 0x14
Function at 0x10002ad0
Capabilities:
Check os version

Disassembly:
sub esp, 0x150
mov eax, dword [0x1003c360]
xor eax, esp
mov dword [esp + 0x14c], eax
cmp dword [esp + 0x15c], 0x46
push ebp
mov ebp, dword [esp + 0x15c]
push esi
mov esi, dword [esp + 0x15c]
push edi
mov edi, dword [esp + 0x170]
jne 0x10002bc4
push 0x11c
lea eax, [esp + 0x40]
push 0
push eax
call fcn.10013e10
add esp, 0xc
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x4c], 2
jne 0x10002b43
cmp dword [esp + 0x40], 5
je 0x10002bc4
mov eax, dword [esi + 0xc]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x30]
push edx
push eax
call ebx
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call ebx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
call ebx
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
sub edx, dword [esp + 0x34]
sub eax, dword [esp + 0x30]
pop ebx
cmp eax, edx
jle 0x10002ba3
cmp byte [esi + 0x8b], 0
jne 0x10002bc4
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x14]
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x24]
cmp dword [edi + 8], eax
je 0x10002bc4
mov dword [edi + 8], eax
jmp 0x10002bc4
cmp byte [esi + 0x8b], 0
je 0x10002bc4
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
sub eax, dword [esp + 0x20]
add eax, dword [esp + 0x28]
cmp dword [edi + 0xc], eax
je 0x10002bc4
mov dword [edi + 0xc], eax
mov ecx, dword [esp + 0x16c]
mov edx, dword [esp + 0x168]
mov eax, dword [esi + 0x60]
push edi
push ecx
push edx
push ebp
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [esp + 0x158]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.100131c3
add esp, 0x150
ret 0x14
Function at 0x10002c00
Capabilities:
Check os version

Disassembly:
sub esp, 0x164
mov eax, dword [0x1003c360]
xor eax, esp
mov dword [esp + 0x160], eax
cmp dword [esp + 0x170], 0x46
mov eax, dword [esp + 0x16c]
push esi
mov esi, dword [esp + 0x16c]
push edi
mov edi, dword [esp + 0x180]
mov dword [esp + 0x18], eax
jne 0x10002d29
push ebx
push 0x11c
xor ebx, ebx
lea ecx, [esp + 0x54]
push ebx
push ecx
call fcn.10013e10
add esp, 0xc
lea edx, [esp + 0x50]
push edx
mov dword [esp + 0x54], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x60], 2
jne 0x10002c78
cmp dword [esp + 0x54], 5
je 0x10002d28
mov ecx, dword [esi + 0xc]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x24]
push eax
push ecx
call ebp
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x44]
push edx
push eax
call ebp
mov eax, dword [esi + 0x20]
cmp eax, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
je 0x10002cb4
lea ecx, [esp + 0x10]
push ecx
push eax
call ebp
mov eax, dword [esi + 0x24]
lea edx, [esp + 0x34]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sub ecx, dword [esp + 0x28]
sub edx, dword [esp + 0x24]
pop ebp
cmp edx, ecx
jle 0x10002cff
cmp byte [esi + 0x8b], bl
jne 0x10002d28
cmp dword [edi + 8], ebx
je 0x10002d28
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
sub eax, dword [esp + 0x14]
lea eax, [eax + ecx - 0x16]
cmp dword [edi + 0x10], eax
je 0x10002d28
mov dword [edi + 0x10], eax
jmp 0x10002d28
cmp byte [esi + 0x8b], bl
je 0x10002d28
cmp dword [edi + 0xc], ebx
je 0x10002d28
mov edx, dword [esp + 0x4c]
sub edx, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
sub edx, dword [esp + 0x18]
lea eax, [edx + eax - 0x16]
cmp dword [edi + 0x14], eax
je 0x10002d28
mov dword [edi + 0x14], eax
pop ebx
mov ecx, dword [esp + 0x17c]
mov edx, dword [esp + 0x178]
mov eax, dword [esp + 0x18]
push edi
push ecx
mov ecx, dword [esi + 0x64]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [esp + 0x168]
pop edi
pop esi
xor ecx, esp
call fcn.100131c3
add esp, 0x164
ret 0x14
Function at 0x10003010
Capabilities:
Check os version

Disassembly:
sub esp, 0x150
mov eax, dword [0x1003c360]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebx
mov ebx, dword [esp + 0x15c]
push ebp
mov ebp, dword [esp + 0x164]
cmp ebp, 0x83
push esi
mov esi, dword [esp + 0x160]
jne 0x1000317e
push 0x11c
lea eax, [esp + 0x40]
push 0
push eax
call fcn.10013e10
add esp, 0xc
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x4c], 2
jne 0x10003081
cmp dword [esp + 0x40], 5
je 0x1000317e
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x30]
push edx
push eax
call edi
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
sub ecx, dword [esp + 0x34]
sub edx, dword [esp + 0x30]
cmp edx, ecx
jle 0x10003117
cmp byte [esi + 0x8b], 0
jne 0x1000317d
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x10]
push eax
push ecx
call edi
mov eax, dword [esi + 0x30]
lea edx, [esp + 0x20]
push edx
push eax
call edi
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
mov edx, dword [esi + 0x1a4]
sub edx, ecx
sub edx, eax
add edx, dword [esi + 0x19c]
mov dword [esi + 0x1a0], eax
mov dword [esi + 0x1a8], ecx
je 0x1000317d
add dword [esi + 0x228], edx
mov dword [esi + 0x19c], eax
mov dword [esi + 0x1a4], ecx
mov byte [esi + 0x224], 1
jmp 0x1000317d
cmp byte [esi + 0x8b], 0
je 0x1000317d
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x20]
push ecx
push edx
call edi
mov ecx, dword [esi + 0x30]
lea eax, [esp + 0x10]
push eax
push ecx
call edi
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
mov edx, dword [esi + 0x1f0]
sub edx, ecx
sub edx, eax
add edx, dword [esi + 0x1e8]
mov dword [esi + 0x1ec], eax
mov dword [esi + 0x1f4], ecx
je 0x1000317d
add dword [esi + 0x234], edx
mov dword [esi + 0x1e8], eax
mov dword [esi + 0x1f0], ecx
mov byte [esi + 0x225], 1
pop edi
mov edx, dword [esp + 0x170]
mov eax, dword [esp + 0x16c]
mov ecx, dword [esi + 0x58]
push edx
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [esp + 0x158]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100131c3
add esp, 0x150
ret 0x14
Function at 0x100031c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x150
mov eax, dword [0x1003c360]
xor eax, esp
mov dword [esp + 0x14c], eax
cmp dword [esp + 0x15c], 0x46
push ebp
mov ebp, dword [esp + 0x15c]
push esi
mov esi, dword [esp + 0x16c]
push edi
mov edi, dword [esp + 0x160]
jne 0x100032b9
push 0x11c
lea eax, [esp + 0x40]
push 0
push eax
call fcn.10013e10
add esp, 0xc
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x4c], 2
jne 0x10003233
cmp dword [esp + 0x40], 5
je 0x100032b9
mov eax, dword [edi + 0xc]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x30]
push edx
push eax
call ebx
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0x20]
push ecx
push edx
call ebx
mov ecx, dword [edi + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
call ebx
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
sub edx, dword [esp + 0x34]
sub eax, dword [esp + 0x30]
pop ebx
cmp eax, edx
jle 0x10003296
cmp byte [edi + 0x8b], 0
jne 0x100032b9
mov ecx, dword [esp + 0xc]
sub ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
sub ecx, dword [esp + 0x1c]
lea eax, [ecx + edx]
cmp dword [esi + 8], eax
je 0x100032b9
mov dword [esi + 8], eax
jmp 0x100032b9
cmp byte [edi + 0x8b], 0
je 0x100032b9
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
add eax, ecx
cmp dword [esi + 0xc], eax
je 0x100032b9
mov dword [esi + 0xc], eax
mov edx, dword [esp + 0x16c]
mov eax, dword [esp + 0x168]
mov ecx, dword [edi + 0x54]
push esi
push edx
push eax
push ebp
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [esp + 0x158]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.100131c3
add esp, 0x150
ret 0x14
Function at 0x100032f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x144
mov eax, dword [0x1003c360]
xor eax, esp
mov dword [esp + 0x140], eax
cmp dword [esp + 0x150], 0x46
mov eax, dword [esp + 0x14c]
push esi
mov esi, dword [esp + 0x14c]
push edi
mov edi, dword [esp + 0x160]
mov dword [esp + 8], eax
jne 0x100034af
mov edx, dword [esi + 0xc]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebp
push 0x11c
lea eax, [esp + 0x34]
push 0
push eax
call fcn.10013e10
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esi + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call ebp
cmp dword [esp + 0x40], 2
jne 0x10003383
cmp dword [esp + 0x34], 5
je 0x100034ae
mov ebp, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
mov edx, ebp
sub edx, dword [esp + 0x18]
mov ecx, ebx
sub ecx, dword [esp + 0x14]
cmp ecx, edx
jle 0x10003435
cmp byte [esi + 0x8b], 0
jne 0x100034ad
mov eax, dword [edi + 0x10]
sub eax, dword [esp + 0x2c]
mov ecx, dword [esi + 0x190]
add eax, ecx
add eax, dword [esp + 0x24]
jns 0x100033c4
neg eax
cmp eax, 0x20
je 0x1000345a
mov eax, dword [esi + 0x98]
sub eax, dword [esi + 0x230]
mov byte [esi + 0x8d], 1
sub eax, dword [esi + 0x22c]
sub eax, dword [esi + 0x228]
sub eax, dword [esi + 0x90]
add eax, ecx
cmp dword [edi + 0x10], eax
je 0x100033fc
mov dword [edi + 0x10], eax
mov eax, ebx
sub eax, dword [edi + 0x10]
cmp dword [edi + 8], eax
je 0x10003409
mov dword [edi + 8], eax
cmp dword [esp + 0x44], 2
jne 0x10003422
cmp dword [esp + 0x38], 5
jne 0x10003422
lea eax, [edx - 4]
cmp dword [edi + 0x14], eax
je 0x10003422
mov dword [edi + 0x14], eax
cmp dword [edi + 0xc], 0
je 0x100034ad
mov dword [edi + 0xc], 0
jmp 0x100034ad
cmp byte [esi + 0x8b], 0
je 0x100034ad
mov ecx, dword [esi + 0x1dc]
mov eax, ecx
sub eax, dword [esp + 0x30]
add eax, dword [esp + 0x28]
add eax, dword [edi + 0x14]
jns 0x10003455
neg eax
cmp eax, 0x1e
jne 0x10003463
mov byte [esi + 0x8d], 0
jmp 0x100034ad
mov edx, dword [esi + 0x11c]
sub edx, dword [esi + 0x23c]
mov byte [esi + 0x8d], 1
sub edx, dword [esi + 0x238]
sub edx, dword [esi + 0x234]
sub edx, dword [esi + 0x114]
lea eax, [edx + ecx]
cmp dword [edi + 0x14], eax
je 0x10003493
mov dword [edi + 0x14], eax
mov eax, ebp
sub eax, dword [edi + 0x14]
cmp dword [edi + 0xc], eax
je 0x100034a0
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x100034ad
mov dword [edi + 8], 0
pop ebx
pop ebp
mov eax, dword [esp + 0x15c]
mov ecx, dword [esp + 0x158]
mov edx, dword [esp + 8]
push edi
push eax
mov eax, dword [esi + 0x50]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [esp + 0x148]
pop edi
pop esi
xor ecx, esp
call fcn.100131c3
add esp, 0x144
ret 0x14