joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c7a20
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x8af710
push 0x71a9f0
mov eax, dword fs:[0]
push eax
add esp, 0xffffff8c
mov eax, dword [0x8d3fc4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x6c]
push ecx
mov edx, dword [ebp - 0x70]
push edx
push str.Processors_Number_:__u__Type__u__r_n
push 8
call fcn.006cb1f0
add esp, 0x10
push 0x40
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.00719250
add esp, 0xc
mov dword [ebp - 0x5c], 0x40
lea ecx, [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov dword [ebp - 0x60], 0x100000
mov edx, dword [ebp - 0x58]
push edx
push str._u____memory_in_use_r_n
push 8
call fcn.006cb1f0
add esp, 0xc
mov eax, dword [ebp - 0x54]
add eax, 0x100000
mov ecx, dword [ebp - 0x50]
adc ecx, 0
sub eax, 1
sbb ecx, 0
push 0
push 0x100000
push ecx
push eax
call fcn.007010a0
push edx
push eax
push str._u_MBytes_physical_memory_r_n
push 8
call fcn.006cb1f0
add esp, 0x10
mov edx, dword [ebp - 0x4c]
add edx, 0x100000
mov eax, dword [ebp - 0x48]
adc eax, 0
sub edx, 1
sbb eax, 0
push 0
push 0x100000
push eax
push edx
call fcn.007010a0
push edx
push eax
push str._u_MBytes_physical_memory_free_r_n
push 8
call fcn.006cb1f0
add esp, 0x10
mov ecx, dword [ebp - 0x44]
add ecx, 0x100000
mov edx, dword [ebp - 0x40]
adc edx, 0
sub ecx, 1
sbb edx, 0
push 0
push 0x100000
push edx
push ecx
call fcn.007010a0
push edx
push eax
push str._u_MBytes_paging_file_r_n
push 8
call fcn.006cb1f0
add esp, 0x10
mov eax, dword [ebp - 0x3c]
add eax, 0x100000
mov ecx, dword [ebp - 0x38]
adc ecx, 0
sub eax, 1
sbb ecx, 0
push 0
push 0x100000
push ecx
push eax
call fcn.007010a0
push edx
push eax
push str._u_MBytes_paging_file_free_r_n
push 8
call fcn.006cb1f0
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
jmp 0x6c7bae
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00700c25
mov esp, ebp
pop ebp
ret
Function at 0x6c9b80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 6
cmp dword [ebp + 8], 0
je 0x6c9b9f
cmp dword [ebp + 0xc], 0
je 0x6c9b9f
cmp dword [ebp + 0x10], 0
jne 0x6c9ba4
mov eax, dword [ebp - 4]
jmp 0x6c9c1f
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x6c9be5
lea edx, [ebp - 8]
push edx
push 1
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6c9c1c
mov ecx, dword [ebp + 0x14]
shl ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x6cb2d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.00700fc0
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1800
push 0
lea eax, [ebp - 0x1804]
push eax
call fcn.00719250
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1808], ecx
mov edx, dword [ebp - 0x1808]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1804]
push ecx
call dword [sym.imp.USER32.dll_wvsprintfW]
mov dword [ebp - 0x1808], 0
lea edx, [ebp - 0x1804]
push edx
call fcn.006caee0
add esp, 4
lea eax, [eax + eax - 2]
mov dword [ebp - 0x180c], eax
cmp dword [ebp - 0x180c], 0x1800
jae 0x6cb34f
jmp 0x6cb354
call fcn.00701241
xor ecx, ecx
mov edx, dword [ebp - 0x180c]
mov word [ebp + edx - 0x1804], cx
lea eax, [ebp - 0x1804]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00700c25
mov esp, ebp
pop ebp
ret

Function at 0x6cd490
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7cad6e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x8d3fc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0x10]
call fcn.006ccbb0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.006ccf60
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.006c5f50
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.006c5f50
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x90], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.006ccb20
mov ecx, dword [ebp - 0x10]
add ecx, 0x95
call fcn.006ccb20
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x98], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x9c], 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.006ce7a0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x95
call fcn.006ce7a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x6ce7e0
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6ce812
xor al, al
jmp 0x6ce844
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x6ce838
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, 1
jmp 0x6ce844
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6cf370
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x40
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x6cf39c
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x6cf3a0
xor eax, eax
jmp 0x6cf3e0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 8], edx
push 0xf8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x6cf3c3
xor eax, eax
jmp 0x6cf3e0
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
jne 0x6cf3d6
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
jmp 0x6cf3dd
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x6d0690
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0
jne 0x6d06a6
xor al, al
jmp 0x6d0738
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x6d06d9
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jge 0x6d0712
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0xc]
jb 0x6d0710
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp - 0xc]
cmp dword [ebp + 0xc], ecx
jae 0x6d0710
mov dword [ebp - 0x10], 1
jmp 0x6d0712
jmp 0x6d06c7
cmp dword [ebp - 0x10], 0
jne 0x6d071c
xor al, al
jmp 0x6d0738
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + 0xc]
sub ecx, dword [eax + 0x14]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6d0f50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x6d0f60
xor al, al
jmp 0x6d0f8c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x6d0f77
xor al, al
jmp 0x6d0f8c
mov ecx, dword [ebp - 8]
and ecx, 0x10
je 0x6d0f85
mov byte [ebp - 1], 1
jmp 0x6d0f89
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x6d0f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7caf86
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x8d3fc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
push 0x804d80
lea ecx, [ebp - 0x14]
call fcn.004f0cc4
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
push 0x8401ec
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0072c203
add esp, 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x6d1090
cmp dword [ebp - 0x10], 0
je 0x6d1016
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00700fb3
add esp, 4
mov dword [ebp - 0x10], 0
push 0x208
call fcn.00700faa
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x6d1047
push 0x208
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.00719250
add esp, 0xc
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
jmp 0x6d104e
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x6d108e
mov eax, dword [ebp - 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
call fcn.006b7320
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00700fb3
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x6d10b5
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
call fcn.006b7320
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.00700fb3
add esp, 4
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.006b63d0
mov edx, dword [ebp - 0x20]
or edx, 1
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004e055e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x6d1220
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x6d12da
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6d12da
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6d12da
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x6d12ca
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 4]
push edx
push 0x807364
mov eax, dword [ebp - 8]
push eax
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 4], 0
je 0x6d12ca
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esp, ebp
pop ebp
ret
Function at 0x6d12e0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7cb02b
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.006c65d0
movzx eax, al
test eax, eax
je 0x6d1321
xor al, al
jmp 0x6d142b
mov ecx, dword [ebp + 8]
call fcn.006b7480
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x6d133b
xor al, al
jmp 0x6d142b
mov dword [ebp - 0x268], 0
lea ecx, [ebp - 0x260]
push ecx
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x27c], esp
mov edx, dword [ebp + 0xc]
push edx
call fcn.00438f40
mov dword [ebp - 0x280], eax
mov dword [ebp - 4], 0
lea eax, [ebp - 0x278]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.006d0dd0
add esp, 0x20
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x270], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x270]
call fcn.006b7480
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x274], eax
mov edx, dword [ebp - 0x274]
mov dword [ebp - 0x264], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.004e055e
cmp dword [ebp - 0x264], 0xffffffff
je 0x6d13e6
cmp dword [ebp - 0x264], 0
jne 0x6d13ea
xor al, al
jmp 0x6d142b
cmp dword [ebp - 0x260], 0x10
je 0x6d1402
mov eax, dword [ebp - 0x268]
add eax, 1
mov dword [ebp - 0x268], eax
lea ecx, [ebp - 0x260]
push ecx
mov edx, dword [ebp - 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x6d13ea
cmp dword [ebp - 0x268], 2
jle 0x6d1429
mov al, 1
jmp 0x6d142b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00700c25
mov esp, ebp
pop ebp
ret

Function at 0x6d9f00
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 8]
push str.hide_window__0x_x
call fcn.007552b0
pop ecx
pop ecx
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x6db2c0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push str.ProgressMainWindow__BringToTop
mov ebx, ecx
call fcn.007552b0
cmp dword [ebx + 8], 0
pop ecx
je 0x6d9447
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
push esi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 3
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SetFocus]
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SetActiveWindow]
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
ret
push esi
mov esi, ecx
push dword [esi + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x6db2f6
push dword [esi + 0x20]
push dword [esi + 8]
push str.show_window__0x_x___d
call fcn.007552b0
add esp, 0xc
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
jmp 0x6d939c
pop esi
ret

Function at 0x6db2f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
push 0x42d
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x433
push dword [esi + 8]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [ebp + 8], 0
mov esi, eax
je 0x6db344
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push str.ProgressMainWindow__showReportText
call fcn.007552b0
pop ecx
jmp 0x6db356
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4
Function at 0x703d37
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x736521
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00736397

Function at 0x73bdef
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0073b942

Function at 0x74879d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x844274
push dword [ebp + 8]
lea eax, [ebp - 8]
xor esi, esi
push eax
mov dword [ebp - 8], esi
call fcn.00721bfb
add esp, 0xc
xor eax, eax
cmp dword [ebp - 8], esi
je 0x74880f
push edi
push dword [ebp - 8]
xor edi, edi
mov word [ebp - 4], ax
push 2
inc edi
lea eax, [ebp - 4]
push edi
push eax
call fcn.00721ff9
add esp, 0x10
test eax, eax
je 0x7487fd
mov ax, word [ebp - 4]
cmp al, 0x37
jne 0x7487f3
cmp ah, 0x7a
jne 0x7487fd
push 2
pop esi
jmp 0x7487fd
cmp al, 0x60
jne 0x7487fd
cmp ah, 0xea
cmove esi, edi
cmp dword [ebp - 8], 0
pop edi
je 0x74880d
push dword [ebp - 8]
call fcn.00721d8f
pop ecx
mov eax, esi
pop esi
leave
ret

Function at 0x748812
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
push 0
push eax
call fcn.00719250
push 0x5c
pop eax
push eax
push esi
call fcn.0071ac87
mov edi, eax
add esp, 0x14
test edi, edi
je 0x7488c2
push esi
call fcn.00722cd6
mov ebx, dword [ebp + 0xc]
pop ecx
test ebx, ebx
jne 0x748869
push 0x5c
pop ecx
cmp word [esi + eax*2 - 2], cx
jne 0x74886f
mov eax, edi
sub eax, esi
sar eax, 1
push eax
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0072b5b3
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x7488bd
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00748812
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
inc eax
jmp 0x7488c4
cmp eax, 0x10
je 0x7488b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00700c25
leave
ret
Function at 0x7488d3
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x8d3fc4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.00719250
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x220]
push eax
push 5
mov dword [ebp - 0x220], 0x804d80
mov dword [ebp - 0x21c], 0x852cf8
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], 0x805624
call fcn.0074b5d2
pop ecx
mov esi, eax
lea eax, [ebp - 0x20c]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
neg esi
sbb esi, esi
xor ecx, ebp
and esi, 2
mov eax, esi
pop esi
call fcn.00700c25
leave
ret
Function at 0x749c71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x3c
mov eax, 0x7d22eb
call fcn.00700ca1
mov edi, dword [ebp + 0x10]
mov eax, edi
movzx ecx, word [ebp + 0x14]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
shr eax, 4
inc eax
mov dword [ebp - 0x44], esi
push ecx
movzx eax, ax
push eax
push 6
push ebx
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x749cd2
push 0x409
push dword [ebp - 0x44]
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
jne 0x749cd2
and dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x749d8f
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x749cbd
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
and dword [ebp - 0x18], 0
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
test ecx, ecx
je 0x749d40
and edi, 0xf
jbe 0x749d14
movzx eax, word [ecx]
lea ecx, [ecx + eax*2]
add ecx, 2
sub edi, 1
jne 0x749d06
movzx eax, word [ecx]
push eax
lea eax, [ecx + 2]
push eax
lea ecx, [ebp - 0x40]
call fcn.00516bcc
lea ecx, [ebp - 0x28]
cmp ecx, eax
je 0x749d38
mov byte [ebp - 0x44], 0
push dword [ebp - 0x44]
push eax
call fcn.004cc546
lea ecx, [ebp - 0x40]
call fcn.004c0931
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004c2b5d
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x749d8f
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
cmp eax, 0x1000
jb 0x749d86
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004343f0
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.007009b8
pop ecx
pop ecx
mov eax, esi
call fcn.00700c4b
ret

Function at 0x74a445
Capabilities:
Create process on windows

Disassembly:
xor edx, edx
cmp dword [ecx + 0xf4], edx
je 0x74a46e
lea eax, [ecx + 0xe4]
cmp dword [eax + 0x14], 8
jb 0x74a45d
mov eax, dword [eax]
push 5
push edx
push edx
push eax
push 0x80a248
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret