joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417c92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x417cfb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x417d3c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x417d21
mov ecx, ebx
call fcn.00417980
add ebx, 0x28
dec ebp
jne 0x417d15
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x417d37
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.004178b0
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.00417de0
mov ebx, eax
cmp ebx, edi
jne 0x417d9f
lea ecx, [ebp + 0x20]
call fcn.00418ac0
mov ebx, eax
cmp ebx, edi
jne 0x417d9f
lea ecx, [ebp + 0x1c]
call fcn.00418ac0
mov ebx, eax
cmp ebx, edi
jne 0x417d9f
push ebp
call fcn.00417e30
mov ebx, eax
cmp ebx, edi
je 0x417db4
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.00417e10
cmp ebx, edi
jle 0x417daf
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x417db4
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x417dc6
cmp dword [esi + 0x40], edi
jne 0x417dc6
cmp dword [esi + 0x3c], edi
jne 0x417dc6
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x418a80
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x418aa9
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x418ab8
mov eax, 1
ret 4
Function at 0x40593b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004032d6
and dword [ebp - 0x14], 0
cmp dword [0x40b7d8], 0
mov dword [ebp - 0x18], eax
jne 0x4059ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405a96
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405a96
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b7e0], eax
call edi
push eax
call esi
mov dword [0x40b7e8], eax
test eax, eax
je 0x4059ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b7e4], eax
mov eax, dword [0x40b7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405a47
cmp dword [0x40b7e8], ecx
je 0x405a47
push eax
call esi
push dword [0x40b7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405a47
test ebx, ebx
je 0x405a47
call edi
test eax, eax
je 0x405a3e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405a3e
test byte [ebp - 8], 1
jne 0x405a47
or dword [ebp + 0x10], 0x200000
jmp 0x405a7a
mov eax, dword [0x40b7dc]
cmp eax, dword [ebp - 0x18]
je 0x405a7a
push eax
call esi
test eax, eax
je 0x405a7a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405a7a
mov eax, dword [0x40b7e0]
cmp eax, dword [ebp - 0x18]
je 0x405a7a
push eax
call esi
test eax, eax
je 0x405a7a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b7d8]
call esi
test eax, eax
je 0x405a96
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405a98
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040269a
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x1004447
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x1013054]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1013f80], 0
push esi
push edi
mov esi, 0x1013f80
jne 0x100450e
mov edi, 0x104
push edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1004497
push 0x100136c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10045a5
push 0x1001364
lea eax, [ebp - 0x120]
push eax
push 0x100135c
lea eax, [ebp - 0x224]
push edi
push eax
call fcn.0100440c
add esp, 0x14
test eax, eax
jns 0x10044c3
push 0x1001338
jmp 0x100448c
push 0
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10044ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10044ea
push 0x1001308
jmp 0x100448c
push 0x10012f4
push 0x10012f0
lea eax, [ebp - 0x120]
push eax
push 0x10012e8
push edi
push esi
call fcn.0100440c
add esp, 0x18
test eax, eax
js 0x10044bc
push 0x10012e4
push esi
call fcn.01008339
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100452b
push 0x10012b8
jmp 0x100448c
lea eax, [ebp - 0x1c]
push eax
call fcn.01008257
lea eax, [ebp - 0x10]
push eax
call fcn.01008179
pop ecx
pop ecx
lea eax, [ebp - 0x10]
test ebx, ebx
je 0x100456c
push ebx
push 0x10012b0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x10012a0
lea eax, [ebp - 0x47c]
push 0x258
push eax
call fcn.0100440c
add esp, 0x1c
jmp 0x100458f
push 0x10012b0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x100128c
lea eax, [ebp - 0x47c]
push 0x258
push eax
call fcn.0100440c
add esp, 0x18
lea eax, [ebp - 0x47c]
push esi
push eax
call fcn.01007fbb
push esi
call fcn.01007f42
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01008355
leave
ret
Function at 0x1004603
Capabilities:
Create directory
Get common file path
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1013054]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1014088], 0
push esi
push edi
mov esi, 0x1014088
jne 0x10046ca
mov edi, 0x104
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x1004653
push 0x100136c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10046f7
push 0x1001364
lea eax, [ebp - 0x108]
push eax
push 0x100135c
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0100440c
add esp, 0x14
test eax, eax
jns 0x100467f
push 0x1001338
jmp 0x1004648
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10046a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10046a6
push 0x1001308
jmp 0x1004648
push 0x100139c
push 0x10012f0
lea eax, [ebp - 0x108]
push eax
push 0x10012e8
push edi
push esi
call fcn.0100440c
add esp, 0x18
test eax, eax
js 0x1004678
push 0x10012e4
push esi
call fcn.01008339
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10046e7
push 0x10012b8
jmp 0x1004648
push esi
push ebx
call fcn.01007fbb
push esi
call fcn.01007f42
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01008355
leave
ret

Function at 0x1004b9f
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 4]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x1004bef
push esi
call fcn.01004af9
test eax, eax
jne 0x1004bde
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x10016e8
call fcn.010045b8
add esp, 0xc
jmp 0x1004beb
push esi
push 0x10016a0
call fcn.010045b8
pop ecx
pop ecx
xor eax, eax
jmp 0x1004c64
push edi
call fcn.01008579
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x1004c1c
push 0x1001684
push ebx
push ebx
push 0x100166c
push 0x158
push 0x10015ac
call fcn.0100470a
add esp, 0x18
jmp 0x1004beb
push edi
push ebx
push esi
call fcn.01008600
add esp, 0xc
push esi
push edi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1004c62
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001654
push 0x100166c
push 0x161
push 0x10015ac
call fcn.0100470a
push esi
call fcn.0100850b
add esp, 0x1c
jmp 0x1004beb
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1004d14
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x1001814
push 0x80000002
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
je 0x1004d69
push ebx
push eax
push 0x1001800
push 0x10017ec
push 0x194
push 0x10017b8
call fcn.0100470a
add esp, 0x18
xor eax, eax
jmp 0x1004e28
push esi
push edi
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push 0x10017b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, 0x10017ec
mov esi, 0x10017b8
cmp eax, ebx
jne 0x1004de7
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
push 0x10012b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x1004e00
push ebx
push eax
push 0x10017a0
push edi
push 0x19d
push esi
call fcn.0100470a
add esp, 0x18
push 0x1001798
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, ebx
je 0x1004dfd
cmp eax, 2
je 0x1004dfd
push ebx
push eax
push 0x1001784
push edi
push 0x1a1
jmp 0x1004df4
push ebx
push eax
push 0x10017a0
push edi
push 0x1a7
push esi
call fcn.0100470a
add esp, 0x18
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x1004e23
push ebx
push eax
push 0x1001774
push edi
push 0x1ac
push esi
call fcn.0100470a
add esp, 0x18
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1004e32
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x1001814
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004edd
push ebx
push 0x10012b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, 0x1001784
mov edi, 0x1001850
mov esi, 0x10017b8
test eax, eax
je 0x1004e94
cmp eax, 2
je 0x1004e94
push 0
push eax
push ebx
push edi
push 0x1cd
push esi
call fcn.0100470a
add esp, 0x18
push 0x1001798
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x1004ebe
cmp eax, 2
je 0x1004ebe
push 0
push eax
push ebx
push edi
push 0x1d2
push esi
call fcn.0100470a
add esp, 0x18
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
test eax, eax
je 0x1004efc
push 0
push eax
push 0x1001840
push edi
push 0x1d6
push esi
jmp 0x1004ef4
push 0
push eax
push 0x1001830
push 0x1001850
push 0x1d8
push 0x10017b8
call fcn.0100470a
add esp, 0x18
pop edi
pop esi
leave
ret
Function at 0x10053cb
Capabilities:
Get common file path
Get file size
Print debug messages
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x41
pop esi
push 0x104
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100541b
push 0x1001a10
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
jmp 0x100553e
push 0x10012f4
push 0x10012f0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.010051fd
test eax, eax
jne 0x1005443
push 0x10019cc
jmp 0x100540e
push edi
push ebx
push ebx
push 3
push ebx
push ebx
push 0x80000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x218], edi
cmp edi, 0xffffffff
je 0x1005537
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x100550c
push esi
call fcn.01008579
pop ecx
mov dword [ebp - 0x210], eax
cmp eax, ebx
je 0x100550c
push ebx
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 0x210]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100550c
push 0x10019b4
push dword [ebp - 0x210]
call fcn.01008480
pop ecx
pop ecx
cmp eax, ebx
je 0x100550c
mov esi, 0x10019a8
push esi
push eax
call fcn.01008480
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x100550c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
push 0x20
push edi
call fcn.010083b0
pop ecx
pop ecx
cmp eax, ebx
je 0x10054ee
mov byte [eax], bl
push edi
call fcn.0100894e
pop ecx
mov ecx, eax
mov eax, 0x3ff
add ecx, eax
shr ecx, 0xa
add ecx, eax
shr ecx, 0xa
mov dword [ebp - 0x214], ecx
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x210], ebx
je 0x100552c
push dword [ebp - 0x210]
call fcn.0100850b
pop ecx
push 0x41
pop eax
cmp dword [ebp - 0x214], eax
jb 0x100553d
mov eax, dword [ebp - 0x214]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01008355
leave
ret
Function at 0x10056fc
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
xor edi, edi
lea eax, [ebp - 0x117]
push edi
push eax
mov byte [ebp - 0x118], 0
call fcn.01008600
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1005883
lea eax, [ebp - 0x118]
push eax
push 0x1001ae8
call fcn.01005253
test eax, eax
je 0x1005781
lea eax, [ebp - 0x118]
push eax
push 0x1001ad8
call fcn.01005253
test eax, eax
jne 0x10058a7
push 0x1001ac8
jmp 0x1005786
push 0x1001abc
push 0xd
lea eax, [ebp - 0x14]
push eax
call fcn.01005110
push ebx
lea eax, [ebp - 0x14]
push eax
push 0x1001aa8
push edi
push edi
mov ebx, 0x1001a9c
push ebx
push 0x289
mov edi, 0x10017b8
push edi
call fcn.0100470a
add esp, 0x1c
push esi
lea eax, [ebp - 0x21c]
push eax
push 0xd9
push dword [0x1014294]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x1005801
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001998
push ebx
push 0x28c
push edi
call fcn.0100470a
add esp, 0x18
push 0x1001a88
push esi
lea eax, [ebp - 0x21c]
push eax
call fcn.01005110
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0100514c
add esp, 0x10
push esi
lea eax, [ebp - 0x21c]
push eax
push 0x64
push dword [0x1014294]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x1005864
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001998
push ebx
push 0x292
push edi
call fcn.0100470a
add esp, 0x18
push 0x1001978
push esi
lea eax, [ebp - 0x21c]
push eax
call fcn.01005110
push 0x10
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
push dword [0x10142a8]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
jmp 0x10058a7
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001a70
push 0x1001a9c
push 0x285
push 0x10017b8
call fcn.0100470a
add esp, 0x18
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01008355
leave
ret
Function at 0x10060d4
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 0xbb9
push dword [ecx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
movzx eax, word [ebp + 8]
shl eax, 0x10
push eax
push 0
push 0x401
push edi
call esi
push 0
push 0
push 0x402
push edi
call esi
push 0
push 1
push 0x404
push edi
call esi
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10063a8
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
cmp eax, edi
je 0x10063cf
push edi
push edi
push 0x46b
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1006343
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
cmp eax, edi
jne 0x1006411
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001edc
push 0x1001ec8
push 0xce
push 0x1001e94
call fcn.0100470a
add esp, 0x18
xor eax, eax
jmp 0x1006414
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x10068f3
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1013054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101303c]
cmp eax, 0xffffffff
je 0x1006920
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x10069df
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10069b0
push 0x1001fb0
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01006835
xor esi, esi
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005253
test eax, eax
je 0x10069d6
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01004c70
test eax, eax
je 0x100699d
cmp dword [ebp - 0x134], 0x50001
jne 0x10069d6
mov eax, dword [ebp - 0x130]
shr eax, 0x10
mov ecx, 0xa28
cmp ax, cx
jne 0x10069d6
xor eax, eax
inc eax
mov dword [0x101303c], eax
jmp 0x10069de
push 0x10018bc
push esi
push esi
push 0x1001fa0
push 0x9e
jmp 0x10069c9
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f88
push 0x1001fa0
push 0xa1
push 0x1001f54
call fcn.0100470a
add esp, 0x18
mov dword [0x101303c], esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01008355
leave
ret
Function at 0x10069f0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1013054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1013040]
cmp eax, 0xffffffff
je 0x1006a1d
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1006ac9
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1006a9a
push 0x1001fb0
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01006835
xor esi, esi
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005253
test eax, eax
je 0x1006ac0
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01004c70
test eax, eax
je 0x1006a87
cmp dword [ebp - 0x134], 0x50002
jne 0x1006ac0
xor eax, eax
inc eax
mov dword [0x1013040], eax
jmp 0x1006ac8
push 0x10018bc
push esi
push esi
push 0x1001fc0
push 0xb9
jmp 0x1006ab3
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001f88
push 0x1001fc0
push 0xbc
push 0x1001f54
call fcn.0100470a
add esp, 0x18
mov dword [0x1013040], esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01008355
leave
ret

Function at 0x1006b76
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1013054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1013048]
cmp eax, 0xffffffff
je 0x1006ba0
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1006bf8
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x1006bf1
cmp dword [ebp - 0x94], 4
jne 0x1006bf1
cmp dword [ebp - 0x90], 0xa
jne 0x1006bf1
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
je 0x1006bf1
call fcn.01006ada
test eax, eax
jne 0x1006bf1
inc eax
jmp 0x1006bf3
xor eax, eax
mov dword [0x1013048], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01008355
leave
ret

Function at 0x1006c09
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1013054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101304c]
cmp eax, 0xffffffff
je 0x1006c33
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x1006c99
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 1
jne 0x1006c92
cmp dword [ebp - 0x94], 4
jne 0x1006c92
cmp dword [ebp - 0x90], 0xa
jne 0x1006c92
mov eax, dword [ebp - 0x8c]
shr eax, 0x10
mov ecx, 0x45a
cmp ax, cx
je 0x1006c92
mov eax, 0x8ae
cmp word [ebp - 0x8c], ax
jb 0x1006c92
call fcn.01006ada
test eax, eax
jne 0x1006c92
inc eax
jmp 0x1006c94
xor eax, eax
mov dword [0x101304c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01008355
leave
ret