joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d96
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1009088]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
xor esi, esi
push esi
push 0x208
mov ecx, 0x82
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x414]
push eax
push ebx
push esi
push edx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x420], ebx
call dword [sym.imp.SETUPAPI.dll_SetupGetTargetPathW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1001e81
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x20c]
push eax
call edi
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1001e81
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x1009b14
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1001e81
lea eax, [ebp - 0x20c]
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp + eax*2 - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
push ebx
lea eax, [ebp - 0x414]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
lea edi, [ebp - 0x430]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x430]
push eax
push esi
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x1001f66
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [0x1009d54], esi
jne 0x1001f66
lea eax, [ebp - 0x418]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x418], esi
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
mov eax, dword [ebp - 0x418]
cmp eax, esi
je 0x1001f50
lea eax, [eax + eax + 2]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, esi
je 0x1001f50
push esi
push dword [ebp - 0x418]
lea eax, [ebp - 0x430]
push edi
push esi
push esi
push esi
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
je 0x1001f45
cmp word [edi], si
je 0x1001f45
push 0x2c
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x1001f33
mov word [eax], si
cmp word [edi], si
je 0x1001f45
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01001c37
push edi
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [ebp - 0x430]
push eax
push eax
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
jne 0x1001eb5
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret 0xc
Function at 0x100249e
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1009088]
push ebx
push esi
push edi
push 0xa
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push 0x28
lea eax, [ebp - 0x240]
push eax
push 3
xor ebx, ebx
mov esi, 0x10012fc
push esi
push ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x218], ebx
call sub.WINSPOOL.DRV_EnumPrinterDriversW
test eax, eax
jne 0x1002547
cmp dword [ebp - 0x214], ebx
jbe 0x1002547
push dword [ebp - 0x214]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
mov dword [ebp - 0x218], eax
je 0x1002655
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x214]
push ecx
push dword [ebp - 0x214]
push eax
push 3
push esi
push ebx
call sub.WINSPOOL.DRV_EnumPrinterDriversW
cmp dword [ebp - 0x210], ebx
jbe 0x1002639
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp dword [ebp - 0x210], ebx
jbe 0x1002639
mov edi, dword [ebp - 0x218]
add edi, 0xc
cmp dword [edi - 8], ebx
je 0x100262a
mov eax, dword [edi]
cmp eax, ebx
je 0x10025ae
cmp word [eax], bx
je 0x10025ae
push eax
push ebx
call fcn.01001c37
xor esi, esi
inc esi
cmp eax, ebx
je 0x10025b1
mov dword [eax + 0x24], esi
jmp 0x10025b1
xor esi, esi
inc esi
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x10025cb
cmp word [eax], bx
je 0x10025cb
push eax
push ebx
call fcn.01001c37
cmp eax, ebx
je 0x10025cb
mov dword [eax + 0x24], esi
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x10025e5
cmp word [eax], bx
je 0x10025e5
push eax
push ebx
call fcn.01001c37
cmp eax, ebx
je 0x10025e5
mov dword [eax + 0x24], esi
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x10025ff
cmp word [eax], bx
je 0x10025ff
push eax
push ebx
call fcn.01001c37
cmp eax, ebx
je 0x10025ff
mov dword [eax + 0x24], esi
mov esi, dword [edi + 0x10]
cmp esi, ebx
je 0x100262a
cmp word [esi], bx
je 0x100262a
push esi
push ebx
call fcn.01001c37
cmp eax, ebx
je 0x1002621
mov dword [eax + 0x24], 1
jmp 0x1002621
inc esi
inc esi
cmp word [esi], bx
jne 0x100261f
inc esi
inc esi
jne 0x1002606
add edi, 0x28
dec dword [ebp - 0x210]
jne 0x1002587
cmp dword [ebp - 0x218], ebx
je 0x1002655
push dword [ebp - 0x218]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret
Function at 0x1002667
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1009088]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x214], eax
push 0x4a
lea eax, [ebp - 0x20c]
push eax
call fcn.01005095
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.010029a3
mov edi, eax
test edi, edi
je 0x1002712
cmp word [edi], 0
je 0x1002712
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x1009704
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1002712
lea eax, [ebp - 0x210]
push eax
push ebx
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x210]
and word [eax], 0
push ebx
call esi
xor eax, eax
inc eax
jmp 0x1002714
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret 8

Function at 0x1002728
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1009088]
push esi
mov dword [ebp - 4], eax
push 0x5e
lea eax, [ebp - 0x20c]
push eax
xor esi, esi
call fcn.01005095
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1002805
push edi
mov ecx, 0x82
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
push 0x5f
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x41c], 0x208
call fcn.01005095
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop edi
jne 0x10027f9
push 0x60
lea eax, [ebp - 0x20c]
push eax
call fcn.01005095
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10027f9
inc esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.01006e99
leave
ret
Function at 0x1002817
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1009088]
push edi
push 0x45
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x118]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x1002881
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x13c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x13c], 2
jne 0x1002881
xor eax, eax
inc eax
jmp 0x1002883
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
call fcn.01006e99
leave
ret

Function at 0x1002db1
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4cc
mov eax, dword [0x1009088]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x4c4], 1
call fcn.010051d2
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
and word [ebp - 0x206], 0
push 0x4001
mov edi, 0x2b4
push edi
lea eax, [ebp - 0x4c0]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x4000
push edi
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0x4c0]
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
cmp dword [ebp - 0x4c8], edi
mov dword [ebp - 0x4cc], eax
je 0x1002e66
cmp eax, edi
je 0x1002e66
push dword [ebp - 0x4c8]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov edi, 0x1003
push edi
push ebx
call esi
push dword [ebp - 0x4cc]
push 0
push edi
push ebx
call esi
jmp 0x1002e6c
mov dword [ebp - 0x4c4], edi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret 4
Function at 0x100397b
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1009088]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [0x10092ec]
test eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], edi
je 0x10039ad
push eax
push 0xfffffffffffffff2
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [0x1009d44]
mov dword [0x10090bc], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov dword [0x10092e4], edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10039e0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, 0x100990c
push esi
push 0x3fa
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor eax, eax
cmp dword [0x1009d44], eax
setne al
push eax
push 0x3fd
push edi
call dword [sym.imp.USER32.dll_CheckDlgButton]
cmp dword [0x1009d44], 0
je 0x1003a24
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003a24
xor eax, eax
inc eax
jmp 0x1003a26
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x3fe
push edi
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov eax, dword [0x1009d40]
neg eax
sbb eax, eax
mov ebx, 0x3fc
add eax, ebx
push eax
push ebx
push 0x3fb
push dword [ebp - 0x210]
call dword [sym.imp.USER32.dll_CheckRadioButton]
push dword [0x1009d44]
push ebx
mov ebx, dword [ebp - 0x210]
push ebx
call esi
push eax
call edi
push dword [0x1009d44]
push 0x3fb
push ebx
call esi
push eax
call edi
push dword [0x1009d44]
push 0x3fa
push ebx
call esi
push eax
call edi
push dword [0x10092e0]
mov esi, dword [sym.imp.USER32.dll_SetForegroundWindow]
call esi
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.01006e99
leave
ret 0xc

Function at 0x1003abe
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1009088]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x104
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
push 0x3fa
push ebx
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
test eax, eax
je 0x1003b18
cmp dword [0x1009d44], 0
je 0x1003b13
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003b13
xor eax, eax
inc eax
jmp 0x1003b15
xor eax, eax
push eax
jmp 0x1003b1a
push 0
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3fe
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
push dword [0x1009d44]
push 0x3fc
push ebx
call esi
push eax
call edi
push dword [0x1009d44]
push 0x3fb
push ebx
call esi
push eax
call edi
push dword [0x1009d44]
push 0x3fa
push ebx
call esi
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret 4
Function at 0x1003b78
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1009088]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1003bae
and word [ebp - 0x20c], ax
push esi
lea eax, [ebp - 0x414]
push eax
push 0x3fa
push edi
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
test eax, eax
jne 0x1003bcf
push 0x21
call fcn.01005193
jmp 0x1003bea
push 5
lea eax, [ebp - 0x20c]
push eax
push 0
lea eax, [ebp - 0x414]
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01006e99
leave
ret 4

Function at 0x1003bfd
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1009088]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x214], eax
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x20c]
push 0x104
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20c]
push eax
push 0x3fa
push esi
mov dword [ebp - 0x218], esi
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
test eax, eax
mov dword [ebp - 0x210], eax
je 0x1003ccc
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 0
mov ebx, 0x80
push ebx
push 3
push 0
push 1
mov edi, 0xc0000000
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
cmp eax, 0xffffffff
je 0x1003c87
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003cbc
push 0
push ebx
push 1
push 0
push 1
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
cmp eax, 0xffffffff
je 0x1003cb5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1003cbc
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0
pop ebx
jne 0x1003cf4
mov esi, dword [ebp - 0x218]
cmp dword [ebp + 0x10], 0
je 0x1003ceb
mov edi, dword [0x10092e0]
push 0x21
mov dword [0x10092e0], esi
call fcn.01005193
mov dword [0x10092e0], edi
cmp dword [ebp - 0x210], 0
je 0x1003d1a
cmp dword [ebp - 0x214], 0
je 0x1003d1a
cmp word [ebp - 0x20c], 0
je 0x1003d1a
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
pop esi
call fcn.01006e99
leave
ret 0xc
Function at 0x1003d33
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1009088]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.01003bfd
test eax, eax
je 0x1003e2f
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x100990c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x3fb
push esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [0x1009d40], eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x1001340
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1003e2a
cmp dword [0x1009d44], ebx
mov dword [ebp - 0x210], ebx
je 0x1003dda
mov dword [ebp - 0x210], 1
cmp dword [0x1009d40], ebx
je 0x1003de9
or dword [ebp - 0x210], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x210]
push eax
push 4
push ebx
push 0x1001334
push dword [ebp - 0x214]
call esi
push 0x104
push edi
push 1
push ebx
push 0x1001324
push dword [ebp - 0x214]
call esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1003e31
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret 4
Function at 0x1003f95
Capabilities:
Set current directory
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x1009088]
and word [ebp - 0x824], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov esi, dword [0x1009d1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x82c], eax
jmp 0x100414a
cmp dword [esi + 0x20], 0
jne 0x1004147
push dword [esi + 4]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x100405a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push dword [esi + 4]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x2a
lea eax, [ebp - 0x61c]
push eax
call fcn.01005095
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x82c]
call edi
push 0x2c
lea eax, [ebp - 0x61c]
push eax
call fcn.01005095
push dword [esi]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x82c]
call edi
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1004147
cmp eax, 2
jne 0x10040e9
push 0x1a
lea eax, [ebp - 0x414]
push eax
call fcn.01005095
push 0
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x82c]
call edi
jmp 0x1004147
xor ecx, ecx
push ecx
push ecx
lea edx, [ebp - 0x828]
push edx
push 0x400
push eax
push ecx
push 0x1300
mov dword [ebp - 0x828], ecx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1004147
cmp dword [ebp - 0x828], 0
je 0x1004147
push 0
lea eax, [ebp - 0x830]
push eax
push dword [ebp - 0x828]
call ebx
shl eax, 1
push eax
push dword [ebp - 0x828]
push dword [ebp - 0x82c]
call edi
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [esi + 0x3c]
test esi, esi
jne 0x1003fd3
push 0x34
lea eax, [ebp - 0x414]
push eax
call fcn.01005095
push esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x414]
push eax
call ebx
shl eax, 1
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x82c]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret 4
Function at 0x100586a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [0x1009d50], eax
jne 0x100588d
lea ecx, [ebp - 4]
push ecx
push eax
push eax
push 0x10055a2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 4

Function at 0x1005c03
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x1009088]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
push 0x4401
xor eax, eax
mov ecx, 0xad
lea edi, [ebp - 0x2b8]
push 0x2b4
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2b8]
push eax
push 0
push dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp word [ebp - 0xa4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [esi + 0x18], eax
je 0x1005c90
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [esi + 0x14], eax
je 0x1005c96
lea ecx, [ebp - 0xa4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1005c96
push esi
call fcn.01005b00
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01006e99
leave
ret 4
Function at 0x1005ca9
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1009088]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x420]
push eax
push dword [edi]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
test esi, esi
je 0x1005dc6
lea eax, [esi + 1]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [ebp - 0x418], eax
je 0x1005dc6
push eax
push esi
push dword [ebp - 0x420]
push dword [edi]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1005db5
and dword [ebp - 0x41c], 0
and dword [ebp - 0x424], 0
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x10013d8
push dword [ebp - 0x418]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1005db5
mov esi, dword [ebp - 0x41c]
push 0x2b
lea eax, [ebp - 0x414]
push eax
call fcn.01005095
movzx eax, word [esi + 0xc]
push eax
movzx eax, word [esi + 0xe]
push eax
movzx eax, word [esi + 8]
push eax
movzx eax, word [esi + 0xa]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [edi + 8], eax
je 0x1005db5
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x418]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [edi + 8], 0
jne 0x1005e0c
push 0x1f
lea eax, [ebp - 0x20c]
push eax
call fcn.01005095
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [edi + 8], eax
je 0x1005e0c
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01006e99
leave
ret 4