joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b75b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b764e
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x4b7612
cmp byte [ebx + 0x10], 0
jne 0x4b7612
cmp byte [ebx + 0x3c], 0
jne 0x4b7612
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4b7633
lea edx, [ebp - 4]
mov eax, dword [0x5a465c]
call fcn.0040cca4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48ed20]
call fcn.00422c1c
call fcn.0040880c
jmp 0x4b7633
lea edx, [ebp - 8]
mov eax, dword [0x5a465c]
call fcn.0040cca4
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48ed20]
call fcn.00422c1c
call fcn.0040880c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7655
lea eax, [ebp - 8]
mov edx, 2
call fcn.004091e4
ret

Function at 0x4b7fec
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b803a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004b7430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8053
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b805c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004b7430
dec esi
jne 0x4b807e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x4dac78
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
call sub.kernel32.dll_GetCurrentProcess
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtectEx
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteProcessMemory
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtectEx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4db214
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp], edx
mov edi, eax
lea ebx, [0x54b7b4]
lea esi, [esp + 4]
lea ecx, [esp + 8]
mov edx, esi
mov eax, dword [esp]
call fcn.004db3aa
lea edx, [esp + 8]
mov eax, esi
call fcn.004db3d4
mov edx, edi
mov ecx, 8
mov eax, dword [esp + 8]
shr eax, 4
mov edi, dword [esp + 8]
shl edi, 0x1c
or eax, edi
xor eax, dword [edx]
add edx, 4
mov edi, eax
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x600]
xor dword [esi], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x400]
xor dword [esi], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x200]
xor dword [esi], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4]
xor dword [esi], eax
mov eax, dword [esp + 8]
xor eax, dword [edx]
add edx, 4
mov edi, eax
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x700]
xor dword [esi], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x500]
xor dword [esi], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x300]
xor dword [esi], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4 + 0x100]
xor dword [esi], eax
mov eax, dword [esi]
shr eax, 4
mov edi, dword [esi]
shl edi, 0x1c
or eax, edi
xor eax, dword [edx]
add edx, 4
mov edi, eax
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x600]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x400]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x200]
xor dword [esp + 8], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4]
xor dword [esp + 8], eax
mov eax, dword [esi]
xor eax, dword [edx]
add edx, 4
mov edi, eax
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x700]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 8
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x500]
xor dword [esp + 8], edi
mov edi, eax
shr edi, 0x10
and edi, 0x3f
mov edi, dword [ebx + edi*4 + 0x300]
xor dword [esp + 8], edi
shr eax, 0x18
and eax, 0x3f
mov eax, dword [ebx + eax*4 + 0x100]
xor dword [esp + 8], eax
dec ecx
jne 0x4db249
lea edx, [esp + 8]
mov eax, esi
call fcn.004db44f
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov eax, dword [esi]
call fcn.004db4ce
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x5012dc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.00409184
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x50130d
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040930c
add esp, 0x24
pop ebx
ret
Function at 0x53d438
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x53d5b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, 0x53d5d4
call fcn.004daf00
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x10
call fcn.00409b34
lea eax, [ebp - 0x14]
call fcn.00409738
mov edx, eax
mov eax, 0x5a3f08
mov ecx, 0x10
call fcn.00406840
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x10]
call fcn.00409738
add eax, 4
mov bl, byte [eax]
lea eax, [ebp - 0x14]
call fcn.00409738
mov edx, dword [ebp - 0x1c]
lea eax, [eax + edx - 1]
xor byte [eax], bl
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
jne 0x53d4a0
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, 6
call fcn.00409b34
lea eax, [ebp - 0xc]
call fcn.00409738
mov word [eax], 0x400
lea eax, [ebp - 0xc]
call fcn.00409738
add eax, 2
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov byte [ebp - 0x21], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x53d50e
mov eax, dword [ebp - 0x2c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
jle 0x53d53b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0xc]
call fcn.00409738
mov edx, dword [ebp - 0x20]
lea eax, [eax + edx - 1]
mov al, byte [eax]
add byte [ebp - 0x21], al
inc dword [ebp - 0x20]
dec dword [ebp - 0x28]
jne 0x53d51f
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00409648
lea eax, [ebp - 0x18]
call fcn.00409738
add eax, 7
mov dl, byte [ebp - 0x21]
mov byte [eax], dl
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.004db548
lea ecx, [ebp - 0x30]
mov edx, 0xe6
xor eax, eax
call fcn.0040a448
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0xc]
call fcn.00409960
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004db658
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.004099b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d5c0
lea eax, [ebp - 0x30]
call fcn.004091a8
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00409214
ret

Function at 0x930164
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x93016a
pop ebp
sub ebp, 6
sub ebp, 0x530164
jmp 0x9301c8
jmp 0x9301d1
mov eax, 0x530164
add eax, ebp
add eax, 0x93
mov ecx, 0x638
mov edx, 0xfa0b5b87
xor byte [eax], dl
inc eax
dec ecx
jne 0x9301e8
jmp 0x9301fb
in eax, dx
invalid
Function at 0x10456058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104561a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1045607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045606a
add dl, dl
jne 0x10456089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104560dc
xor eax, eax
add dl, dl
jne 0x10456096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1045617d
add dl, dl
jne 0x104560a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104560b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104560bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104560c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104560d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10456075
mov eax, 1
add dl, dl
jne 0x104560ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104560f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104560e1
sub eax, ebx
mov ebx, 1
jne 0x10456128
mov ecx, 1
add dl, dl
jne 0x1045610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10456119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10456105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10456075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1045613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1045614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10456136
cmp eax, 0x7d00
jae 0x1045616d
cmp eax, 0x500
jb 0x10456168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10456075
cmp eax, 0x7f
ja 0x10456170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10456075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1045619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10456075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10001690
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x101ce4f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
mov dword [ebp - 0x110], 0x2e4b415c
mov dword [ebp - 0x10c], 0x747874
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x110]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100016e0
push esi
push edi
lea edi, [ebp - 0x108]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x100016f4
mov ecx, eax
shr ecx, 2
push 0
rep movsd dword es:[edi], dword [esi]
push 0x80
push 3
push 0
push 1
mov ecx, eax
push SysReAllocString
lea edx, [ebp - 0x108]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000176e
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call fcn.10011dee
add esp, 4
push 0
mov edi, eax
lea eax, [ebp - 0x10c]
push eax
push ebx
push edi
push esi
mov dword [ebp - 0x10c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop ebx
test edi, edi
je 0x1000176e
push edi
call fcn.10001010
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.101056ba
mov esp, ebp
pop ebp
ret

Function at 0x1002440b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10024452
call fcn.100160c4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10024452
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1002446e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.10023f0b
mov esi, eax
test edi, edi
je 0x1002446c
test ebx, ebx
je 0x1002446c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1002484d
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x10124edf
call fcn.10106837
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x10024872
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x100248c4
call fcn.100198aa
push eax
lea ecx, [ebp - 0x10]
call fcn.10012b61
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10108eab
push eax
call fcn.10011f30
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1001240b
mov eax, esi
call fcn.1010690f
ret 8
Function at 0x1004ef85
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100160c4
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1004efbe
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.1004ebc2
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1004f01c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x1004f040
cmp dword [edi + 0x74], 0
jne 0x1004f040
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.100160c4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1004efdd
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1005101a
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.10050cbb
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10051064
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.100197ab
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.10014973
jmp 0x1005106f
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10018abf
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10051075
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.10024517
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x100510b2
call fcn.10050cbb
mov dword [esi + 0xc], 1
jmp 0x100510b7
call fcn.10050cbb
cmp dword [esi], 0
je 0x10051100
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x100510d8
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.100197ab
jmp 0x100510ea
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.10012cff
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.10014973
jmp 0x10051124
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x10051124
push dword [esi]
push dword [ebp + 8]
call fcn.10018abf
pop esi
pop ebp
ret 0xc

Function at 0x10080660
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x1008067a
call fcn.100160c4
mov esi, dword [eax + 0xc]
push dword [0x101d5668]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10080698
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10080690
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x100806c5
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x10080692
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.1008058e
mov esi, eax
jmp 0x100806b7

Function at 0x100cb470
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.100ffd19
call fcn.10015af5
cmp dword [eax + 0x14], 0
jne 0x100cb48d
mov ecx, esi
pop esi
jmp fcn.100caf75
pop esi
ret

Function at 0x100ce6b8
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.10069f31
call fcn.10015af5
cmp dword [eax + 0x14], 0
jne 0x100ce6d5
mov ecx, esi
pop esi
jmp fcn.100ce08b
pop esi
ret
Function at 0x100e0eb1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x100e0ec9
mov edi, dword [esi + 0xc]
jmp 0x100e0f09
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100e0ee2
call fcn.100177ae
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x100e0ef7
call fcn.100177ae
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x100e0f09
call fcn.100177ae
call fcn.100160c4
cmp dword [eax + 0x3c], 0
je 0x100e0f1e
push edi
mov ecx, ebx
call fcn.100dfce3
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.100e0dcb
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x100e0f3c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x100e0f48
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x101056ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101ce4f0]
jne 0x101056c4
repz ret
jmp fcn.1010b972
Function at 0x10116e72
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101ce4f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1010c8b7
and dword [ebp - 0x14], 0
cmp dword [0x101d7e30], 0
mov dword [ebp - 0x18], eax
jne 0x10116f25
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10116fcd
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1017da4c
push ebx
call edi
test eax, eax
je 0x10116fcd
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x1017da3c
push ebx
mov dword [0x101d7e30], eax
call edi
push eax
call esi
push 0x1017da28
push ebx
mov dword [0x101d7e34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x101d7e38], eax
call edi
push eax
call esi
mov dword [0x101d7e40], eax
test eax, eax
je 0x10116f25
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x101d7e3c], eax
mov eax, dword [0x101d7e3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10116f7e
cmp dword [0x101d7e40], ecx
je 0x10116f7e
push eax
call esi
push dword [0x101d7e40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10116f7e
test ebx, ebx
je 0x10116f7e
call edi
test eax, eax
je 0x10116f75
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10116f75
test byte [ebp - 8], 1
jne 0x10116f7e
or dword [ebp + 0x10], 0x200000
jmp 0x10116fb1
mov eax, dword [0x101d7e34]
cmp eax, dword [ebp - 0x18]
je 0x10116fb1
push eax
call esi
test eax, eax
je 0x10116fb1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10116fb1
mov eax, dword [0x101d7e38]
cmp eax, dword [ebp - 0x18]
je 0x10116fb1
push eax
call esi
test eax, eax
je 0x10116fb1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x101d7e30]
call esi
test eax, eax
je 0x10116fcd
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10116fcf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101056ba
leave
ret