joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10136c00
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
xor ebx, ebx
inc edx
mov edi, dword [esi]
cmp dword [edi + 0x254], ebx
je 0x10136c60
cmp dword [edi + 0x264], ebx
je 0x10136c59
cmp byte [0x107d44f4], 0
push edi
push dword [edi + 0x250]
je 0x10136c48
call dword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x10136c4e
call dword [sym.imp.kernel32.dll_FindNextFileA]
mov ecx, dword [esi]
xor edx, edx
inc edx
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
jmp 0x10136d40
mov eax, dword [edi + 0x25c]
test eax, eax
je 0x10136dcf
push eax
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [esi]
cmp dword [ecx + 0x260], ebx
je 0x10136cae
lea eax, [ebp - 0x234]
push eax
call fcn.1013204f
mov eax, dword [esi]
push dword [eax + 0x260]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov ecx, dword [esi]
add esp, 0xc
test byte [ecx + 0x268], 1
push 0x10
pop eax
lea edx, [eax + 0x70]
cmove eax, edx
mov dword [ecx], eax
cmp byte [0x107d44f4], 0
je 0x10136cda
push dword [esi]
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
jmp 0x10136cfc
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.1013204f
push dword [esi]
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ecx, dword [esi]
mov dword [ecx + 0x250], eax
xor eax, eax
mov ecx, dword [esi]
cmp dword [ecx + 0x250], 0xffffffff
setne al
mov dword [ecx + 0x264], eax
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10136d2a
mov dword [eax + 0x250], ebx
mov eax, dword [esi]
xor edx, edx
inc edx
mov dword [eax + 0x254], edx
mov eax, dword [esi]
cmp dword [eax + 0x264], ebx
jne 0x10136d40
mov dword [esi + 4], edx
mov ecx, eax
cmp dword [eax + 0x264], ebx
je 0x10136d67
cmp byte [0x107d44f4], 0
jne 0x10136d67
push dword [eax + 0x258]
add eax, 0x2c
push eax
call fcn.1013204f
mov ecx, dword [esi]
xor edx, edx
inc edx
mov eax, dword [ecx]
mov dword [ecx + 0x26c], eax
mov edi, dword [esi]
mov ebx, dword [edi + 0x26c]
shr ebx, 4
and ebx, edx
je 0x10136d9c
push esi
xor ebx, ebx
call fcn.1013204f
xor edx, edx
inc edx
cmp word [eax], 0x2e
je 0x10136d98
test byte [edi + 0x268], 3
jne 0x10136da6
mov ebx, edx
jmp 0x10136da6
test byte [edi + 0x268], 1
cmovne ebx, edx
mov eax, dword [edi + 0x264]
test eax, eax
je 0x10136dca
push 0
test ebx, ebx
pop ebx
jne 0x10136c20
test byte [edi + 0x26c], 2
jne 0x10136c20
test eax, eax
setne al
jmp 0x10136dd1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10147db0
leave
ret 4
Function at 0xcc6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xcc61a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcc607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcc606a
add dl, dl
jne 0xcc6089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcc60dc
xor eax, eax
add dl, dl
jne 0xcc6096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcc617d
add dl, dl
jne 0xcc60a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcc60b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcc60bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcc60c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcc60d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcc6075
mov eax, 1
add dl, dl
jne 0xcc60ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcc60f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcc60e1
sub eax, ebx
mov ebx, 1
jne 0xcc6128
mov ecx, 1
add dl, dl
jne 0xcc610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcc6119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcc6105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcc6075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcc613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcc614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcc6136
cmp eax, 0x7d00
jae 0xcc616d
cmp eax, 0x500
jb 0xcc6168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcc6075
cmp eax, 0x7f
ja 0xcc6170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcc6075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcc619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcc6075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x417bcb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ab20]
jne 0x417bd5
repz ret
jmp fcn.0041bf6c

Function at 0x41e3d8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041a9ba
and dword [ebp - 4], 0
cmp dword [0x42c39c], 0
mov ebx, eax
jne 0x41e489
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41e53a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41e53a
push eax
call fcn.0041a948
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42c39c], eax
call esi
push eax
call fcn.0041a948
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42c3a0], eax
call esi
push eax
call fcn.0041a948
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42c3a4], eax
call esi
push eax
call fcn.0041a948
pop ecx
mov dword [0x42c3ac], eax
test eax, eax
je 0x41e489
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041a948
pop ecx
mov dword [0x42c3a8], eax
mov eax, dword [0x42c3a8]
cmp eax, ebx
je 0x41e4e1
cmp dword [0x42c3ac], ebx
je 0x41e4e1
push eax
call fcn.0041a9c3
push dword [0x42c3ac]
mov esi, eax
call fcn.0041a9c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41e4e1
test edi, edi
je 0x41e4e1
call esi
test eax, eax
je 0x41e4d8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41e4d8
test byte [ebp - 0xc], 1
jne 0x41e4e1
or dword [ebp + 0x10], 0x200000
jmp 0x41e51a
mov eax, dword [0x42c3a0]
cmp eax, ebx
je 0x41e51a
push eax
call fcn.0041a9c3
pop ecx
test eax, eax
je 0x41e51a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41e51a
mov eax, dword [0x42c3a4]
cmp eax, ebx
je 0x41e51a
push eax
call fcn.0041a9c3
pop ecx
test eax, eax
je 0x41e51a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42c39c]
call fcn.0041a9c3
pop ecx
test eax, eax
je 0x41e53a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41e53c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6c9d3232
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x718b5b36
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4059f9
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405cb7
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405a38
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4243a8], eax
jmp 0x405bc2
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405a52
test eax, eax
je 0x405b70
test bl, 2
je 0x405b70
mov esi, 0x421928
push edi
push esi
call fcn.00406237
cmp dword [ebp + 8], 0
je 0x405a71
push 0x40a3c4
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405a77
push edi
call fcn.00405c10
cmp byte [edi], 0
jne 0x405a85
cmp byte [0x421928], 0x5c
jne 0x405a90
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405b66
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405bf4
cmp byte [eax], 0
je 0x405ad6
cmp byte [ebp - 0x1c], 0
je 0x405ad6
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405aec
mov al, byte [esi + 1]
test al, al
je 0x405b45
cmp al, 0x2e
jne 0x405aec
cmp byte [esi + 2], 0
je 0x405b45
push esi
push ebx
call fcn.00406237
test byte [ebp - 0x14c], 0x10
je 0x405b11
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b45
push dword [ebp + 0xc]
push edi
call fcn.004059f9
jmp 0x405b45
push dword [ebp - 4]
push edi
call fcn.004059b1
test eax, eax
jne 0x405b3d
cmp dword [ebp - 4], eax
je 0x405b35
push edi
push 0xfffffffffffffff1
call fcn.0040537b
push 0
push edi
call fcn.00406010
jmp 0x405b45
inc dword [0x4243a8]
jmp 0x405b45
push edi
push 0xfffffffffffffff2
call fcn.0040537b
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405ab4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405b70
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405bc2
cmp dword [ebp - 0xc], esi
jne 0x405b84
inc dword [0x4243a8]
jmp 0x405bc2
push edi
call fcn.004065ca
test eax, eax
je 0x405bc2
push edi
call fcn.00405bc9
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.004059b1
test eax, eax
jne 0x405bba
cmp dword [ebp - 4], esi
je 0x405b7c
push edi
push 0xfffffffffffffff1
call fcn.0040537b
push esi
push edi
call fcn.00406010
jmp 0x405bc2
push edi
push 0xffffffffffffffe5
call fcn.0040537b
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10016284
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1001629f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x100163f0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
push 2
mov ecx, dword [ebp - 4]
call fcn.10016d1d
mov eax, dword [ebp - 8]
cmp dword [eax], 0xff40b36f
jbe 0x10016305
mov dword [ebp - 0x10], 1
jmp 0x10016309
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
je 0x1001631c
mov dword [ebp - 0x48], 1
jmp 0x10016320
and dword [ebp - 0x48], 0
push 2
mov ecx, dword [ebp - 4]
call fcn.10016d1d
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x1001633a
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jne 0x10016347
push 8
pop eax
test eax, eax
jne 0x10016347
and dword [ebp - 0x4c], 0
jmp 0x1001634e
mov dword [ebp - 0x4c], 1
push 2
mov ecx, dword [ebp - 4]
call fcn.10016d1d
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x9add
je 0x1001636c
mov dword [ebp - 0x18], 1
jmp 0x10016370
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x10016383
mov dword [ebp - 0x1c], 1
jmp 0x10016387
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 1
jne 0x100163a5
push 1
mov ecx, dword [ebp - 4]
call fcn.10016d1d
cmp dword [eax], 0
je 0x100163a5
mov dword [ebp - 0x20], 1
jmp 0x100163a9
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
je 0x100163c4
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x100163c4
mov dword [ebp - 0x24], 1
jmp 0x100163c8
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x24], eax
jne 0x100163e1
mov eax, 0x13e97a0e
test eax, eax
jne 0x100163e1
and dword [ebp - 0x28], 0
jmp 0x100163e8
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001665b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e1c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100166ed
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x40]
push eax
call fcn.10014ab2
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
call fcn.10016f36
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10016f6b
jmp 0x100166f5
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001c888
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001c8e3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001c8c4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001c8e1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016d1d
mov dword [eax], 0xfffffffd
jmp 0x1001c8b9
jmp 0x1001c8eb
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esp, ebp
pop ebp
ret

Function at 0x1001d523
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001d551
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001d54f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1001d59c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001d57f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1001d59c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.10016d1d
mov dword [eax], 0xc6a53d06
jmp 0x1001d574
mov esp, ebp
pop ebp
ret
Function at 0x1001d9eb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001da1c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001da17
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1001db16
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.10016d1d
cmp dword [eax], 0
je 0x1001daef
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.10016d1d
or ecx, 0xffffffff
sub ecx, dword [eax]
cmp ecx, 0xe055a24b
jbe 0x1001da99
mov dword [ebp - 8], 1
jmp 0x1001da9d
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
cmp dword [ebp - 8], 0xdfee
jle 0x1001dab7
mov dword [ebp - 0x14], 1
jmp 0x1001dabb
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jle 0x1001dace
mov dword [ebp - 0x18], 1
jmp 0x1001dad2
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.10016d1d
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax]
jne 0x1001daef
mov dword [ebp - 0x10], 1
jmp 0x1001daf3
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp - 0x10], 1
je 0x1001db0a
mov dword [ebp - 0x1c], 1
jmp 0x1001db0e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002883b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028937
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
cmp dword [eax], 0x9f9f4aec
jb 0x100288a9
mov dword [ebp - 0xc], 1
jmp 0x100288ad
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x3c]
cmp eax, dword [ecx]
jg 0x100288cf
mov dword [ebp - 8], 1
jmp 0x100288d3
and dword [ebp - 8], 0
push 0
mov ecx, dword [ebp - 0x40]
call fcn.10016d1d
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax - 0x7b36dc0e]
cmp dword [ebp - 0xc], eax
jne 0x100288f7
mov dword [ebp - 0x10], 1
jmp 0x100288fb
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 7
jl 0x1002890a
mov dword [ebp - 0x14], 1
jmp 0x1002890e
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jne 0x10028929
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10028929
mov dword [ebp - 0x18], 1
jmp 0x1002892d
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x10028955
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x10028955
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esp, ebp
pop ebp
ret
Function at 0x1002d8e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002d90d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002d90b
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1002d937
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x1002f1c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f1e4
xor eax, eax
jmp 0x1002f32f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f202
xor eax, eax
jmp 0x1002f32f
push 0x6dc9
push 1
push 0x5972
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.1002ed6e
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1002f22a
xor eax, eax
jmp 0x1002f32f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x42a2
push 0x64af
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002f026
add esp, 0x20
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0x4499
push 0x7705
call fcn.1002f0e0
add esp, 0x18
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x1f8e
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.1002f15f
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x1002f2a8
push dword [ebp - 4]
push dword [ebp - 0x14]
push 1
push 0x68b8
call fcn.1002bb82
add esp, 0x10
push dword [ebp - 4]
call fcn.1002de08
pop ecx
test eax, eax
jne 0x1002f2b9
xor eax, eax
jmp 0x1002f32f
push dword [ebp - 4]
push 0x5b8f
push 0x2996
push 0x5f50
push 0
call fcn.1002a3ed
add esp, 0x14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f317
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f2f4
xor eax, eax
jmp 0x1002f32f
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f30d
xor eax, eax
jmp 0x1002f32f
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f328
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f32c
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret