joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434386
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44465c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0042aec7
and dword [ebp - 0x14], 0
cmp dword [0x448bf0], 0
mov dword [ebp - 0x18], eax
jne 0x434439
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4344e1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43d558
push ebx
call edi
test eax, eax
je 0x4344e1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x448bf0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x448bf4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x448bf8], eax
call edi
push eax
call esi
mov dword [0x448c00], eax
test eax, eax
je 0x434439
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x448bfc], eax
mov eax, dword [0x448bfc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x434492
cmp dword [0x448c00], ecx
je 0x434492
push eax
call esi
push dword [0x448c00]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x434492
test ebx, ebx
je 0x434492
call edi
test eax, eax
je 0x434489
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x434489
test byte [ebp - 8], 1
jne 0x434492
or dword [ebp + 0x10], 0x200000
jmp 0x4344c5
mov eax, dword [0x448bf4]
cmp eax, dword [ebp - 0x18]
je 0x4344c5
push eax
call esi
test eax, eax
je 0x4344c5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4344c5
mov eax, dword [0x448bf8]
cmp eax, dword [ebp - 0x18]
je 0x4344c5
push eax
call esi
test eax, eax
je 0x4344c5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x448bf0]
call esi
test eax, eax
je 0x4344e1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4344e3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042396b
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x424bfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004248ad

Function at 0x424c07
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424a37
Function at 0x10001270
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
cmp dword [ebp + 8], 0
setne al
mov dword [ebp - 8], eax
xor ecx, ecx
jne 0x10001285
xor edx, edx
jne 0x10001285
cmp dword [ebp - 8], 0
jne 0x1000129d
push 0x80004005
call fcn.10001020
xor eax, eax
jne 0x10001279
xor ecx, ecx
jne 0x100012a1
xor edx, edx
jne 0x100012a1
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100012be
cmp dword [ebp + 0x14], 0xffffffff
jne 0x100012be
mov eax, 0x57
jmp 0x10001303
cmp dword [ebp + 0x14], 0xffffffff
jne 0x100012d4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp + 0x14], eax
movzx edx, byte [ebp + 0x10]
neg edx
sbb edx, edx
and edx, 6
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100014d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov byte [ebp - 8], 0x72
mov byte [ebp - 7], 0x62
mov byte [ebp - 6], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100031f7
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10001602
mov edx, dword [ebp - 4]
push edx
call fcn.10003480
add esp, 4
push eax
call fcn.10002e7c
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
call fcn.10002ff6
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10003463
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.10003564
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.10002ff6
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10001410
add esp, 0xc
mov edx, dword [ebp - 0xc]
sub edx, 0x10
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.10002400
add esp, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.1000320e
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.1000320e
add esp, 4
cmp dword [ebp - 0x18], 0
je 0x100015fc
cmp dword [ebp + 0xc], 0
je 0x100015fc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.100028c0
add esp, 8
mov dword [ebp - 0x1c], eax
call dword [ebp - 0x1c]
cmp dword [ebp + 0x10], 0
je 0x100015f3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10002ad0
add esp, 4
mov eax, 1
jmp 0x10001604
xor eax, eax
jmp 0x10001604
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001610
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [ebp - 4], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0
jne 0x1000164c
mov al, 1
jmp 0x1000164e
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10001a20
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x10001a32
jmp 0x10001aa0
push 0x104
push 0x10013c80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov ecx, 0x10013fbc
call fcn.100011b0
push 0x10013c80
push str.rundll32__s_MainWork
push 0x10013e90
call fcn.10002f72
add esp, 0xc
push 0xffffffffffffffff
push 0
push str.Network_Service
push 0x10013e90
mov ecx, 0x10013fbc
call fcn.10001270
mov ecx, 0x10013fbc
call fcn.10001160
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001b40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
jmp 0x10001b7f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
movzx ecx, word [eax + 6]
cmp dword [ebp - 4], ecx
jge 0x10001c9b
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10], 0
jne 0x10001c0c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
jle 0x10001c07
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x34]
push eax
push 4
push 0x1000
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001be0
xor eax, eax
jmp 0x10001ca0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.10006c00
add esp, 0xc
jmp 0x10001b6d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x14]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x10]
push ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10001b20
add esp, 8
test eax, eax
jne 0x10001c2d
xor eax, eax
jmp 0x10001ca0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x34]
push edx
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x1c]
call edx
add esp, 0x14
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001c64
xor eax, eax
jmp 0x10001ca0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100075e0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov dword [ecx + 8], edx
jmp 0x10001b6d
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10002e6d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10012050]
jne 0x10002e77
repz ret
jmp fcn.10003efc

Function at 0x1000bcf0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10012050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100085f6
and dword [ebp - 0x14], 0
cmp dword [0x10013c5c], 0
mov dword [ebp - 0x18], eax
jne 0x1000bda3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000be4b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000be4b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10013c5c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10013c60], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10013c64], eax
call edi
push eax
call esi
mov dword [0x10013c6c], eax
test eax, eax
je 0x1000bda3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10013c68], eax
mov eax, dword [0x10013c68]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000bdfc
cmp dword [0x10013c6c], ecx
je 0x1000bdfc
push eax
call esi
push dword [0x10013c6c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000bdfc
test ebx, ebx
je 0x1000bdfc
call edi
test eax, eax
je 0x1000bdf3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000bdf3
test byte [ebp - 8], 1
jne 0x1000bdfc
or dword [ebp + 0x10], 0x200000
jmp 0x1000be2f
mov eax, dword [0x10013c60]
cmp eax, dword [ebp - 0x18]
je 0x1000be2f
push eax
call esi
test eax, eax
je 0x1000be2f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000be2f
mov eax, dword [0x10013c64]
cmp eax, dword [ebp - 0x18]
je 0x1000be2f
push eax
call esi
test eax, eax
je 0x1000be2f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10013c5c]
call esi
test eax, eax
je 0x1000be4b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000be4d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002e6d
leave
ret
Function at 0x4018a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x4018c6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x40195a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401915
cmp eax, 0x40
je 0x401915
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4018b9
cmp eax, 0x40
je 0x4018b9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x4018b9
mov dword [esp + 8], 0x34
mov dword [esp + 4], 0x403068
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sym.__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x100028a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], 0x4e52454b
mov dword [ebp - 0x28], 0x32334c45
mov dword [ebp - 0x24], 0x6c6c642e
mov byte [ebp - 0x20], 0
mov eax, dword [edi]
mov dword [ebp - 8], edi
movzx esi, word [eax + 0x14]
add esi, eax
mov dword [ebp - 0x1c], 0x74726956
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x466c6175
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], 0x656572
push eax
call dword [0x10162de8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [edi]
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp cx, word [edi + 6]
jae 0x100029da
add esi, 0x28
push ebx
mov edx, dword [esi + 0x14]
test edx, 0x2000000
je 0x10002930
push 0x4000
push dword [esi]
push dword [esi - 8]
call eax
jmp 0x100029bb
mov ecx, edx
mov eax, edx
shr eax, 0x1e
shr ecx, 0x1d
and eax, 1
and ecx, 1
lea ecx, [eax + ecx*2]
mov eax, edx
shr eax, 0x1f
lea eax, [eax + ecx*2]
mov ebx, dword [eax*4 + 0x10192314]
test edx, 0x4000000
je 0x10002960
or ebx, 0x200
mov eax, dword [esi]
test eax, eax
jne 0x1000297b
test dl, 0x40
je 0x10002970
mov eax, dword [edi + 0x20]
jmp 0x10002977
test dl, dl
jns 0x100029bb
mov eax, dword [edi + 0x24]
test eax, eax
je 0x100029bb
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x74726956
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], 0x506c6175
push eax
mov dword [ebp - 0x34], 0x65746f72
mov word [ebp - 0x30], 0x7463
mov byte [ebp - 0x2e], 0
call dword [0x10162de8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x10]
push ecx
push ebx
push dword [esi]
push dword [esi - 8]
call eax
mov eax, dword [ebp - 8]
add esi, 0x28
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
mov edi, dword [eax]
movzx eax, word [edi + 6]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
jl 0x10002914
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003050
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
mov ebx, ecx
test ebx, ebx
je 0x10003216
cmp dword [ebx + 0x10], 0
lea eax, [ebx + 4]
mov dword [ebp - 4], eax
je 0x10003086
mov ecx, dword [eax]
mov eax, dword [ebx]
push 0
push 0
push ecx
mov eax, dword [eax + 0x28]
add eax, ecx
call eax
mov dword [ebx + 0x10], 0
jmp 0x10003089
mov dword [ebp - 4], eax
cmp dword [ebx + 8], 0
push esi
mov esi, dword [0x10162de8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x44], 0x4e52454b
mov dword [ebp - 0x40], 0x32334c45
mov dword [ebp - 0x3c], 0x6c6c642e
mov byte [ebp - 0x38], 0
je 0x10003186
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x65657246
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x24], 0x7262694c
push eax
mov dword [ebp - 0x20], 0x797261
call esi
push eax
call edi
xor esi, esi
mov edi, eax
cmp dword [ebx + 0xc], esi
jle 0x100030f9
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + esi*4]
cmp eax, 0xffffffff
je 0x100030f3
push eax
call edi
inc esi
cmp esi, dword [ebx + 0xc]
jl 0x100030e5
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x4e52454b
push eax
mov dword [ebp - 0x50], 0x32334c45
mov dword [ebp - 0x4c], 0x6c6c642e
mov byte [ebp - 0x48], 0
mov dword [ebp - 0x10], 0x70616548
mov dword [ebp - 0xc], 0x65657246
mov byte [ebp - 8], 0
call dword [0x10162de8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x64], 0x50746547
lea eax, [ebp - 0x64]
mov dword [ebp - 0x60], 0x65636f72
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x5c], 0x65487373
push eax
mov word [ebp - 0x58], 0x7061
mov byte [ebp - 0x56], 0
call dword [0x10162de8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0
call eax
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x10162de8]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x74726956
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x30], 0x466c6175
push eax
mov dword [ebp - 0x2c], 0x656572
call esi
push eax
call edi
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
test ecx, ecx
je 0x100031bb
push 0x8000
push 0
push ecx
call eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x70616548
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x18], 0x65657246
push eax
mov byte [ebp - 0x14], 0
call esi
push eax
call edi
mov esi, eax
mov dword [ebp - 0x74], 0x50746547
lea eax, [ebp - 0x74]
mov dword [ebp - 0x70], 0x65636f72
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x6c], 0x65487373
push eax
mov word [ebp - 0x68], 0x7061
mov byte [ebp - 0x66], 0
call dword [0x10162de8]
push eax
call edi
push ebx
push 0
call eax
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100069c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152fd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100086d0
mov esi, eax
add esp, 4
test esi, esi
je 0x10006a0f
push 1
mov dword [ebp - 4], 0
call fcn.10144b7a
add esp, 4
mov dword [esi + 4], eax
jmp 0x10006a11
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000841d
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebx, ecx
xor esi, esi
lock cmpxchg dword [ebx], esi
test eax, eax
je 0x1000844b
cmp eax, 0xffffffff
jne 0x1000843e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x214
ret 4
xor ebp, ebp
test byte [esp + 0x228], 1
mov dword [esp + 0x10], ebp
je 0x10008467
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x1000850a
call fcn.100082fa
mov esi, eax
test esi, esi
je 0x1000843c
test byte [esp + 0x228], 2
je 0x10008483
push 2
jmp 0x10008506
test byte [esp + 0x228], 4
je 0x10008490
push ebp
jmp 0x10008506
call fcn.10008252
test eax, eax
jne 0x10008501
call fcn.100082b2
mov ebp, eax
test ebp, ebp
je 0x1000843c
push 0x208
lea eax, [esp + 0x20]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x1c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100084fb
cmp eax, 0x104
jae 0x100084fb
mov ecx, edi
call fcn.10008174
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
push 0
lea eax, [esp + 0x28]
push eax
call ebp
mov eax, dword [esp + 0x10]
jmp 0x1000850e
push 0
push 0
jmp 0x10008507
push 0x800
push ebp
push edi
call esi
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1000851c
or eax, 0xffffffff
xchg dword [ebx], eax
jmp 0x1000843c
xchg dword [ebx], eax
test eax, eax
je 0x1000852c
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
jmp 0x1000843e

Function at 0x1000a258
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000a2b1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000a2b1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1000a2a2
cmp esi, ecx
jae 0x1000a2b1
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1000a290
cmp esi, ecx
jae 0x1000a2b1
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1000a2b3
xor eax, eax
pop esi
pop ebp
ret