joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032f7a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003301d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10032fd3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10032fd1
push 0x30c
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1003301b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10033001
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003301b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1000a8c0
or dword [eax], 0xffffffff
jmp 0x10032ff6
jmp 0x1003303a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0x1007
push 1
push 0x5db2
call fcn.10029391
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10036438
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003646c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x28db
push 0
push dword [ebp - 0xc]
call fcn.100380b1
add esp, 0x10
jmp 0x100364ef
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100364d5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100364b6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x100364d3
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.1000a8c0
mov dword [eax], 0xdf9c
jmp 0x100364ab
jmp 0x100364ef
push 0xd73
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret

Function at 0x10036508
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10036559
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003654f
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003654d
push 0xd9e
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x10036557
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x1003656d
push 0
push 0x2d3d
push 0x4005
call fcn.10029017
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10036af8
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10036b8c
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10036b76
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x17
jmp 0x10036b42
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xb
jg 0x10036b74
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10036b68
push 0x1d17
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10036b72
jmp 0x10036b37
jmp 0x10036b37
jmp 0x10036b8a
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10036b8a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10036ba5
push 0
push 0x1c65
push 0x7800
push 0x7b5e
call fcn.1003d80e
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10037d87
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10037e05
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10037dfb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10037ddf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10037df9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000a8c0
and dword [eax], 0
jmp 0x10037dd4
jmp 0x10037e03
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10037e2d
push 0x51f5
push 0x694d
push 0x62f0
push 0x326e
push 0x77e
push 1
push 0x4679
call fcn.10035c54
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x1003d41d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003d4d0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003d4b3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
push 4
push 0x2000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x50]
mov eax, dword [ebp - 0xc]
push dword [eax + 0x34]
push 0xf612
push 0xe193
call fcn.100275ad
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x1003d4b1
push 4
push 0x2000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x50]
push 0
push 0xf612
push 0xe193
call fcn.100275ad
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x1003d4ce
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003d4ce
push 0
push 0x10c3
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x1003d525
mov dword [ebp - 8], 0xb3ae3556
mov dword [ebp - 8], 0
jmp 0x1003d4e7
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffffd
jle 0x1003d517
mov dword [ebp - 0x20], 0x905d
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1003d50d
push 0x68c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp - 0x20], 0
je 0x1003d515
jmp 0x1003d517
jmp 0x1003d4e0
push 0x53c7
push 0
call fcn.10035fc5
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1003f0e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003f162
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003f154
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003f138
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003f152
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000a8c0
and dword [eax], 0
jmp 0x1003f12d
jmp 0x1003f160
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x1003f176
push 0x48b4
push 0x4ceb
push 0
call fcn.10028994
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1003f903
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003f939
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003f92a
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x1003f937
push 0x68c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1003f94b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0
call fcn.100289e0
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004028d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100402e4
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100402c4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100402c2
push 0x187f
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x100402e2
push 0xc25
push 0xd1b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1004030f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0x16e
push 0x57d2
push dword [ebp - 0xc]
push 0
push 0x776d
push dword [ebp - 0x10]
call fcn.10035e0f
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x10040412
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10040439
push 0x191e
push 1
push 0x41d0
call fcn.100405fb
add esp, 0xc
jmp 0x100405f7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100405de
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x1ab8
cmp dword [ebp - 0x38], 0xa51
jge 0x1004057b
lea eax, [ebp - 0x3c]
push eax
push 0x10008180
call fcn.1004bcab
pop ecx
pop ecx
and dword [ebp - 0x10], 0
or dword [ebp - 8], 0xffffffff
or dword [ebp - 0x18], 0xffffffff
and dword [ebp - 0x14], 0
jmp 0x100404ab
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x3c]
jge 0x10040559
lea eax, [ebp - 0xc]
push eax
push 0x10008180
call fcn.1004bcab
pop ecx
pop ecx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
je 0x100404e7
cmp dword [ebp - 0xc], 2
jne 0x100404db
cmp dword [ebp - 8], 3
je 0x100404e7
cmp dword [ebp - 0xc], 3
jne 0x100404ed
cmp dword [ebp - 8], 2
jne 0x100404ed
or dword [ebp - 0x10], 0xffffffff
jmp 0x10040559
cmp dword [ebp - 0xc], 1
jne 0x100404f9
cmp dword [ebp - 8], 2
je 0x10040505
cmp dword [ebp - 0xc], 2
jne 0x1004050e
cmp dword [ebp - 8], 1
jne 0x1004050e
mov eax, dword [ebp - 0x10]
add eax, 3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 1
jne 0x1004051a
cmp dword [ebp - 8], 3
je 0x10040526
cmp dword [ebp - 0xc], 3
jne 0x1004052f
cmp dword [ebp - 8], 1
jne 0x1004052f
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 2
jne 0x10040548
cmp dword [ebp - 8], 1
jne 0x10040548
cmp dword [ebp - 0x18], 3
jne 0x10040548
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x100404a4
cmp dword [ebp - 0x10], 0
jge 0x1004056c
push 0x100086c8
call fcn.1004c236
pop ecx
jmp 0x1004057b
push dword [ebp - 0x10]
push 0x100086d4
call fcn.1004c43c
pop ecx
pop ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push 8
pop ecx
imul ecx, ecx, 5
lea eax, [eax + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 4], 0
jbe 0x100405dc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
jbe 0x100405dc
push 0x3d82
push 0x7b9b
mov eax, dword [ebp - 0x40]
push dword [eax]
lea eax, [ebp - 0x24]
push eax
push 0x78e6
push 0x6a12
push 1
push dword [ebp - 0x28]
push 0
push 0x6a63
call fcn.10036e1e
add esp, 0x28
jmp 0x100405a1
jmp 0x100405f7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100405f7
push 0x68c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1004161e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100416c3
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004169f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10041680
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1004169d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000a8c0
mov dword [eax], 0x51af
jmp 0x10041675
jmp 0x100416c1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100416c1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x100416df
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
call fcn.1003f0c8
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10042878
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100428f1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100428b4
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x100428ec
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0xfff8
jb 0x100428e0
mov dword [ebp - 8], 1
jmp 0x100428e4
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x100429a3
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1004295a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004293b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10042958
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.1000a8c0
mov dword [eax], 0xfffffff6
jmp 0x10042930
jmp 0x100429a3
push 0
push 0x1755
push 0x146b
push 0x1720
push 0x11cf
push 0x22de
push 0x22ca
push 0x2072
push 0x23bf
push 0x24e3
push 0x17e0
push 0x137c
push 0x2637
push 0x1105
call dword [sym.imp.GDI32.dll_CreateFontA]
mov esp, ebp
pop ebp
ret
Function at 0x10060c05
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006c758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10051b38
mov dword [ebp - 0x14], eax
cmp dword [0x106597e0], esi
jne 0x10060cf8
push 0x800
push esi
push 0x10008018
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10060c85
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10060dd8
push esi
push esi
push 0x10008018
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10060dd8
push 0x10008030
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10060dd8
push eax
call ebx
push 0x1000803c
push edi
mov dword [0x106597e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000804c
push edi
mov dword [0x106597e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10008060
push edi
mov dword [0x106597e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106597f0], eax
test eax, eax
je 0x10060cf5
push 0x1000807c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106597ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10060d1d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10060d10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10060d32
push 4
pop eax
jmp 0x10060dda
cmp dword [ebp - 0x14], esi
je 0x10060d32
push dword [0x106597e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10060d17
mov eax, dword [0x106597ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10060d90
cmp dword [0x106597f0], edi
je 0x10060d90
push eax
call ebx
push dword [0x106597f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10060d90
test eax, eax
je 0x10060d90
call ecx
test eax, eax
je 0x10060d85
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10060d85
test byte [ebp - 8], 1
jne 0x10060d90
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10060dc0
mov eax, dword [0x106597e4]
cmp eax, edi
je 0x10060dbd
push eax
call ebx
test eax, eax
je 0x10060dbd
call eax
mov esi, eax
test esi, esi
je 0x10060dbd
mov eax, dword [0x106597e8]
cmp eax, edi
je 0x10060dbd
push eax
call ebx
test eax, eax
je 0x10060dbd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106597e0]
call ebx
test eax, eax
je 0x10060dd8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10060dda
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004f422
mov esp, ebp
pop ebp
ret
Function at 0x416213
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00416292
jae 0x41621f
xor ecx, ecx
call fcn.00416292
jae 0x416249
xor eax, eax
call fcn.00416292
jae 0x41625a
mov al, 0x10
call fcn.00416292
adc al, al
jae 0x41623b
jne 0x416287
stosb byte es:[edi], al
jmp 0x416220
call fcn.0041629e
dec ecx
loop 0x416266
mov eax, ebp
call fcn.0041629c
jmp 0x416288
lodsb al, byte [esi]
shr eax, 1
je 0x4162ae
adc ecx, 2
mov ebp, eax
jmp 0x416288
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0041629c
cmp eax, 0x7d00
jae 0x416286
cmp eax, 0x500
jae 0x416287
cmp eax, 0x7f
ja 0x416288
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416220
pop ebp
ret 8

Function at 0x891058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8911a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x89107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x89106a
add dl, dl
jne 0x891089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8910dc
xor eax, eax
add dl, dl
jne 0x891096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x89117d
add dl, dl
jne 0x8910a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8910b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8910bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8910c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8910d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x891075
mov eax, 1
add dl, dl
jne 0x8910ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8910f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8910e1
sub eax, ebx
mov ebx, 1
jne 0x891128
mov ecx, 1
add dl, dl
jne 0x89110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x891119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x891105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x891075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x89113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x89114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x891136
cmp eax, 0x7d00
jae 0x89116d
cmp eax, 0x500
jb 0x891168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x891075
cmp eax, 0x7f
ja 0x891170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x891075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x89119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x891075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10