joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bf60
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x2d4
cmp word [eax], 0
mov dword [ebp - 0x2b8], ecx
mov dword [ebp - 0x2a0], 1
mov dword [ebp - 0x29c], eax
je 0x1003c1e0
add eax, 2
cmp word [eax], 0
jne 0x1003bf90
sub eax, ebx
add eax, 2
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x2a0]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym.mscms.dll_OpenColorProfileW
sub esp, 0x10
mov esi, eax
test eax, eax
je 0x1003c1a0
lea eax, [ebp - 0x294]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym.mscms.dll_GetColorProfileHeader
sub esp, 8
test eax, eax
je 0x1003c170
mov ecx, dword [sym.imp.advapi32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2b4]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [ebp - 0x2bc], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionICM
mov dword [esp], 0x80000002
call ecx
lea edx, [ebp - 0x214]
mov eax, ebx
sub esp, 0x24
call sym._basename
mov eax, dword [ebp - 0x288]
mov dword [esp + 8], str._c_c_c_c
mov dword [esp + 4], 5
movzx ebx, al
mov dword [esp + 0x18], ebx
movzx ebx, ah
mov dword [esp + 0x14], ebx
mov ebx, eax
shr eax, 0x18
shr ebx, 0x10
mov dword [esp + 0xc], eax
movzx ebx, bl
mov dword [esp + 0x10], ebx
lea ebx, [ebp - 0x2aa]
mov dword [esp], ebx
call sym._swprintf.constprop.0
lea eax, [ebp - 0x2b0]
mov dword [esp + 0x20], 0
mov ecx, dword [ebp - 0x2bc]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x2b4]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call ecx
lea edx, [ebp - 0x214]
sub esp, 0x24
test edi, edi
je 0x1003c1c0
mov eax, dword [ebp - 0x2b8]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 3
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2b0]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
mov eax, dword [ebp - 0x2b0]
mov ebx, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x2b4]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp], esi
call sym.mscms.dll_CloseColorProfile
mov edx, 1
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
mov dword [ebp - 0x2b8], eax
call sym.mscms.dll_CloseColorProfile
mov edx, dword [ebp - 0x2b8]
mov eax, dword fs:[0x18]
sub esp, 4
mov dword [eax + 0x34], 0x7db
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword fs:[0x18]
xor edx, edx
mov dword [eax + 0x34], 0x7db
lea esp, [ebp - 0xc]
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
sub esp, 8
jmp 0x1003c134
mov eax, 2
jmp 0x1003bf9e
Function at 0x46f502
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6b500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [eax + 8]
mov dword [ebp - 0x40], eax
push edi
xor edi, edi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x46f52c
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
push eax
call fcn.00602399
pop ecx
pop ecx
test eax, eax
jne 0x46f559
test dword [ebp - 0x36], 0x4000
jne 0x46f5cc
mov ecx, dword [ebp - 0x40]
push ebx
push esi
call fcn.0046f768
mov edi, eax
test edi, edi
js 0x46f5cc
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x46f563
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46f584
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x46f5cc
cmp dword [esi + 0x14], 8
jb 0x46f590
mov esi, dword [esi]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebx + 4]
add eax, 0x5c
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], edi
push 0x677a8c
cmp ecx, dword [ebx + 8]
je 0x46f5bb
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
mov ecx, ebx
call fcn.0046dc5f
jmp 0x46f5cc
lea edx, [ebp - 0x44]
push edx
lea edx, [ebp - 0x48]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.0046ddf6
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042d8e5
leave
ret 4

Function at 0x471dd5
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push 0xf0000000
push 0x18
push 0
push 0
push 0x6cf8e8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
setne al
ret

Function at 0x47340c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.00472fc4
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
invalid

Function at 0x47382f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x62fffffc], esi
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
dec dword [edx - 0x3a]
test dword [esi + 0x46fffffc], esi
Function at 0x5363b9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x34
mov eax, 0x627db3
call fcn.0042d958
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
call fcn.00426baa
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], ebx
push eax
call fcn.00519b45
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
call fcn.005008ff
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x53640a
test al, 0x10
jne 0x53640a
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.00507bbe
mov al, bl
call fcn.0042d907
ret

Function at 0x54df53
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x54df65
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x54dfaa
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret

Function at 0x54e01e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x54e027
pop esi
ret

Function at 0x54e5e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul edx, dword [ebp + 0xc]
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x54e5f8
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x4239a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.TGOqOPny
lea edi, [esi - 0x19000]
push edi
or ebp, 0xffffffff
jmp 0x4239c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4239c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4239b8
mov eax, 1
add ebx, ebx
jne 0x4239db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4239d0
jne 0x4239ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4239d0
xor ecx, ecx
sub eax, 3
jb 0x423a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423a72
mov ebp, eax
add ebx, ebx
jne 0x423a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423a3c
inc ecx
add ebx, ebx
jne 0x423a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423a1d
jne 0x423a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423a4d
jmp 0x4239be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423a5c
add edi, ecx
jmp 0x4239be
pop esi
mov edi, esi
mov ecx, 0x138
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x423a7a
cmp byte [edi], 6
jne 0x423a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x423a7f
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x423aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23030]
or eax, eax
je 0x423ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x423ac9
call dword [esi + 0x2302c]
mov ebp, dword [esi + 0x23034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x423b22
sub esp, 0xffffff80
jmp 0x4038fc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10008420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082bda
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100bc1b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
lea eax, [edi + 0x50]
mov dword [edi], 0x1008fabc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edi
mov dword [eax], vtable.std::ios_base.0
mov dword [ebp - 4], 0
mov dword [eax], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 1
lea esi, [edi + 4]
push 0
push 0
push esi
mov dword [ebp - 0x10], 1
call fcn.10007ca0
mov dword [ebp - 4], 2
mov eax, dword [edi]
push 8
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], esi
lea eax, [ecx - 0x50]
mov dword [ecx + edi - 4], eax
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.10053309
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100084d8
push 1
call fcn.1003a658
add esp, 4
mov dword [ebx + 4], eax
jmp 0x100084da
xor ebx, ebx
lea eax, [esi + 4]
mov dword [esi + 0x34], ebx
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov byte [ebp - 4], 3
mov dword [esi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 4
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100832da
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100bc1b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 5
lea eax, [ebx + 0x30]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
or esi, 0xffffffff
mov edx, dword [eax]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100099da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
lea eax, [ebx + 0x2c]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
mov edx, dword [eax]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009a01
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
lea eax, [ebx + 0x28]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
mov edx, dword [eax]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009a28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
lea edi, [ebx + 0x18]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0xb
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.10012a20
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 2
push 0x18
push dword [edi]
call fcn.10053339
add esp, 8
mov byte [ebp - 4], 1
lea eax, [ebx + 0x14]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
mov edx, dword [eax]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10009a8f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0x10
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.10012ac0
mov eax, dword [edi]
mov dword [eax + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov dword [edi + 4], 0
mov byte [ebp - 4], 0
push 0x28
push dword [edi]
call fcn.10053339
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.100095f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b130
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008386b
mov eax, dword fs:[0]
push eax
mov eax, 0x1010
call fcn.10053770
mov eax, dword [0x100bc1b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
call fcn.10024200
test eax, eax
je 0x1000b314
push 0x1000
lea eax, [ebp - 0x1010]
push edi
push eax
call fcn.100592a0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1010]
push 0x7ff
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
mov edi, eax
test edi, edi
jle 0x1000b314
call fcn.1000b580
mov ecx, eax
test ecx, ecx
je 0x1000b332
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1018], eax
mov dword [ebp - 4], 1
mov ecx, dword [0x100bd5b0]
test ecx, ecx
jne 0x1000b23c
push 0x100b2004
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100bd5b0], 0
jne 0x1000b223
push 0x1c
call fcn.10053309
mov esi, eax
add esp, 4
mov dword [ebp - 0x1014], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x1000b217
lea ecx, [esi + 4]
mov dword [esi], vtable._BaseModule::CCriticalSection.0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x1000b219
xor esi, esi
mov byte [ebp - 4], 1
mov dword [0x100bd5b0], esi
push 0x100b2004
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100bd5b0]
test ecx, ecx
jne 0x1000b23c
xor eax, eax
jmp 0x1000b298
mov eax, dword [0x100bd5ac]
test eax, eax
jne 0x1000b298
mov eax, dword [ecx]
push ecx
call dword [eax]
cmp dword [0x100bd5ac], 0
jne 0x1000b288
push 0x14
call fcn.10053309
add esp, 4
mov dword [ebp - 0x1014], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x1000b276
mov ecx, eax
call fcn.1001b7a0
mov ecx, eax
jmp 0x1000b278
xor ecx, ecx
mov byte [ebp - 4], 1
xchg dword [ebp - 0x1014], eax
mov dword [0x100bd5ac], ecx
mov eax, dword [0x100bd5b0]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, dword [0x100bd5ac]
lea ecx, [ebp - 0x101c]
push ecx
mov ecx, eax
call fcn.1001d020
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1010]
push ecx
push dword [eax]
lea eax, [ebp - 0x1018]
push str.__s__s
push eax
call fcn.1000b450
add esp, 0x10
mov byte [ebp - 4], 1
or ebx, 0xffffffff
mov edx, dword [ebp - 0x101c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000b2eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1018]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1000b314
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100536aa
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000b090
int3
Function at 0x100126e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10012739
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10012739
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1001272a
cmp esi, edx
jae 0x10012739
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10012718
cmp esi, edx
jae 0x10012739
cmp word [esi], 0
je 0x10012739
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x100170a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100bc1b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100bd640
mov dword [ebp - 0x30], 0x6f0053
lea esi, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x740066
mov dword [ebp - 0x28], 0x610077
mov edx, 0x16
mov dword [ebp - 0x24], 0x650072
sub esi, eax
mov dword [ebp - 0x20], 0x33005c
mov dword [ebp - 0x1c], 0x300036
mov dword [ebp - 0x18], 0x610057
mov dword [ebp - 0x14], 0x6c006c
mov dword [ebp - 0x10], 0x610050
mov dword [ebp - 0xc], 0x650070
mov dword [ebp - 8], 0x72
nop dword [eax]
lea ecx, [edx + 0x7fffffe8]
test ecx, ecx
je 0x1001712e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001712e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10017110
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100536aa
mov esp, ebp
pop ebp
ret

Function at 0x10017150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100bc1b4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x6f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x100bd80c
mov dword [ebp - 0x24], 0x740066
mov dword [ebp - 0x20], 0x610077
mov edx, 0x11
mov dword [ebp - 0x1c], 0x650072
sub esi, eax
mov dword [ebp - 0x18], 0x43005c
mov dword [ebp - 0x14], 0x4d0043
mov dword [ebp - 0x10], 0x75006f
mov dword [ebp - 0xc], 0x650073
nop
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x100171ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x100171ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100171b0
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100536aa
mov esp, ebp
pop ebp
ret
Function at 0x100171f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100bc1b4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x34], 0x6f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x34]
mov eax, 0x100bd738
mov dword [ebp - 0x30], 0x740066
push edi
mov dword [ebp - 0x2c], 0x610077
mov edx, 0x17
mov dword [ebp - 0x28], 0x650072
sub esi, eax
mov dword [ebp - 0x24], 0x48005c
mov dword [ebp - 0x20], 0x6c0061
mov dword [ebp - 0x1c], 0x57006f
mov dword [ebp - 0x18], 0x6c0061
mov dword [ebp - 0x14], 0x50006c
mov dword [ebp - 0x10], 0x700061
mov dword [ebp - 0xc], 0x720065
lea ecx, [edx + 0x7fffffe7]
test ecx, ecx
je 0x10017283
movzx ecx, word [esi + eax]
test cx, cx
je 0x10017283
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10017265
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100536aa
mov esp, ebp
pop ebp
ret

Function at 0x100172b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100bc1b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x100bd7c4
mov dword [ebp - 0x24], 0x6f0053
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x740066
mov dword [ebp - 0x1c], 0x610077
mov edx, 0x10
mov dword [ebp - 0x18], 0x650072
sub esi, eax
mov dword [ebp - 0x14], 0x48005c
mov dword [ebp - 0x10], 0x6f0061
mov dword [ebp - 0xc], 0x61006b
mov dword [ebp - 8], 0x6e
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x1001732e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001732e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10017310
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100536aa
mov esp, ebp
pop ebp
ret

Function at 0x10017350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100bc1b4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], 0x6f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x28]
mov eax, 0x100bd784
mov dword [ebp - 0x24], 0x740066
mov dword [ebp - 0x20], 0x610077
mov edx, 0x11
mov dword [ebp - 0x1c], 0x650072
sub esi, eax
mov dword [ebp - 0x18], 0x59005c
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x790067
mov dword [ebp - 0xc], 0x6e0061
nop
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x100173ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x100173ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100173b0
test edx, edx
lea ecx, [eax - 2]
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100536aa
mov esp, ebp
pop ebp
ret