joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b6360
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x100b6380
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x100b88f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x100b8aad
call fcn.100b8906
Function at 0x101d55af
Capabilities:
Read file on windows

Disassembly:
je 0x10382d8d
push eax
mov dx, 0x76e3
jmp 0x1032d25f
cmp eax, edi
jmp 0x10116ab5
push 0x100e70b8
movsx ecx, dx
mov ecx, esp
movzx cx, bh
push esi
lea ecx, [ebp - 0x1c]
jmp 0x1027409d
push esi
bt esi, eax
push edi
sbb esi, 0x6e5b5c45
cmc
mov eax, dword [0x100f3de0]
xor dword [ebp - 8], eax
sub si, 0x37fe
bsr si, cx
xor eax, ebp
movzx esi, di
sar si, 0xd4
push eax
btc si, 0xa5
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
shl ax, cl
sbb esi, ebp
mov dword [ebp - 0x18], esp
mov esi, ecx
bts ax, sp
sub edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
lahf
mov dword [ebp - 4], edi
lahf
setnp al
push 0x100e70b4
push esi
cmovnp ax, si
cbw
setns al
lea eax, [ebp - 0x1c]
push eax
jmp 0x1037ddd9
call fcn.1004dd29
lea esp, [esp + 0xc]
rcr ah, 0xd0
mov eax, dword [ebp - 0x1c]
jmp 0x10192a76
push edx
call fcn.1004dbd0
lea esp, [esp + 0x14]
mov eax, 0x5a4d
stc
test bl, 0x24
cmp word [ebp - 0x20], ax
jmp 0x10234fa2
jmp 0x1028bdc1
push ecx
jmp 0x101d5798
jne 0x10382d8d
mov edi, 1
jmp 0x10022044
call fcn.1004db3c
mov edx, dword [ebp - 0x1c]
jmp 0x10216820
push 1
movzx edx, di
cwd
mov dh, 0x2b
push 2
movzx edx, bp
cwd
lea edx, [ebp - 0x20]
push edx
jmp 0x103c5914
je 0x101bb40d
push eax
push 1
bswap ecx
not cl
jmp 0x103b1b3f
call fcn.1004d849
lea esp, [esp + 0xc]
mov eax, dword [ebp - 0x1c]
clc
cmp eax, edi
jmp 0x1037a66d
mov dword [ebp - 4], 0xfffffffe
mov eax, edi
mov ecx, dword [ebp - 0x10]
xchg bx, di
not edi
mov dword fs:[0], ecx
pop ecx
bswap si
pop edi
mov esi, 0x3d7f0e0f
pop esi
movsx ebx, ax
not bl
movzx ebx, di
pop ebx
jmp 0x103c837c
push ecx
jmp 0x102b7df7
push 2
lea ecx, [ebp - 0x20]
jmp 0x103a7536
call fcn.1004db3c
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1004dbd0
lea esp, [esp + 0x14]
xadd ch, cl
mov ecx, 0x5a4d
cmp bh, 0x35
cmp word [ebp - 0x20], cx
jmp 0x1028bdc1
mov esp, ebp
mov ebp, 0x44133a5
not ebp
pop ebp
jmp 0x100551be
Function at 0x102586e5
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
push ebp
btr ebp, 0xd6
mov ebp, esp
adc eax, 0x70eb6e2f
sar eax, cl
ror ax, cl
push 0xffffffffffffffff
push 0x100bfaa7
not eax
bts ax, bp
mov eax, dword fs:[0]
push eax
sal eax, 0xf2
sub esp, 0x10c
movsx eax, cx
sar al, cl
clc
mov eax, dword [0x100f3de0]
jmp loc.10028abd

Function at 0x10312429
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Write file on windows

Disassembly:
je 0x1031dfcd
call fcn.10045afe
xor ecx, ecx
neg cl
test bl, 0xce
cmp eax, esi
setne cl
test di, cx
cmp ecx, esi
jmp loc.10028a99
push ebp
mov ebp, esp
and ax, 0x353f
cwde
sub al, dl
and esp, 0xfffffff8
rcl al, 0xbb
push 0xffffffffffffffff
push 0x100bebbb
bts eax, ebp
bt eax, ebp
mov eax, dword fs:[0]
cmp edi, 0x2691367c
push eax
dec eax
rol ah, cl
lea esp, [esp - 0x4c8]
inc eax
mov eax, dword [0x100f3de0]
xor eax, esp
mov dword [esp + 0x4c0], eax
add ax, 0x3062
movsx eax, cx
mov ah, 0xc
push ebx
bswap bx
xchg bx, ax
btc ebx, 0x14
push esi
rol bl, 0x18
sar eax, 0x93
bts bx, bx
push edi
mov eax, dword [0x100f3de0]
sub ebx, ebp
xor eax, esp
bt bx, si
neg bx
push eax
sal bh, 0xc2
bsr eax, ebp
bts eax, esi
lea eax, [esp + 0x4d8]
btc bx, 0x3d
shr ebx, 0xc
add bx, di
mov dword fs:[0], eax
shl bh, 0x9d
shr ebx, 0x14
mov ebx, ecx
cmp ebp, 0x526920cf
cmp sp, si
jmp 0x103a74fb
mov ecx, dword [esp + 0x4d8]
bts esi, ebx
btr esi, edi
rcl esi, 0xb1
mov dword fs:[0], ecx
pop ecx
pop edi
add esi, 0x47ec7bfa
pop esi
sub cl, 0xad
sal cx, cl
pop ebx
mov ecx, dword [esp + 0x4c0]
stc
xor ecx, esp
jmp 0x10358c94
call fcn.1004d436
mov esp, ebp
cmovl ebp, esi
pop ebp
jmp fcn.1003f2fd
sub esi, esi
cmp dword [0x1010858c], esi
jmp 0x10250eb4

Function at 0x1031511e
Capabilities:
Read file on windows

Disassembly:
push ebp
inc ah
mov ebp, esp
bt ax, ax
push 0xfffffffffffffffe
sub ax, bp
ror ax, cl
push 0x1025da68
cbw
sets al
rol ax, 0x60
push 0x10053580
mov eax, dword fs:[0]
test edx, 0x1d770fa5
jmp loc.1000a435
Function at 0x1000a7ba
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000a7fe
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000a7f2
push 0x391
push 0xfa2
push 0
push 0x36d
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1000a7fc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
jmp 0x1000a81b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
push 0x5726
push 0x5f67
call fcn.1000bec4
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1000af69
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000af8d
push 0x202b
push 0x49b3
push 1
call fcn.1000b00c
add esp, 0xc
jmp 0x1000b008
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000afe8
mov dword [ebp - 0x18], 1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000afc1
push 0x1266
call dword [sym.imp.USER32.dll_SetCapture]
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1000afe6
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1673
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1000b008
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000b008
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov esp, ebp
pop ebp
ret

Function at 0x1000b024
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000b0c5
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000b078
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000b076
push 0
push 0x1ee1
push 0
push 0
push 0xcff
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1000b0c3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1000b0a6
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x1000b0c3
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10028ca3
mov dword [eax], 0xfffffff8
jmp 0x1000b09b
jmp 0x1000b0d9
push 0x2e50
push 0
push 0x18df
call fcn.10010baf
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1000b7ec
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1000b871
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000b856
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.10028ca3
mov ecx, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x1000b86f
push 0x391
push 0xfa2
push 0
push 0x36d
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1000b879
push 0
call fcn.1000f849
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000cd82
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000ce18
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000cdcb
push 0x391
push 0xfa2
push 0
push 0x36d
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1000ce16
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000cdf9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1000ce16
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10028ca3
mov dword [eax], 0x42c70bb7
jmp 0x1000cdee
jmp 0x1000ce2c
push 0x739d
push 0x6636
push 1
call fcn.1000be06
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1000d01d
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000d04a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x39f6
push 1
push 0x5e98
call fcn.1000d08a
add esp, 0x10
jmp 0x1000d086
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000d06a
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
jmp 0x1000d086
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000d086
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret
Function at 0x1000fbb8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000fcb4
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000fc28
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1000fcb2
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1000fc3c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x38], 0x197b
cmp dword [ebp - 0x38], 0x131f
jge 0x1000fcb2
lea eax, [ebp - 8]
push eax
push 0x10008ae8
call fcn.1004eb10
pop ecx
pop ecx
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 0x3c], 0
je 0x1000fc91
lea eax, [ebp - 0x40]
push eax
push 0x10008ae4
call fcn.1004eb10
pop ecx
pop ecx
cmp dword [ebp - 0x40], 0
je 0x1000fc8f
mov byte [ebp - 1], 1
jmp 0x1000fc91
jmp 0x1000fc60
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000fca2
mov dword [ebp - 0xc], 0x10008b84
jmp 0x1000fca9
mov dword [ebp - 0xc], 0x10008b8c
push dword [ebp - 0xc]
call fcn.1004f621
pop ecx
jmp 0x1000fcd1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
push 0x5fc2
push 0
push dword [ebp - 0x44]
push 0x636d
call fcn.10010383
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x100100ad
Capabilities:
Create pipe
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001012c
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10010102
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10010100
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1673
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1001012a
push 0
push 0x4f3
push 0x14e0
push 0x639
push 0x238
push 0x1084
push 0x2300
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10010162
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x4b24
push 0x23f6
push 1
push 0x6a32
push 0x33e3
push 0x2b08
push 0x665f
push 0x6337
call fcn.1000beee
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x1001c866
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001c8e3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001c8c0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001c8be
push 0
push 0x1ee1
push 0
push 0
push 0xcff
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001c8e1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1001c8e1
push 0x24d2
call dword [sym.imp.GDI32.dll_SaveDC]
jmp 0x1001c8f5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 1
push dword [ebp - 0x20]
call fcn.1001046a
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001ca25
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ca97
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001ca56
push 0xb6b
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x1001ca95
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001ca95
push 0x8f4
push 0x51c
push 0x8d
push 0xf0a
push 0x77
push 0
push 0
push 0
push 0
push 0x1eed
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x1001caed
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001cac1
push 0
push 0x1ee1
push 0
push 0
push 0xcff
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001caed
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001caed
push 0
push 0x1248
push 0x6fb
push 0
push 0x541
push 0x1adb
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esp, ebp
pop ebp
ret
Function at 0x1001d329
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001d367
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001d351
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1001d365
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001d365
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
jmp 0x1001d38d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0x401b
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x43c6
call fcn.1000b12f
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1001d7ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001d9b1
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001d80e
mov byte [ebp - 3], 0
movzx eax, byte [ebp - 3]
test eax, eax
je 0x1001d809
push 0x130f
push 0x463
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x1001d9af
mov dword [ebp - 0x28], 0x1846
cmp dword [ebp - 0x28], 0x568
jge 0x1001d9a5
push 0x1087c164
push 0x10008ae4
call fcn.1004eb10
pop ecx
pop ecx
test eax, eax
je 0x1001d9a5
cmp dword [0x1087c164], 0
je 0x1001d9a5
and dword [0x1089f234], 0
mov ecx, 0x1099d9a0
call fcn.10029064
and dword [ebp - 0xc], 0
jmp 0x1001d866
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x1087c164]
jge 0x1001d8b3
mov eax, dword [ebp - 0xc]
lea eax, [eax*4 + 0x1089f8a8]
push eax
push 0x10008ae4
call fcn.1004eb10
pop ecx
pop ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [0x1089f234]
add ecx, dword [eax*4 + 0x1089f8a8]
mov dword [0x1089f234], ecx
push 0x1089f234
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x1099d9a0
call fcn.10029046
jmp 0x1001d85f
or dword [ebp - 0x1c], 0xffffffff
mov eax, dword [0x1087c164]
mov dword [ebp - 8], eax
jmp 0x1001d8c8
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jl 0x1001d991
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x1001d991
mov eax, dword [0x1089f234]
cdq
idiv dword [ebp - 8]
test edx, edx
jne 0x1001d98c
mov eax, dword [0x1089f234]
cdq
idiv dword [ebp - 8]
mov dword [ebp - 0x20], eax
and dword [ebp - 0x18], 0
and dword [ebp - 0x10], 0
jmp 0x1001d91a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax*4 + 0x1089f8a8]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jg 0x1001d98c
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x1001d937
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x1089f234]
jge 0x1001d972
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001d972
movzx esi, byte [ebp - 1]
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x1099d9a0
call fcn.10029085
and esi, eax
je 0x1001d966
mov byte [ebp - 2], 1
jmp 0x1001d96a
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 1], al
jmp 0x1001d92e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001d987
mov eax, dword [0x1087c164]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jmp 0x1001d98c
jmp 0x1001d903
jmp 0x1001d8c1
push dword [ebp - 0x1c]
push 0x10008b08
call fcn.1004f14f
pop ecx
pop ecx
jmp 0x1001d822
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1001d9c9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 1
push 0x4f7f
call fcn.1001c84c
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret