joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401710
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
push ebx
mov eax, 0x5a4d
mov dword [ebp - 0x2f0], ecx
push esi
push edi
movups xmmword [ebp - 0x310], xmm0
cmp word [ecx], ax
jne 0x401bff
mov edi, dword [ecx + 0x3c]
add edi, ecx
mov dword [ebp - 0x2ec], edi
cmp dword [edi], 0x4550
jne 0x401bff
mov eax, 0x14c
test word [edi + 0x16], ax
je 0x401bff
mov eax, dword [edi + 0x34]
push 0x2c8
mov dword [ebp - 0x2f8], eax
lea eax, [ebp - 0x2e4]
push 0
push eax
call fcn.00403ca0
add esp, 0xc
mov dword [ebp - 0x2e8], 0x10002
lea eax, [ebp - 0x2e8]
push eax
push dword [ebp - 0x30c]
push esi
call fcn.00af932f
test eax, eax
je 0x401bff
mov ebx, dword [ebp - 0x244]
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x1c]
add ebx, 8
push eax
push ebx
push dword [ebp - 0x310]
push edi
call fcn.005cb3d2
test eax, eax
je 0x401bff
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2f8]
cmp esi, eax
jne 0x4017ff
push esi
push dword [ebp - 0x310]
call fcn.004c5bc5
ret
push 0x40
push 0x3000
push dword [edi + 0x50]
call fcn.00aec93d
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402838
mov esp, ebp
pop ebp
ret
Function at 0x402570
Capabilities:
Decompress data using quicklz
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
test byte [ecx], 2
mov eax, 9
push ebx
push esi
mov esi, 3
mov ebx, edx
cmovne esi, eax
mov edx, 1
mov eax, dword [ebp + 8]
add esi, ecx
dec eax
add eax, ebx
mov dword [ebp - 0x20], eax
add eax, 0xfffffff6
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebx - 1]
mov dword [ebp - 4], eax
nop word [eax + eax]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ebx
cmp edx, 1
jne 0x4025bd
mov edx, dword [esi]
cmp dword [ebp - 0x10], 1
lea ecx, [esi + 4]
cmovne ecx, esi
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx]
mov dword [ebp - 8], esi
shr dword [ebp - 8], 0x10
test dl, 1
je 0x402675
mov eax, esi
shr edx, 1
shr eax, 4
and eax, 0xfff
mov dword [ebp - 0xc], edx
and esi, 0xf
mov eax, dword [edi + eax*4]
mov dword [ebp - 0x18], eax
lea edx, [esi + 2]
mov eax, dword [ebp - 8]
movzx eax, al
cmove edx, eax
neg esi
mov dword [ebp - 0x10], edx
mov edi, edx
sbb esi, esi
add ecx, 3
xor edx, edx
add esi, ecx
mov ecx, ebx
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0x18]
sub esi, ebx
nop word [eax + eax]
mov eax, dword [esi + ecx]
lea ecx, [ecx + 3]
add edx, 3
mov dword [ecx - 3], eax
cmp edx, edi
jb 0x402620
add ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 8]
mov dword [ebp - 0x18], ebx
cmp eax, dword [ebp - 0x14]
jae 0x40266d
mov ebx, dword [ebp - 0x14]
inc eax
mov edx, dword [eax]
mov esi, eax
shr edx, 0xc
xor edx, dword [eax]
and edx, 0xfff
mov dword [edi + edx*4], eax
inc eax
mov byte [edx + edi + 0x4000], 1
cmp esi, ebx
jb 0x402648
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
jmp 0x4025a4
cmp ebx, dword [ebp - 0x1c]
jae 0x4026dc
mov eax, edx
mov dword [ebx], esi
mov esi, dword [ebp - 0x10]
and eax, 0xf
mov ecx, dword [eax*4 + 0x412d00]
add ebx, ecx
mov eax, dword [ebp - 4]
add esi, ecx
shr edx, cl
mov dword [ebp - 0xc], edx
lea ecx, [ebx - 3]
mov dword [ebp - 8], esi
cmp eax, ecx
jae 0x4025b0
mov esi, ecx
mov dword [ebp - 4], ecx
lea edx, [eax + 1]
sub esi, eax
nop
mov ecx, dword [edx]
shr ecx, 0xc
xor ecx, dword [edx]
and ecx, 0xfff
mov dword [edi + ecx*4], edx
inc edx
mov byte [ecx + edi + 0x4000], 1
sub esi, 1
jne 0x4026b0
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 4]
jmp 0x4025b0
mov esi, dword [ebp - 0x20]
cmp ebx, esi
ja 0x402715
mov dword [ebp - 0x20], 0x80000000
nop word [eax + eax]
cmp edx, 1
mov eax, edx
cmove edx, dword [ebp - 0x20]
add ecx, 4
cmp eax, 1
cmovne ecx, dword [ebp - 0x10]
shr edx, 1
mov al, byte [ecx]
inc ecx
mov byte [ebx], al
inc ebx
mov dword [ebp - 0x10], ecx
cmp ebx, esi
jbe 0x4026f0
mov eax, dword [ebp - 4]
add esi, 0xfffffffd
cmp eax, esi
jae 0x40273f
lea edx, [eax + 1]
sub esi, eax
mov ecx, dword [edx]
shr ecx, 0xc
xor ecx, dword [edx]
and ecx, 0xfff
mov dword [edi + ecx*4], edx
inc edx
mov byte [ecx + edi + 0x4000], 1
sub esi, 1
jne 0x402721
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4030fa
Capabilities:
Parse pe header

Disassembly:
push 0
push edx
call fcn.0041af46
test eax, eax
je 0x403139
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403139
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403139
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403139
cmp dword [ecx + 0x74], 0xe
jbe 0x403139
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40dd10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40dd3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40dd3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x41dc30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41dd3c
test eax, eax
je 0x41dd3c
push esi
push edi
mov ecx, 0x10
mov esi, 0x438ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x41dd23
lea edi, [eax + 4]
jmp 0x41dc87
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x41dc9c
mov dword [ebp - 4], 2
jmp 0x41dcbd
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x41dcb3
mov dword [ebp - 4], 1
jmp 0x41dcbd
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x41dd33
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x41dcf6
mov byte [ecx], 0x3d
jmp 0x41dd02
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x41dd0d
mov byte [ecx], 0x3d
jmp 0x41dd13
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x41dc84
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4b1b7532
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x727f1a2e
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1000187d
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.10055dbc
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.10055dbc
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.10055dbc
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.100566c0
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x10001936
mov eax, 0
jmp 0x10001aa2
cmp dword [ebp + 0xc], 0
jne 0x1000196c
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10001969
push 0xa0
push 0x40350fa
push 6
call fcn.10055dda
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x10001994
mov eax, 0x10104240
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x1000198e
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x100019c9
push 0x104
push 0x40350fa
push 6
call fcn.10055dda
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x10104251
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x100019ff
push 0x12e
push 0x40350fa
push 6
call fcn.10055dda
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10001a9d
push 0x225
push 0x40350fa
push 6
call fcn.10055dda
add esp, 0xc
jmp 0x10001aa2
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.10055db6
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.10055db6
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001d4e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10105ba2]
push ebx
call fcn.10055db6
add esp, 4
mov eax, 0x10104252
mov dword [0x10105ba2], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10055db6
add esp, 4
mov eax, 0x10104252
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x10001ea9
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10001dbb
push 0x34
push 0x4035158
push 6
call fcn.10055dda
add esp, 0xc
mov eax, dword [0x10105ba2]
push eax
push eax
mov ebx, eax
call fcn.10001104
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.10055dbc
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10105ba2]
call fcn.10001b1f
jmp 0x10001e02
mov esp, ebp
pop ebp
ret 8

Function at 0x10001fc5
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x100020db
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002000
push 0
push 0x4035706
push 6
call fcn.10055dda
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10002008
mov esp, ebp
pop ebp
ret 4

Function at 0x1000220d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10056740
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10002252
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10002287
push 0x36
push 0x4035153
push 6
call fcn.10055dda
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000229a
mov eax, 0x10104251
push eax
push 1
mov ebx, 0x170
call fcn.10056780
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x100022b8
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100022c9
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x10006c8c
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10006cae
mov eax, 0xfffffffd
jmp 0x10006d8e
mov ebx, dword [0x10105bc2]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10006d5c
mov ebx, dword [0x10105bc2]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10006cfd
mov ebx, dword [0x10105bc2]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10006cfd
mov eax, 1
jmp 0x10006d02
mov eax, 0
test eax, eax
je 0x10006d2e
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10006d17
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x10105bc2]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10006d84
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10006d8e
mov esp, ebp
pop ebp
ret 4

Function at 0x10006ffd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x100070b0
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x1000711b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x100071ce
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x10007739
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10056740
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000777e
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x10104251
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.100063a1
add esp, 8
cmp eax, 0
jne 0x100077f9
call fcn.1000787d
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x10105bd2]
test ebx, ebx
je 0x100077bc
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov dword [0x10105bd2], eax
mov eax, dword [0x10105bd2]
test eax, eax
je 0x100077e0
push eax
mov ebx, eax
call fcn.10002d7b
inc eax
push eax
call fcn.10055dbc
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x100077f3
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10007834
push 0x202
push 0x4035e95
push 6
call fcn.10055dda
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10007847
mov eax, 0x10104251
push eax
push 1
mov ebx, 0x170
call fcn.10056780
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10007865
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007876
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000787d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10056740
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100078c2
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x100078f7
push 0x36
push 0x4035eab
push 6
call fcn.10055dda
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000790a
mov eax, 0x10104251
push eax
push 1
mov ebx, 0x170
call fcn.10056780
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10007928
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007939
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1000793e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10056740
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007983
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x100079b8
push 0x36
push 0x4035e96
push 6
call fcn.10055dda
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x100079d4
push eax
mov ebx, eax
call fcn.10002d7b
inc eax
push eax
call fcn.10055dbc
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x100079d9
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100079ea
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x10007d52
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.1000711b
test eax, eax
je 0x10007d95
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10007d95
cmp word [eax], 0x5a4d
jne 0x10007d95
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10007d95
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.100071ed
mov eax, dword [ebp + 8]
jmp 0x10007dae
mov esp, ebp
pop ebp
ret 4
Function at 0x1000ba53
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x1000ba8b
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x1000ba79
mov al, 1
jmp 0x1000baea
cmp dword [ebx + 0x54], ecx
jne 0x1000ba82
mov al, 2
jmp 0x1000baea
cmp dword [ebx + 0x7c], ecx
jne 0x1000baea
mov al, 3
jmp 0x1000baea
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x1000baa0
mov al, 4
jmp 0x1000baea
cmp ecx, 5
jne 0x1000bac0
cmp ebx, 0
jne 0x1000baae
mov al, 5
jmp 0x1000baea
cmp ebx, 1
jne 0x1000bab7
mov al, 6
jmp 0x1000baea
cmp ebx, 2
jne 0x1000bac0
mov al, 7
jmp 0x1000baea
cmp ecx, 6
jne 0x1000bae8
cmp ebx, 0
jne 0x1000bace
mov al, 8
jmp 0x1000baea
cmp ebx, 1
jne 0x1000bad5
mov al, 9
cmp ebx, 2
jne 0x1000badc
mov al, 0xa
cmp ebx, 3
jne 0x1000bae3
mov al, 0xb
cmp ebx, 4
jne 0x1000baea
mov al, 0xc
pop ebx
leave
ret

Function at 0x1000d2b7
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10105bee]
push ebx
call fcn.10055db6
add esp, 4
mov eax, 0x10104252
mov dword [0x10105bee], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10055db6
add esp, 4
mov eax, 0x10104252
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x1000d412
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000d324
push 0x34
push 0x4035eb6
push 6
call fcn.10055dda
add esp, 0xc
mov eax, dword [0x10105bee]
push eax
push eax
mov ebx, eax
call fcn.10001104
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.10055dbc
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10105bee]
call fcn.10001b1f
jmp 0x1000d36b
mov esp, ebp
pop ebp
ret 8

Function at 0x1000d52e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x1000d644
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000d569
push 0
push 0x4035eb8
push 6
call fcn.10055dda
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x1000d571
mov esp, ebp
pop ebp
ret 4
Function at 0x1000e5f4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x1000e62c
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x1000e61a
mov al, 1
jmp 0x1000e68b
cmp dword [ebx + 0x54], ecx
jne 0x1000e623
mov al, 2
jmp 0x1000e68b
cmp dword [ebx + 0x7c], ecx
jne 0x1000e68b
mov al, 3
jmp 0x1000e68b
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x1000e641
mov al, 4
jmp 0x1000e68b
cmp ecx, 5
jne 0x1000e661
cmp ebx, 0
jne 0x1000e64f
mov al, 5
jmp 0x1000e68b
cmp ebx, 1
jne 0x1000e658
mov al, 6
jmp 0x1000e68b
cmp ebx, 2
jne 0x1000e661
mov al, 7
jmp 0x1000e68b
cmp ecx, 6
jne 0x1000e689
cmp ebx, 0
jne 0x1000e66f
mov al, 8
jmp 0x1000e68b
cmp ebx, 1
jne 0x1000e676
mov al, 9
cmp ebx, 2
jne 0x1000e67d
mov al, 0xa
cmp ebx, 3
jne 0x1000e684
mov al, 0xb
cmp ebx, 4
jne 0x1000e68b
mov al, 0xc
pop ebx
leave
ret

Function at 0x1000e6b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10056740
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000e6fd
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000e732
push 0x36
push 0x4035a09
push 6
call fcn.10055dda
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000e745
mov eax, 0x10104251
push eax
push 1
mov ebx, 0x170
call fcn.10056780
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x1000e763
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000e774
push ebx
call fcn.10055db6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret