joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004e8ee
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10057080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10042ae9
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10042ae9
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1004e965
cmp word [ecx], dx
je 0x1004e965
mov eax, dword [0x100b808c]
push edi
dec eax
push eax
push 0x100b7f78
call fcn.1004e88d
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1004e9d8
cmp word [eax], dx
je 0x1004e9d8
mov eax, dword [edi]
test eax, eax
je 0x1004e989
cmp word [eax], dx
je 0x1004e989
lea eax, [ebp - 0x10]
push eax
call fcn.1004e270
jmp 0x1004e992
lea eax, [ebp - 0x10]
push eax
call fcn.1004e30b
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1004ea02
mov eax, dword [0x100b7f74]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100b7c68
call fcn.1004e88d
add esp, 0xc
test al, al
je 0x1004ea02
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1004e9cd
cmp word [eax], di
je 0x1004e9cd
lea eax, [ebp - 0x10]
push eax
call fcn.1004e270
pop ecx
jmp 0x1004ea04
lea eax, [ebp - 0x10]
push eax
call fcn.1004e30b
jmp 0x1004e9ca
mov eax, dword [edi]
test eax, eax
je 0x1004e9ef
cmp word [eax], dx
je 0x1004e9ef
lea eax, [ebp - 0x10]
push eax
call fcn.1004e225
pop ecx
jmp 0x1004ea02
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1004eacd
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1004e712
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1004eacd
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1004eacd
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1004eacd
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1004ea5a
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10047c17
test ebx, ebx
je 0x1004eac8
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10047c17
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1004eacd
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1004eacd
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100520d5
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1004eacf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037321
leave
ret
Function at 0x100522f1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1005226d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10052460
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10052460
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10052415
jg 0x1005234d
test eax, eax
je 0x1005240b
push 1
push 0x1000
call fcn.10042722
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10052370
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10052402
push 0x8000
push ebx
call fcn.1005219e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10052399
jg 0x10052394
cmp ecx, 0x1000
jb 0x10052399
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10043804
add esp, 0x10
cmp eax, 0xffffffff
je 0x100523de
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10052394
jl 0x100523c5
test ecx, ecx
jne 0x10052386
push dword [ebp - 0xc]
push ebx
call fcn.1005219e
push esi
call fcn.10045658
add esp, 0xc
xor ebx, ebx
jmp 0x1005246e
cmp byte [edi + 0x24], 0
je 0x100523f5
cmp dword [edi + 0x20], 5
jne 0x100523f5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10052400
mov ebx, dword [edi + 0x18]
jmp 0x10052402
xor ebx, ebx
push esi
call fcn.10045658
pop ecx
jmp 0x1005246e
test ecx, ecx
jg 0x100523d7
jl 0x10052415
test eax, eax
jae 0x100523d7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10049046
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10052435
cmp byte [edi + 0x1c], 0
je 0x100523d7
jmp 0x10052466
push ebx
call fcn.1004c852
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100523d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1005246e
cmp byte [edi + 0x1c], 0
je 0x1005246b
mov ebx, dword [edi + 0x18]
jmp 0x1005246e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10049046
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10053e50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10053e7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10053e7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100072fb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c8
mov eax, 0x1002ab14
call fcn.1001799a
mov ebx, ecx
cmp dword [ebx + 0x20], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3d0], eax
je 0x100074d1
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x3bc], 7
mov dword [ebp - 0x3b8], 1
jb 0x10007340
mov eax, dword [esi]
lea ecx, [ebp - 0x3b8]
xor edi, edi
push ecx
push edi
lea ecx, [ebp - 0x3bc]
push ecx
push edi
push eax
push dword [ebx + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp ecx, 2
je 0x100074c7
cmp dword [ebp - 0x3bc], 7
jne 0x100074c7
test ecx, ecx
je 0x10007390
push esi
lea eax, [ebx + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x3b4]
call fcn.10028743
jmp 0x100074de
mov eax, dword [ebp - 0x3b8]
add eax, 2
mov dword [ebp - 0x3c8], edi
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3c4], edi
mov dword [ebp - 0x3c0], edi
push eax
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 4], edi
call fcn.10028743
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x3c4]
mov edi, dword [ebp - 0x3c8]
sub eax, edi
mov dword [ebp - 0x3cc], eax
mov ecx, edi
push 0
pop eax
cmove ecx, eax
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100073ed
mov eax, dword [esi]
lea edx, [ebp - 0x3b8]
push edx
push ecx
lea ecx, [ebp - 0x3bc]
push ecx
push 0
push eax
push dword [ebx + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
jne 0x10007378
mov ebx, dword [ebp - 0x3cc]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x14], 7
test ebx, ebx
mov eax, edi
cmove eax, ecx
and dword [ebp - 0x28], ecx
and dword [ebp - 0x18], ecx
mov word [ebp - 0x28], cx
lea ecx, [ebp - 0x28]
lea eax, [eax + esi*2]
push eax
call fcn.10028743
mov ecx, dword [ebp - 0x3d0]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call fcn.10028743
mov eax, dword [ebp - 0x18]
inc eax
mov byte [ebp - 4], 1
add esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x1000748c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10007485
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100074ef
push ecx
call fcn.10028743
pop ecx
xor ecx, ecx
mov eax, edi
test ebx, ebx
cmove eax, ecx
cmp byte [eax + esi*2], cl
jne 0x1000741a
test edi, edi
je 0x100074c3
mov eax, dword [ebp - 0x3c0]
mov ecx, edi
sub eax, ecx
cmp eax, 0x1000
jb 0x100074bc
mov edi, dword [ecx - 4]
sub ecx, edi
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x100074ef
push edi
call fcn.10028743
pop ecx
mov al, 1
jmp 0x100074c9
xor al, al
call fcn.1001794f
ret 8
push ecx
push ecx
lea ecx, [ebp - 0x3b4]
call fcn.10028743
push 0x1005b9a0
lea eax, [ebp - 0x3b4]
push eax
call fcn.10028743
call fcn.1001c8c1
int3
Function at 0x10014524
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x1005b240
call fcn.10017dae
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.kernel32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x1001459a
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x1001459a
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x1001459a
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x1001459a
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x100145a3
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10014791
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x10060010]
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x1006000c]
test edx, edx
jne 0x100147d9
test eax, eax
je 0x100147ec
mov edx, eax
mov dword [0x10060010], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x100147ec
cmp ecx, ebx
jb 0x100147ec
cmp ecx, edi
jbe 0x100148dc
mov edx, eax
mov dword [0x10060010], edx
test eax, eax
je 0x10014822
mov ecx, eax
test eax, eax
je 0x10014811
mov eax, dword [ecx + 8]
test eax, eax
je 0x10014811
cmp eax, ebx
jb 0x10014811
cmp eax, edi
jbe 0x100148dc
mov edx, dword [edx + 4]
mov ecx, edx
mov dword [0x10060010], edx
mov eax, edx
test ecx, ecx
jne 0x100147fa
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x1001485c
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
cmp esi, 0x40000000
jae 0x10014884
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
mov edx, esi
mov ecx, ebx
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
mov edx, edi
mov ecx, esi
call fcn.10028743
mov edx, eax
test edx, edx
je 0x10014901
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x1006000c]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10060010], edx
mov dword [0x1006000c], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x100148cc
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x10014901
cmp esi, edi
ja 0x10014901
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.10018da4
add esp, 0xc
mov eax, esi
jmp 0x10014903
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10014798
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x10060010]
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x1006000c]
test edx, edx
jne 0x100147d9
test eax, eax
je 0x100147ec
mov edx, eax
mov dword [0x10060010], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x100147ec
cmp ecx, ebx
jb 0x100147ec
cmp ecx, edi
jbe 0x100148dc
mov edx, eax
mov dword [0x10060010], edx
test eax, eax
je 0x10014822
mov ecx, eax
test eax, eax
je 0x10014811
mov eax, dword [ecx + 8]
test eax, eax
je 0x10014811
cmp eax, ebx
jb 0x10014811
cmp eax, edi
jbe 0x100148dc
mov edx, dword [edx + 4]
mov ecx, edx
mov dword [0x10060010], edx
mov eax, edx
test ecx, ecx
jne 0x100147fa
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x1001485c
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
cmp esi, 0x40000000
jae 0x10014884
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
mov edx, esi
mov ecx, ebx
call fcn.10028743
mov edx, eax
test edx, edx
jne 0x100148a2
mov edx, edi
mov ecx, esi
call fcn.10028743
mov edx, eax
test edx, edx
je 0x10014901
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x1006000c]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10060010], edx
mov dword [0x1006000c], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x100148cc
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x10014901
cmp esi, edi
ja 0x10014901
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.10018da4
add esp, 0xc
mov eax, esi
jmp 0x10014903
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1001492c
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov ecx, dword [0x1006000c]
push esi
mov esi, 0x1006000c
test ecx, ecx
je 0x1001499c
push edi
xor eax, eax
cmp dword [ecx], 0x52727464
jne 0x1001496e
lea edi, [ecx + 0x10000]
lea edx, [ecx + 0x88]
cmp dword [edx], 0
je 0x10014960
cmp dword [edx], ecx
jb 0x1001498e
cmp dword [edx], edi
jae 0x1001498e
inc eax
add edx, 0x48
cmp eax, 0x38d
jb 0x10014953
xor eax, eax
inc eax
test eax, eax
je 0x10014992
mov eax, dword [ecx + 4]
push 0x8000
push 0
push ecx
mov dword [esi], eax
call dword [sym.imp.kernel32.dll_VirtualFree]
and dword [0x10060010], 0
jmp 0x10014995
xor eax, eax
jmp 0x1001496e
lea esi, [ecx + 4]
mov ecx, dword [esi]
test ecx, ecx
jne 0x1001493d
pop edi
pop esi
ret
Function at 0x10015998
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x24
push 0x1005b280
call fcn.10017dae
mov dword [ebp - 0x30], edx
mov ebx, ecx
xor esi, esi
test ebx, ebx
jne 0x100159b8
push esi
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x100159cf
push 0xc1
jmp 0x10015ae0
mov edi, dword [ebx + 0x3c]
cmp dword [edi + ebx], 0x4550
je 0x100159e5
push 0xbf
jmp 0x10015ae0
cmp word [edi + ebx + 0x14], si
je 0x10015adb
mov edi, dword [edi + ebx + 0x78]
lea eax, [edi + ebx]
neg edi
sbb edi, edi
and edi, eax
mov dword [ebp - 0x28], edi
je 0x10015adb
mov ecx, dword [edi + 0x1c]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x34], ecx
mov edx, dword [edi + 0x20]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x24], edx
mov eax, esi
mov dword [ebp - 0x1c], esi
cmp eax, dword [edi + 0x14]
jae 0x10015ab2
test ecx, ecx
je 0x10015a4f
mov edx, dword [ecx + eax*4]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
jmp 0x10015a51
mov edx, esi
mov ecx, esi
mov eax, esi
mov dword [ebp - 0x20], esi
cmp eax, dword [edi + 0x18]
jae 0x10015a82
mov edi, dword [ebp - 0x24]
movzx eax, word [edi + eax*2]
cmp eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x28]
jne 0x10015aa9
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10015aa5
mov ecx, dword [ebp - 0x20]
mov ecx, dword [eax + ecx*4]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x10]
add eax, dword [ebp - 0x1c]
push edx
push ecx
push eax
push dword [ebp - 0x30]
mov eax, 0x1001440a
call eax
test eax, eax
je 0x10015ab2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
jmp 0x10015a38
mov ecx, esi
jmp 0x10015a82
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x10015a58
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x10015aef
push 0xc0
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10028743
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10028752
pop dword [ebp - 0x38]
mov eax, 0x10028752
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x41588
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0xb2b93c41
sub ecx, 0xb2b8f3bc
mov edx, eax
mov edi, 0x10068a00
add edi, dword [ebp - 0x38]
mov esi, 0x53ffe1a2
mov ebx, dword [edi]
mov dword [ebp - 4], 0xf196351e
sub ebx, esi
add dword [ebp - 0x14], 0x1175b305
mov dword [edx], ebx
xor dword [ebp - 0x18], eax
add edx, 4
add edi, 4
loop 0x1002879b
add eax, 0x114e7
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1007a10c
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 0xc], ecx
jle 0x1007a132
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
movsx eax, byte [ecx + edx]
xor eax, 0xffffff80
shl eax, 0x18
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [esp + 0x10]
jl 0x1007a11d
pop esi
ret

Function at 0x1007ed43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1007ed52
pop dword [ebp - 0x48]
mov eax, 0x1007ed52
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xf9cda91a
sub dword [ebp - 0x58], 0xab7b63cf
mov dword [ebp - 0x54], 0x5fd8c36b
sub dword [ebp - 0x54], 0x2da57726
mov dword [ebp - 0x50], 0x88aed3c8
sub dword [ebp - 0x50], 0x3c628f9a
mov dword [ebp - 0x4c], 0x9da95ed4
add dword [ebp - 0x4c], 0x6256a12c
lea eax, [ebp - 0x58]
push eax
mov eax, 0xb67f527d
add eax, 0x59891db7
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xb4e21bba
add dword [ebp - 0x58], 0xbf904d9c
mov dword [ebp - 0x54], 0x2d6bdca9
add dword [ebp - 0x54], 0x140084cc
mov dword [ebp - 0x50], 0x362b478c
add dword [ebp - 0x50], 0x2d4424e0
mov dword [ebp - 0x4c], 0x9b86f32f
sub dword [ebp - 0x4c], 0x9b86f32f
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xe2910a02
sub eax, 0xd28899de
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3dd3f
push 0
call eax
mov ecx, 0xcef7d2ad
sub ecx, 0xcef788fb
xor ebx, ebx
add ebx, eax
mov esi, 0xe0a035b7
sub esi, 0xd094a5b7
add esi, dword [ebp - 0x48]
mov edi, 0x7eb37a81
add edi, 0x3ce01c36
sub dword [ebp - 0x14], eax
mov edx, dword [esi]
add dword [ebp - 0x44], esi
xor edx, edi
add dword [ebp - 0x3c], 0xb30fc75a
mov dword [ebx], edx
add dword [ebp - 0x18], 0x935f89a0
add ebx, 4
add esi, 0x7e5c952
add esi, 0xf81a36b2
loop 0x1007ee71
add eax, 0x39dadd2
sub eax, 0x39c9437
xor ebx, ebx
add ebx, eax
add eax, 0xd34d549e
sub eax, 0xd34d5499
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4015c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4015d9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401614
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401610
lea ebx, [ebx]
cmp esi, eax
jae 0x401614
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401600
cmp esi, eax
jb 0x40161a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40616e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4061a7
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00402298
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00402273
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x407fed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x408030
call fcn.00409aba
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x408030
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40804b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00407ba4
test ebx, ebx
mov esi, eax
je 0x408049
test edi, edi
je 0x408049
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40d3ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40d410
call fcn.00409aba
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40d410
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40d453
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x40d43c
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40d43c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40d450
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40e7fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00409aba
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40e833
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0040e41e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x412cbd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x412ceb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x412d09
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00412c27
jmp 0x412d09
mov eax, dword [esi + 0x14]
test eax, eax
je 0x412d09
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00412c27
test edi, edi
mov eax, edi
jne 0x412cf3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x454c60]
test ecx, ecx
je 0x412dcc
jmp 0x412cbc
ret 8

Function at 0x42485a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x451540]
jne 0x424864
repz ret
jmp fcn.0042950d