joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40edf0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba445
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x503d7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 4]
mov dword [esi], 0x4c8c4c
push 0
push eax
call dword [0x503c34]
and dword [esi + 8], 0
lea eax, [esi + 0xc]
and dword [ebp - 4], 0
push 0x41107c
push 0x41108d
push 3
push 4
push eax
call fcn.004b8320
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x24]
mov eax, dword [ebp + 8]
sub esp, 0x10
mov edi, esp
sub esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
add ecx, 0x18
mov dword [ebp - 0x1c], eax
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041154b
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x30]
sub esp, 0x10
mov edi, esp
sub esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
lea ecx, [esi + 0x24]
call fcn.0041154b
mov eax, dword [ebp + 0x10]
and dword [esi + 0x34], 0
push ecx
push esi
lea ecx, [ebp - 0x18]
mov dword [esi + 0x30], eax
mov byte [esi + 0x38], 0
call fcn.00410f74
push 1
push 0x10
mov edi, dword [eax]
mov ecx, dword [eax + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [ebp + 0xc], ecx
call dword [0x503d08]
test eax, eax
jne 0x40ef0d
push 0x131f462
call dword [0x503c88]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 8]
mov dword [eax + 0xc], ecx
lea ecx, [esi + 4]
mov dword [eax + 4], 1
mov dword [eax], 0x4c8bcc
mov dword [eax + 8], edi
mov dword [ebp + 8], eax
call fcn.0040ce22
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40ef42
and dword [ebp + 8], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [ebp - 0x18]
call fcn.0040b280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret 0xc
Function at 0x411f37
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba5f8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x503d7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
push ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x24], edx
call fcn.0041225a
push eax
lea ecx, [ebp - 0x54]
call fcn.0040e346
push eax
mov al, byte [edi + 0x28]
mov cl, byte [edi + 0x38]
mov edx, dword [edi + 0x34]
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x38]
mov byte [ebp - 0x26], cl
mov ecx, dword [edi + 0x30]
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 0x25], 1
push eax
lea eax, [edi + 0x20]
mov dword [ebp - 0x38], ecx
push eax
lea eax, [edi + 0x18]
mov dword [ebp - 0x34], edx
push eax
lea eax, [edi + 8]
mov byte [ebp - 0x30], 1
push eax
push edi
mov byte [ebp - 0x27], 1
call dword [0x503928]
lea ecx, [ebp - 0x50]
call fcn.0041105a
lea ecx, [ebp - 0x44]
call fcn.0041105a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b7acb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc

Function at 0x412085
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9ebf
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x503d7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push ecx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x1c], edx
call fcn.0041225a
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040e346
push eax
mov al, byte [edi + 0x28]
mov cl, byte [edi + 0x38]
mov edx, dword [edi + 0x34]
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x1e]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 0x1e], cl
mov ecx, dword [edi + 0x30]
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 0x1d], 1
push eax
lea eax, [edi + 0x20]
mov dword [ebp - 0x30], ecx
push eax
lea eax, [edi + 0x18]
mov dword [ebp - 0x2c], edx
push eax
lea eax, [edi + 8]
mov byte [ebp - 0x28], 1
push eax
push edi
mov byte [ebp - 0x1f], 1
call dword [0x503928]
lea ecx, [ebp - 0x48]
call fcn.0041105a
lea ecx, [ebp - 0x3c]
call fcn.0041105a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b7acb
leave
ret 8
Function at 0x414b57
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ba7cf
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
call fcn.004b9d09
mov eax, dword [0x503d7c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
cmp esi, edi
je 0x414c6e
push 0x14
pop ebx
push esi
lea ecx, [ebp + 8]
call fcn.00414c8c
test al, al
je 0x414bbd
add esi, ebx
cmp esi, edi
jne 0x414b98
jmp 0x414c6e
push edi
lea ecx, [ebp + 8]
call fcn.00414c8c
test al, al
jne 0x414bc8
sub edi, ebx
cmp esi, edi
jne 0x414bb0
jmp 0x414c6e
mov eax, edi
sub eax, esi
cdq
idiv ebx
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x1010], eax
mov eax, 0x7fffffff
cmp ebx, eax
cmovl eax, ebx
cmp ebx, 0xcc
jbe 0x414c25
mov ebx, eax
cmp eax, 0xccccccc
ja 0x414c0d
test eax, eax
jle 0x414c0d
imul eax, ebx, 0x14
push 1
push eax
call dword [0x503d08]
test eax, eax
jne 0x414c11
shr ebx, 1
jne 0x414bf9
xor eax, eax
xor ebx, ebx
cmp ebx, 0xcc
ja 0x414c2b
push eax
call dword [0x503d04]
mov ebx, 0xcc
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x100c], eax
mov dword [ebp - 0x1008], ebx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1014]
push ebx
push eax
push dword [ebp - 0x1010]
mov edx, esi
push dword [ebp + 8]
push edi
call fcn.00414fb3
cmp dword [ebp - 0x1008], 0xcc
mov esi, dword [eax]
jbe 0x414c6e
push dword [ebp - 0x100c]
call dword [0x503d04]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b7acb
leave
ret 4
Function at 0x41f911
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push 0x14
mov eax, 0x4bb0b7
call fcn.004b9797
mov edi, ecx
mov edx, dword [ebp + 0xc]
mov ebx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ecx + edx]
xor eax, ebx
imul ebx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x41f929
push ebx
push edx
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0041fe86
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41f95d
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x41fa5a
cmp dword [edi + 8], 0xaaaaaaa
jne 0x41f971
push 0x4cbb98
call dword [0x4c24ac]
lea eax, [edi + 4]
mov dword [ebp - 0x20], eax
and dword [ebp - 4], 0
and dword [ebp - 0x1c], 0
push 0x18
call dword [0x4c2590]
mov esi, eax
pop ecx
test esi, esi
jne 0x41f994
call dword [0x4c24a8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
mov eax, dword [eax]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f2f10]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f2f10]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x41fa0c
mov ecx, edi
call fcn.0041fc93
push ebx
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041fe86
mov edx, dword [eax]
jmp 0x41fa0f
mov edx, dword [ebp - 0x18]
mov eax, dword [edi + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
mov dword [ebp + 0xc], ecx
and eax, ebx
mov ecx, dword [edi + 0xc]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi + 4]
jne 0x41fa3b
mov dword [ecx + eax*8], esi
jmp 0x41fa4d
cmp ebx, edx
jne 0x41fa44
mov dword [ecx + eax*8], esi
jmp 0x41fa51
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41fa51
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
call fcn.004b976b
ret 8

Function at 0x41fe5a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + edi]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x41fe69
mov eax, dword [ecx + 0x18]
pop edi
and eax, esi
pop esi
pop ebp
ret 4

Function at 0x41fedf
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov ecx, 0x811c9dc5
cmp dword [ebp + 8], esi
jbe 0x41ff02
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, dword [ebp + 8]
jb 0x41fef0
mov eax, ecx
pop esi
leave
ret 4
Function at 0x42b0ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
push 4
pop eax
mov word [esi + 0x60], ax
movzx eax, ax
or eax, 0x10000
mov dword [esi], 0x4d06dc
mov dword [esi + 4], 0x4d0680
mov dword [esi + 8], 0x4d0640
mov dword [esi + 0xc], 0x4d061c
mov dword [esi + 0x10], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x70], edi
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42b12a
mov dword [esi + 0x20], edi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x24], 8
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x54], 1
call dword [0x4c21cc]
push edi
mov dword [esi + 0x7c], eax
lea eax, [esi + 0x80]
push edi
push eax
call dword [0x4c211c]
mov dword [esi + 0x98], edi
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x42b18c
mov dword [esi + 0x10], edi
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
ret
Function at 0x43a9ce
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x43ab21
mov edx, 0x10000000
cmp eax, 0x7c
je 0x43ab21
cmp eax, 0x29
jne 0x43aa07
cmp dword [esi + 0x10], 0
jne 0x43ab21
test dword [esi + 0x50], edx
je 0x43ab27
cmp eax, 0x2e
jne 0x43aa22
push 5
lea ecx, [esi + 0x24]
call fcn.0043abfe
mov ecx, esi
call fcn.0043a9a5
jmp 0x43ab0b
cmp eax, 0x5c
jne 0x43aa77
mov ecx, esi
call fcn.0043a9a5
test byte [esi + 0x50], 0x80
je 0x43aa6b
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x43aa53
push 4
lea ecx, [esi + 0x24]
call fcn.0043abfe
mov ecx, esi
call fcn.0043a9a5
jmp 0x43ab12
cmp eax, 0x42
jne 0x43aa6b
push 4
lea ecx, [esi + 0x24]
call fcn.0043abfe
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x43aa47
mov ecx, esi
call fcn.0043b36d
jmp 0x43ab0b
cmp eax, 0x5b
jne 0x43aa97
mov ecx, esi
call fcn.0043a9a5
mov ecx, esi
call fcn.0043b321
cmp dword [esi + 0x4c], 0x5d
je 0x43aa16
push 4
jmp 0x43ab29
cmp eax, 0x28
jne 0x43aab4
mov ecx, esi
call fcn.0043a9a5
mov ecx, esi
call fcn.0043b413
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x43ab27
jmp 0x43ab00
cmp eax, 0x5e
jne 0x43aabd
push 2
jmp 0x43aa3f
cmp eax, 0x24
jne 0x43aac9
push 3
jmp 0x43aa3f
cmp eax, 0x2a
je 0x43ab1d
cmp eax, 0x2b
je 0x43ab1d
cmp eax, 0x3f
je 0x43ab1d
cmp eax, 0x7b
je 0x43ab1d
cmp eax, 0x7d
jne 0x43aae7
test dword [esi + 0x50], edx
je 0x43ab19
cmp eax, 0x5d
jne 0x43aaf1
test dword [esi + 0x50], edx
je 0x43aa90
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0043b57c
mov bl, 1
mov ecx, esi
call fcn.0043a9a5
test bl, bl
je 0x43ab12
mov ecx, esi
call fcn.0043b494
mov cl, 1
jmp 0x43a9d5
push 6
jmp 0x43ab29
push 0xa
jmp 0x43ab29
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.0043a27e
int3
Function at 0x4549da
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc477
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x503d7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esi + 0xc], 1
push 0x50
lea eax, [esi + 0x34]
mov dword [esi], 0x4d4274
push edi
push eax
mov dword [esi + 4], 0x4d4250
mov dword [esi + 8], 0x4d4240
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], 7
call fcn.004b8a01
add esp, 0xc
lea eax, [esi + 0x84]
push 0x408ec4
push fcn.0041277e
push 3
push 0x18
push eax
mov dword [ebp - 4], edi
call fcn.004b8320
push dword [ebp + 8]
mov dword [esi + 0xcc], edi
mov ecx, esi
mov dword [esi + 0xd0], edi
call fcn.00454fae
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret 4

Function at 0x4b8a01
Capabilities:
Encode data using xor

Disassembly:
call eax
les ebp, [esi + 0x2229463]
lds ebp, [ebx - 0x45605265]
in al, 0x50
and dword [edi - 0x62], 0x4c0cddf0
dec ecx
popal
call 0x510b5414
invalid
ljmp 0x34de:0x37c168bc
mov al, ah
mov esi, 0x94ccab78
invalid
mov ebx, 0x5e5d584b
mov esi, 0x1e0be940
jg 0x4b899f
pop ecx
std
pop edi
jge 0x4b89d9
add dword [ebp - 0x68919020], ebx
out 0x13, al
stosd dword es:[edi], eax
ficomp dword [edx + 0x3d]
pushfd
das
dec edx
test eax, 0x3b5e4506
sti
outsb dx, byte [esi]
xchg ebp, eax
mov ebp, 0xd8b6e55d
xchg edi, eax
in eax, 0x8b
push ebx
outsb dx, byte [esi]
jge 0x4b89e0
in eax, 0x76
and eax, 0x4e99a99e
dec ebx
mov ch, 0x44
arpl word [edx + 0x44eb88b], di
push 0x217983f7
Function at 0x10005baf
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1074
call fcn.100588e0
mov eax, dword [0x1011ca44]
xor eax, esp
mov dword [esp + 0x1070], eax
push esi
mov esi, dword [esp + 0x107c]
push edi
mov edi, dword [esp + 0x1084]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
push 0
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0x58
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0x5a
push dword [esp + 0x1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x1c], xmm0
call esi
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x100c4ef4]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x100c4f18]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x108c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x100c4f18]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
mov ecx, 0x800
cvtdq2pd xmm0, xmm0
push ecx
andps xmm0, xmmword [0x100c4f30]
divsd xmm0, qword [0x100c4f00]
addsd xmm0, qword [0x100c4ef8]
cvttsd2si eax, xmm0
xorps xmm0, xmm0
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x7c]
push eax
push 0x1002
push ecx
movups xmmword [esp + 0x30], xmm0
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
push 5
lea eax, [esp + 0x7c]
push 0x100c2e18
push eax
call fcn.1006018c
test eax, eax
mov ecx, 0x100c2e24
lea eax, [esp + 0x44]
cmovne ecx, edi
push ecx
push 0x20
push eax
call fcn.1006018c
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push dword [esp + 0x10]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp + 0x1078]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.100587af
add esp, 0x1074
ret 0xc
Function at 0x1000fffd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x134
mov eax, dword [0x1011ca44]
xor eax, ebp
mov dword [ebp + 0x70], eax
movzx eax, word [ebp + 0x7c]
push esi
mov esi, dword [0x1011fbe8]
push edi
push 0xf0
push eax
xor edi, edi
mov dword [ebp - 0x98], ecx
push esi
inc edi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x1001016e
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x1001016e
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001016e
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x1001016d
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x9c], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x100100e7
push 3
lea eax, [ebp - 0x90]
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], eax
call fcn.10010db8
push dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x90]
cmove edi, ecx
cmp dword [ebp - 0x94], eax
je 0x1001015f
push dword [ebp - 0x94]
call fcn.1006018c
pop ecx
jmp 0x1001015f
mov ecx, 0x1234
cmp cx, ax
jne 0x1001015f
or dword [ebp - 0xbc], 0xffffffff
lea eax, [ebp - 0x90]
push 3
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0x94], eax
call fcn.10010db8
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xb8], eax
cmp eax, ecx
je 0x10010139
push eax
call fcn.1006018c
pop ecx
lea eax, [ebp - 0xc0]
push eax
mov eax, dword [ebp - 0x98]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x9c]
test edi, edi
jne 0x1001005e
pop ebx
mov ecx, dword [ebp + 0x70]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.100587af
add ebp, 0x74
leave
ret 4
Function at 0x10010183
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x4a8
mov eax, dword [0x1011ca44]
xor eax, esp
mov dword [esp + 0x4a4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x4b4]
lea eax, [esp + 0x2a4]
push esi
mov esi, dword [esp + 0x4bc]
mov ebx, 0x208
push edi
push ebx
push 0
push eax
call fcn.1005c640
push ebx
lea eax, [esp + 0xb4]
push 0
push eax
call fcn.1005c640
push 0x44
pop edi
push edi
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.1005c640
push ebp
lea eax, [esp + 0x2d4]
mov dword [esp + 0x88], edi
push ebx
push eax
call fcn.1006018c
push esi
push ebp
push 0x100c6a40
lea eax, [esp + 0xe0]
push ebx
push eax
call fcn.1006018c
add esp, 0x44
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x64]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x2d0]
push eax
call fcn.1006018c
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
add esp, 0x28
test eax, eax
jne 0x100102c7
call ebx
mov esi, eax
mov edi, 0x2e4
cmp esi, edi
jne 0x100102c0
lea eax, [esp + 0xa4]
mov dword [esp + 0x24], 0x3c
xor ecx, ecx
mov dword [esp + 0x34], eax
xorps xmm0, xmm0
mov dword [esp + 0x28], 0x40
lea eax, [esp + 0x24]
movlpd qword [esp + 0x48], xmm0
push eax
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], 0x100c6a4c
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 5
mov dword [esp + 0x48], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x100102fa
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x100102fa
mov dword [esp + 0x14], eax
jmp 0x100102cb
call fcn.1006018c
jmp 0x100102f8
mov eax, dword [esp + 0x14]
push eax
call fcn.10004cff
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
je 0x100102ea
mov esi, dword [esp + 0x10]
jmp 0x100102ee
call ebx
mov esi, eax
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, esi
push ebp
call fcn.1006018c
pop ecx
mov ecx, dword [esp + 0x4b4]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100587af
add esp, 0x4a8
ret