joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004c63
Capabilities:
Packed with generic packer

Disassembly:
call dword [sym.imp.USER32.dll_GetSysColorBrush]
pop edi
pop esi
xor eax, eax
pop ebx
push ebx
push dword [esp - 0x6a]
call 0x10004c92
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001ca78
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
test eax, eax
je 0x10004c58
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push 0x100020c8
push 1
push 0x10004d88
push dword [esp + 0x72]
push ebp
call 0x10004cc5
xor ebx, ebx
test eax, eax
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
push edi
push eax
setge bl
call dword [ecx + 0x70]
xor edx, edx
test eax, eax
lea esp, [esp + 0x18]
add dword [esp + 4], ebx
push dword [esp - 0x24]
push 0xffffffffffffffa6
push dword [esp - 0x24]
push dword [esp - 0xc8]
push edx
call fcn.10004d08
je 0x10004c80
mov eax, dword [0x1001c907]
mov ecx, dword [esp]
lea edx, [esp + 4]
push 1
push edx
call fcn.10013123
cmp eax, 0xffffffff
jne 0x10004cbb
jmp loc.1002c1a2

Function at 0x10004c92
Capabilities:
Packed with generic packer

Disassembly:
call dword [sym.imp.USER32.dll_GetSysColorBrush]
pop edi
pop esi
xor eax, eax
pop ebx
push ebx
push dword [esp - 0x6a]
call 0x10004c92
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001ca78
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
test eax, eax
je 0x10004c58
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push 0x100020c8
push 1
push 0x10004d88
push dword [esp + 0x72]
push ebp
call 0x10004cc5
xor ebx, ebx
test eax, eax
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
push edi
push eax
setge bl
call dword [ecx + 0x70]
xor edx, edx
test eax, eax
lea esp, [esp + 0x18]
add dword [esp + 4], ebx
push dword [esp - 0x24]
push 0xffffffffffffffa6
push dword [esp - 0x24]
push dword [esp - 0xc8]
push edx
call fcn.10004d08
je 0x10004c80
mov eax, dword [0x1001c907]
mov ecx, dword [esp]
lea edx, [esp + 4]
push 1
push edx
call fcn.10013123
cmp eax, 0xffffffff
jne 0x10004cbb
jmp loc.1002c1a2

Function at 0x10004cc5
Capabilities:
Packed with generic packer

Disassembly:
call dword [sym.imp.USER32.dll_GetSysColorBrush]
pop edi
pop esi
xor eax, eax
pop ebx
push ebx
push dword [esp - 0x6a]
call 0x10004c92
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001ca78
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
test eax, eax
je 0x10004c58
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push 0x100020c8
push 1
push 0x10004d88
push dword [esp + 0x72]
push ebp
call 0x10004cc5
xor ebx, ebx
test eax, eax
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
push edi
push eax
setge bl
call dword [ecx + 0x70]
xor edx, edx
test eax, eax
lea esp, [esp + 0x18]
add dword [esp + 4], ebx
push dword [esp - 0x24]
push 0xffffffffffffffa6
push dword [esp - 0x24]
push dword [esp - 0xc8]
push edx
call fcn.10004d08
je 0x10004c80
mov eax, dword [0x1001c907]
mov ecx, dword [esp]
lea edx, [esp + 4]
push 1
push edx
call fcn.10013123
cmp eax, 0xffffffff
jne 0x10004cbb
jmp loc.1002c1a2
Function at 0x10004d83
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push dword [esp - 0xe8]
push eax
push 0x100037e8
call fcn.10004db5
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push 0x1001d1c5
push eax
call dword [ecx + 0x24]
mov esi, eax
mov eax, dword [esp + 4]
push eax
push 0x1001c391
push 0x1001c6d2

Function at 0x10004db5
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push edx
call fcn.10004de2
xor ecx, ecx
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp loc.1002e866

Function at 0x10004f60
Capabilities:
Packed with generic packer

Disassembly:
shr edi, 0x1c
cmp eax, 0x18
mov dword [esi + 0x2014], ecx
jg 0x10004f0e
mov ecx, esi
call fcn.10011831
mov eax, dword [esi + 0x2018]
mov ecx, dword [esi + 0x2014]
xor dword [esp], eax
xor dword [esp], eax
push eax
push 0x10000c73
push dword [esp + 0xc]
push dword [esp + 8]
push 0x30
push 0x1000724e
call fcn.10003cc0
push 1
push eax
mov eax, dword [0x1001d17f]
call fcn.10012695
cmp eax, 0xffffffff
je 0x10004f59
mov ecx, dword [esp]
mov eax, dword [ecx + 4]
mov ecx, dword [0x1001c39e]
cmp eax, ecx
je 0x10004fa9
push ecx
push eax
call dword [sym.imp.USER32.dll_IsIconic]
inc edi
mov edx, dword [esp + 0x10]
neg eax
neg edx
sbb eax, 0
mov dword [esp + 0x14], eax
push ecx
push dword [esp - 0xc3]
push dword [esp - 0x24]
push 0xffffffffffffffcf
push dword [esp - 0x70]
call fcn.10004fe8
jmp 0x1002e5d6

Function at 0x100052b0
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push esp
push dword [esp - 0xd6]
call 0x1000527c
sub eax, edi
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
push edx
push esi
push ecx
push ecx
push eax
call fcn.10009f06
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
lea esp, [esp + 0xc]
add dword [esp + 4], ecx
push 0x10005668
push dword [esp - 0x77]
call 0x100052b0
mov dword [esp + 0x10], 2
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x100052e4
xor ebp, ebp
cmp edi, 0x1001d029
je 0x1000532e
jmp loc.1002df23
cmp eax, 0xffffffff
jne 0x10005326
xchg dword [esp], ecx
push esi
add esi, 0x7b90
mov esi, 0xc6ca6fc
push 0xffffffffffffffd5
push dword [esp + 8]
push dword [esp + 0xc]
push esp
push 0x100104ec
call fcn.10003731
jne 0x10005321
jmp loc.1002fbef
mov edx, dword [esp + 0x10]
push edx
push edi
mov ecx, esi
call fcn.100135ff
test eax, eax
je fcn.1000536c
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push 1
push eax
mov eax, dword [0x1001d20d]
call fcn.1000a3e7

Function at 0x10005372
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0xbc], ebx
jne 0x100053f8
lea ecx, [esp + 0x10]
jmp loc.1002db62

Function at 0x1000542d
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esi]
mov edx, eax
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
xor eax, eax
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + 0x14]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
push edx
mov edx, dword [esp + 0x10]
jmp 0x1002b4ee
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x100053b8
mov eax, dword [ecx + 0x1c]
test eax, eax
Function at 0x100054b8
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov ebx, dword [esp + 8]
push ebx
push eax
push dword [esp - 0x65]
push 0x10005998
call 0x100054be
lea edx, [esp + 4]
push 1
push edx
call fcn.10005372
cmp eax, 0xffffffff
jne 0x10005441
xor eax, eax
mov ecx, dword [esp + 4]
lea esp, [esp + 0x14]
add dword [esp + 4], ebx
push dword [esp - 0xec]
push ebx
push dword [esp - 0xac]
push 0x42
call 0x100054f9
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1001cbef
mov eax, dword [0x1001c049]
push esi
push edi
push 0x1001c93b
push 0x1001d134
jmp loc.1002b752

Function at 0x100054be
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov ebx, dword [esp + 8]
push ebx
push eax
push dword [esp - 0x65]
push 0x10005998
call 0x100054be
lea edx, [esp + 4]
push 1
push edx
call fcn.10005372
cmp eax, 0xffffffff
jne 0x10005441
xor eax, eax
mov ecx, dword [esp + 4]
lea esp, [esp + 0x14]
add dword [esp + 4], ebx
push dword [esp - 0xec]
push ebx
push dword [esp - 0xac]
push 0x42
call 0x100054f9
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1001cbef
mov eax, dword [0x1001c049]
push esi
push edi
push 0x1001c93b
push 0x1001d134
jmp loc.1002b752

Function at 0x100054f9
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov ebx, dword [esp + 8]
push ebx
push eax
push dword [esp - 0x65]
push 0x10005998
call 0x100054be
lea edx, [esp + 4]
push 1
push edx
call fcn.10005372
cmp eax, 0xffffffff
jne 0x10005441
xor eax, eax
mov ecx, dword [esp + 4]
lea esp, [esp + 0x14]
add dword [esp + 4], ebx
push dword [esp - 0xec]
push ebx
push dword [esp - 0xac]
push 0x42
call 0x100054f9
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1001cbef
mov eax, dword [0x1001c049]
push esi
push edi
push 0x1001c93b
push 0x1001d134
jmp loc.1002b752

Function at 0x10005559
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov dword [esi], 0x100045fc
call fcn.1000ef81
test byte [esp + 8], 1
je fcn.100055b8
push esi
jmp loc.1002b88d

Function at 0x100055a0
Capabilities:
Log keystrokes via polling
Packed with generic packer

Disassembly:
call fcn.10003cc0
push ebx
call dword [sym.imp.WINSPOOL.DRV_DocumentPropertiesA]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.10010c18
mov ecx, dword [ebp - 0x234]
mov eax, esp
push ecx
push esi
push ebx
push eax

Function at 0x100055b8
Capabilities:
Log keystrokes via polling
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
push 0x1001c4e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov ecx, dword [ecx + 0x14]
lea eax, [esp + 0xc]
push eax
push ecx
Function at 0x100055e0
Capabilities:
Log keystrokes via polling
Packed with generic packer

Disassembly:
push edx
push dword [esp - 0x17]
push dword [esp - 0xea]
push dword [esp + 0x74]
push dword [esp - 0x76]
push eax
call 0x1000561b
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x10005633
xor eax, eax
mov edx, dword [esp + 0xc]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax]
push edx
mov edx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push edx
push eax
lea esp, [esp + 0x18]
mov edx, dword [esp + 8]
push ebp
push 0x66
call 0x10005638
mov ecx, dword [ecx]
test ecx, ecx
je 0x10005606
call ecx
mov eax, dword [0x1001cc54]
lea esp, [esp + 0xc]
add dword [esp + 4], edx
push dword [esp - 0xa0]
call 0x10005673
je 0x1000560a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov bl, al
call dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x10005697
xor eax, eax
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100056e1
mov byte [eax + 1], bl
lea esp, [esp + 8]
pop edx
ret 0xc
push esi
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x1001c4ea
jmp 0x1002df7d

Function at 0x1000561b
Capabilities:
Log keystrokes via polling
Packed with generic packer

Disassembly:
push edx
push dword [esp - 0x17]
push dword [esp - 0xea]
push dword [esp + 0x74]
push dword [esp - 0x76]
push eax
call 0x1000561b
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x10005633
xor eax, eax
mov edx, dword [esp + 0xc]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax]
push edx
mov edx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push edx
push eax
lea esp, [esp + 0x18]
mov edx, dword [esp + 8]
push ebp
push 0x66
call 0x10005638
mov ecx, dword [ecx]
test ecx, ecx
je 0x10005606
call ecx
mov eax, dword [0x1001cc54]
lea esp, [esp + 0xc]
add dword [esp + 4], edx
push dword [esp - 0xa0]
call 0x10005673
je 0x1000560a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov bl, al
call dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x10005697
xor eax, eax
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100056e1
mov byte [eax + 1], bl
lea esp, [esp + 8]
pop edx
ret 0xc
push esi
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x1001c4ea
jmp 0x1002df7d
Function at 0x10005638
Capabilities:
Log keystrokes via polling
Packed with generic packer

Disassembly:
push edx
push dword [esp - 0x17]
push dword [esp - 0xea]
push dword [esp + 0x74]
push dword [esp - 0x76]
push eax
call 0x1000561b
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x10005633
xor eax, eax
mov edx, dword [esp + 0xc]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax]
push edx
mov edx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push edx
push eax
lea esp, [esp + 0x18]
mov edx, dword [esp + 8]
push ebp
push 0x66
call 0x10005638
mov ecx, dword [ecx]
test ecx, ecx
je 0x10005606
call ecx
mov eax, dword [0x1001cc54]
lea esp, [esp + 0xc]
add dword [esp + 4], edx
push dword [esp - 0xa0]
call 0x10005673
je 0x1000560a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov bl, al
call dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x10005697
xor eax, eax
pop ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100056e1
mov byte [eax + 1], bl
lea esp, [esp + 8]
pop edx
ret 0xc
push esi
mov dword [esp + 0xc], ebx
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x1001c4ea
jmp 0x1002df7d

Function at 0x100056d7
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x10005698
xor ecx, ecx
mov edx, eax
mov dword [edx], ecx

Function at 0x100056ff
Capabilities:
Create thread

Disassembly:
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [esi]
dec eax
mov dword [esi], eax
jne 0x1000570a
mov edx, dword [esi + 4]
push esi
call dword [edx + 0x18]
push ebx
push edi
push 0x10001708
jmp loc.1002d47a

Function at 0x10005867
Capabilities:
Set registry value

Disassembly:
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1001cd06
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
jne 0x10005812
mov eax, 0x1001c4d3
mov ecx, dword [esp + 0x18]
lea edx, [esp]
mov dword [esp + 0xc], edx
lea edx, [esp + 8]
push edx
Function at 0x100058bf
Capabilities:
Set registry value

Disassembly:
jmp 0x1002f3e7
jmp 0x1002c4aa
lea ecx, [ecx]
mov eax, dword [ebp + 4]
test eax, eax
jne 0x100057f8
mov edi, dword [0x1001c584]
test edi, edi
je 0x100057fd
mov esi, dword [ebp]
mov eax, dword [edi]
push esi
push ecx
push dword [esp + 0x77]
push dword [esp + 0x2a]
call 0x100058bf
cmp eax, 0xffffffff
jne 0x1000584e
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.1000de47
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
lea esp, [esp + 0x10]
mov esi, dword [esp + 8]
push dword [esp - 0x92]
push esp
call 0x100058ed
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
cmp esi, edi
je 0x10005860
mov ecx, esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esi, 4
cmp esi, edi
jne 0x1000595b
lea esp, [esp + 0xc]
add dword [esp + 4], esi
push dword [esp - 0x81]
push ebp
push dword [esp - 0x86]
push ebx
call 0x1000593d
mov ecx, dword [0x1001c534]
mov ecx, dword [ecx]
test ecx, ecx
je 0x1000589d
call ecx
mov eax, dword [0x1001c46e]
sub dword [0x1001c386], 4
cmp dword [0x1001cde8], eax
jae 0x100058eb
push eax
call dword [sym.imp.USER32.dll_IsIconic]
and dword [0x1001d1a8], 0
pop ecx
xor eax, eax
lea esp, [esp + 0x14]
pop esi
ret 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [esp + 0x674]
call fcn.1000d48b
pop edi
pop esi
pop ebx
mov esp, ebp

Function at 0x100058ed
Capabilities:
Set registry value

Disassembly:
jmp 0x1002f3e7
jmp 0x1002c4aa
lea ecx, [ecx]
mov eax, dword [ebp + 4]
test eax, eax
jne 0x100057f8
mov edi, dword [0x1001c584]
test edi, edi
je 0x100057fd
mov esi, dword [ebp]
mov eax, dword [edi]
push esi
push ecx
push dword [esp + 0x77]
push dword [esp + 0x2a]
call 0x100058bf
cmp eax, 0xffffffff
jne 0x1000584e
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.1000de47
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
lea esp, [esp + 0x10]
mov esi, dword [esp + 8]
push dword [esp - 0x92]
push esp
call 0x100058ed
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
cmp esi, edi
je 0x10005860
mov ecx, esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esi, 4
cmp esi, edi
jne 0x1000595b
lea esp, [esp + 0xc]
add dword [esp + 4], esi
push dword [esp - 0x81]
push ebp
push dword [esp - 0x86]
push ebx
call 0x1000593d
mov ecx, dword [0x1001c534]
mov ecx, dword [ecx]
test ecx, ecx
je 0x1000589d
call ecx
mov eax, dword [0x1001c46e]
sub dword [0x1001c386], 4
cmp dword [0x1001cde8], eax
jae 0x100058eb
push eax
call dword [sym.imp.USER32.dll_IsIconic]
and dword [0x1001d1a8], 0
pop ecx
xor eax, eax
lea esp, [esp + 0x14]
pop esi
ret 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [esp + 0x674]
call fcn.1000d48b
pop edi
pop esi
pop ebx
mov esp, ebp
Function at 0x10005a8c
Capabilities:
Packed with generic packer

Disassembly:
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ce19
push 0x1001d0eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push esp
push 0x100000fa
push dword [esp + 0xc]
push 0xffffffffffffffab
push dword [esp + 4]
push 0x1000244a
jmp loc.1002d907

Function at 0x10005b40
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 4]
push eax
push 0x1001c255
push 0

Function at 0x10005b78
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
call 0x10005b78
sub esp, 0x1001c904
mov eax, dword [0x1001cda8]
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
lea esp, [esp + 8]
mov edx, dword [esp + 8]
push 0x10001260
push 0x23
call 0x10005bb8
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c726
mov eax, dword [0x1001ccef]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c9b5
lea edi, [esp + 9]
lea esp, [esp + 0xc]
add dword [esp + 4], edx
push 0x100027c8
push 0x10001c20
push esp
push ebp
call 0x10005bec
mov eax, dword [ecx + 0x14]
sub esp, 8
test eax, eax
jne 0x10005c10
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov dword [esp + 4], ecx
lea ecx, [esp]
push ecx
push 0x47
push eax
lea esp, [esp + 0x14]
pop edx
ret 4
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push esp
push 0x1000049e
push 0x7f
push 0x4c
push 0x10000395
push 0x1000e697
call fcn.10003abc
or ecx, edx
je 0x10005c59
push 0x1001c359
call dword [sym.imp.USER32.dll_GetClassNameA]
push eax
jmp loc.1002c5a3
Function at 0x10005b8f
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
call 0x10005b78
sub esp, 0x1001c904
mov eax, dword [0x1001cda8]
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
lea esp, [esp + 8]
mov edx, dword [esp + 8]
push 0x10001260
push 0x23
call 0x10005bb8
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c726
mov eax, dword [0x1001ccef]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c9b5
lea edi, [esp + 9]
lea esp, [esp + 0xc]
add dword [esp + 4], edx
push 0x100027c8
push 0x10001c20
push esp
push ebp
call 0x10005bec
mov eax, dword [ecx + 0x14]
sub esp, 8
test eax, eax
jne 0x10005c10
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov dword [esp + 4], ecx
lea ecx, [esp]
push ecx
push 0x47
push eax
lea esp, [esp + 0x14]
pop edx
ret 4
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push esp
push 0x1000049e
push 0x7f
push 0x4c
push 0x10000395
push 0x1000e697
call fcn.10003abc
or ecx, edx
je 0x10005c59
push 0x1001c359
call dword [sym.imp.USER32.dll_GetClassNameA]
push eax
jmp loc.1002c5a3

Function at 0x10005bb8
Capabilities:
Extract resource via kernel32 functions
Query environment variable

Disassembly:
call 0x10005b78
sub esp, 0x1001c904
mov eax, dword [0x1001cda8]
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x114
lea esp, [esp + 8]
mov edx, dword [esp + 8]
push 0x10001260
push 0x23
call 0x10005bb8
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c726
mov eax, dword [0x1001ccef]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c9b5
lea edi, [esp + 9]
lea esp, [esp + 0xc]
add dword [esp + 4], edx
push 0x100027c8
push 0x10001c20
push esp
push ebp
call 0x10005bec
mov eax, dword [ecx + 0x14]
sub esp, 8
test eax, eax
jne 0x10005c10
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov dword [esp + 4], ecx
lea ecx, [esp]
push ecx
push 0x47
push eax
lea esp, [esp + 0x14]
pop edx
ret 4
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push eax
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push esp
push 0x1000049e
push 0x7f
push 0x4c
push 0x10000395
push 0x1000e697
call fcn.10003abc
or ecx, edx
je 0x10005c59
push 0x1001c359
call dword [sym.imp.USER32.dll_GetClassNameA]
push eax
jmp loc.1002c5a3

Function at 0x10005c55
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, dword [ecx + 0x14]
xor eax, eax
test esi, esi
je 0x10005c9b
mov edx, dword [esp + 8]
sub edx, eax
je 0x10005cce
dec edx
test edi, edi
jge 0x10005c65
mov eax, dword [esp + 8]
test eax, eax
mov dword [esp + 0x14], 0xffffffff
je 0x10005c63
jmp 0x1002e08f
push esi
call dword [eax + 0x18]
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, dword [esp + 0x1c]
push esi
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test edi, edi
Function at 0x10005d8d
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [esp]
push 0x1001c934
push eax
call dword [sym.imp.USER32.dll_GetTopWindow]
call eax
test eax, eax
jne 0x10005d84

Function at 0x10005db5
Capabilities:
Create thread
Packed with generic packer

Disassembly:
push 0x1001c8b9
call fcn.100056b1
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x1c18]
push eax
push ecx
push eax
push dword [esp - 0xd6]
push dword [esp - 5]
call 0x10005ddc
mov eax, dword [esp]
cmp eax, 4
ja 0x10005d9f
push 0x1001cdf3
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push dword [esp - 0x19]
push dword [esp - 0xaa]
push dword [esp - 0x27]
call 0x10005e0e
inc esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call dword [sym.imp.WINSPOOL.DRV_ClosePrinter]
mov esi, eax
test esi, esi
lea esp, [esp + 0x10]
add dword [esp + 4], eax
push dword [esp - 0x56]
push dword [esp - 0x27]
push edx
call 0x10005e36
pop esi
mov eax, dword [ecx + 0x14]
sub esp, 8
test eax, eax
jne 0x10005e41
mov ecx, dword [eax]
push esi
push edi
lea esp, [esp + 0x10]
pop eax
ret 8
call dword [ecx + 8]
mov dword [esi], 0
xor eax, eax
test edi, edi
pop edi
pop esi
mov dword [ebx + 0x114], 1
setge al
pop ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
or ecx, dword [esp]
add esp, 4
push dword [esp + 0xc]
push 0xffffffffffffffe4
push edx
push 0x1000004d
push 0x1000956f
call fcn.10003abc
push eax
jmp loc.1002b22f

Function at 0x10005ddc
Capabilities:
Packed with generic packer

Disassembly:
push 0x1001c8b9
call fcn.100056b1
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x1c18]
push eax
push ecx
push eax
push dword [esp - 0xd6]
push dword [esp - 5]
call 0x10005ddc
mov eax, dword [esp]
cmp eax, 4
ja 0x10005d9f
push 0x1001cdf3
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push dword [esp - 0x19]
push dword [esp - 0xaa]
push dword [esp - 0x27]
call 0x10005e0e
inc esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call dword [sym.imp.WINSPOOL.DRV_ClosePrinter]
mov esi, eax
test esi, esi
lea esp, [esp + 0x10]
add dword [esp + 4], eax
push dword [esp - 0x56]
push dword [esp - 0x27]
push edx
call 0x10005e36
pop esi
mov eax, dword [ecx + 0x14]
sub esp, 8
test eax, eax
jne 0x10005e41
mov ecx, dword [eax]
push esi
push edi
lea esp, [esp + 0x10]
pop eax
ret 8
call dword [ecx + 8]
mov dword [esi], 0
xor eax, eax
test edi, edi
pop edi
pop esi
mov dword [ebx + 0x114], 1
setge al
pop ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
or ecx, dword [esp]
add esp, 4
push dword [esp + 0xc]
push 0xffffffffffffffe4
push edx
push 0x1000004d
push 0x1000956f
call fcn.10003abc
push eax
jmp loc.1002b22f