joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66d25c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x66d26f
xor eax, eax
jmp 0x66d2f9
lea eax, [esi + 0x30]
push edi
push eax
call fcn.0065f440
pop ecx
test eax, eax
jne 0x66d2f5
xor edi, edi
lea eax, [esi + 0x14]
inc edi
push eax
mov dword [esi + 0x28], edi
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d2f5
lea eax, [esi + 0x18]
push eax
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d2f5
lea eax, [esi + 0x1c]
push eax
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d2f5
push dword [ebp + 0x14]
lea eax, [esi + 0x20]
push dword [ebp + 0x14]
push eax
call fcn.0065f549
add esp, 0xc
test eax, eax
jne 0x66d2f5
push dword [ebp + 0x14]
push eax
lea eax, [esi + 0x24]
push eax
call fcn.0065f549
add esp, 0xc
test eax, eax
jne 0x66d2f5
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], edi
push dword [ebp + 0xc]
push eax
call fcn.0065f5a8
add esp, 0xc
test eax, eax
jne 0x66d2f5
mov dword [esi], edi
jmp 0x66d2f8
push 0xc
pop eax
pop edi
pop esi
pop ebp
ret

Function at 0x66d4a7
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x66d4be
push ebx
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d500
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x66d4d2
push edi
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d4ff
push ebx
call fcn.0065f4b4
push edi
call fcn.0065f4b4
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x66d4f0
xor eax, eax
jmp 0x66d4ff
push esi
push 0x66d469
push eax
call fcn.0065f5a8
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x66d4a8
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x66d4be
push ebx
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d500
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x66d4d2
push edi
call fcn.0065f42c
pop ecx
test eax, eax
jne 0x66d4ff
push ebx
call fcn.0065f4b4
push edi
call fcn.0065f4b4
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x66d4f0
xor eax, eax
jmp 0x66d4ff
push esi
push 0x66d469
push eax
call fcn.0065f5a8
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x421870
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x421892
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421899
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421888
mov eax, 1
add ebx, ebx
jne 0x4218ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4218a0
jne 0x4218bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4218a0
xor ecx, ecx
sub eax, 3
jb 0x4218d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421942
mov ebp, eax
add ebx, ebx
jne 0x4218db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4218e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42190c
inc ecx
add ebx, ebx
jne 0x4218f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4218ed
jne 0x421909
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4218ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42192c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42191d
jmp 0x42188e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42192c
add edi, ecx
jmp 0x42188e
pop esi
mov edi, esi
mov ecx, 0x436
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42194a
cmp byte [edi], 7
jne 0x42194a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42194f
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x4219be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25bcc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x25c38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42197c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x25c40]
or eax, eax
je 0x4219b8
mov dword [ebx], eax
add ebx, 4
jmp 0x421999
call dword [esi + 0x25c3c]
mov ebp, dword [esi + 0x25c44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4219f2
sub esp, 0xffffff80
jmp 0x405762

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x497b7fa3
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x7c73694e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x420795
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
call fcn.00437b23
call fcn.00428d9a
pushfd
mov dword [esp + 8], ebx
movsx bx, al
mov bx, word [esp]
movzx bx, dl
not bx
mov ebx, 0x402741
jmp 0x42854f
pushal
mov ebx, dword [ebx + 0x3a2a7]
jmp 0x42508c
mov dword [esp], 0x5ff54bb2
xchg dword [esp + 8], ebx
jmp 0x41b641
jmp 0x441978
pushfd
jmp 0x41b3c7
mov edx, 6
lea esp, [esp + 8]
jb 0x41f698
pushal
push 0x6f3e4d9b
mov byte [esp + 4], al
lea esp, [esp + 0x24]
call fcn.00403d68
lahf
cdq
movsx ax, dl
push 1
xchg edx, eax
rdtsc
cdq
push 1
movzx eax, cl
movzx cx, dl
lea eax, [ebp - 0x14]
movsx dx, al
push 0x57276d35
mov dword [esp], eax
pushfd
xchg edx, eax
bswap cx
mov ecx, 0x412e90
not ax
bswap dx
rdtsc
pop eax
mov edx, 0x412eb4
lea eax, [edx*4 - 0x66bc6628]
cwde
mov eax, dword [ebp - 8]
jp 0x41f8b2
call fcn.0042d563
push ebp
not ah
pushfd
pushfd
mov eax, dword [ebp - 0x14]
bswap dx
lea edx, [ebp - 4]
mov dword [esp + 8], 0xe37e08c6
push dword [esp + 8]
lea esp, [esp + 0x10]
call fcn.00406ad4
mov eax, eax
lahf
lahf
jmp 0x428547
call fcn.0041d9ae
push esp
mov dword fs:[eax], edx
push dword [esp + 8]
pushal
mov byte [esp + 0xc], 0xfa
lea esp, [esp + 0x34]
jmp fcn.0043fb1c
mov eax, dword [ebp - 4]
call fcn.00445ae0
jmp 0x41c6f5
pushfd
push ebx
mov byte [esp + 4], 0x32
lea esp, [esp + 8]
call fcn.00403d68
call fcn.00422f3c
mov edx, 0x40aa78
call fcn.00443885
lea esp, [esp + 0x24]
call fcn.00406b70
push 0x4baad405
movsx ax, al
cdq
push dword [ebp - 0x9d14]
pop dword [esp]
bswap eax
lahf
push 0x4138b0
push 0xb1da9794
movsx dx, cl
push dword [esp]
push dword [ebp - 0x10]
pop dword [esp + 4]
pushal
mov byte [esp], 0x68
bswap dx
call fcn.00439c6a
call fcn.0041c964
movzx bx, bl
mov ebx, dword [esp + 4]
jmp 0x41cd52

Function at 0x422df6
Capabilities:
Execute anti-debugging instructions

Disassembly:
adc ebx, esi
mov ebx, eax
rcr si, 3
sub eax, eax
jmp 0x446343
call fcn.0044ac80
call fcn.0041b883
in al, dx
sub ch, byte [edx]
insb byte es:[edi], dx
lea ebp, [esp + 4]
cmp ch, dl
bts dx, 1
shld edx, edi, 0x16
mov dword [esp], 0
sal dl, 7
push 0
cmp bh, bh
push esi
mov word [esp], 0x51df
mov dword [esp], 0
cmc
mov edx, ebx
shl edx, 0x13
stc
push ebx
mov bl, bh
rcr bx, cl
push esi
and bx, 0xb271
shld dx, si, 0xc
sub bl, bh
shr ebx, 4
push edi
movzx bx, bl
ja 0x41ac24
xchg ebx, esi
adc ebx, 0xe96ae7f5
mov ebx, eax
not si
test bx, 0x8665
bts si, ax
rcl esi, 0x11
sub eax, eax
movzx si, al
not dx
push esp
mov dword [esp], ebp
xchg dx, di
movsx si, dl
push 0x427a21
lea edx, [ecx + 0x4f0d7aea]
movsx edx, dl
movzx si, cl
push dword fs:[eax]
movzx di, al
mov dword fs:[eax], esp
cdq
mov esi, 0x24438835
rdtsc
mov edi, 0x24438835
rdtsc
mov dx, sp
xchg dl, al
mov dword [ebp - 4], 0x7adfd1
call fcn.0044503d
not di
movzx esi, bl
movzx di, cl
push ebp
movsx si, al
push 0x427a21
push ebp
bswap si
lea esp, [esp + 4]
jle 0x420d97
movzx si, cl
push dword fs:[eax]
not si
call fcn.00428352
Function at 0x4274d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4274c1
not al
jmp 0x42d803
pushal
push edi
lea esp, [esp + 0x24]
call fcn.0042dbab
pushal
mov word [esp], dx
call fcn.0042a9d8
movsx ax, cl
mov eax, ebp
mov eax, dword [ebp - 0x9d24]
pushfd
pushfd
push dword [esp + 4]
pushal
lea esp, [esp + 0x2c]
call fcn.00407e3c
lahf
mov eax, dword [ebp - 0x34]
lea ecx, [edi - 0x6b40cae1]
movzx cx, dl
mov cx, 0x4d50
fstp qword [eax]
rdtsc
bswap bx
rdtsc
lahf
wait
push eax
pop edx
movzx ebx, dl
lea ecx, [ebp - 0x9d28]
xchg bl, al
jmp 0x44086a
cwde
mov eax, dword [ebp - 0x20]
jmp 0x438166
cwde
mov edx, 2
jmp 0x423e34

Function at 0x4275ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
mov ebp, dword [ebp + 0x1ea6e]
mov word [esp + 8], cx
mov byte [esp], 0xfd
lea ebp, [ebp - 0x506c4877]
call fcn.0041ca09

Function at 0x4275ea
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0x413860
cdq
setp al
lahf
lea edx, [ebp - 0x9d04]
pushfd
pushfd
lahf
mov eax, dword [ebp + 0xc8]
pushfd
push 0x98947e9a
mov byte [esp + 4], 0xb2
push dword [esp + 4]
lea esp, [esp + 0x1c]
call fcn.00406b70
rdtsc
rdtsc
call fcn.0044807b

Function at 0x427c75
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x425f79
lea esp, [esp + 0x44]
call fcn.00407e3c
aad 0x18
bsf dx, sp
mov eax, dword [ebp - 0x4c]
shld dx, cx, 2
not cl
fstp qword [eax]
shl cl, 7
clc
shl ch, 2
wait
sbb cx, 0x20af
sub eax, eax
pushal
lea ecx, [edx*4 + 0x2cbe2ca9]
not ch
mov edx, dword [esp + 0x20]
mov ch, 0x82
push dword [esp + 4]
mov ecx, dword [esp + 0x28]
push dword [esp]
bswap ecx
jmp 0x43afc4
lahf
lea eax, [esp - 0x15e4e72f]
mov eax, dword [ebp - 0x9d40]
pushal
pushal
jmp 0x41bc19
lea ecx, [0xea648e2]
mov ecx, dword [esp + 0x30]
push edx
pushfd
mov dword fs:[eax], edx
movzx ax, cl
movsx ax, dl
mov dword [esp + 0x38], 0x426f9d
call fcn.00439a22
push eax
lea edx, [edx - 0x4527acb0]
mov byte [esp + 8], 0x24
xchg dword [esp + 0xc], edx
pushfd
pushfd
pushal
pushfd
push dword [esp + 0x38]
ret 0x40

Function at 0x428352
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, 0x88
push esi
mov dword [esp + 0x44], eax
cdq
cdq
movzx dx, bl
call fcn.0042874d
pushal
call fcn.0042c3bf
pushfd
lea esp, [esp + 8]
mov dword fs:[eax], esp
sets ah
cwde
lahf
pushfd
mov esi, 0x24438835
pushal
bswap ax
mov edi, 0x24438835
pushal
cdq
movzx eax, al
mov dword [ebp - 4], 0x7adfd1
rdtsc
rdtsc
lea eax, [ebp - 8]
movzx dx, dl
jmp 0x4279ad
Function at 0x42aaee
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 8]
call fcn.00406b70
pushfd
mov byte [esp], ch
cwde
push dword [ebp - 0x9cf0]
pop dword [esp]
not ax
lea edx, [ebp - 0x29d6d1ea]
push 0x413818
movsx ax, bl
lahf
push 0xbf2fa6c9
lea edx, [ebp - 0x9cf4]
setno ah
lea eax, [edi + 0x116369af]
bswap ax
movzx ax, al
mov eax, dword [ebp + 0xb4]
pushfd
mov word [esp], cx
pushfd
lea esp, [esp + 0xc]
call fcn.00406b70
movzx edx, dl
lea edx, [esp - 0x45d28462]
push dword [ebp - 0x9cf4]
xchg dx, ax
lea edx, [esi + 0x26218831]
push esi
rdtsc
mov dword [esp], 0x413828
mov dx, si
rdtsc
xchg dh, al
lea edx, [ebp - 0x9cf8]
movzx ax, bl
lahf
pushal
mov eax, dword [ebp + 0xb8]
call fcn.0042311c

Function at 0x42b22f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
call fcn.00406b70
lahf
push dword [ebp - 0x9d10]
lea eax, [edi - 0x6b83951]
push 0x4138a0
rdtsc
jmp 0x447933
movzx eax, bl
lea edx, [ebp - 0x9d14]
movzx ax, al
pushfd
mov byte [esp], 0xcd
pushal
mov eax, dword [ebp + 0xd8]
push dword [esp]
jmp 0x42d6c6

Function at 0x42c0f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
fld qword [ebp + 0xa4]
shrd ax, sp, 0xa
btr eax, edx
add esp, 0xfffffff8
pushal
pushfd
mov ah, dl
pop eax
fstp xword [esp + 0x20]
jmp 0x42c1c7
movzx ax, dl
lea eax, [ebx*2 - 0x45600b44]
wait
movsx eax, bl
lea esp, [esp + 0x20]
jnp 0x43aa86
not al
lea eax, [ebp - 0x9ce8]
jmp 0x449422
movzx ax, cl
mov al, 0x4a
pushfd
lea eax, [ebp - 0x9ce8]
jmp 0x4412f2
call fcn.00407ddc
push 0x9b1dbb0d
pushfd
rdtsc
bswap dx
push dword [ebp - 0x9ce8]
pop dword [esp + 4]
not dh
cwde
pushal
cwde
mov dword [esp + 0x20], 0x4137f4
not eax
lea edx, [ebp - 0x9cec]
movsx ax, dl
mov eax, dword [ebp + 0xac]
pushfd
pushfd
lea esp, [esp + 0x28]
call fcn.00406b70
pushal
push eax
push dword [ebp - 0x9cec]
pop dword [esp + 0x20]
pushfd
push edx
push 0xf4418866
push esp
lea esp, [esp + 0x30]
jmp 0x41c85b

Function at 0x43fa84
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
lea ecx, [ebp - 0x9d34]
lea edx, [ebp - 0x1fd6a33a]
lahf
mov word [esp], bx
rdtsc
mov edx, 5
pushal
bswap eax
pushal
mov eax, dword [ebp - 0x20]
pushfd
push ebx
mov byte [esp + 0xc], 0x84
lea esp, [esp + 0x4c]
jmp 0x441f08
Function at 0x4491f4
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0x10
xchg esi, ebx
pushal
pop esi
mov esi, dword [esp + 0x1c]
mov byte [esp + 8], cl
jmp 0x43aa98
sar ah, cl
xor ax, ax
push 0xb5b16acf
mov eax, ebx
rol ecx, cl
ror dx, cl
bt sp, 5
lea edx, [edx*4 - 0x20241ccb]
mov ecx, 0xa
btc dx, di
btc dx, bp
btr dx, cx
cdq
cmc
call fcn.0044927c
dec esi
test cl, 0x1c
test ebx, ebx
mov word [esp], bx
lea esp, [esp + 4]
jne 0x425c68
jmp 0x43b60e
mov dword [esp], ecx
mov word [esp + 4], sp
mov byte [esp + 4], bl
lea esp, [esp + 0x20]
call fcn.0040284c
jmp 0x43caea
push 0x23590deb
mov ebx, dword [esp + 0x24]
mov dword [esp + 4], ecx
push 0x79acfd8a
push dword [esp + 0x2c]
ret 0x30
pushal
fld qword [esp + 0x20]
jmp 0x42b5a4
inc bl
jmp 0x4203d9
lea esp, [esp + 0x50]
call fcn.0040bca4
inc al
not ax
rdtsc
bswap cx
fadd qword [esp]
rdtsc
push edi
fstp qword [esp + 4]
movzx dx, dl
wait
movzx dx, bl
lahf
mov eax, ebx
mov word [esp], sp
xchg ebx, edx
dec bh
mov ecx, 0xa
xchg dl, bl
pop ebx
cdq
bswap bx
inc bx
idiv ecx
movzx ebx, dl
bswap bx
pushfd
movzx bx, al
mov ebx, eax
jmp 0x427bbf

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x1edd6ae2
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x7547211a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10005110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b663
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100b85b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 0
mov dword [edi + 0x24], vtable.popmgr::IPopMgrClient.0
mov dword [edi], vtable.Popularize.0
lea esi, [edi + 0x30]
mov dword [edi + 0x24], vtable.Popularize.1.0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov byte [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0x1010101
mov word [esi + 0xc], 0x101
mov byte [esi + 0xe], 1
mov dword [ebp - 0x14], esi
add esi, 0x10
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1000cd40
mov dword [esi], eax
mov eax, edi
mov byte [edi + 0x48], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ccc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000cd19
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000cd19
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000cd0a
cmp esi, edx
jae 0x1000cd19
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000ccf8
cmp esi, edx
jae 0x1000cd19
cmp word [esi], 0
je 0x1000cd19
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000fee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c4a8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x100b85b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1003f8ee
mov edi, eax
add esp, 4
test edi, edi
je 0x1000ff83
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10018c4b
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000ff85
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.10004630
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x1000ffe5
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x1000ffe5
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x10010009
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1001002b
cmp byte [ebp + 0xc], 0
je 0x10010018
push esi
call fcn.10019172
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10010037
mov esi, str.ios_base::badbit_set
jmp 0x10010047
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.10010070
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10005560
push 0x100ae18c
lea eax, [ebp - 0x30]
push eax
call fcn.100657fb
int3
Function at 0x10011520
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100115ea
push dword [esi]
call fcn.1003c9e0
add esp, 4
test eax, eax
je 0x100115ea
cmp dword [edi + 0x1c], 0
jne 0x1001156d
push 4
call fcn.1003f8ee
add esp, 4
test eax, eax
je 0x10011568
mov dword [eax], vtable.HttpTaskFactoryEx::HttpCallback.0
jmp 0x1001156a
xor eax, eax
mov dword [edi + 0x1c], eax
cmp dword [edi], 0
jne 0x100115cd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x100115ea
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call esi
push str.HttpUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x100115cd
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x100115ea
cmp dword [edi + 4], 0
je 0x100115ea
cmp dword [edi + 0xc], 0
je 0x100115ea
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x100116b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c693
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x100b85b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10014490
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0x10095474
push str.popularize
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne bl
test eax, eax
je 0x10011841
call fcn.10041ed0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100117d4
push 0x6f
push str.d:jenkins.jenkinsworkspacepay_group_sys_clean_sys_clean_clientclient_sys_clean_tpi_src_sys_clean_client.cc
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], al
call fcn.1000ed70
push 3
push 0x10094c74
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000ed70
mov byte [ebp - 4], 2
call fcn.10041ed0
mov edi, eax
lea ecx, [ebp - 0xf0]
push 0x49
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10004e80
mov esi, eax
push str.never_popularize
push esi
mov byte [ebp - 4], 3
call fcn.100064e0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xf0]
call fcn.100068d0
lea ecx, [ebp - 0x40]
call fcn.100059d0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.100059d0
xor eax, eax
mov dword [ebp - 0x30], 0
push eax
push 0x100946c0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.1000ee70
push 0xd
xor eax, eax
mov byte [ebp - 4], 4
push str.break_no_tips
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov word [ebp - 0x58], ax
call fcn.1000ee70
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.10016ee0
add esp, 8
lea ecx, [ebp - 0x58]
call fcn.10005a20
lea ecx, [ebp - 0x40]
call fcn.10005a20
mov edx, dword [ebp - 0x14]
xor bl, 1
cmp edx, 8
jb 0x1001187a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10011870
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10011898
push edx
push ecx
call fcn.1003f91e
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fc9d
mov esp, ebp
pop ebp
ret
call fcn.1006958e
int3

Function at 0x10011a80
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [ecx + 4]
add ecx, 0x10
jmp fcn.10009dd0