joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
in al, dx
add ebp, 0x24
push esp
call fcn.004b11af
push cs
push ebx
xor al, 0x16
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x4b3373
invalid
add dl, byte [esi + 0x8408bad]
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004b11af
fisubr dword [ecx - 0x7749968]
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.004b11af
push dword [edi - 0x4a]
inc eax
lodsb al, byte [esi]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4b339c
mov eax, 0x41636f72
invalid
inc esi

Function at 0x4b34ef
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5bfd6f
call fcn.0059d452
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4b3514
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4b3566
call fcn.004a8620
push eax
lea ecx, [ebp - 0x10]
call fcn.00402150
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0059d55c
push eax
call fcn.00401ad0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401c30
mov eax, esi
call fcn.0059d52a
ret 8

Function at 0x4b5e81
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x4b5ec9
push 0x5e25e4
push 4
push eax
call fcn.0059db08
push eax
call fcn.00401ad0
add esp, 0x10
jmp 0x4b5edf
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4b5f62
push edi
call fcn.0059d0d6
mov edi, dword [eax]
call fcn.0059d0d6
and dword [eax], 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00599f85
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.0059d0d6
cmp dword [eax], 0
je 0x4b5f36
call fcn.0059d0d6
push dword [eax]
call fcn.004a7450
pop ecx
jmp 0x4b5f3d
call fcn.0059d0d6
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
pop edi
je 0x4b5f62
cmp dword [ebp - 0x11c], esi
jae 0x4b5f62
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x4b5f64
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00599ed4
leave
ret
Function at 0x4b5f71
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push 0x5cfac8
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.004adb9a
pop ecx
cmp eax, esi
je 0x4b605b
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x4b605b
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.00599fb0
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x4b605b
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x4b605b
cmp esi, 0x14
jge 0x4b605b
push 0x10
push 0
push edi
call fcn.0059fdcc
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4b604a
call fcn.0059d0d6
cmp dword [eax], 0x22
je 0x4b604a
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.0059d579
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x4b6020
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x6ca780], 0
jne 0x4b60e6
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x4b610f
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.004b5e81
pop ecx
pop ecx
test eax, eax
jne 0x4b6111
inc edi
cmp edi, esi
jl 0x4b60ec
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
leave
ret 8

Function at 0x4b73fd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.004b58ff
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4b7436
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.004b703f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4b7494
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4b74b8
cmp dword [edi + 0x74], 0
jne 0x4b74b8
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.004b58ff
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004b7455
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4b919f
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004b8e5e
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4b91e9
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004a851a
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004a84eb
jmp 0x4b91f4
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004bb9bd
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4b91fa
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.004b31b9
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4b9237
call fcn.004b8e5e
mov dword [esi + 0xc], 1
jmp 0x4b923c
call fcn.004b8e5e
cmp dword [esi], 0
je 0x4b9285
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x4b925d
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.004a851a
jmp 0x4b926f
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.00402390
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.004a84eb
jmp 0x4b92a9
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x4b92a9
push dword [esi]
push dword [ebp + 8]
call fcn.004bb9bd
pop esi
pop ebp
ret 0xc
Function at 0x4bc61c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4bc651
xor eax, eax
jmp 0x4bc6a4
lea eax, [ebp - 0x210]
push eax
call fcn.0059d579
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x4bc682
push 0x5e3474
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005a033a
add esp, 0xc
test eax, eax
jne 0x4bc64d
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005a033a
add esp, 0xc
test eax, eax
jne 0x4bc64d
lea eax, [ebp - 0x210]
push eax
call fcn.004adc20
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00599ed4
leave
ret

Function at 0x4c9367
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
ja 0x4c9384
cmp dword [ecx + 0x114], 0
je 0x4c9384
call fcn.004c8937
pop ebp
ret 8
pop ebp
jmp method.CStatic.virtual_128

Function at 0x515e6a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b3370

Function at 0x52724d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x527267
call fcn.004b58ff
mov esi, dword [eax + 0xc]
push dword [0x6cc908]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x527285
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x52727d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x5272b2
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x52727f
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.0052717b
mov esi, eax
jmp 0x5272a4

Function at 0x540301
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 0x4c]
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi], vtable.CMFCToolBarDropSource.0
test eax, eax
je 0x54031b
push eax
call edi
mov eax, dword [esi + 0x50]
test eax, eax
je 0x540325
push eax
call edi
mov eax, dword [esi + 0x54]
test eax, eax
je 0x54032f
push eax
call edi
pop edi
mov ecx, esi
pop esi
jmp fcn.004b2dd0

Function at 0x5772e5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004b0b16
call fcn.0049c9b0
cmp eax, esi
pop esi
jne 0x577301
mov ecx, 0x6caa80
jmp fcn.004bd173
ret
Function at 0x57abea
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x57ac02
mov edi, dword [esi + 0xc]
jmp 0x57ac42
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x57ac1b
call fcn.004aaf21
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x57ac30
call fcn.004aaf21
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x57ac42
call fcn.004aaf21
call fcn.004b58ff
cmp dword [eax + 0x3c], 0
je 0x57ac57
push edi
mov ecx, ebx
call fcn.00579aae
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0057ab04
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x57ac75
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x57ac81
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x599ed4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6319d0]
jne 0x599ede
repz ret
jmp fcn.005a2dbf
Function at 0x5ae9ea
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.005a25c5
and dword [ebp - 0x14], 0
cmp dword [0x6ceee8], 0
mov dword [ebp - 0x18], eax
jne 0x5aea9d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5aeb45
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x5aeb45
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x6068b0
push ebx
mov dword [0x6ceee8], eax
call edi
push eax
call esi
push 0x60689c
push ebx
mov dword [0x6ceeec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6ceef0], eax
call edi
push eax
call esi
mov dword [0x6ceef8], eax
test eax, eax
je 0x5aea9d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6ceef4], eax
mov eax, dword [0x6ceef4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x5aeaf6
cmp dword [0x6ceef8], ecx
je 0x5aeaf6
push eax
call esi
push dword [0x6ceef8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x5aeaf6
test ebx, ebx
je 0x5aeaf6
call edi
test eax, eax
je 0x5aeaed
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x5aeaed
test byte [ebp - 8], 1
jne 0x5aeaf6
or dword [ebp + 0x10], 0x200000
jmp 0x5aeb29
mov eax, dword [0x6ceeec]
cmp eax, dword [ebp - 0x18]
je 0x5aeb29
push eax
call esi
test eax, eax
je 0x5aeb29
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5aeb29
mov eax, dword [0x6ceef0]
cmp eax, dword [ebp - 0x18]
je 0x5aeb29
push eax
call esi
test eax, eax
je 0x5aeb29
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6ceee8]
call esi
test eax, eax
je 0x5aeb45
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5aeb47
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
leave
ret
Function at 0x65b895f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x65b89654
jmp 0x65b896a0
jmp 0x65b896ec
jmp 0x65b89738
jmp 0x65b89784
jmp 0x65b897d0
jmp 0x65b8981c
jmp 0x65b89868
jmp 0x65b898b4
jmp 0x65b89900
jmp 0x65b8994c
jmp 0x65b89998
jmp 0x65b899e4
jmp 0x65b89a30
jmp 0x65b89a7c
jmp 0x65b89ac8
jmp 0x65b89b14
jmp 0x65b89b60
jmp 0x65b89bac
jmp 0x65b89bf8
jmp 0x65b89c44
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x65b89c96
jmp 0x65b89ce2
jmp 0x65b89d2e
jmp 0x65b89d7a
jmp 0x65b89dc6
jmp 0x65b89e12
jmp 0x65b89e5e
jmp 0x65b89eaa
jmp 0x65b89ef6
jmp 0x65b89f42
jmp 0x65b89f8e
jmp 0x65b89fda
jmp 0x65b8a026
jmp 0x65b8a072
jmp 0x65b8a0be
jmp 0x65b8a10a
jmp 0x65b8a156
jmp 0x65b8a1a2
jmp 0x65b8a1ee
jmp 0x65b8a23a
jmp 0x65b8a286
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x65b8a2ec
jmp 0x65b8a338
jmp 0x65b8a384
jmp 0x65b8a3d0
jmp 0x65b8a41c
jmp 0x65b8a468
jmp 0x65b8a4b4
jmp 0x65b8a500
jmp 0x65b8a54c
jmp 0x65b8a598
jmp 0x65b8a5e4
jmp 0x65b8a630
jmp 0x65b8a67c
jmp 0x65b8a6c8
jmp 0x65b8a714
jmp 0x65b8a760
jmp 0x65b8a7ac
jmp 0x65b8a7f8
jmp 0x65b8a844
jmp 0x65b8a890
jmp 0x65b8a8dc
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x65b8a931
jmp 0x65b8a97d
jmp 0x65b8a9c9
jmp 0x65b8aa15
jmp 0x65b8aa61
jmp 0x65b8aaad
jmp 0x65b8aaf9
jmp 0x65b8ab45
jmp 0x65b8ab91
jmp 0x65b8abdd
jmp 0x65b8ac29
jmp 0x65b8ac75
jmp 0x65b8acc1
jmp 0x65b8ad0d
jmp 0x65b8ad59
jmp 0x65b8ada5
jmp 0x65b8adf1
jmp 0x65b8ae3d
jmp 0x65b8ae89
jmp 0x65b8aed5
jmp 0x65b8af21
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x65b8af86
jmp 0x65b8afd2
jmp 0x65b8b01e
jmp 0x65b8b06a
jmp 0x65b8b0b6
jmp 0x65b8b102
jmp 0x65b8b14e
jmp 0x65b8b19a
jmp 0x65b8b1e6
jmp 0x65b8b232
jmp 0x65b8b27e
jmp 0x65b8b2ca
jmp 0x65b8b316
jmp 0x65b8b362
jmp 0x65b8b3ae
jmp 0x65b8b3fa
jmp 0x65b8b446
jmp 0x65b8b492
jmp 0x65b8b4de
jmp 0x65b8b52a
jmp 0x65b8b576
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x65b8b5dc
jmp 0x65b8b628
jmp 0x65b8b674
jmp 0x65b8b6c0
jmp 0x65b8b70c
jmp 0x65b8b758
jmp 0x65b8b7a4
jmp 0x65b8b7f0
jmp 0x65b8b83c
jmp 0x65b8b888
jmp 0x65b8b8d4
jmp 0x65b8b920
jmp 0x65b8b96c
jmp 0x65b8b9b8
jmp 0x65b8ba04
jmp 0x65b8ba50
jmp 0x65b8ba9c
jmp 0x65b8bae8
jmp 0x65b8bb34
jmp 0x65b8bb80
jmp 0x65b8bbcc
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x20]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x30], eax
jmp 0x65b8bc32
jmp 0x65b8bc7e
jmp 0x65b8bcca
Function at 0x65b9b9f2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x66315018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x66315018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x65b9ba5e
jmp 0x65b9baaa
jmp 0x65b9baf6
jmp 0x65b9bb42
jmp 0x65b9bb8e
jmp 0x65b9bbda
jmp 0x65b9bc26
jmp 0x65b9bc72
jmp 0x65b9bcbe
jmp 0x65b9bd0a
jmp 0x65b9bd56
jmp 0x65b9bda2
jmp 0x65b9bdee
jmp 0x65b9be3a
jmp 0x65b9be86
jmp 0x65b9bed2
jmp 0x65b9bf1e
jmp 0x65b9bf6a
jmp 0x65b9bfb6
jmp 0x65b9c002
jmp 0x65b9c04e
mov dword [ebp - 0x14], 0
jmp 0x65b9c0a1
jmp 0x65b9c0ed
jmp 0x65b9c139
jmp 0x65b9c185
jmp 0x65b9c1d1
jmp 0x65b9c21d
jmp 0x65b9c269
jmp 0x65b9c2b5
jmp 0x65b9c301
jmp 0x65b9c34d
jmp 0x65b9c399
jmp 0x65b9c3e5
jmp 0x65b9c431
jmp 0x65b9c47d
jmp 0x65b9c4c9
jmp 0x65b9c515
jmp 0x65b9c561
jmp 0x65b9c5ad
jmp 0x65b9c5f9
jmp 0x65b9c645
jmp 0x65b9c691
mov dword [ebp - 0x18], 0
jmp 0x65b9c6e4
jmp 0x65b9c730
jmp 0x65b9c77c
jmp 0x65b9c7c8
jmp 0x65b9c814
jmp 0x65b9c860
jmp 0x65b9c8ac
jmp 0x65b9c8f8
jmp 0x65b9c944
jmp 0x65b9c990
jmp 0x65b9c9dc
jmp 0x65b9ca28
jmp 0x65b9ca74
jmp 0x65b9cac0
jmp 0x65b9cb0c
jmp 0x65b9cb58
jmp 0x65b9cba4
jmp 0x65b9cbf0
jmp 0x65b9cc3c
jmp 0x65b9cc88
jmp 0x65b9ccd4
mov dword [ebp - 0x10], 0
jmp 0x65b9cd27
jmp 0x65b9cd73
jmp 0x65b9cdbf
jmp 0x65b9ce0b
jmp 0x65b9ce57
jmp 0x65b9cea3
jmp 0x65b9ceef
jmp 0x65b9cf3b
jmp 0x65b9cf87
jmp 0x65b9cfd3
jmp 0x65b9d01f
jmp 0x65b9d06b
jmp 0x65b9d0b7
jmp 0x65b9d103
jmp 0x65b9d14f
jmp 0x65b9d19b
jmp 0x65b9d1e7
jmp 0x65b9d233
jmp 0x65b9d27f
jmp 0x65b9d2cb
jmp 0x65b9d317
mov dword [ebp - 0x10], 0
jmp 0x65b9f297
jmp 0x65b9d36f
jmp 0x65b9d3bb
jmp 0x65b9d407
jmp 0x65b9d453
jmp 0x65b9d49f
jmp 0x65b9d4eb
jmp 0x65b9d537
jmp 0x65b9d583
jmp 0x65b9d5cf
jmp 0x65b9d61b
jmp 0x65b9d667
jmp 0x65b9d6b3
jmp 0x65b9d6ff
jmp 0x65b9d74b
jmp 0x65b9d797
jmp 0x65b9d7e3
jmp 0x65b9d82f
jmp 0x65b9d87b
jmp 0x65b9d8c7
jmp 0x65b9d913
jmp 0x65b9d95f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x66315014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x65b9d9bc
jmp 0x65b9da08
jmp 0x65b9da54
jmp 0x65b9daa0
jmp 0x65b9daec
jmp 0x65b9db38
jmp 0x65b9db84
jmp 0x65b9dbd0
jmp 0x65b9dc1c
jmp 0x65b9dc68
jmp 0x65b9dcb4
jmp 0x65b9dd00
jmp 0x65b9dd4c
jmp 0x65b9dd98
jmp 0x65b9dde4
jmp 0x65b9de30
jmp 0x65b9de7c
jmp 0x65b9dec8
jmp 0x65b9df14
jmp 0x65b9df60
jmp 0x65b9dfac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6631501c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp fcn.65b9e009
mov eax, dword [0x66315018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x65b9d323
nop
leave
ret
Function at 0x100a83d
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
call dword [0x1001164]
test eax, eax
je 0x100a89a
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcstok]
push edi
mov edi, 0x1001390
push edi
push eax
call esi
push edi
push ebx
call esi
mov edi, eax
add esp, 0x10
test edi, edi
je 0x100a898
mov esi, dword [0x10010b0]
push 0x1001378
push edi
call esi
test eax, eax
jne 0x100a884
inc ebx
call fcn.01010f09
jmp 0x100a898
push 0x100135c
push edi
call esi
test eax, eax
jne 0x100a898
xor ebx, ebx
inc ebx
call fcn.01010b47
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x100cb99
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0xc]
lea ebx, [esi + 0x50]
push ebx
xor edi, edi
push edi
push esi
push 0x100ce42
push dword [esi + 0x58]
push edi
call dword [0x10010ec]
cmp eax, edi
mov dword [esi + 0x4c], eax
je 0x100cbfa
mov dword [ebp - 4], edi
push 1
mov edi, 0x1036850
push edi
call fcn.010262dd
mov ecx, dword [0x1036848]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 8], esi
call fcn.0100cc11
push edi
mov esi, eax
call fcn.01024c1f
jmp 0x100cc05
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov esi, 0x80000001
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100e0df
Capabilities:
Access the windows event log
Check if file exists
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1035f7c]
push ebx
push esi
push edi
push dword [0x1035260]
xor ebx, ebx
push ebx
push 6
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ebx
call dword [0x1001108]
mov esi, eax
cmp esi, ebx
mov edi, 0x148
jne 0x100e17e
call dword [fcn.010010d4]
cmp eax, 2
jne 0x100e172
push ebx
lea eax, [ebp - 0x30]
push eax
call fcn.0100dd0c
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x100e1b2
push dword [0x1035260]
lea eax, [ebp - 0x30]
push edi
push ebx
mov dword [ebp - 0xc], eax
push 0x8000004
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], ebx
call dword [0x1001104]
mov esi, eax
cmp esi, ebx
jne 0x100e167
mov dword [ebp - 0x14], 0x80041003
push dword [ebp - 0x20]
call fcn.0100d8a8
pop ecx
jmp 0x100e179
mov dword [ebp - 0x14], 0x80041003
cmp dword [ebp - 0x14], ebx
jl 0x100e1a7
push edi
push ebx
push ebx
push 6
push esi
call dword [0x1001100]
cmp eax, ebx
jne 0x100e195
mov dword [ebp - 0x14], 0x80041003
cmp dword [ebp - 0x14], ebx
jl 0x100e1a7
mov dword [0x1036904], esi
mov dword [0x1036908], eax
jmp 0x100e21f
cmp esi, ebx
je 0x100e1b2
push esi
call dword [0x10010b8]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov dword [ebp - 0x18], ebx
call dword [0x1001070]
test eax, eax
je 0x100e21f
mov eax, dword [0x1035260]
push ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 1
push dword [ebp - 0x18]
push 0x80000040
push ebx
push 2
push dword [0x1036918]
call dword [0x1001078]
test eax, eax
jne 0x100e216
call dword [fcn.010010d4]
push dword [ebp - 0x18]
call dword [0x10010fc]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
call fcn.0102451e
leave
ret