joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005e0e
Capabilities:
Packed with generic packer

Disassembly:
push 0x1001c8b9
call fcn.100056b1
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x1c18]
push eax
push ecx
push eax
push dword [esp - 0xd6]
push dword [esp - 5]
call 0x10005ddc
mov eax, dword [esp]
cmp eax, 4
ja 0x10005d9f
push 0x1001cdf3
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push dword [esp - 0x19]
push dword [esp - 0xaa]
push dword [esp - 0x27]
call 0x10005e0e
inc esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call dword [sym.imp.WINSPOOL.DRV_ClosePrinter]
mov esi, eax
test esi, esi
lea esp, [esp + 0x10]
add dword [esp + 4], eax
push dword [esp - 0x56]
push dword [esp - 0x27]
push edx
call 0x10005e36
pop esi
mov eax, dword [ecx + 0x14]
sub esp, 8
test eax, eax
jne 0x10005e41
mov ecx, dword [eax]
push esi
push edi
lea esp, [esp + 0x10]
pop eax
ret 8
call dword [ecx + 8]
mov dword [esi], 0
xor eax, eax
test edi, edi
pop edi
pop esi
mov dword [ebx + 0x114], 1
setge al
pop ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
or ecx, dword [esp]
add esp, 4
push dword [esp + 0xc]
push 0xffffffffffffffe4
push edx
push 0x1000004d
push 0x1000956f
call fcn.10003abc
push eax
jmp loc.1002b22f

Function at 0x10005e94
Capabilities:
Packed with generic packer

Disassembly:
mov esi, eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x10005e81
xor eax, eax
pop esi

Function at 0x10005ea9
Capabilities:
Get thread local storage value

Disassembly:
mov dword [esi + 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x10005edc
push eax
push esi
push 0x10005458
push edx
push ecx
call 0x10005ee4
call fcn.1000e476
cmp eax, 0xffffffff
jne 0x10005f19
jmp 0x1002d62d
mov eax, dword [eax]
jmp 0x1002efce
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x10005ee2
xor eax, eax
pop ecx
mov eax, dword [ecx + 0x14]
mov dword [esp], 0
mov eax, dword [eax + 0x14]
mov ecx, dword [eax]
lea edx, [esp]
push edx
push eax
call dword [ecx + 0x94]

Function at 0x10005ee4
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esi + 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x10005edc
push eax
push esi
push 0x10005458
push edx
push ecx
call 0x10005ee4
call fcn.1000e476
cmp eax, 0xffffffff
jne 0x10005f19
jmp 0x1002d62d
mov eax, dword [eax]
jmp 0x1002efce
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x10005ee2
xor eax, eax
pop ecx
mov eax, dword [ecx + 0x14]
mov dword [esp], 0
mov eax, dword [eax + 0x14]
mov ecx, dword [eax]
lea edx, [esp]
push edx
push eax
call dword [ecx + 0x94]

Function at 0x10005f09
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push 0x49
call fcn.10005f3d
push ecx
Function at 0x100060b8
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c784
mov eax, dword [0x1001c800]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001cfff
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
add esp, 4
pop ebx
push 0xffffffffffffffb9
push 0xfffffffffffffffe
push 0x1000055f
push edx
push 0x10006965
call fcn.10003ea8
add eax, 2
add esi, 2
test cl, cl
jne 0x10006145
xor eax, eax
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne fcn.10006136
push ebx
push edi
jmp loc.1002e663

Function at 0x10006136
Capabilities:
Packed with generic packer

Disassembly:
jne 0x1000614c
mov edx, dword [str._PyD]
mov eax, dword [edx]
push 0x1001ca63
push eax
call dword [sym.imp.GDI32.dll_ScaleViewportExtEx]
xor eax, eax
mov ecx, dword [esp]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [esp + 0xc]
push eax
push dword [ebp - 8]
call fcn.10007ec9
push 0
push esi
sub esi, eax
push esp
push 0x1000080a
push 0x1000087b
push 0x10000698
push 0x1000d8bb
call fcn.10003cc0
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx

Function at 0x100061e6
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.10006947
test eax, eax
jmp loc.1002cd2f

Function at 0x10006271
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [ebx - 0x535ef314], al
push es
add al, 0x10
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 7
lea ecx, [esp + 8]
push ecx
push 0x1001cb50
push edx
push 0xffffffffffffffdc
call 0x100062b4
add byte [eax], al
mov eax, 0x1001d1c9
push esi
push 0
mov esi, ecx
call fcn.10010bc3
mov dword [esi], 0x100063e0
lea esp, [esp + 8]
mov edx, dword [esp + 8]
push 0x100017d8
push dword [esp + 0x27]
push 0x10005eb0
push eax
push 0xffffffffffffffe5
call 0x100062f7
mov eax, 0x1001c1d4
mov eax, dword [esp]
cmp eax, 0x2710
jne 0x1000631b
mov eax, 0x1001c4d0
jle 0x1000627d
mov eax, 0x1001c103
mov eax, 0x1001c6c6
mov eax, 0x1001c78e
lea esp, [esp + 0x18]
add dword [esp + 4], edx
push 0xffffffffffffffba
call fcn.1000632a
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
mov eax, dword [edi + 0x78]
and eax, 0x10000000
push ebp
mov dword [esp + 0x24], eax
push esi
mov eax, ebx
jmp loc.1002cc8c
Function at 0x100062b4
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [ebx - 0x535ef314], al
push es
add al, 0x10
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 7
lea ecx, [esp + 8]
push ecx
push 0x1001cb50
push edx
push 0xffffffffffffffdc
call 0x100062b4
add byte [eax], al
mov eax, 0x1001d1c9
push esi
push 0
mov esi, ecx
call fcn.10010bc3
mov dword [esi], 0x100063e0
lea esp, [esp + 8]
mov edx, dword [esp + 8]
push 0x100017d8
push dword [esp + 0x27]
push 0x10005eb0
push eax
push 0xffffffffffffffe5
call 0x100062f7
mov eax, 0x1001c1d4
mov eax, dword [esp]
cmp eax, 0x2710
jne 0x1000631b
mov eax, 0x1001c4d0
jle 0x1000627d
mov eax, 0x1001c103
mov eax, 0x1001c6c6
mov eax, 0x1001c78e
lea esp, [esp + 0x18]
add dword [esp + 4], edx
push 0xffffffffffffffba
call fcn.1000632a
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
mov eax, dword [edi + 0x78]
and eax, 0x10000000
push ebp
mov dword [esp + 0x24], eax
push esi
mov eax, ebx
jmp loc.1002cc8c

Function at 0x100062f7
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [ebx - 0x535ef314], al
push es
add al, 0x10
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 7
lea ecx, [esp + 8]
push ecx
push 0x1001cb50
push edx
push 0xffffffffffffffdc
call 0x100062b4
add byte [eax], al
mov eax, 0x1001d1c9
push esi
push 0
mov esi, ecx
call fcn.10010bc3
mov dword [esi], 0x100063e0
lea esp, [esp + 8]
mov edx, dword [esp + 8]
push 0x100017d8
push dword [esp + 0x27]
push 0x10005eb0
push eax
push 0xffffffffffffffe5
call 0x100062f7
mov eax, 0x1001c1d4
mov eax, dword [esp]
cmp eax, 0x2710
jne 0x1000631b
mov eax, 0x1001c4d0
jle 0x1000627d
mov eax, 0x1001c103
mov eax, 0x1001c6c6
mov eax, 0x1001c78e
lea esp, [esp + 0x18]
add dword [esp + 4], edx
push 0xffffffffffffffba
call fcn.1000632a
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
mov eax, dword [edi + 0x78]
and eax, 0x10000000
push ebp
mov dword [esp + 0x24], eax
push esi
mov eax, ebx
jmp loc.1002cc8c

Function at 0x10006866
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, 0x1001d211
mov eax, dword [0x1001ceaa]
test eax, eax
je 0x100067f8

Function at 0x100068f9
Capabilities:
Query environment variable
Set environment variable
Set registry value

Disassembly:
push eax
call dword [edx + 0x34]
mov eax, dword [esi]
mov edx, dword [eax]
push 0x1001c39a
push eax
call dword [edx + 0x2c]
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
push edi
push dword [esp + 8]
push 0xffffffffffffff96
push dword [esp + 4]
push dword [esp + 0xc]
push 0x1000e347
call fcn.10003abc
mov dword [0x1001c42a], eax
je 0x10006907
push esi
mov esi, dword [str.KEY_RIGHT]
push 0x1001d023
push eax
call esi
Function at 0x10006947
Capabilities:
Query environment variable
Set environment variable
Set registry value

Disassembly:
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [edx + 8]
cmp eax, ebx
jl 0x10007d02
jmp loc.1002f15e
test edi, edi
mov esi, edx
jle 0x10007d00
lea ebx, [ebx]
movzx ecx, byte [esi]
mov edx, ecx
shr edx, 4
mov dl, byte [edx + 0x10007318]
and ecx, 0xf

Function at 0x1000699a
Capabilities:
Query environment variable
Set registry value

Disassembly:
mov dword [esp], eax
mov dword [ebp + 8], ecx
call dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
call fcn.1000d448
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x1001cb9f
je loc.10006968
xchg dword [esp], edx
push eax
xor dword [esp], eax
xor dword [esp], ebx
call eax
mov word [ebp - 0x1a4], 2
push edx
push 0x10000d70
push 0x100008e9
push 0x1000096e
push 0x1000e06a
call fcn.10003cc0
call fcn.10008cb5
mov edx, eax
xor eax, eax
test edx, edx
je 0x10006997
push edi
mov ecx, 0x1001c338
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, edx
lea edx, [esp + 8]
push edx
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 4]
cmp eax, 0x21
jmp loc.1002da19

Function at 0x10006a86
Capabilities:
Query environment variable

Disassembly:
jne 0x10006a75
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.10005559
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
push edi

Function at 0x10006af6
Capabilities:
Packed with generic packer

Disassembly:
add esp, 0x1001d296
mov ecx, dword [esp + 0x204]
mov eax, 0x1001d02c
pop esi
call fcn.10005559
add esp, 0x1001d2aa
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001c5b2
push eax
mov eax, 0x1001cb8a
push esi
push 0x5d
push 0x10001350
push esp
call 0x10006b4d
push esi
mov esi, dword [esp + 0x38]
push ebp
push ebx
push esi
push 0x1001cd8b
mov ecx, edi
call fcn.100087a4
mov dword [esp + 0x3c], ebp
lea esp, [esp + 0x10]
mov esi, dword [esp + 8]
push 0x10005200
push 0xffffffffffffffd2
push dword [esp - 0x97]
push dword [esp - 0x74]
call fcn.10006b8f
jl 0x10006b14
jmp loc.1002c4e8

Function at 0x10006b4d
Capabilities:
Packed with generic packer

Disassembly:
add esp, 0x1001d296
mov ecx, dword [esp + 0x204]
mov eax, 0x1001d02c
pop esi
call fcn.10005559
add esp, 0x1001d2aa
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001c5b2
push eax
mov eax, 0x1001cb8a
push esi
push 0x5d
push 0x10001350
push esp
call 0x10006b4d
push esi
mov esi, dword [esp + 0x38]
push ebp
push ebx
push esi
push 0x1001cd8b
mov ecx, edi
call fcn.100087a4
mov dword [esp + 0x3c], ebp
lea esp, [esp + 0x10]
mov esi, dword [esp + 8]
push 0x10005200
push 0xffffffffffffffd2
push dword [esp - 0x97]
push dword [esp - 0x74]
call fcn.10006b8f
jl 0x10006b14
jmp loc.1002c4e8

Function at 0x10006e89
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esi + 0x14]
cmp eax, ebx
jne 0x10006e49
jmp loc.1002d741
Function at 0x10006f34
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push 0x39
push 0x10005940
push 0x10002ec8
push 0x10005ff8
push 0x10005d60
call fcn.10006f66
push edx
call fcn.10010039
cmp eax, 0xffffffff
jne 0x10006eee
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.1000cb7c

Function at 0x100071e8
Capabilities:
Packed with generic packer

Disassembly:
mov edi, dword [0x1001c462]
push str.SBDROM_TITL
lea eax, [esp + 0x14]
push eax
push 0
call edi

Function at 0x100071fc
Capabilities:
Packed with generic packer

Disassembly:
stosw word es:[edi], ax
mov eax, dword [edx]
push edx
call dword [eax + 0x10]
xor edx, edx
test eax, eax
setge dl
mov dword [esi + 0x1c], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xb4], 0xffffffff
mov esi, edx
call fcn.1000e94b
mov eax, esi
push ebp
push eax
push dword [esp + 0xc]
push 0x65
push 0x1000053a
push 0xffff759
call fcn.10003cc0
push eax
call dword [edx + 0x68]
test eax, eax
jl 0x100071ba
mov edx, dword [esi + 0x14]
mov eax, dword [edx + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push ebx
push 5
push edx
push edi
push eax
call dword [ecx + 0x54]

Function at 0x10007230
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x2014], ecx
mov dword [eax + 0x2018], ecx
push eax
push esp
push 0xffffffffffffffe1
push 6
call fcn.1000726d
jmp loc.1002b0b4

Function at 0x1000726d
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
mov eax, dword [esp + 8]
push dword [esp + 0x33]
push eax
push 0xffffffffffffffc7
push 0xfffffffffffffff4
push esp
call 0x100072a3
mov eax, dword [esp + 8]
push 0x1001cb7a
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
test eax, eax
jne 0x1000728d
push 8
call fcn.10007476
test eax, eax
je 0x10007251
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push 0x10003e08
push dword [esp + 0x46]
call 0x100072e0
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
pop esi
mov ecx, dword [esp + 0x20c]
call fcn.1000f8d2
add esp, str.OCATOR7
push 0x1001c9fa
lea esp, [esp + 0xc]
pop eax
ret 0xc
Function at 0x100073b0
Capabilities:
Allocate thread local storage

Disassembly:
push eax
call esi
push 0x1001c93d
lea ecx, [esp + 0x2c]
push ecx
call esi
lea edx, [esp + 0x28]
push edx
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push 0x10001ad8
push dword [esp + 5]
push 0x10005ad0
push dword [esp - 0x66]
push ecx
call 0x100073b0
je 0x10007360
mov eax, dword [esp + 0x1c]
push eax
push 0x1001c8b1
call fcn.10007dcb
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10007401
mov ecx, eax
mov edx, dword [ecx]
lea esp, [esp + 0x18]
add dword [esp + 4], ecx
push 0x19
push 0x10004838
push 0x10004df8
push dword [esp + 0x61]
call 0x100073e9
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push eax
push 0x1001c6de
lea esp, [esp + 0x14]
pop ecx
ret 4
mov dword [esp + 0x24], 0xffffffff
call dword [eax + 0x6c]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, eax
mov eax, dword [esp + 0x28]
pop ecx
leave
ret 4

Function at 0x1000754d
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x1001c388]
inc dword [eax]
jmp loc.1002c5e0

Function at 0x1000756c
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push 0x10000daf
push dword [esp + 0xc]
push 0x100005bc
push ebx
push 0xfffd7a1
call fcn.100038e6
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.10007c76
push eax
call dword [sym.imp.KERNEL32.dll_RaiseException]

Function at 0x10007a1b
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push ecx
push dword [esp - 0x10]
push dword [esp - 0xe6]
push dword [esp - 0x6e]
call 0x10007a1b
mov ecx, dword [edi]
mov edx, dword [ecx]
push 0x1001cdde
push esi
call dword [edx + 0x24]
mov ecx, dword [edi]
mov eax, dword [ecx]
push 0x1001d291
push esi
call dword [eax + 0x1c]
mov ecx, dword [edi]
mov edx, dword [ecx]
push 0x65
lea esp, [esp + 0x10]
mov ecx, dword [esp + 8]
push dword [esp - 0x6b]
push dword [esp - 0x5b]
push 0x10002a68
jmp loc.1002ea9f

Function at 0x10007c76
Capabilities:
Extract resource via kernel32 functions
Set environment variable

Disassembly:
push ecx
push 8
mov ecx, esi
call fcn.100065d6
mov esi, dword [esp + 0xc]
cmp esi, ebx
je fcn.10004ace
mov ebx, dword [0x1001ca6f]

Function at 0x10007c92
Capabilities:
Extract resource via kernel32 functions
Packed with generic packer
Set environment variable

Disassembly:
push ecx
push 0xffffffffffffffdd
push dword [esp + 0x56]
push dword [esp - 0x29]
push dword [esp - 0xef]
push dword [esp + 0x60]
call fcn.10007cec
lea edx, [esp + 8]
push edx
push 0x1001c913
jmp loc.1002ee6b

Function at 0x10007cec
Capabilities:
Set environment variable

Disassembly:
lea esp, [esp + 0x18]
mov ecx, dword [esp + 8]
push esi
call fcn.10007d1d
pop ebp
pop ebx
push esi
push edi
mov edi, ecx
Function at 0x10007d1d
Capabilities:
Set environment variable

Disassembly:
lea esp, [esp + 8]
add dword [esp + 4], ecx
push dword [esp - 0x35]
push dword [esp - 0x91]
push dword [esp + 0x58]
call 0x10007d65
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1001cd21
push ecx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x10007db4
mov eax, dword [0x1001c4a2]
lea esp, [esp + 0x10]
pop ecx
ret 0xc
xor ecx, ecx

Function at 0x10007e70
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x18]
add dword [esp + 4], edi
push edx
call fcn.10007e97
mov ecx, dword [esp + 0xc]
push esi
jmp loc.1002bb5b

Function at 0x1000804b
Capabilities:
Packed with generic packer

Disassembly:
test esi, esi
pop edi
setge al
pop esi
push ebp
mov ebp, esp
push esi
push 0x67
push 0x100052e8
push 0x14
push dword [esp - 0xb7]
push dword [esp - 0x27]
call 0x1000808b
cmp eax, 0xffffffff
jne 0x10008026
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.1000427c
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
lea esp, [esp + 0x18]
mov esi, dword [esp + 8]
push dword [esp + 0x5b]
call 0x100080b9
lea edx, [ebx + ecx*4]
mov dword [esi + 0xc], eax
mov dword [esi + 8], edx
mov dword [esi + 4], ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
push eax
push esi
call fcn.1001203b
push esi
lea esp, [esp + 8]
add dword [esp + 4], esi
push dword [esp - 0x1c]
push dword [esp - 0xe]
push dword [esp - 0x3b]
push 0x10002110
call 0x100080f0
push 0xffffffffffffffff
push 0x1001cecf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea esp, [esp + 0x14]
pop esi
ret 0xc

Function at 0x1000815a
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 4]
call fcn.10007db6
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push edx
inc edx
jmp loc.1002c847

Function at 0x100081e9
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
sub esp, 0xc
mov eax, dword [str._MovieLibrary_]
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.USER32.dll_GetParent]
add esp, 4
push 0x10000998
push 0x100005f1
push ecx
push 0xffffffffffffffd6
push 0x1000d324
call fcn.10003731
jmp loc.1002f5c0

Function at 0x100082dd
Capabilities:
Read file on windows

Disassembly:
lea esp, [esp + 0xc]
add dword [esp + 4], edx
push eax
push ebp
push 0x2d
push dword [esp - 0x2a]
push 0x62
call 0x10008320
push eax
push ebx
push 0x1001cd79
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0x1fe
call edi
lea edx, [esp + 0x18]
push edx
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
lea esp, [esp + 0x18]
pop edx
ret 4

Function at 0x100083c8
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
mov edx, dword [esp + 8]
push 0x10005528
push dword [esp - 0x42]
jmp loc.1002d813
Function at 0x100084fa
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx

Function at 0x1000851f
Capabilities:
Packed with generic packer

Disassembly:
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
mov ecx, dword [esp + 8]
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
jmp loc.1002e894

Function at 0x10008746
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0x1001d15e
push edx
call dword [sym.imp.USER32.dll_ValidateRect]
test eax, eax
je 0x1000879f
mov ecx, dword [esp]
lea eax, [esp + 4]
push 1
push edi
add edi, ebx
mov edi, 0xe82d7819
push ecx
push eax
push esi
push 0x100000c2
push 0x1000bb7f
call fcn.10003cc0
mov eax, dword [esi + 0xd0]
xor ebx, ebx
test eax, eax
jbe 0x100087aa
jmp loc.1002fd86

Function at 0x100087c7
Capabilities:
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
push 0x1001c9cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push dword [esp + 0x76]
push 0x10005d50
push 9
jmp loc.1002b952

Function at 0x10008997
Capabilities:
Check os version

Disassembly:
cmp dword [ebp + 0xc], 3
jmp 0x1002cc65
call fcn.1000ef81
and dword [ebp - 0x1c], 0
mov esi, dword [ebp + 0xc]
mov eax, esi
imul eax, dword [ebp + 0x10]
add dword [ebp + 8], eax
and dword [ebp - 4], 0
dec dword [ebp + 0x10]
js 0x10008900
sub dword [ebp + 8], esi
mov ecx, dword [ebp + 8]
call dword [ebp + 0x14]
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
call fcn.1000802d
push eax
xor dword [esp], eax
xor dword [esp], edi
cmp dword [ebp + 0xc], 2
jne 0x10006de2
push dword [ebp + 8]
call fcn.1000b38f
push 0x27
push ebx
push 0x100001d4
push 0x10000f7d
push 0xfffe476
call fcn.10003cc0
mov eax, dword [esp + 4]
mov edx, dword [eax]
push esi
lea esi, [ebx + 0x110]
push esi
push 0x1001c2e5
push eax
call dword [edx]
test eax, eax
jge 0x10008989
push 0x1001c68e
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
call dword [sym.imp.USER32.dll_IsIconic]
cmp eax, edi
je 0x100089e9
push ecx
push 0x40
push 0x10004b60
call 0x100089c8
mov dword [esp + 0xc], 0x1e0
mov eax, dword [ecx + 8]
mov edx, dword [eax]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [edx + 0x74]
mov eax, dword [esp + 8]
test eax, eax
je 0x100089ec
jmp 0x1002ba4a
cmp eax, 0x6f
jmp 0x1002d9ed

Function at 0x10008b15
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push dword [esp - 0x67]
push 4
call fcn.10008b49
mov eax, dword [0x1001d27a]
inc dword [eax]
mov eax, dword [0x1001ccfe]
pop ebx
mov ecx, dword [ebx]
push esi
push 0
push ecx

Function at 0x10008ba0
Capabilities:
Packed with generic packer

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
test esi, esi
mov eax, dword [0x1001c857]
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push 1
push edx
call fcn.1000715d
cmp eax, 0xffffffff
jne 0x10008b3e
push esi
call dword [sym.imp.USER32.dll_DrawTextA]
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]