joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eb78]
and eax, dword [0x1047eb00]
mov dword [0x1047eb18], eax
push str.fuckyou
call fcn.10005b10
add esp, 4
mov ecx, dword [0x1047eb40]
sub ecx, dword [0x101a2310]
mov dword [0x1047eb78], ecx
mov edx, dword [0x101a23a4]
add edx, dword [0x1047ebb4]
mov dword [0x101a22f4], edx
mov eax, dword [0x101a23c8]
sub eax, dword [0x101a2358]
mov dword [0x1047ebb0], eax
mov ecx, dword [0x1047eb0c]
imul ecx, dword [0x101a23d0]
mov dword [0x101a230c], ecx
mov edx, dword [0x1047eb14]
sub edx, dword [0x101a2378]
mov dword [0x101a2340], edx
mov eax, dword [0x1047eb98]
and eax, dword [0x1047eb74]
mov dword [0x101a23d8], eax
push 0
call fcn.1012b5f8
mov ecx, dword [0x1047eba4]
and ecx, dword [0x101a234c]
mov dword [0x1047eb7c], ecx
xor eax, eax
jmp 0x10016267
pop ebp
ret

Function at 0x10016270
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eb5c]
imul eax, dword [0x1047eb5c]
mov dword [0x101a23a4], eax
mov ecx, dword [0x1047eb70]
imul ecx, dword [0x101a23e4]
mov dword [0x1047eb18], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x1047eb2c]
sub edx, dword [0x101a23cc]
mov dword [0x101a235c], edx
mov eax, dword [0x1047eb74]
add eax, dword [0x101a231c]
mov dword [0x101a2328], eax
mov ecx, dword [0x1047eb8c]
imul ecx, dword [0x1047eb6c]
mov dword [0x101a23d4], ecx
mov edx, dword [0x101a236c]
sub edx, dword [0x101a2368]
mov dword [0x101a22fc], edx
mov eax, dword [0x101a2370]
and eax, dword [0x101a23c0]
mov dword [0x1047eb98], eax
push 0
call fcn.1012b5f8
mov ecx, dword [0x101a22f4]
and ecx, dword [0x1047eb7c]
mov dword [0x101a232c], ecx
mov edx, dword [0x101a23c0]
sub edx, dword [0x101a2320]
mov dword [0x1047eaf4], edx
xor eax, eax
jmp 0x10016381
pop ebp
ret
Function at 0x10016390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eb00]
add eax, dword [0x101a2318]
mov dword [0x101a2314], eax
mov ecx, dword [0x101a2350]
add ecx, dword [0x101a22fc]
mov dword [0x1047eb44], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x101a2370]
sub edx, dword [0x1047ebac]
mov dword [0x101a2360], edx
mov eax, dword [0x1047eb38]
sub eax, dword [0x101a23d4]
mov dword [0x1047ebac], eax
mov ecx, dword [0x101a23a0]
and ecx, dword [0x101a239c]
mov dword [0x101a22f0], ecx
mov edx, dword [0x101a23d4]
add edx, dword [0x101a233c]
mov dword [0x1047eaf0], edx
mov eax, dword [0x101a238c]
and eax, dword [0x101a23ec]
mov dword [0x101a23d0], eax
mov ecx, dword [0x101a2350]
sub ecx, dword [0x101a2328]
mov dword [0x101a23cc], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x1047eb74]
add edx, dword [0x1047eb34]
mov dword [0x1047eb38], edx
mov eax, dword [0x1047eaf4]
imul eax, dword [0x1047eb84]
mov dword [0x1047eb68], eax
mov ecx, dword [0x101a22ec]
imul ecx, dword [0x1047ebb8]
mov dword [0x101a232c], ecx
mov edx, dword [0x101a239c]
add edx, dword [0x101a236c]
mov dword [0x101a23c0], edx
mov eax, dword [0x101a237c]
sub eax, dword [0x1047eb0c]
mov dword [0x1047eb5c], eax
mov ecx, dword [0x101a2314]
and ecx, dword [0x1047eb20]
mov dword [0x1047eb6c], ecx
mov edx, dword [0x1047eb64]
sub edx, dword [0x101a23b8]
mov dword [0x101a23e8], edx
mov eax, dword [0x101a2354]
add eax, dword [0x1047eafc]
mov dword [0x1047eb48], eax
xor eax, eax
jmp 0x100164d3
pop ebp
ret

Function at 0x100164e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a2318]
add eax, dword [0x101a2340]
mov dword [0x101a23c0], eax
mov ecx, dword [0x1047eb2c]
sub ecx, dword [0x101a23ec]
mov dword [0x101a2328], ecx
mov edx, dword [0x1047eb94]
and edx, dword [0x101a22f8]
mov dword [0x101a2394], edx
mov eax, dword [0x101a2320]
and eax, dword [0x101a23cc]
mov dword [0x101a2388], eax
mov ecx, dword [0x101a236c]
add ecx, dword [0x1047eb58]
mov dword [0x101a23d8], ecx
mov edx, dword [0x1047eaf0]
imul edx, dword [0x1047eaf0]
mov dword [0x101a23cc], edx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov eax, dword [0x101a233c]
add eax, dword [0x1047eb54]
mov dword [0x101a234c], eax
mov ecx, dword [0x1047eb58]
and ecx, dword [0x101a2384]
mov dword [0x101a23c8], ecx
mov edx, dword [0x1047eb94]
add edx, dword [0x1047eb3c]
mov dword [0x101a23bc], edx
mov eax, dword [0x1047eafc]
imul eax, dword [0x101a230c]
mov dword [0x1047eb84], eax
push 0
call fcn.1012b5f8
mov ecx, dword [0x101a2304]
sub ecx, dword [0x101a230c]
mov dword [0x101a23a4], ecx
mov edx, dword [0x1047eaf0]
imul edx, dword [0x101a2324]
mov dword [0x1047eb7c], edx
mov eax, dword [0x101a23b4]
and eax, dword [0x101a2344]
mov dword [0x101a2394], eax
mov ecx, dword [0x101a23bc]
add ecx, dword [0x101a2318]
mov dword [0x101a2364], ecx
mov edx, dword [0x101a23d0]
and edx, dword [0x101a230c]
mov dword [0x101a23b4], edx
mov eax, dword [0x101a23bc]
imul eax, dword [0x1047eb28]
mov dword [0x1047eb28], eax
xor eax, eax
jmp 0x10016626
pop ebp
ret
Function at 0x10016630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a23ac]
and eax, dword [0x101a231c]
mov dword [0x101a23e0], eax
push str.fuckyou
call fcn.10005b10
add esp, 4
mov ecx, dword [0x101a234c]
and ecx, dword [0x101a23d8]
mov dword [0x101a23c4], ecx
mov edx, dword [0x101a238c]
sub edx, dword [0x1047eb30]
mov dword [0x1047eb38], edx
push 0
call fcn.1012b5f8
mov eax, dword [0x1047eb18]
and eax, dword [0x1047eaf8]
mov dword [0x1047eb88], eax
mov ecx, dword [0x101a2370]
imul ecx, dword [0x101a22f4]
mov dword [0x101a23d4], ecx
mov edx, dword [0x1047eb8c]
imul edx, dword [0x1047eb04]
mov dword [0x1047eb20], edx
mov eax, dword [0x101a2314]
add eax, dword [0x1047eb48]
mov dword [0x1047eb8c], eax
mov ecx, dword [0x1047eb6c]
imul ecx, dword [0x101a23b0]
mov dword [0x101a230c], ecx
mov edx, dword [0x101a2374]
sub edx, dword [0x101a2350]
mov dword [0x101a232c], edx
mov eax, dword [0x101a23b8]
and eax, dword [0x101a2300]
mov dword [0x101a23f0], eax
mov ecx, dword [0x1047eb90]
and ecx, dword [0x1047eb30]
mov dword [0x101a236c], ecx
xor eax, eax
jmp 0x10016776
pop ebp
ret

Function at 0x10016780
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a232c]
and eax, dword [0x1047eb1c]
mov dword [0x101a234c], eax
mov ecx, dword [0x1047eb5c]
sub ecx, dword [0x101a23e8]
mov dword [0x101a23d0], ecx
mov edx, dword [0x101a2388]
and edx, dword [0x1047eb4c]
mov dword [0x1047eb70], edx
mov eax, dword [0x101a234c]
and eax, dword [0x1047eb90]
mov dword [0x101a2384], eax
push str.fuckyou
call fcn.10005b10
add esp, 4
mov ecx, dword [0x101a2398]
add ecx, dword [0x101a2344]
mov dword [0x1047eb74], ecx
mov edx, dword [0x101a2394]
add edx, dword [0x101a2314]
mov dword [0x101a233c], edx
mov eax, dword [0x101a2320]
and eax, dword [0x101a2370]
mov dword [0x1047eafc], eax
mov ecx, dword [0x101a2394]
imul ecx, dword [0x1047eba8]
mov dword [0x101a2364], ecx
mov edx, dword [0x101a2388]
sub edx, dword [0x101a23b8]
mov dword [0x1047ebb0], edx
mov eax, dword [0x101a23f0]
add eax, dword [0x101a23d8]
mov dword [0x1047ebb8], eax
mov ecx, dword [0x101a2378]
add ecx, dword [0x101a2334]
mov dword [0x1047eaf8], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x101a23b0]
sub edx, dword [0x101a237c]
mov dword [0x101a22f8], edx
mov eax, dword [0x101a2388]
add eax, dword [0x1047eb04]
mov dword [0x101a23cc], eax
mov ecx, dword [0x1047eb00]
imul ecx, dword [0x101a2388]
mov dword [0x1047eb64], ecx
xor eax, eax
jmp 0x10016909
pop ebp
ret
Function at 0x10016910
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a232c]
imul eax, dword [0x101a23a0]
mov dword [0x1047eb8c], eax
mov ecx, dword [0x1047eb24]
and ecx, dword [0x1047eb8c]
mov dword [0x1047eb4c], ecx
mov edx, dword [0x101a235c]
add edx, dword [0x101a2380]
mov dword [0x101a233c], edx
mov eax, dword [0x101a235c]
and eax, dword [0x101a2338]
mov dword [0x1047eb84], eax
push str.fuckyou
call fcn.10005b10
add esp, 4
mov ecx, dword [0x101a22f8]
add ecx, dword [0x101a23b0]
mov dword [0x101a23e8], ecx
mov edx, dword [0x101a2394]
imul edx, dword [0x1047eb10]
mov dword [0x101a23cc], edx
mov eax, dword [0x101a2390]
imul eax, dword [0x101a23ec]
mov dword [0x101a2340], eax
mov ecx, dword [0x1047eb14]
and ecx, dword [0x1047eb18]
mov dword [0x1047eaf4], ecx
mov edx, dword [0x1047eb70]
sub edx, dword [0x101a23b8]
mov dword [0x101a23dc], edx
mov eax, dword [0x101a23c0]
and eax, dword [0x101a22f0]
mov dword [0x101a239c], eax
push 0
call fcn.1012b5f8
mov ecx, dword [0x101a23a0]
imul ecx, dword [0x1047eb70]
mov dword [0x1047eba0], ecx
mov edx, dword [0x101a239c]
add edx, dword [0x1047eb88]
mov dword [0x101a22e8], edx
mov eax, dword [0x1047eb38]
sub eax, dword [0x101a2390]
mov dword [0x1047eb44], eax
xor eax, eax
jmp 0x10016a55
pop ebp
ret
Function at 0x10016a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a2318]
sub eax, dword [0x101a23bc]
mov dword [0x101a2348], eax
mov ecx, dword [0x101a2320]
and ecx, dword [0x1047eb38]
mov dword [0x1047eaf8], ecx
mov edx, dword [0x101a2320]
sub edx, dword [0x1047eb40]
mov dword [0x1047eb78], edx
mov eax, dword [0x1047eb2c]
and eax, dword [0x101a233c]
mov dword [0x101a22e8], eax
mov ecx, dword [0x101a23c0]
add ecx, dword [0x101a23bc]
mov dword [0x101a23bc], ecx
mov edx, dword [0x101a23a0]
imul edx, dword [0x101a23e4]
mov dword [0x1047eb78], edx
mov eax, dword [0x101a2314]
imul eax, dword [0x1047ebb8]
mov dword [0x101a2368], eax
mov ecx, dword [0x101a2368]
imul ecx, dword [0x101a2320]
mov dword [0x1047eb9c], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x1047eb10]
imul edx, dword [0x1047eb9c]
mov dword [0x1047eb58], edx
mov eax, dword [0x1047eb04]
imul eax, dword [0x1047eb58]
mov dword [0x1047ebb4], eax
mov ecx, dword [0x101a23a4]
add ecx, dword [0x1047eb7c]
mov dword [0x1047ebb4], ecx
mov edx, dword [0x1047eaf8]
sub edx, dword [0x1047eb5c]
mov dword [0x101a23bc], edx
mov eax, dword [0x101a2300]
and eax, dword [0x1047eb64]
mov dword [0x1047eb44], eax
push 0
call fcn.1012b5f8
mov ecx, dword [0x101a239c]
add ecx, dword [0x101a2324]
mov dword [0x101a232c], ecx
mov edx, dword [0x101a2304]
imul edx, dword [0x1047eb28]
mov dword [0x101a236c], edx
mov eax, dword [0x101a2330]
sub eax, dword [0x101a23f0]
mov dword [0x101a230c], eax
mov ecx, dword [0x1047eb54]
add ecx, dword [0x1047eb08]
mov dword [0x101a238c], ecx
mov edx, dword [0x101a22f4]
imul edx, dword [0x101a23ac]
mov dword [0x1047eb54], edx
mov eax, dword [0x101a23b8]
imul eax, dword [0x101a23f0]
mov dword [0x101a2340], eax
mov ecx, dword [0x101a239c]
add ecx, dword [0x101a230c]
mov dword [0x101a2340], ecx
mov edx, dword [0x1047eb44]
sub edx, dword [0x1047eb54]
mov dword [0x1047eb94], edx
mov eax, dword [0x101a2304]
sub eax, dword [0x101a2348]
mov dword [0x101a2380], eax
xor eax, eax
jmp 0x10016c8f
pop ebp
ret
Function at 0x10021104
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], esi
je 0x10021149
call fcn.1001ae58
mov ebx, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10021149
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10021165
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.10029c4d
mov ebx, eax
test edi, edi
je 0x10021163
test esi, esi
je 0x10021163
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1002581f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x1014b5bd
call fcn.1012c1fb
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x6c], esi
jne 0x10025845
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10025899
call fcn.1001ca13
push eax
lea ecx, [ebp - 0x10]
call fcn.1001ab91
mov ecx, dword [edi + 0x6c]
lea edx, [ebp - 0x10]
mov eax, dword [ecx]
push edx
mov dword [ebp - 4], esi
call dword [eax + 0x8c]
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push edi
call fcn.1012c1ae
push eax
call fcn.1001a37f
add esp, 0x14
test edi, edi
je 0x1002588c
push edi
call fcn.1012c360
pop ecx
mov esi, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.1001b03d
mov eax, esi
call fcn.1012c1c9
ret 8

Function at 0x10027520
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
mov ecx, dword [esi + 4]
push eax
push dword [ebp + 0xc]
call fcn.100257ae
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x1002755c
call fcn.1002773b
mov dword [esi + 0xc], 1
jmp 0x10027561
call fcn.1002773b
cmp dword [esi], 0
je 0x100275aa
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x10027584
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.1001b61f
jmp 0x10027595
push 0xff
mov ecx, esi
call fcn.1001afcd
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.1001b642
jmp 0x100275ce
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x100275ce
push dword [esi]
push dword [ebp - 4]
call fcn.10026d1a
pop esi
leave
ret 0xc
Function at 0x10027692
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.1002773b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x100276da
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1001b61f
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1001b642
jmp 0x100276e5
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10026d1a
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1002c7b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebx + 0x78], edi
test edi, 0xffff0000
jne 0x1002c7d5
cmp dword [ebx + 0x74], 0
jne 0x1002c7d5
movzx eax, di
mov dword [ebx + 0x74], eax
call fcn.1001ae58
mov esi, dword [eax + 0xc]
push 5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1002ca3b
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1002c80f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.1001ae58
mov ebx, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1002c846
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.1002c865
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1003cb9e
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10074130
call fcn.1001aea6
cmp dword [eax + 0x14], 0
jne 0x1003cbb9
mov ecx, esi
pop esi
jmp fcn.1003bfbd
pop esi
ret

Function at 0x1003d8ca
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.101065dd
call fcn.1001aea6
cmp dword [eax + 0x14], 0
jne 0x1003d8e5
mov ecx, esi
pop esi
jmp fcn.1003d1bd
pop esi
ret
Function at 0x100467bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test esi, esi
jne 0x100467d3
call fcn.1001ae58
mov esi, dword [eax + 0xc]
push 0x1015f480
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x10046829
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10046828
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x10046809
xor esi, esi
jmp 0x1004681f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.1004682f
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1010d677
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
test byte [esi + 4], 1
push edi
mov dword [ebp - 4], ebx
je 0x1010d691
mov edi, dword [esi + 0xc]
jmp 0x1010d6d1
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1010d6aa
call fcn.10028275
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x1010d6bf
call fcn.10028275
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x1010d6d1
call fcn.10028275
call fcn.1001ae58
cmp dword [eax + 0x3c], 0
je 0x1010d6e6
push edi
mov ecx, ebx
call fcn.1010cf0b
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.1010d8a9
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x7c]
test ecx, ecx
je 0x1010d709
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x7c], 0
test ebx, ebx
je 0x1010d712
mov edi, ebx
mov dword [eax + 0x7c], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1013ee45
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10483448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.101335c4
mov dword [ebp - 0x14], eax
cmp dword [0x1048b028], edi
jne 0x1013ef36
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1013eec3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1013f016
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1013f016
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1013f016
push eax
call ebx
push 0x10181a64
push esi
mov dword [0x1048b028], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10181a74
push esi
mov dword [0x1048b02c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x1048b030], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1048b038], eax
test eax, eax
je 0x1013ef33
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1048b034], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1013ef5b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1013ef4e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1013ef70
push 4
pop eax
jmp 0x1013f018
cmp dword [ebp - 0x14], edi
je 0x1013ef70
push dword [0x1048b028]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1013ef55
mov eax, dword [0x1048b034]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1013efce
cmp dword [0x1048b038], esi
je 0x1013efce
push eax
call ebx
push dword [0x1048b038]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1013efce
test eax, eax
je 0x1013efce
call ecx
test eax, eax
je 0x1013efc3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1013efc3
test byte [ebp - 8], 1
jne 0x1013efce
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1013effe
mov eax, dword [0x1048b02c]
cmp eax, esi
je 0x1013effb
push eax
call ebx
test eax, eax
je 0x1013effb
call eax
mov edi, eax
test edi, edi
je 0x1013effb
mov eax, dword [0x1048b030]
cmp eax, esi
je 0x1013effb
push eax
call ebx
test eax, eax
je 0x1013effb
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1048b028]
call ebx
test eax, eax
je 0x1013f016
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1013f018
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10129f9e
leave
ret
Function at 0x42dd20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x424015
lea edi, [esi - 0x23015]
push edi
or ebp, 0xffffffff
jmp 0x42dd42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42dd49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42dd38
mov eax, 1
add ebx, ebx
jne 0x42dd5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42dd50
jne 0x42dd6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42dd50
xor ecx, ecx
sub eax, 3
jb 0x42dd80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ddf2
mov ebp, eax
add ebx, ebx
jne 0x42dd8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42dd98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ddbc
inc ecx
add ebx, ebx
jne 0x42dda8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42dd9d
jne 0x42ddb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42dd9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42dddc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ddcd
jmp 0x42dd3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42dddc
add edi, ecx
jmp 0x42dd3e
pop esi
mov edi, esi
mov ecx, 0x912
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ddfa
cmp byte [edi], 6
jne 0x42ddfa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ddff
lea edi, [esi + 0x2b000]
mov eax, dword [edi]
or eax, eax
je 0x42de6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2d000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2d050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42de2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2d054]
or eax, eax
je 0x42de68
mov dword [ebx], eax
add ebx, 4
jmp 0x42de49
call dword [esi + 0x2d064]
mov ebp, dword [esi + 0x2d058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42dea2
sub esp, 0xffffff80
jmp 0x415f10