joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007625
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
lea edi, [ebx + eax + 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [0x1038030]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x100f924
lea eax, [ebp - 4]
push eax
push edi
push esi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov dword [ebp + 0x10], eax
test eax, eax
jl 0x10076e0
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.msvcrt.dll_memmove]
cmp ebx, eax
jb 0x10076ff
mov ebx, dword [ebp + 0x14]
push eax
lea eax, [esi + 0x14]
push eax
push ebx
call edi
mov eax, dword [esi + 0x10]
shr eax, 1
add esp, 0xc
xor ecx, ecx
mov word [ebx + eax*2], cx
cmp dword [ebp + 0x10], 0
jl 0x1007708
mov eax, dword [esi + 0xc]
cmp dword [ebp + 0x18], eax
jb 0x1007708
mov ebx, dword [ebp + 0x1c]
push eax
mov eax, dword [esi + 8]
add eax, esi
push eax
push ebx
call edi
add esp, 0xc
cmp dword [esi + 4], 1
jne 0x10076e0
mov eax, dword [esi + 0xc]
lea ecx, [eax + 2]
cmp ecx, dword [ebp + 0x18]
ja 0x100f92e
mov eax, dword [esi + 0xc]
mov byte [ebx + eax], 0
inc dword [esi + 0xc]
mov eax, dword [esi + 0xc]
mov byte [ebx + eax], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x18
mov dword [ebp + 0x10], 0xc0000023
jmp 0x100769c
mov dword [ebp + 0x10], 0xc0000023
jmp 0x10076e0
mov eax, 0xc0000017
jmp 0x10076f8
add eax, 0xfffffffe
mov dword [esi + 0xc], eax
jmp 0x10076cf

Function at 0x1007d33
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.01007da4
xor esi, esi
cmp eax, esi
jl 0x1007d9a
push esi
push esi
lea eax, [ebp - 0x18]
push eax
push 0x1f0003
push 0x1038084
mov dword [ebp - 0x18], 0x18
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ntdll.dll_NtCreateEvent]
cmp eax, esi
jl 0x1007d9a
push esi
push esi
push dword [ebp + 8]
push 0x100674b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x100fd1f
push eax
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
pop esi
leave
ret 4
mov eax, 0xc0000017
jmp 0x1007d9a
Function at 0x1008171
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x5a
pop eax
push 0x5c
mov word [ebp - 0x138], ax
pop eax
mov word [ebp - 0x136], ax
lea eax, [ebp - 0x138]
mov dword [ebp - 0x150], eax
lea eax, [ebp - 0x158]
push eax
xor esi, esi
push 0x20019
lea eax, [ebp - 0x128]
push eax
mov dword [edi], 0x10000
mov dword [ebp - 0x134], 0x1008350
mov dword [ebp - 0x158], 0x18
mov dword [ebp - 0x154], esi
mov dword [ebp - 0x14c], 0x40
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x144], esi
call dword [sym.imp.ntdll.dll_NtOpenKey]
cmp eax, esi
jl 0x10082f8
push 0x14
pop eax
push 0x16
mov word [ebp - 0x130], ax
pop eax
mov word [ebp - 0x12e], ax
lea eax, [ebp - 0x164]
push eax
push 0x11c
lea eax, [ebp - 0x120]
push eax
push 1
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x128]
mov dword [ebp - 0x12c], 0x1008338
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
push dword [ebp - 0x128]
mov dword [ebp - 0x124], eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x124], esi
jl 0x10082f2
cmp dword [ebp - 0x114], esi
je 0x1011b5b
mov eax, dword [ebp - 0x118]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp + eax - 0x120]
push eax
lea eax, [ebp - 0x140]
push eax
call esi
push 0x100831c
lea eax, [ebp - 0x160]
push eax
call esi
push 0x1008308
lea eax, [ebp - 0x16c]
push eax
call esi
mov esi, dword [sym.imp.ntdll.dll_RtlPrefixUnicodeString]
push 1
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x160]
push eax
call esi
test al, al
jne 0x1011b50
push 1
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x16c]
push eax
call esi
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x10001
add eax, 0x10000
mov dword [edi], eax
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100158a
leave
ret 4
mov dword [edi], 0x40002
jmp 0x10082f2
mov dword [ebp - 0x124], 0xc0000034
jmp 0x10082f2
Function at 0x1008cb0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1f8
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0xdc
push esi
lea eax, [ebp - 0x1e8]
push edi
push eax
mov dword [ebp - 0x1ec], edi
mov dword [ebp - 0x1f4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1e8]
push eax
push edi
mov ebx, 0x1008d28
mov dword [ebp - 0x1f0], edi
mov edi, dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
push ebx
mov word [ebp - 0x1a4], si
call edi
test eax, eax
jne 0x100f450
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100158a
leave
ret
mov esi, 0x8000
xor ecx, ecx
mov dword [ebp - 0x1f8], ecx
cmp dword [0x1038e6c], ecx
jbe 0x100f4c2
mov eax, dword [0x1038e48]
mov dx, word [ebp - 0x13c]
add eax, ecx
cmp dx, word [eax + 8]
jne 0x100f4ab
mov dx, word [ebp - 0x138]
cmp dx, word [eax + 0xa]
jne 0x100f4ab
test byte [ebp - 0x134], 4
je 0x100f49e
test byte [eax], 1
je 0x100f4ab
or dword [eax], esi
inc dword [ebp - 0x1ec]
jmp 0x100f4ab
test byte [eax], 2
je 0x100f4ab
or dword [eax], esi
inc dword [ebp - 0x1f4]
inc dword [ebp - 0x1f8]
mov eax, dword [ebp - 0x1f8]
add ecx, 0x10
cmp eax, dword [0x1038e6c]
jb 0x100f465
inc dword [ebp - 0x1f0]
lea eax, [ebp - 0x1e8]
push eax
push dword [ebp - 0x1f0]
push ebx
call edi
test eax, eax
jne 0x100f455
cmp dword [ebp - 0x1ec], 2
jb 0x1008d17
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [ebp - 0x1f4], ebx
jbe 0x100f500
mov dword [0x1038f2c], edi
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, ebx
je 0x100f58e
cmp eax, esi
jae 0x100f58e
push 0x100f61c
sub esi, eax
push esi
lea eax, [ebp + eax - 0x10c]
push eax
call fcn.010227ca
cmp eax, ebx
jge 0x100f557
push eax
push 0x1011bd8
mov esi, dword [sym.imp.ntdll.dll_DbgPrintEx]
push edi
push 0x70
call esi
push 0x1009bd0
push edi
push 0x70
call esi
add esp, 0x1c
jmp 0x1008d17
push ebx
push ebx
push 3
push ebx
push edi
push SysAllocStringLen
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x1038f24], eax
cmp eax, 0xffffffff
jne 0x100f587
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100f5f0
jmp 0x100f53a
mov eax, edi
jmp 0x1008d19
mov esi, dword [sym.imp.ntdll.dll_DbgPrintEx]
push 0x100f5b0
push edi
push 0x70
call esi
push 0x1009bd0
push edi
push 0x70
call esi
add esp, 0x18
jmp 0x1008d17
Function at 0x1008dbf
Capabilities:
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x220], 0x1008f30
mov dword [ebp - 0x21c], 0x1008f14
mov dword [ebp - 0x218], 0x1008ef4
mov dword [ebp - 0x214], 0x1008ecc
xor edi, edi
mov esi, dword [ebp + edi*8 - 0x21c]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1008e6d
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push dword [ebp + edi*8 - 0x220]
mov dword [ebp - 0x210], 0x208
push 0x1008e78
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x1008e6d
mov eax, dword [ebp - 0x210]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x20e], cx
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
inc edi
cmp edi, 2
jb 0x1008e00
jmp 0x100c64e
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100158a
leave
ret
push 0x104
lea eax, [ebp - 0x20c]
push eax
call 0x101a8c1
jmp 0x1008f50
Function at 0x100a5a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x14
pop ecx
lea eax, [esi + 1]
mul ecx
push edx
push eax
call fcn.01004ee2
test eax, eax
jl 0x100c8d5
mov eax, dword fs:[0x18]
mov ecx, dword [0x1038030]
mov eax, dword [eax + 0x30]
push edi
push dword [ebp - 4]
add ecx, 0x200000
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x100c8df
push ebx
push 1
lea eax, [ebp - 0xc]
push eax
push 0
push 1
lea eax, [ebp - 8]
push eax
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0100a4ce
mov ebx, eax
test ebx, ebx
jl 0x100c8e9
mov eax, dword [ebp - 8]
push dword [esi]
imul eax, eax, 0x14
add eax, edi
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
add eax, edi
mov dword [esi + 0x18], eax
mov eax, dword fs:[0x18]
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov dword [esi], edi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 8
mov eax, 0xc0000095
jmp 0x100a653
mov eax, 0xc0000017
jmp 0x100a652
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x100a64f
Function at 0x100aecb
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [ebp + 0x1c], 0
push esi
je 0x100b58f
mov eax, 0xc0030001
pop esi
pop ebp
ret 0x18
mov ecx, dword [0x1038030]
push dword [ebp + 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
add ecx, 0x240000
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x100c874
push edi
push dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push edi
push esi
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
cmp dword [ebp + 0x18], 0x64
jne 0x100b5e1
cmp dword [0x10383cc], edi
jne 0x100b5e1
mov dword [0x10383cc], esi
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
add eax, 0x1c
push dword [ebp + 0x10]
push eax
call fcn.0100b607
pop edi
test eax, eax
jne 0x100aedb
jmp 0x100c87e
mov eax, 0xc0000017
jmp 0x100aee0
push esi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
and dword [0x10383cc], 0
jmp 0x100c874
Function at 0x100b036
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x2c]
sub esp, 0x14
push ebx
push esi
xor esi, esi
push edi
cmp eax, esi
je 0x100b04d
mov byte [eax], 0
mov eax, dword [ebp + 0x30]
cmp eax, esi
jne 0x100fd6e
mov eax, dword [ebp + 0x34]
cmp eax, esi
je 0x100b062
mov byte [eax], 0
mov eax, dword [ebp + 0x38]
cmp eax, esi
je 0x100b06b
mov dword [eax], esi
movzx edi, byte [ebp + 0x10]
xor ebx, ebx
inc ebx
mov dword [ebp + 0x34], ebx
push ebx
push dword [ebp + 0x28]
lea eax, [ebp + 0x34]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push edi
push esi
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0100af51
cmp eax, esi
jl 0x100b0af
cmp dword [ebp + 0x34], esi
je 0x100b0b6
cmp word [ebp - 0x14], bx
jne 0x100b075
jmp 0x100fd76
pop edi
pop esi
pop ebx
leave
ret 0x34
mov eax, 0xc0000001
jmp 0x100b0af
mov byte [eax], 0
jmp 0x100b058
cmp dword [ebp + 0x2c], esi
je 0x100fd86
lea eax, [ebp - 0x10]
push eax
call fcn.01013e58
jmp 0x100fd98
cmp dword [ebp + 0x30], esi
je 0x100fd96
lea eax, [ebp - 0x10]
push eax
call fcn.01013e02
jmp 0x100fd98
xor eax, eax
mov ecx, dword [ebp + 0x38]
mov edx, dword [ebp - 4]
cmp ecx, esi
je 0x100fda4
mov dword [ecx], edx
mov cx, word [ebp - 6]
cmp cx, si
je 0x100fe11
cmp eax, esi
jne 0x100fe11
cmp dword [ebp - 0x10], esi
jne 0x100fe00
cmp word [ebp - 0xa], 0x12
jne 0x100b075
test edx, 0x4000000
je 0x100febe
mov al, byte [0x1038415]
test al, al
je 0x100fe72
mov dx, cx
shr dx, 8
test dl, dl
je 0x100fe72
push 2
lea eax, [ebp + 0x10]
push eax
push dword [0x1038330]
mov byte [ebp + 0x10], dl
mov byte [ebp + 0x11], cl
jmp 0x100fe9c
cmp word [ebp - 0xa], 0x1b
je 0x100fe11
cmp cx, 0xa
jne 0x100febe
cmp dword [ebp - 0x10], esi
je 0x100b075
mov ecx, dword [ebp + 0x2c]
cmp ecx, esi
je 0x100fe29
cmp eax, esi
jne 0x100fea9
mov ecx, dword [ebp + 0x30]
cmp ecx, esi
je 0x100fe34
cmp eax, esi
jne 0x100feb1
push esi
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
movzx cx, al
cmp cx, word [ebp - 0xa]
jne 0x100b075
mov ecx, dword [ebp - 4]
shr eax, 8
movzx eax, al
mov eax, dword [eax*4 + 0x1038e70]
test ecx, eax
je 0x100b075
not eax
and eax, ecx
test al, 0x1f
jne 0x100b075
jmp 0x100feba
mov edx, dword [0x1038330]
mov byte [ebp + 0x13], cl
test al, al
je 0x100fe96
movsx ax, cl
movzx eax, ax
push eax
push edx
call fcn.010232a1
test eax, eax
je 0x100fe96
mov edx, 0x4e4
push ebx
lea eax, [ebp + 0x13]
push eax
push edx
call fcn.01024157
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
jmp 0x100fec4
mov byte [ecx], bl
mov cx, word [ebp - 0xa]
jmp 0x100febe
movsx ax, byte [ebp - 0xa]
mov byte [ecx], bl
jmp 0x100fea1
mov cx, word [ebp - 6]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
xor eax, eax
jmp 0x100b0af
Function at 0x10127fe
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
test byte [0x10382cc], 0x20
jne 0x101297f
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x101297f
mov eax, dword [0x1038258]
test byte [eax], 1
push esi
push edi
je 0x101286a
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x1012977
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
push eax
push edi
call fcn.01012465
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1012977
push ebx
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1012976
mov esi, dword [0x1038258]
push ebx
push ebx
push dword [esi + 0x50]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [esi + 0x58]
mov eax, dword [esi + 0x40]
push eax
push dword [esi + 0x44]
push 4
push eax
push dword [0x1038268]
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x101296c
push dword [0x1038268]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call edi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1012955
push dword [0x1038268]
call edi
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x101294c
push dword [ebp - 8]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
call edi
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call edi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [ebp - 0x28]
push eax
push 0x18
push dword [ebp - 0x10]
call edi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
lea eax, [ebp - 0x28]
push eax
push 0x18
push dword [ebp - 8]
call edi
push dword [esi + 0x58]
push dword [esi + 0x40]
push dword [esi + 0x44]
push dword [ebp - 0x20]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_GetDIBits]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push ebx
push dword [0x1038260]
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebx
push dword [esi + 0x50]
call dword [sym.imp.ntdll.dll_NtReleaseMutant]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
leave
ret
Function at 0x1014cff
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1014e71
cmp word [ebx + 0x18], 0
je 0x1014e71
mov cx, word [ebp + 0x10]
test cx, cx
jne 0x1014d2d
xor eax, eax
jmp 0x1014e76
cmp word [ebx + 0x10], 0
je 0x1014d54
movsx eax, word [ebx + 0x12]
mov eax, dword [ebx + eax*4 + 0x28]
cmp word [eax], cx
jne 0x1014d54
mov edi, dword [ebp + 0xc]
movzx ecx, cx
lea esi, [eax + 2]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1014e96
xor esi, esi
mov dword [ebp + 8], esi
cmp dword [ebp + 0x14], esi
je 0x1014d86
movzx eax, word [ebx + 0x14]
push 1
push eax
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.01014536
movzx eax, ax
cmp ax, 0xffff
je 0x1014d86
push eax
push ebx
call fcn.010143e5
mov dword [ebp + 8], eax
movzx eax, word [ebx + 0x10]
movzx ecx, word [ebx + 0x18]
inc word [ebx + 0x12]
cmp ax, cx
jge 0x1014d9e
inc eax
mov word [ebx + 0x10], ax
jmp 0x1014dee
movzx eax, word [ebx + 0x12]
cmp ax, cx
jl 0x1014dad
xor eax, eax
mov word [ebx + 0x12], ax
inc word [ebx + 0x16]
movzx eax, word [ebx + 0x16]
cmp ax, cx
jl 0x1014dc0
xor eax, eax
mov word [ebx + 0x16], ax
movsx eax, word [ebx + 0x12]
push dword [ebx + eax*4 + 0x28]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ax, word [ebx + 0x14]
cmp ax, word [ebx + 0x12]
jne 0x1014dee
mov eax, 0xffffffff
mov word [ebx + 0x14], ax
movzx eax, word [ebx + 0x14]
cmp ax, 0xffff
je 0x1014e15
mov cx, word [ebp + 0x10]
cwde
mov eax, dword [ebx + eax*4 + 0x28]
cmp word [eax], cx
jne 0x1014e15
mov edi, dword [ebp + 0xc]
movzx ecx, cx
lea esi, [eax + 2]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1014e1b
push ebx
call fcn.01014cde
movsx eax, word [ebx + 0x12]
lea esi, [ebx + eax*4 + 0x28]
mov eax, dword [ebp + 8]
test eax, eax
je 0x1014e2e
mov dword [esi], eax
jmp 0x1014e96
movzx edi, word [ebp + 0x10]
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea edx, [edi + 2]
push edx
add ecx, 0xc0000
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi], eax
test eax, eax
jne 0x1014e7d
cmp word [ebx + 0x12], ax
jg 0x1014e69
mov ax, word [ebx + 0x10]
mov word [ebx + 0x12], ax
dec word [ebx + 0x12]
dec word [ebx + 0x10]
mov eax, 0xc0000017
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov cx, word [ebp + 0x10]
mov word [eax], cx
mov eax, dword [esi]
push edi
push dword [ebp + 0xc]
inc eax
inc eax
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
or dword [ebx + 8], 2
jmp 0x1014d26
Function at 0x1014f1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x1014f2f
xor eax, eax
jmp 0x1014fae
push esi
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x18]
movzx eax, di
shr eax, 4
xor esi, esi
inc eax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1014f9e
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1014f9e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1014f9e
and edi, 0xf
jmp 0x1014f72
dec edi
lea eax, [eax + esi*2]
movzx esi, word [eax]
inc eax
inc eax
test edi, edi
jne 0x1014f6e
cmp dword [ebp + 0x14], edi
jne 0x1014f84
mov dword [ebx], eax
jmp 0x1014faa
dec dword [ebp + 0x14]
cmp esi, dword [ebp + 0x14]
jbe 0x1014f8f
mov esi, dword [ebp + 0x14]
lea ecx, [esi + esi]
push ecx
push eax
push ebx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x1014faa
xor eax, eax
mov word [ebx + esi*2], ax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x10151bf
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x14
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
call edi
mov esi, eax
test esi, esi
jne 0x10151fa
mov eax, 0xc0000017
jmp 0x10152cc
movzx edx, word [ebp + 0x10]
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edx
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
mov dword [ebp - 4], edx
call edi
mov dword [esi + 0xc], eax
test eax, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
jne 0x101523b
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x10151f0
mov ecx, dword [0x1038030]
push ebx
movzx ebx, word [ebp + 0x18]
push ebx
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
call edi
mov dword [esi + 0x10], eax
test eax, eax
jne 0x101528a
push dword [esi + 0xc]
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
mov eax, 0xc0000017
jmp 0x10152cb
push dword [ebp - 4]
mov ax, word [ebp + 0x10]
push dword [ebp + 0xc]
mov edi, dword [sym.imp.msvcrt.dll_memmove]
push dword [esi + 0xc]
mov word [esi + 8], ax
mov ax, word [ebp + 0x18]
mov word [esi + 0xa], ax
call edi
push ebx
push dword [ebp + 0x14]
push dword [esi + 0x10]
call edi
mov eax, dword [ebp + 8]
add eax, 0x10
mov ecx, dword [eax]
mov dword [esi + 4], eax
mov dword [esi], ecx
mov dword [ecx + 4], esi
add esp, 0x18
mov dword [eax], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x14
Function at 0x1015351
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [eax + 4], ecx
push dword [esi + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
push dword [esi + 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
pop edi
xor eax, eax
pop esi
pop ebp
ret 4