joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x100720ac
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1008c54c]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c54c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x40]
xor eax, eax
mov ecx, 1
mov byte [esp + 0x20], 0x15
mov byte [esp + 0x21], 0x6f
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0xbe
mov byte [esp + 0x24], 0x19
mov byte [esp + 0x25], 0xfb
mov byte [esp + 0x26], 0x1c
mov byte [esp + 0x27], 0x18
mov byte [esp + 0x28], 0xc0
mov byte [esp + 0x14], 0x59
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x4d
mov byte [esp + 0x17], 0xdf
mov byte [esp + 0x18], 0x75
mov byte [esp + 0x19], 0xbd
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x7d
mov byte [esp + 0x1c], 0xa5
test byte [0x100907ac], cl
jne 0x10041734
or dword [0x100907ac], ecx
lea edi, [esp + 0x14]
lea ebx, [esp + 0x20]
mov esi, 0x100907a8
mov dword [esp + 0x38], eax
call fcn.10043850
push 0x100782a0
call fcn.1005f1f6
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov ecx, 1
mov ebx, dword [0x100907a8]
mov al, 0xc6
mov byte [esp + 0x14], 0xf6
mov byte [esp + 0x15], 0x7b
mov byte [esp + 0x16], 0x58
mov byte [esp + 0x17], 0x57
mov byte [esp + 0x18], 0xd4
mov byte [esp + 0x19], 0x90
mov byte [esp + 0x1a], 0x77
mov byte [esp + 0x1b], 0xf4
mov byte [esp + 0x1c], 0xe8
mov byte [esp + 0x1d], 0xad
mov byte [esp + 0x1e], 0x67
mov byte [esp + 0x1f], 0x68
mov byte [esp + 0x20], 0x9d
mov byte [esp + 0x21], 0x1e
mov byte [esp + 0x22], 0x2a
mov byte [esp + 0x23], 0x39
mov byte [esp + 0x24], 0xb1
mov byte [esp + 0x25], 0xfc
mov byte [esp + 0x26], 0x44
mov byte [esp + 0x27], al
mov byte [esp + 0x28], al
mov byte [esp + 0x29], 0xc9
mov byte [esp + 0x2a], 0xb
mov byte [esp + 0x2b], 4
test byte [0x100907b4], cl
jne 0x100417ec
or dword [0x100907b4], ecx
lea eax, [esp + 0x20]
push eax
lea edi, [esp + 0x18]
mov esi, 0x100907b0
mov dword [esp + 0x3c], ecx
call fcn.1002fdb0
push 0x10078290
call fcn.1005f1f6
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [0x100907b0]
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1005f0c0
add esp, 0x28
ret
Function at 0x100425f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x10071e7c
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1008c54c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push edi
mov eax, dword [0x1008c54c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
test byte [0x10090704], 1
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov al, 0x6b
mov byte [esp + 0x20], 0xb5
mov byte [esp + 0x21], al
mov byte [esp + 0x22], 0x3f
mov byte [esp + 0x23], 0x28
mov byte [esp + 0x24], 0xc3
mov byte [esp + 0x25], 0xbf
mov byte [esp + 0x26], 0x3e
mov byte [esp + 0x27], 0xb8
mov byte [esp + 0x28], 0x6a
mov byte [esp + 0x29], 0xce
mov byte [esp + 0x2a], 0xf2
mov byte [esp + 0x14], 0xe7
mov byte [esp + 0x15], 0xe
mov byte [esp + 0x16], 0x58
mov byte [esp + 0x17], al
mov byte [esp + 0x18], 0xaf
mov byte [esp + 0x19], 0xd0
mov byte [esp + 0x1a], 0x4d
mov byte [esp + 0x1b], 0xdd
mov byte [esp + 0x1c], 0x21
mov byte [esp + 0x1d], 0xab
mov byte [esp + 0x1e], 0x8b
mov esi, 1
jne 0x100426dc
or dword [0x10090704], esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
mov edi, 0x10090700
mov dword [esp + 0x40], 0
call fcn.1003a7e0
push 0x100783f0
call fcn.1005f1f6
add esp, 4
mov dword [esp + 0x38], 0xffffffff
test byte [0x1009070c], 1
mov ebp, dword [0x10090700]
mov al, 0x35
mov byte [esp + 0x14], 0x54
mov byte [esp + 0x15], 8
mov byte [esp + 0x16], 0x36
mov byte [esp + 0x17], 0x8f
mov byte [esp + 0x18], al
mov byte [esp + 0x19], 0x58
mov byte [esp + 0x1a], 0x88
mov byte [esp + 0x1b], 0x12
mov byte [esp + 0x1c], 0x2d
mov byte [esp + 0x1d], 0x77
mov byte [esp + 0x1e], 0xf0
mov byte [esp + 0x1f], 0xa8
mov byte [esp + 0x20], al
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x40
mov byte [esp + 0x23], 0xee
mov byte [esp + 0x24], 0x45
mov byte [esp + 0x25], 0x31
mov byte [esp + 0x26], 0xbb
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 3
mov byte [esp + 0x29], 0x13
mov byte [esp + 0x2a], 0x9c
mov byte [esp + 0x2b], 0xc4
jne 0x10042795
or dword [0x1009070c], esi
lea eax, [esp + 0x20]
mov dword [esp + 0x38], esi
push eax
lea edi, [esp + 0x18]
mov esi, 0x10090708
call fcn.1002fdb0
push 0x100783e0
call fcn.1005f1f6
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x10]
mov edx, dword [0x10090708]
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1005f0c0
add esp, 0x2c
ret
Function at 0x10042ca0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10071d8c
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1008c54c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push edi
mov eax, dword [0x1008c54c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
test byte [0x100906cc], 1
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov al, 0x72
mov byte [esp + 0x20], 0x20
mov byte [esp + 0x21], 0x6d
mov byte [esp + 0x22], 0xa7
mov byte [esp + 0x23], 0xca
mov byte [esp + 0x24], 0xb2
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0xe3
mov byte [esp + 0x27], 0x75
mov byte [esp + 0x28], 0xf
mov byte [esp + 0x29], 0x79
mov byte [esp + 0x2a], 0x82
mov byte [esp + 0x14], al
mov byte [esp + 0x15], 8
mov byte [esp + 0x16], 0xc0
mov byte [esp + 0x17], 0x89
mov byte [esp + 0x18], 0xde
mov byte [esp + 0x19], 0x1d
mov byte [esp + 0x1a], 0x90
mov byte [esp + 0x1b], 0x10
mov byte [esp + 0x1c], 0x44
mov byte [esp + 0x1d], 0x1c
mov byte [esp + 0x1e], 0xfb
mov esi, 1
jne 0x10042d8c
or dword [0x100906cc], esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
mov edi, 0x100906c8
mov dword [esp + 0x40], 0
call fcn.1003a7e0
push 0x10078460
call fcn.1005f1f6
add esp, 4
mov dword [esp + 0x38], 0xffffffff
test byte [0x100906d4], 1
mov ebp, dword [0x100906c8]
mov al, 0x29
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0x42
mov byte [esp + 0x16], 0x5f
mov byte [esp + 0x17], 0x7c
mov byte [esp + 0x18], 0x75
mov byte [esp + 0x19], 0xeb
mov byte [esp + 0x1a], 0x57
mov byte [esp + 0x1b], 0x1e
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1d], 0x4d
mov byte [esp + 0x1e], 0xfc
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], 0x61
mov byte [esp + 0x21], 0x26
mov byte [esp + 0x22], al
mov byte [esp + 0x23], 0x1d
mov byte [esp + 0x24], 5
mov byte [esp + 0x25], 0x82
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x27], 0x2c
mov byte [esp + 0x28], 0x5a
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], 0x90
mov byte [esp + 0x2b], 0
jne 0x10042e45
or dword [0x100906d4], esi
lea eax, [esp + 0x20]
mov dword [esp + 0x38], esi
push eax
lea edi, [esp + 0x18]
mov esi, 0x100906d0
call fcn.1002fdb0
push 0x10078450
call fcn.1005f1f6
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x10]
mov edx, dword [0x100906d0]
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1005f0c0
add esp, 0x2c
ret

Function at 0x10042f70
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 0x3c
mov esi, eax
call fcn.1004407f
mov edx, dword [esp + 0x10]
mov dword [0x100906c4], eax
add esp, 4
xor eax, eax
mov ecx, esi
sub edx, esi
lea ecx, [ecx]
mov si, word [edx + ecx]
xor si, word [ecx]
mov edi, dword [0x100906c4]
mov word [eax + edi], si
add eax, 2
add ecx, 2
cmp eax, 0x3a
jb 0x10042f90
mov ecx, dword [0x100906c4]
xor eax, eax
pop edi
mov word [ecx + 0x3a], ax
mov eax, 0x100906c4
pop esi
ret 4
Function at 0x10043080
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 0x28
mov esi, eax
call fcn.1004407f
mov edx, dword [esp + 0x10]
mov dword [0x100906bc], eax
add esp, 4
xor eax, eax
mov ecx, esi
sub edx, esi
lea ecx, [ecx]
mov si, word [edx + ecx]
xor si, word [ecx]
mov edi, dword [0x100906bc]
mov word [eax + edi], si
add eax, 2
add ecx, 2
cmp eax, 0x26
jb 0x100430a0
mov ecx, dword [0x100906bc]
xor eax, eax
pop edi
mov word [ecx + 0x26], ax
mov eax, 0x100906bc
pop esi
ret 4

Function at 0x100430e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push 0x24
mov edi, eax
call fcn.1004407f
mov edx, dword [esp + 0x10]
mov dword [esi], eax
add esp, 4
xor eax, eax
mov ecx, edi
sub edx, edi
lea ebx, [ebx]
mov di, word [edx + ecx]
xor di, word [ecx]
mov ebx, dword [esi]
mov word [eax + ebx], di
add eax, 2
add ecx, 2
cmp eax, 0x22
jb 0x10043100
mov eax, dword [esi]
xor ecx, ecx
pop edi
mov word [eax + 0x22], cx
mov eax, esi
pop ebx
ret 4

Function at 0x10043240
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 0x1c
mov esi, eax
call fcn.1004407f
mov edx, dword [esp + 0x10]
mov dword [0x100906b4], eax
add esp, 4
xor eax, eax
mov ecx, esi
sub edx, esi
lea ecx, [ecx]
mov si, word [edx + ecx]
xor si, word [ecx]
mov edi, dword [0x100906b4]
mov word [eax + edi], si
add eax, 2
add ecx, 2
cmp eax, 0x1a
jb 0x10043260
mov ecx, dword [0x100906b4]
xor eax, eax
pop edi
mov word [ecx + 0x1a], ax
mov eax, 0x100906b4
pop esi
ret 4

Function at 0x10043400
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push 0x18
mov edi, eax
call fcn.1004407f
mov edx, dword [esp + 0x10]
mov dword [esi], eax
add esp, 4
xor eax, eax
mov ecx, edi
sub edx, edi
lea ebx, [ebx]
mov di, word [edx + ecx]
xor di, word [ecx]
mov ebx, dword [esi]
mov word [eax + ebx], di
add eax, 2
add ecx, 2
cmp eax, 0x16
jb 0x10043420
mov eax, dword [esi]
xor ecx, ecx
pop edi
mov word [eax + 0x16], cx
mov eax, esi
pop ebx
ret 4

Function at 0x100436f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0x12
call fcn.1004407f
mov esi, dword [esp + 0x10]
mov dword [edi], eax
add esp, 4
xor eax, eax
sub esi, ebp
lea ebx, [ebx]
lea ecx, [eax + ebp]
mov dl, byte [esi + ecx]
xor dl, byte [ecx]
mov ecx, dword [edi]
mov byte [eax + ecx], dl
inc eax
cmp eax, 0x11
jb 0x10043710
mov edx, dword [edi]
pop esi
mov byte [edx + 0x11], 0
mov eax, edi
pop ebp
ret 8
Function at 0x10043730
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push 0x19
call fcn.1004407f
mov dword [esi], eax
mov ebp, edi
add esp, 4
xor eax, eax
sub ebp, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ebx, dword [esi]
add ecx, eax
movzx edx, byte [ecx + ebp]
xor dl, byte [ecx]
add eax, 6
mov byte [eax + ebx - 6], dl
movzx edx, byte [edi + eax - 5]
xor dl, byte [ecx + 1]
mov ebx, dword [esi]
mov byte [ebx + eax - 5], dl
movzx edx, byte [edi + eax - 4]
xor dl, byte [ecx + 2]
mov ebx, dword [esi]
mov byte [ebx + eax - 4], dl
movzx edx, byte [edi + eax - 3]
xor dl, byte [ecx + 3]
mov ebx, dword [esi]
mov byte [ebx + eax - 3], dl
movzx edx, byte [edi + eax - 2]
xor dl, byte [ecx + 4]
mov ebx, dword [esi]
mov byte [ebx + eax - 2], dl
movzx edx, byte [edi + eax - 1]
xor dl, byte [ecx + 5]
mov ecx, dword [esi]
mov byte [ecx + eax - 1], dl
cmp eax, 0x18
jb 0x10043746
mov edx, dword [esi]
pop ebp
mov byte [edx + 0x18], 0
mov eax, esi
pop ebx
ret 4

Function at 0x100437c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x14
call fcn.1004407f
mov esi, dword [esp + 0xc]
mov dword [0x100906ac], eax
add esp, 4
xor eax, eax
sub esi, edi
lea ecx, [eax + edi]
mov dl, byte [esi + ecx]
xor dl, byte [ecx]
mov ecx, dword [0x100906ac]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x13
jb 0x100437d8
mov edx, dword [0x100906ac]
mov byte [edx + 0x13], 0
mov eax, 0x100906ac
pop esi
ret 4

Function at 0x10043810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0x18
call fcn.1004407f
mov esi, dword [esp + 0x10]
mov dword [edi], eax
add esp, 4
xor eax, eax
sub esi, ebp
lea ebx, [ebx]
lea ecx, [eax + ebp]
mov dl, byte [esi + ecx]
xor dl, byte [ecx]
mov ecx, dword [edi]
mov byte [eax + ecx], dl
inc eax
cmp eax, 0x17
jb 0x10043830
mov edx, dword [edi]
pop esi
mov byte [edx + 0x17], 0
mov eax, edi
pop ebp
ret 8

Function at 0x10043910
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 0x24
mov esi, eax
call fcn.1004407f
mov edx, dword [esp + 0x10]
mov dword [0x10090680], eax
add esp, 4
xor eax, eax
mov ecx, esi
sub edx, esi
lea ecx, [ecx]
mov si, word [edx + ecx]
xor si, word [ecx]
mov edi, dword [0x10090680]
mov word [eax + edi], si
add eax, 2
add ecx, 2
cmp eax, 0x22
jb 0x10043930
mov ecx, dword [0x10090680]
xor eax, eax
pop edi
mov word [ecx + 0x22], ax
mov eax, 0x10090680
pop esi
ret 4

Function at 0x10043a80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x2e
mov ebx, eax
call fcn.1004407f
mov esi, dword [esp + 0x18]
mov edi, 0xfffffffe
add esp, 4
mov dword [0x10090678], eax
xor ecx, ecx
sub esi, ebx
lea eax, [ebx + 2]
sub edi, ebx
jmp 0x10043ab0
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + ecx*2]
xor bx, word [eax - 2]
mov ebp, dword [0x10090678]
lea edx, [edi + eax]
mov word [edx + ebp], bx
movzx ebx, word [esi + eax]
xor bx, word [eax]
mov ebp, dword [0x10090678]
add ecx, 2
add eax, 4
mov word [edx + ebp + 2], bx
cmp ecx, 0x16
jb 0x10043ab0
mov ecx, dword [0x10090678]
pop edi
pop esi
xor eax, eax
pop ebp
mov word [ecx + 0x2c], ax
mov eax, 0x10090678
pop ebx
ret 4
Function at 0x10043b00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x1e
mov ebx, eax
call fcn.1004407f
mov esi, dword [esp + 0x18]
mov edi, 0xfffffffe
add esp, 4
mov dword [0x10090674], eax
xor ecx, ecx
sub esi, ebx
lea eax, [ebx + 2]
sub edi, ebx
jmp 0x10043b30
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + ecx*2]
xor bx, word [eax - 2]
mov ebp, dword [0x10090674]
lea edx, [edi + eax]
mov word [edx + ebp], bx
movzx ebx, word [esi + eax]
xor bx, word [eax]
mov ebp, dword [0x10090674]
add ecx, 2
add eax, 4
mov word [edx + ebp + 2], bx
cmp ecx, 0xe
jb 0x10043b30
mov ecx, dword [0x10090674]
pop edi
pop esi
xor eax, eax
pop ebp
mov word [ecx + 0x1c], ax
mov eax, 0x10090674
pop ebx
ret 4

Function at 0x10043d20
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push 0x18
mov esi, eax
call fcn.1004407f
mov edx, dword [esp + 0x10]
mov dword [0x10090668], eax
add esp, 4
xor eax, eax
mov ecx, esi
sub edx, esi
lea ecx, [ecx]
mov si, word [edx + ecx]
xor si, word [ecx]
mov edi, dword [0x10090668]
mov word [eax + edi], si
add eax, 2
add ecx, 2
cmp eax, 0x16
jb 0x10043d40
mov ecx, dword [0x10090668]
xor eax, eax
pop edi
mov word [ecx + 0x16], ax
mov eax, 0x10090668
pop esi
ret 4

Function at 0x10043ea0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
push 0xa6
mov ebx, eax
call fcn.1004407f
mov esi, dword [esp + 0x18]
mov edi, 0xfffffffe
add esp, 4
mov dword [0x1009065c], eax
xor ecx, ecx
sub esi, ebx
lea eax, [ebx + 2]
sub edi, ebx
lea ebx, [ebx]
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + ecx*2]
xor bx, word [eax - 2]
mov ebp, dword [0x1009065c]
lea edx, [edi + eax]
mov word [edx + ebp], bx
movzx ebx, word [esi + eax]
xor bx, word [eax]
mov ebp, dword [0x1009065c]
add ecx, 2
add eax, 4
mov word [edx + ebp + 2], bx
cmp ecx, 0x52
jb 0x10043ed0
mov ecx, dword [0x1009065c]
pop edi
pop esi
xor eax, eax
pop ebp
mov word [ecx + 0xa4], ax
mov eax, 0x1009065c
pop ebx
ret 4

Function at 0x10049d76
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10049dbd
call fcn.1004d880
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10049dbd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10049dd9
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.100498ee
mov esi, eax
test edi, edi
je 0x10049dd7
test ebx, ebx
je 0x10049dd7
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1004ac04
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x100712e8
call fcn.10060ba0
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1004ac29
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1004ac6f
lea ecx, [ebp - 0x10]
call fcn.100472f6
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1004a473
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100101c0
mov eax, esi
call fcn.10060c78
ret 8

Function at 0x1004bfaa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x1004bff2
call fcn.1004d880
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1004bff2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x1004c035
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x1004c01e
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x1004c01e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x1004c032
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1005f0c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008c54c]
jne 0x1005f0ca
repz ret
jmp fcn.1006238f

Function at 0x1006a447
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10062507
and dword [ebp - 4], 0
cmp dword [0x100905cc], 0
mov ebx, eax
jne 0x1006a4f8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1006a5a9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1006a5a9
push eax
call fcn.10062495
mov dword [esp], 0x1007d480
push edi
mov dword [0x100905cc], eax
call esi
push eax
call fcn.10062495
mov dword [esp], 0x1007d46c
push edi
mov dword [0x100905d0], eax
call esi
push eax
call fcn.10062495
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100905d4], eax
call esi
push eax
call fcn.10062495
pop ecx
mov dword [0x100905dc], eax
test eax, eax
je 0x1006a4f8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10062495
pop ecx
mov dword [0x100905d8], eax
mov eax, dword [0x100905d8]
cmp eax, ebx
je 0x1006a550
cmp dword [0x100905dc], ebx
je 0x1006a550
push eax
call fcn.10062510
push dword [0x100905dc]
mov esi, eax
call fcn.10062510
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1006a550
test edi, edi
je 0x1006a550
call esi
test eax, eax
je 0x1006a547
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1006a547
test byte [ebp - 0xc], 1
jne 0x1006a550
or dword [ebp + 0x10], 0x200000
jmp 0x1006a589
mov eax, dword [0x100905d0]
cmp eax, ebx
je 0x1006a589
push eax
call fcn.10062510
pop ecx
test eax, eax
je 0x1006a589
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1006a589
mov eax, dword [0x100905d4]
cmp eax, ebx
je 0x1006a589
push eax
call fcn.10062510
pop ecx
test eax, eax
je 0x1006a589
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100905cc]
call fcn.10062510
pop ecx
test eax, eax
je 0x1006a5a9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1006a5ab
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10105ea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1017b074]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10105f5c
cmp byte [esi + 0x3d], 0
je 0x10105f5c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10105f4a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10105f11
sub eax, 1
je 0x10105f15
sub eax, 2
jne 0x10105f4a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10140300
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10105f33
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10105f4a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10140300
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10140300
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10140300
mov esp, ebp
pop ebp
ret