joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa7c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0xa7c5b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0xa7c63
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0xa7cfb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0xa7ca9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0xa7d0a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0xa7cbe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0xa7cd0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0xa7c90
jmp 0xa7cd9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0xa7c90
cmp edi, ebx
jge 0xa7cf0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0xa7c94
jmp 0xa7cf4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0xa7c9d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0xa7d92
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0xa7d92
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0xa7d44
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0xa7d30
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0xa7d92
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0xa7d50
dec eax
mov ecx, 1
xor esi, esi
jmp 0xa7dac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0xa7c5b
test edx, edx
mov dword [esp], ecx
js 0xa7de0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0xa7df0
inc ebp
dec edx
cmp edi, ebp
jne 0xa7dc0
mov edx, 0xffffffff
jmp 0xa7df2
xor edi, edi
jmp 0xa7df5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0xa7da0
and ebp, 3
je 0xa7e28
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0xa7e10
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0xa7e2a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0xa7da0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0xa7e40
jmp 0xa7da0
Function at 0xa8990
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0xa89f5
mov esi, dword [ecx + 4]
mov eax, 0xfffff640
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax + 0xff8]
shr edx, 1
xor edi, edx
mov dword [ecx + eax + 0x1384], edi
add eax, 4
jne 0xa89b0
mov eax, 0x270
jmp 0xa8acf
cmp eax, 0x4e0
jb 0xa8acf
mov esi, dword [ecx + 0x9c4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0x9c8]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 0xff8]
xor edi, edx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0xa8a10
mov esi, dword [ecx + 0xd50]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 + 0xd54]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 + 4]
xor edi, edx
mov dword [ecx + eax*4 + 0x390], edi
inc eax
cmp eax, 0x18c
jne 0xa8a60
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7ffffffe
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ecx], edx
mov eax, dword [ecx + eax*4 + 4]
mov edx, eax
shr edx, 0xb
and edx, dword [ecx + 0x1384]
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor eax, edx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
pop edi
ret
Function at 0xbb020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x20], 0xbf14bd53
mov dword [esp + 0x24], 0x832d8133
mov dword [esp + 0x28], 0x8786852a
mov eax, 0xff5cd55c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0xa32ac4]
xor ecx, eax
mov edx, ecx
not edx
and edx, 0xe5
and ecx, 0x1a
sub ecx, edx
add cl, 5
mov byte [esp + eax + 0xa32ac4], cl
inc eax
cmp eax, 0xff5cd568
jne 0xbb060
mov dword [esp + 0x48], 0x61f47fd6
mov dword [esp + 0x4c], 0x65f463f6
mov dword [esp + 0x50], 0x698767bc
mov dword [esp + 0x54], 0x6dc06b85
mov dword [esp + 0x58], 0x51f36fc1
mov dword [esp + 0x5c], 0x55f853f3
mov dword [esp + 0x60], 0x59f757fe
mov dword [esp + 0x64], 0x5dc85bc9
mov dword [esp + 0x68], 0x41405f84
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xe
xor cl, byte [esp + eax + 0x48]
add cl, 0x90
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 0x24
jne 0xbb0e0
movzx ecx, word [esp + 0x48]
lea eax, [esp + 0x15c]
test cx, cx
je 0xbb121
lea edx, [esp + 0x4a]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xbb110
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0xbb151
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xbb140
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0xbb181
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xbb170
mov word [eax], 0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 0x48], 0x6f6c6c82
mov byte [esp + 0x4c], 0x8c
mov eax, 0xc8
mov ecx, 0xf6d85a37
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x80]
mov edi, eax
xor edi, ecx
and edi, edx
xor edi, ecx
mov edx, 0xbe
sub edx, edi
lea esi, [edi + 0x493d2e41]
or esi, 1
sub esi, edi
lea ebx, [esi - 0x493d2e41]
neg esi
and esi, 2
mov edi, ebx
and edi, 0xfd
imul edi, esi
mov esi, ebx
and esi, 2
or ebx, 2
imul ebx, esi
xor edx, 1
add edx, edi
add edx, ebx
mov byte [esp + eax - 0x80], dl
inc eax
dec ecx
cmp eax, 0xcd
jne 0xbb1b0
movzx eax, byte [esp + 0x48]
test al, al
je 0xbb22d
lea ecx, [esp + 0x49]
mov edi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0xbb220
jmp 0xbb231
mov edi, dword [esp + 4]
mov byte [edi], 0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x38]
lea esi, [esp + 0x15c]
push eax
push ecx
push edx
push esi
call fcn.000aae40
add esp, 0x10
movzx eax, al
mov eax, dword [eax*4 + 0xe3794]
mov ecx, 0xae6ce794
xor ecx, dword [0xe379c]
add eax, ecx
inc eax
jmp eax
Function at 0x3c8060
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov dword [esp], 0x11102ffe
mov eax, esp
mov ecx, 0x21
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [eax]
lea esi, [ecx - 0x225a3100]
or esi, edx
and edx, ecx
lea edi, [esi + esi]
not edi
add edi, esi
or edi, edx
add edi, 0xed2e790f
mov edx, edi
and edx, 1
xor edi, 1
lea edx, [edi + edx*2]
mov byte [eax], dl
inc eax
dec ecx
cmp ecx, 0x1d
jne 0x3c8080
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 4
pop esi
pop edi
ret

Function at 0x3c8e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
movzx edx, byte [esp + eax + 0x698232ac]
xor edx, eax
mov ecx, edx
and ecx, 0x5f
add ecx, ecx
xor edx, 0xa0
sub ecx, edx
mov byte [esp + eax + 0x698232ac], cl
inc eax
cmp eax, 0x967dcd58
jne 0x3c8e80
mov eax, dword [esp]
mov edx, dword [0xe965c]
test edx, edx
je 0x3c8ef8
xor ebx, ebx
mov ecx, dword [0xe9660]
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0x3c8ed0
inc ebx
cmp edx, ebx
jne 0x3c8ec0
jmp 0x3c8ef8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x3c8ef8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0xe9664]
call fcn.003c6a80
add esp, 0x20
test edi, edi
je 0x3c8f02
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x3c8f0e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x3c91d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x3c91f0
sar ebx, 1
mov ecx, ebx
and ecx, 2
mov ebp, ebx
or ebx, 2
imul ebx, ecx
xor ecx, 2
and ebp, 0xfffd
imul ebp, ecx
lea ecx, [ebx + ebp]
mov word [esp + 4], cx
lea ecx, [ebx + ebp]
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0xc8c9cacb
mov eax, 0x967dcd54
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x698232ac]
xor ecx, eax
mov ebx, ecx
and ebx, 0x5f
add ebx, ebx
xor ecx, 0xa0
sub ebx, ecx
mov byte [esp + eax + 0x698232ac], bl
inc eax
cmp eax, 0x967dcd58
jne 0x3c9270
mov eax, dword [esp]
mov edi, dword [0xe965c]
test edi, edi
je 0x3c92e5
xor ebx, ebx
mov ebp, dword [0xe9660]
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0x3c92c1
inc ebx
cmp edi, ebx
jne 0x3c92b0
jmp 0x3c92e5
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x3c92e5
lea eax, [esp + 0xc]
push esi
push eax
push edx
push dword [esp + 0x48]
push 0x10
push edi
push dword [0xe9664]
call fcn.003c6a80
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001e10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.100199e3

Function at 0x10002690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b749
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x102f8750]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 0
call fcn.1001926b
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x100026ea
push 0x80004005
call fcn.10001de0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0
push eax
push 0x32
mov dword [ebp - 0x48], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edi, [ebp - 0x44]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10002712
mov ax, word [0x1016e1c0]
lea ecx, [ebp - 0x44]
mov word [edi], ax
lea edx, [ecx + 1]
jmp 0x10002730
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002730
sub ecx, edx
lea eax, [ebp - 0x44]
push ecx
push eax
mov ecx, esi
call fcn.100020d0
push 0xb
push str.IconLib.mdb
mov ecx, esi
call fcn.10002450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10141c6c
mov esp, ebp
pop ebp
ret 4

Function at 0x100028b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100028c5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10002904
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10002900
lea ebx, [ebx]
cmp esi, edx
jae 0x10002904
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x100028f0
cmp esi, edx
jb 0x10002909
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x100035c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x102f7880
push 0x133000
push 0x101c4018
call fcn.10003de0
push 0x101c4018
call fcn.10003640
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10003606
push dword [ebp + 8]
push ebx
call fcn.100043e0
add esp, 8
test eax, eax
jne 0x1000360b
push ebx
call fcn.100045b0
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
sub esp, 0x848
mov ecx, 0x212
mov edi, esp
mov esi, str.ytl.quanshy.com
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.100045b0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10003c60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b990
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x102f8750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
xor edx, edx
mov eax, dword [esi]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], ecx
movzx eax, word [eax + 6]
cmp edx, eax
jge 0x10003dc6
cmp dword [ecx + 0x10], 0
push 0x101ac4a4
jne 0x10003d27
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x24], 0x36
call fcn.101425c6
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x10003d08
mov esi, dword [ebp - 0x14]
push 4
push 0x1000
push edi
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0
push eax
mov dword [esi + 8], eax
call fcn.10142c80
add esp, 0xc
mov eax, 0x10003d0e
ret
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x28], 0x43
call fcn.101425c6
mov eax, dword [ebp - 0x14]
push 4
push 0x1000
push dword [eax + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
mov eax, 0x10003d61
ret
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003de0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
xor ecx, ecx
test edi, edi
jle 0x10003e2f
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x6d9
jmp 0x10003e00
movsx eax, byte [esi + ebx]
inc esi
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add dl, 0x4f
xor byte [ecx + eax], dl
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [edx + edx*4]
mov edx, ecx
sub edx, eax
neg edx
sbb edx, edx
inc ecx
and esi, edx
cmp ecx, edi
jl 0x10003e00
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10003e40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015b9b0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x102f8750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov ecx, dword [eax]
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x1c], eax
jge 0x10003fb9
mov edx, dword [ecx + 0x24]
mov eax, edx
mov esi, edx
shr eax, 0x1d
shr esi, 0x1e
mov edi, edx
and eax, 1
shr edi, 0x1f
and esi, 1
test edx, 0x2000000
je 0x10003efd
push 0x101ac4a4
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x24], 0x4b
call fcn.101425c6
mov eax, dword [ebp - 0x14]
push 0x4000
push dword [eax + 0x10]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x10003eeb
ret
lea eax, [esi + eax*2]
lea eax, [edi + eax*2]
mov eax, dword [eax*4 + 0x102f7018]
mov dword [ebp - 0x20], eax
test edx, 0x4000000
je 0x10003f1d
or eax, 0x200
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x10003f81
push 0x101ac4a4
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x28], 0x10
call fcn.101425c6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
test al, 0x40
je 0x10003f57
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
jmp 0x10003f63
test al, al
jns 0x10003f66
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x18], eax
mov eax, 0x10003f6c
ret
push 0x101ac4a4
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 4
push eax
mov dword [ebp - 0x2c], 0xf
call fcn.101425c6
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x20]
push dword [eax + 0x10]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10003eeb
ret
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003fd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x102f8750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102fe200]
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x1000400f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x6c656853
push eax
mov dword [ebp - 8], 0x78656c
call fcn.100035c0
add esp, 4
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000403f
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x10004037
push esi
lea eax, [ebp - 0x1c]
push 0x1016e80c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10141c6c
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f982
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x1000f9c7
call fcn.100234e3
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1000f9c7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1000f9e3
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1003683e
mov ebx, eax
test edi, edi
je 0x1000f9e1
test esi, esi
je 0x1000f9e1
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100194c7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.100141e5
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x10019503
call fcn.100196e6
mov dword [esi + 0xc], 1
jmp 0x10019508
call fcn.100196e6
cmp dword [esi], 0
je 0x10019551
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x1001952b
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.1000fa3a
jmp 0x1001953c
push 0xff
mov ecx, esi
call fcn.10001fc0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.10011de0
jmp 0x10019575
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x10019575
push dword [esi]
push dword [ebp - 4]
call fcn.10034671
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001963b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.100196e6
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10019683
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1000fa3a
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.10011de0
jmp 0x1001968e
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10034671
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1001972a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x102f8750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
mov dword [ebp - 0x48], esi
call fcn.100196e6
cmp dword [edi], 0
mov ebx, eax
mov dword [edi + 0xc], 1
je 0x1001979b
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x44]
push 0x40
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
push dword [ebp - 0x48]
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.1014558e
add esp, 0x10
cmp eax, 1
je 0x100197e9
push 0xffffffffffffffff
push 0
push dword [ebp + 0x14]
call fcn.10024b61
mov ecx, edi
call fcn.10019694
jmp 0x100197e9
call fcn.10145105
mov edi, dword [eax]
call fcn.10145105
and dword [eax], 0
lea eax, [ebp + 0x18]
push eax
push esi
push 0x3f
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.10142262
add esp, 0x14
call fcn.10145105
cmp dword [eax], 0
je 0x100197d8
call fcn.10145105
push dword [eax]
call fcn.1000e946
pop ecx
jmp 0x100197df
call fcn.10145105
mov dword [eax], edi
lea eax, [ebp - 0x44]
push eax
push ebx
call fcn.10034671
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10141c6c
mov esp, ebp
pop ebp
ret

Function at 0x10019a3f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.100234e3
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10019a76
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.10019a97
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8