joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a98
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x405ab9
mov ecx, dword [0x42371c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x423f78]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x422ee0
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405adb
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
je 0x405c96
jmp 0x405aed
mov cl, byte [ebp + 0xf]
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405c96
inc ebx
cmp cl, 0xfc
jbe 0x405c7c
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, ecx
mov dword [ebp - 0xc], eax
or ch, 0x80
or ah, 0x80
inc ebx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
jne 0x405c27
cmp dword [0x423fc4], 0
push 2
pop esi
je 0x405b4c
push 4
pop esi
test dl, dl
jns 0x405b87
mov eax, edx
and edx, 0x3f
add edx, dword [0x423f78]
and eax, 0x40
push eax
push edi
push edx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.0040595d
cmp byte [edi], 0
jne 0x405c0e
push dword [ebp - 0xc]
push edi
call fcn.00405a98
jmp 0x405c09
cmp edx, 0x25
jne 0x405b9a
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405c09
cmp edx, 0x24
jne 0x405c05
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor esi, esi
jmp 0x405c05
mov eax, dword [0x423f44]
dec esi
test eax, eax
je 0x405bce
push edi
push 0
push 0
push dword [ebp + esi*4 - 0x14]
push dword [0x423f48]
call eax
test eax, eax
je 0x405c09
lea eax, [ebp - 4]
push eax
push dword [ebp + esi*4 - 0x14]
push dword [0x423f48]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405c02
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp + 0xc], 0
jne 0x405c09
and byte [edi], 0
test esi, esi
jne 0x405baf
cmp byte [edi], 0
je 0x405c1f
cmp dword [ebp - 0xc], 0x1a
jne 0x405c1f
push str.MicrosoftInternet_ExplorerQuick_Launch
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405caf
jmp 0x405c6d
cmp byte [ebp + 0xf], 0xfd
jne 0x405c5b
cmp esi, 0x1d
jne 0x405c40
push dword [0x423f48]
push edi
call fcn.004059d4
jmp 0x405c51
mov eax, esi
shl eax, 0xa
add eax, 0x424000
push eax
push edi
call fcn.00405a76
add esi, 0xffffffeb
cmp esi, 7
jae 0x405c6d
jmp 0x405c1f
cmp byte [ebp + 0xf], 0xff
jne 0x405c6d
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00405a98
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x422ee0
jmp 0x405c89
jne 0x405c86
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405c89
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405aea
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405cab
push eax
push dword [ebp + 8]
call fcn.00405a76
leave
ret 8
Function at 0x100015d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x404
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
mov edi, dword [esp + 0x410]
mov eax, dword [edi + 4]
cmp eax, 0x100
mov esi, ecx
je 0x10001619
cmp eax, 0x104
je 0x10001619
cmp eax, 0x101
je 0x10001619
cmp eax, 0x105
je 0x10001619
push edi
call fcn.100618f8
jmp 0x10001704
push ebx
push 0x1fe
lea eax, [esp + 0x212]
push 0
push eax
mov word [esp + 0x218], 0
call fcn.100736a0
mov ecx, dword [edi + 8]
push ecx
lea edx, [esp + 0x21c]
push 0x100989c8
push edx
call fcn.10001000
add esp, 0x18
lea eax, [esp + 0x20c]
push eax
mov ecx, esi
call fcn.10066bfb
mov ecx, dword [esi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffff
push 0xffff
push 0xb1
push ecx
call ebx
mov edx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push edx
call ebx
push 0x1fe
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.100736a0
mov edx, dword [edi + 0xc]
add esp, 0xc
push 0x100
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100016c0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x54]
call fcn.10001460
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.1006351e
mov edx, dword [esi + 0x20]
mov eax, dword [eax + 0x20]
push 0
push edx
push 0x466
push eax
call ebx
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.1007368d
add esp, 0x404
ret 4

Function at 0x10001b90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001ba9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001be4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001be0
lea ebx, [ebx]
cmp esi, eax
jae 0x10001be4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001bd0
cmp esi, eax
jb 0x10001bea
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10001de0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp method.DialogBind.virtual_312
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x10067b1e
cmp dword [edi + 0x54], 0
jne 0x10067b1e
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.10068be3
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.10067ac5
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x10003700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1008d038
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100bbef4]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov edi, ecx
call fcn.1006759b
lea eax, [esp + 0x18]
push eax
call fcn.10047d30
add esp, 4
push 1
lea ecx, [esp + 0x20]
push ecx
xor esi, esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x74], esi
call fcn.100029b0
mov eax, dword [eax]
push eax
call fcn.10073ecc
mov ebp, eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10003789
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [edi + 0x5f8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x10098f64
push esi
push 0x143
push ecx
call ebx
cmp ebp, 7
jge 0x100037bc
mov edx, dword [edi + 0x5f8]
push 0x10098f60
push esi
push 0x143
push edx
call ebx
mov eax, dword [edi + 0x5f8]
push 0x10098f5c
push esi
push 0x143
push eax
call ebx
cmp ebp, 7
jge 0x10003839
mov ecx, dword [edi + 0x5f8]
push 0x10098f58
push esi
push 0x143
push ecx
call ebx
mov edx, dword [edi + 0x5f8]
push 0x10098f54
push esi
push 0x143
push edx
call ebx
mov eax, dword [edi + 0x5f8]
push 0x10098f50
push esi
push 0x143
push eax
call ebx
mov ecx, dword [edi + 0x5f8]
push 0x10098f4c
push esi
push 0x143
push ecx
call ebx
mov edx, dword [edi + 0x5f8]
push str.76543210
push esi
push 0x143
push edx
call ebx
mov eax, dword [edi + 0x5f8]
push 0x10098f40
push esi
push 0x143
push eax
call ebx
mov ecx, dword [edi + 0x5f8]
push 0x10098f38
push esi
push 0x143
push ecx
call ebx
mov edx, dword [edi + 0x5f8]
push 0x10098f30
push esi
push 0x143
push edx
call ebx
mov eax, dword [edi + 0x5f8]
push 0x10098f28
push esi
push 0x143
push eax
call ebx
call fcn.10040920
test eax, eax
je 0x100038a6
mov ecx, dword [edi + 0x5f8]
push 0x10098f20
push esi
push 0x143
push ecx
call ebx
mov edx, dword [edi + 0x5f8]
push esi
push esi
push 0x14e
push edx
call ebx
push str.normal
push 0x457
mov ecx, edi
mov dword [edi + 0x78], esi
mov dword [edi + 0x7c], esi
call fcn.10066af9
mov ecx, eax
call fcn.10066bfb
push str.normal
push 0x3e9
mov ecx, edi
call fcn.10066af9
mov ecx, eax
call fcn.10066bfb
push str.normal
push 0x3ea
mov ecx, edi
call fcn.10066af9
mov ecx, eax
call fcn.10066bfb
jmp 0x10106d16

Function at 0x10006210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.1006759b
xor esi, esi
mov dword [edi + 0x78], esi
jmp loc.10107032
Function at 0x100075b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.1006759b
push 1
mov ecx, edi
call fcn.10062e74
lea ebx, [edi + 0x74]
push str.normal
push ebx
call fcn.10005140
add esp, 8
xor esi, esi
test al, al
je 0x100075f4
mov dword [edi + 0x5d8], esi
jmp 0x1000774e
push 0x10099654
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x10007615
mov dword [edi + 0x5d8], 1
jmp 0x1000774e
push str.gdi2
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x10007636
mov dword [edi + 0x5d8], 2
jmp 0x1000774e
push str.dx.graphic.2d
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x10007657
mov dword [edi + 0x5d8], 3
jmp 0x1000774e
push str.dx.graphic.2d.2
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x10007678
mov dword [edi + 0x5d8], 4
jmp 0x1000774e
push 0x10099604
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x10007699
mov dword [edi + 0x5d8], 5
jmp 0x1000774e
push 0x100995fc
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x100076ba
mov dword [edi + 0x5d8], 6
jmp 0x1000774e
push str.dx.graphic.3d
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x100076d8
mov dword [edi + 0x5d8], 7
jmp 0x1000774e
push str.dx.graphic.3d.8
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x100076f6
mov dword [edi + 0x5d8], 8
jmp 0x1000774e
push str.dx.graphic.opengl
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x10007714
mov dword [edi + 0x5d8], 9
jmp 0x1000774e
push str.dx.graphic.opengl.esv2
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x10007732
mov dword [edi + 0x5d8], 0xa
jmp 0x1000774e
push str.dx.graphic.3d.10plus
push ebx
call fcn.10005140
add esp, 8
test al, al
je 0x1000774e
mov dword [edi + 0x5d8], 0xb
jmp 0x10010b67
jmp 0x100d156a
Function at 0x10008dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.1006759b
mov eax, dword [edi + 0x260]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x100998dc
xor esi, esi
push esi
push 0x143
push eax
call ebx
mov ecx, dword [edi + 0x260]
push str.memory
push esi
push 0x143
push ecx
call ebx
mov edx, dword [edi + 0x260]
push str.memory2
push esi
push 0x143
push edx
call ebx
mov eax, dword [edi + 0x260]
push str.memory3
push esi
push 0x143
push eax
call ebx
mov ecx, dword [edi + 0x260]
push str.memory4
push esi
push 0x143
push ecx
call ebx
mov edx, dword [edi + 0x260]
push str.display2
push esi
push 0x143
push edx
call ebx
mov eax, dword [edi + 0x260]
push 0x1009968c
push esi
push 0x143
push eax
call ebx
mov ecx, dword [edi + 0x260]
push 0x10099684
push esi
push 0x143
push ecx
call ebx
mov edx, dword [edi + 0x260]
push 0x1009967c
push esi
push 0x143
push edx
call ebx
mov eax, dword [edi + 0x260]
push 0x10099674
push esi
push 0x143
push eax
call ebx
mov ecx, dword [edi + 0x20c]
push str.Pbk
push esi
push 0x143
push ecx
call ebx
mov edx, dword [edi + 0x20c]
push 0x10099888
push esi
push 0x143
push edx
call ebx
push str._IN
mov eax, dword [edi + 0x260]
push esi
push 0x143
push eax
call ebx
mov ecx, dword [edi + 0x260]
push esi
push esi
push 0x14e
push ecx
call ebx
mov edx, dword [edi + 0x20c]
push esi
push 1
push 0x14e
push edx
call ebx
lea eax, [edi + 0x74]
push eax
push esi
lea ecx, [edi + 0x240]
mov dword [edi + 0x78], 1
call fcn.10066440
push esi
push 0x4b5
mov ecx, edi
call fcn.10066af9
mov ecx, eax
call fcn.10066c95
push esi
push 0x3e8
mov ecx, edi
call fcn.10066af9
mov ecx, eax
call fcn.10066c95
push esi
push 0x3e9
mov ecx, edi
call fcn.10066af9
mov ecx, eax
call fcn.10066c95
jmp loc.100feef6
Function at 0x10009a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1008da80
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100bbef4]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov edi, ecx
call fcn.1006759b
push 1
mov ecx, edi
call fcn.10062e74
push ecx
mov eax, esp
mov dword [esp + 0x20], esp
push eax
call fcn.10046c00
mov ecx, esp
mov dword [esp + 0x2c], esp
xor esi, esi
push str.rem_path
mov dword [esp + 0x80], esi
call fcn.10009490
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x10099afc
mov byte [esp + 0x84], 1
call fcn.10009490
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x84], 0xffffffff
call fcn.10046ab0
add esp, 0xc
mov edx, esp
mov dword [esp + 0x18], esp
push edx
mov dword [esp + 0x7c], 2
call fcn.10046c00
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.dll_path
mov byte [esp + 0x80], 3
call fcn.10009490
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x10099afc
mov byte [esp + 0x84], 4
call fcn.10009490
lea eax, [esp + 0x2c]
push eax
mov byte [esp + 0x84], 2
call fcn.10046ab0
add esp, 0x10
lea ecx, [edi + 0x23c]
push eax
mov byte [esp + 0x78], 5
call fcn.100085c0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x74], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10009ba9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], esi
jle 0x10009bc1
push eax
call fcn.10073ecc
add esp, 4
mov dword [edi + 0x238], eax
jmp 0x1014b63f
Function at 0x1000e190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.1006759b
push 1
mov ecx, edi
call fcn.10062e74
push 0x3f7
mov ecx, edi
call fcn.10066af9
mov ebx, dword [edi + 0x7c]
sub ebx, 1
mov ebp, eax
mov esi, 0
js 0x1000e1fd
lea ecx, [ecx]
cmp ebx, esi
jl 0x1000e9c0
cmp ebx, dword [edi + 0x7c]
jge 0x1000e9c0
mov eax, dword [edi + 0x78]
mov ecx, dword [eax + ebx*4]
mov edx, dword [ebp + 0x20]
push ecx
push esi
push 0x143
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
sub ebx, 1
jns 0x1000e1d0
mov eax, dword [edi + 0x374]
cmp dword [eax - 0xc], esi
jne 0x1000e22c
mov ecx, dword [ebp + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push esi
push 0x146
push ecx
call ebx
test eax, eax
jle 0x1000e22c
mov edx, dword [ebp + 0x20]
push esi
push esi
push 0x14e
push edx
call ebx
jmp 0x1001bab0
jmp fcn.10060dc2
jmp 0x1002a687
push edi
xchg ecx, ebx
lea ebx, [edi + 0x88]
sets cl
push 0x4ec
mov cx, di
mov ecx, ebx
jmp 0x1002a8cc
call fcn.10063fc8
push edi
mov cx, ax
lea ebp, [edi + 0xe8]
mov ch, al
cmovae ecx, esp
not ch
push 0x4ed
movzx ecx, di
jmp 0x1010b643

Function at 0x10011d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1008e98b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100bbef4]
xor eax, esp
push eax
lea eax, [esp + 0x460]
mov dword fs:[0], eax
mov edi, ecx
call fcn.1006759b
xor esi, esi
push 0x1fe
lea eax, [esp + 0x262]
push esi
push eax
mov word [esp + 0x268], si
call fcn.100736a0
push 0x1fe
lea ecx, [esp + 0x6e]
push esi
push ecx
mov word [esp + 0x74], si
call fcn.100736a0
add esp, 0x18
mov dword [esp + 0x14], vtable.CHotKey.0
mov eax, dword [edi + 0x78]
mov ecx, dword [edi + 0x74]
lea edx, [esp + 0x25c]
push edx
push eax
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x474], esi
call fcn.10001a90
mov eax, dword [edi + 0x80]
mov ecx, dword [edi + 0x7c]
lea edx, [esp + 0x5c]
push edx
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.10001a90
lea edx, [esp + 0x25c]
push edx
lea ecx, [edi + 0x248]
call fcn.10066bfb
lea eax, [esp + 0x5c]
push eax
lea ecx, [edi + 0x1f4]
call fcn.10066bfb
jmp loc.1010c020

Function at 0x100132b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x8c
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.1006759b
jmp loc.10129934

Function at 0x10014d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1008f068
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100bbef4]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
call fcn.1006759b
push 1
mov ecx, edi
call fcn.10062e74
jmp loc.101644e9
Function at 0x10018170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.1006759b
jmp loc.100d4ccc

Function at 0x1001aef0
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.1006759b
xor esi, esi
mov dword [edi + 0x78], esi
jmp loc.1014c14f

Function at 0x1001d260
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10090398
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100bbef4]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
call fcn.1006759b
push 1
mov ecx, edi
call fcn.10062e74
jmp loc.100ea807
Function at 0x1001fcc0
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100906f8
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100bbef4]
xor eax, esp
push eax
lea eax, [esp + 0x8c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.1006759b
push 1
mov ecx, esi
call fcn.10062e74
jmp loc.101261a5

Function at 0x100234c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.1006759b
jmp loc.1016a0cf

Function at 0x100250a0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10090aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100bbef4]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov esi, ecx
call fcn.1006759b
call fcn.10066e2e
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x100250f8
push 0x80004005
call fcn.10001020
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x9c], ebx
mov word [esp + 0x70], 0x5f53
mov word [esp + 0x72], 0x524d
mov word [esp + 0x74], 0x4f7f
mov word [esp + 0x76], 0x7528
mov word [esp + 0x78], 0x7684
mov word [esp + 0x7a], 0x63d2
mov word [esp + 0x7c], 0x4ef6
mov word [esp + 0x7e], 0x7248
mov word [esp + 0x80], 0x672c
mov word [esp + 0x82], 0x53f7
mov word [esp + 0x84], 0x5b
mov word [esp + 0x86], 0x25
mov word [esp + 0x88], 0x73
mov word [esp + 0x8a], 0x5d
mov word [esp + 0x8c], bx
call fcn.10047d30
mov edx, dword [eax]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0xa8], 1
call fcn.10002fd0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x98], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100251d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
mov ecx, esi
call fcn.10062e74
jmp 0x100f8e07
Function at 0x10026470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, dword [0x100bbef4]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.1006759b
push 1
mov ecx, edi
call fcn.10062e74
push 0x3f7
mov ecx, edi
call fcn.10066af9
mov ebx, dword [edi + 0x7c]
sub ebx, 1
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x10], eax
mov esi, 0
js 0x100264e2
cmp ebx, esi
jl 0x10026b88
cmp ebx, dword [edi + 0x7c]
jge 0x10026b88
mov eax, dword [edi + 0x78]
mov ecx, dword [eax + ebx*4]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x20]
push ecx
push esi
push 0x143
push eax
call ebp
sub ebx, 1
jns 0x100264b5
mov ecx, dword [edi + 0x2d0]
cmp dword [ecx - 0xc], esi
jne 0x10026513
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x20]
push esi
push esi
push 0x146
push eax
call ebp
test eax, eax
jle 0x10026513
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x20]
push esi
push esi
push 0x14e
push edx
call ebp
push 0x3f8
mov ecx, edi
call fcn.10066af9
mov ebx, dword [edi + 0x90]
sub ebx, 1
mov dword [esp + 0x10], eax
js 0x10026563
mov edi, edi
cmp ebx, esi
jl 0x10026b88
cmp ebx, dword [edi + 0x90]
jge 0x10026b88
mov eax, dword [edi + 0x8c]
mov ecx, dword [eax + ebx*4]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x20]
push ecx
push esi
push 0x143
push eax
call ebp
sub ebx, 1
jns 0x10026530
mov ecx, dword [edi + 0x2cc]
cmp dword [ecx - 0xc], esi
jne 0x10026594
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x20]
push esi
push esi
push 0x146
push eax
call ebp
test eax, eax
jle 0x10026594
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x20]
push esi
push esi
push 0x14e
push edx
call ebp
jmp 0x1013aeb7
jmp fcn.10060dc2