joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025040
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
test esi, esi
je 0x100251fb
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x100251fb
mov ebp, dword [esp + 0x34]
test ebp, ebp
je 0x100251fb
push ebx
mov ebx, dword [esp + 0x28]
cmp dword [esp + 0x3c], edi
jne 0x1002517b
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push eax
push dword [ebx + 0x1c]
mov dword [esp + 0x28], eax
call fcn.10050400
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100251cc
lea eax, [esp + 0x30]
push eax
push 4
push dword [ebx + 0x18]
call fcn.10050c10
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100251cc
lea eax, [esp + 0x18]
push eax
push esi
push edi
push dword [ebx + 0x1c]
push dword [esp + 0x40]
call fcn.10051790
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x100251cc
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push esi
call fcn.10051840
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10025120
mov eax, dword [ebx]
push esi
push 0
push 0x3ec
mov eax, dword [eax + 0x1c]
push ebx
call eax
add esp, 0x10
jmp 0x100251cc
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x38]
push dword [ebp + 4]
push dword [eax]
push dword [eax + 4]
push esi
call fcn.10051890
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x10025108
mov eax, dword [ebp]
sub eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 4]
add eax, dword [esp + 0x14]
push eax
push esi
call fcn.100518f0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10025108
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x10]
mov dword [ebp], eax
jmp 0x100251cc
mov ecx, dword [ecx]
cmp ecx, dword [esi]
cmova ecx, dword [esi]
xor esi, esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x100251c9
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
jmp 0x100251a0
mov eax, dword [ebx + 4]
mov ecx, dword [edi + 4]
mov dl, byte [eax + esi]
xor dl, byte [ecx + esi]
mov eax, dword [ebp + 4]
mov byte [esi + eax], dl
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc esi
mov dword [esp + 0x10], esi
cmp esi, ecx
jb 0x100251a0
mov ebx, dword [esp + 0x28]
xor edi, edi
mov dword [ebp], ecx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100251e0
push eax
push dword [ebx + 0x1c]
call fcn.10050400
add esp, 8
mov eax, dword [esp + 0x18]
pop ebx
test eax, eax
je 0x100251f2
push eax
call fcn.10051820
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x14
ret
pop edi
pop esi
mov eax, 0x2721
pop ebp
add esp, 0x14
ret
Function at 0x10039c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], 0
push dword [edi + 0xc]
call fcn.1000d1d0
lea eax, [esp + 0x2c]
push eax
push dword [edi + 0xc]
call fcn.1000d1d0
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x4c]
push ecx
push eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], 0
call fcn.1000d1d0
lea eax, [esp + 0x64]
push eax
push dword [edi + 0xc]
call fcn.1000d1d0
mov eax, dword [edi + 0xc]
mov ebp, dword [esp + 0x84]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x34]
push edi
push eax
push ebp
call fcn.1003d4f0
mov ebx, dword [esp + 0xa0]
mov esi, eax
add esp, 0x2c
test esi, esi
jne 0x10039dbf
mov eax, dword [esp + 0x1c]
push edi
mov ebx, dword [eax]
lea eax, [esp + 0x18]
push eax
push ebp
and ebx, 1
call fcn.1003d4f0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10039d5b
lea eax, [esp + 0x24]
push eax
push edi
push dword [esp + 0x7c]
lea eax, [esp + 0x20]
push dword [esp + 0x7c]
push ebx
push eax
call fcn.1000cbe0
mov esi, eax
add esp, 0x18
cmp esi, 0x1f6
jne 0x10039d5b
push edi
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.1003d4f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10039d02
mov ebx, dword [esp + 0x74]
test esi, esi
jne 0x10039dbf
mov ebp, dword [esp + 0x7c]
lea eax, [esp + 0x10]
push esi
push ebp
push edi
push ebx
push dword [esp + 0x80]
push dword [esp + 0x7c]
push eax
call fcn.1000cd40
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x10039dbf
cmp dword [ebp], eax
jne 0x10039dbf
push eax
lea eax, [esp + 0x3c]
push eax
push edi
push ebx
push dword [esp + 0x80]
push dword [esp + 0x80]
push ebp
call fcn.10050400
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x10039dbf
cmp dword [esp + 0x38], esi
mov eax, 0xd1
cmove esi, eax
lea eax, [esp + 0x14]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x28]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x44]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x58]
push eax
call fcn.1000d1f0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x7e02b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22f000]
mov dword [edi + 0x2cd47c], 0x740b054e
push edi
jmp 0x7e02da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7e02e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7e02d0
mov eax, 1
add ebx, ebx
jne 0x7e02f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7e0304
jne 0x7e0323
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7e0323
dec eax
add ebx, ebx
jne 0x7e0310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7e02e8
add ebx, ebx
jne 0x7e031f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7e0375
xor ecx, ecx
sub eax, 3
jb 0x7e033b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7e03aa
sar eax, 1
mov ebp, eax
jmp 0x7e0346
add ebx, ebx
jne 0x7e0346
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7e0314
inc ecx
add ebx, ebx
jne 0x7e0354
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7e0314
add ebx, ebx
jne 0x7e0361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7e0356
jne 0x7e0372
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7e0356
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7e0394
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7e0386
jmp 0x7e02d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7e0394
add edi, ecx
jmp 0x7e02d6
pop esi
mov edi, esi
mov ecx, 0xef8d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7e03b2
cmp byte [edi], 0x26
jne 0x7e03b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7e03b7
lea edi, [esi + 0x3cf000]
mov eax, dword [edi]
or eax, eax
je 0x7e042f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x431dc4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x431f98]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7e03e4
mov ecx, edi
jns 0x7e0413
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x431fa0]
or eax, eax
je 0x7e0429
mov dword [ebx], eax
add ebx, 4
jmp 0x7e0401
call dword [esi + 0x431f9c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7e0460
cmp al, 0xef
ja 0x7e0453
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7e0435
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7e0442
mov ebp, dword [esi + 0x431fa4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7e0494
sub esp, 0xffffff80
jmp 0x5c9f5a
Function at 0x405d1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232d4], 0
push esi
jne 0x405d53
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d2d
mov dword [ecx*4 + 0x4232d0], eax
inc ecx
cmp ecx, 0x100
jl 0x405d28
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d84
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232d0]
xor eax, esi
inc ecx
dec edx
jne 0x405d66
pop edi
not eax
pop esi
ret 0xc

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x7b14511b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x77f8197c
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41ccc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
lea eax, [edi + 0x14128]
push dword [eax]
mov dword [eax], 0xfe02f6c8
push eax
push edi
jmp 0x41ccea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ccf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41cce0
mov eax, 1
add ebx, ebx
jne 0x41cd03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ccf8
jne 0x41cd14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ccf8
xor ecx, ecx
sub eax, 3
jb 0x41cd28
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41cd9a
mov ebp, eax
add ebx, ebx
jne 0x41cd33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41cd40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41cd64
inc ecx
add ebx, ebx
jne 0x41cd50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41cd45
jne 0x41cd61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41cd45
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41cd84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41cd75
jmp 0x41cce6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41cd84
add edi, ecx
jmp 0x41cce6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41cda6
cmp byte [edi], 5
jne 0x41cda6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41cdab
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41ce1a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c1dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c30c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41cdd8
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c314]
or eax, eax
je 0x41ce14
mov dword [ebx], eax
add ebx, 4
jmp 0x41cdf5
call dword [esi + 0x1c310]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x41ce4b
cmp al, 0xef
ja 0x41ce3e
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x41ce20
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x41ce2d
mov ebp, dword [esi + 0x1c318]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41ce7f
sub esp, 0xffffff80
jmp 0x40f7b7
Function at 0xd07cb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5d7000]
push edi
or ebp, 0xffffffff
jmp 0xd07cd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xd07cd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd07cc8
mov eax, 1
add ebx, ebx
jne 0xd07ceb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xd07cfc
jne 0xd07d1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd07d1b
dec eax
add ebx, ebx
jne 0xd07d08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xd07ce0
add ebx, ebx
jne 0xd07d17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xd07d6d
xor ecx, ecx
sub eax, 3
jb 0xd07d33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xd07da2
sar eax, 1
mov ebp, eax
jmp 0xd07d3e
add ebx, ebx
jne 0xd07d3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd07d0c
inc ecx
add ebx, ebx
jne 0xd07d4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xd07d0c
add ebx, ebx
jne 0xd07d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xd07d4e
jne 0xd07d6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xd07d4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xd07d8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xd07d7e
jmp 0xd07cce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xd07d8c
add edi, ecx
jmp 0xd07cce
pop esi
mov edi, esi
mov ecx, 0x4262
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xd07daa
cmp byte [edi], 0x24
jne 0xd07daa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xd07daf
lea edi, [esi + 0x904000]
mov eax, dword [edi]
or eax, eax
je 0xd07e27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x908880]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9089a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xd07ddc
mov ecx, edi
jns 0xd07e0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9089ac]
or eax, eax
je 0xd07e21
mov dword [ebx], eax
add ebx, 4
jmp 0xd07df9
call dword [esi + 0x9089a8]
mov ebp, dword [esi + 0x9089b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xd07e5b
sub esp, 0xffffff80
jmp 0x498e55

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000a620
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.1015bb40
mov eax, dword [0x10216574]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x1000a685
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1000a685
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.10192b50
add eax, 0x40
push eax
call fcn.10012584
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1015b166
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.10010520
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1000a714
call fcn.1000a4e0
test eax, eax
jle 0x1000a714
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1015b166
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1015b166
add esp, 0x108
ret

Function at 0x1000f710
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.100129c7

Function at 0x10011390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x100113b9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100113cf
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100113c6
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10011402
nop
cmp esi, ecx
jae 0x100113c6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x100113f0
cmp esi, ecx
jae 0x100113c6
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10011460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
call fcn.10021037
mov ebx, eax
test ebx, ebx
jne 0x10011480
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
shr eax, 4
push esi
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x10011567
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10011567
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10011567
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x100114e8
cmp esi, ecx
jae 0x10011567
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x100114d2
cmp esi, ecx
jae 0x10011567
cmp word [esi], 0
je 0x10011567
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x10011572
mov ebx, dword [ebp - 4]
mov edx, 1
mov ecx, dword [ebx]
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, edi
or edx, ecx
jge 0x10011530
push edi
mov ecx, ebx
call fcn.10011830
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x10011572
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
pop esi
mov byte [edi + eax], 0
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100118d0
int3
Function at 0x10011580
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor dl, dl
mov dword [ebp - 4], ecx
test eax, eax
je 0x1001168f
test eax, 0xffff0000
jne 0x1001168f
push ebx
push edi
movzx edi, ax
push edi
call fcn.10021037
mov ebx, eax
test ebx, ebx
je 0x1001168b
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x1001168b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1001168b
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001168a
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10011619
cmp esi, ecx
jae 0x1001168a
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10011603
cmp esi, ecx
jae 0x1001168a
cmp word [esi], 0
je 0x1001168a
movzx eax, word [esi]
lea ecx, [esi + 2]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x10011697
mov ebx, dword [ebp - 4]
mov ecx, 1
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x10011661
push edi
mov ecx, ebx
call fcn.10011830
movzx eax, word [esi]
push 0
push 0
push edi
push dword [ebx]
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x10011697
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
mov byte [edi + eax], 0
pop esi
pop edi
mov dl, 1
pop ebx
mov al, dl
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.100118d0
int3

Function at 0x10012931
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x10012979
call fcn.1001e82a
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10012979
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10012986
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x100129c2
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x100129a5
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x100129ae
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x100129c0
test di, di
jne 0x100129c0
test dx, dx
je 0x100129c2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10012a2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.1001e82a
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10012a6b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10012a6b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.10012a73
jmp 0x10012a6d
xor eax, eax
pop edi
pop esi
pop ebp
ret 8