joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401029
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x401a4f
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push 7
push esi
push str..PhysicalDrive0
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x401b45
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
lea esi, [ebp - 0x41c]
mov dword [ebp - 4], 0x400
mov ebx, dword [ebp - 4]
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
push ebx
push esi
lea eax, [ebp - 0x1c]
push 0xc
push eax
push 0x2d1400
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
je 0x401af3
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], esi
cmp eax, ebx
jbe 0x401ad4
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
jmp 0x401af3
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x401af3
lea edi, [eax + esi]
push edi
call fcn.00402d00
push eax
push edi
push dword [ebp + 8]
call fcn.004018cc
add esp, 0x10
xor edi, edi
lea eax, [ebp - 0x41c]
cmp esi, eax
je 0x401b04
push esi
call fcn.00402ce6
pop ecx
cmp dword [ebp - 8], edi
jne 0x401b3a
cmp dword [ebp - 0xc], edi
jne 0x401b27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401b3a
cmp dword [ebp - 4], ebx
ja 0x401b27
or bx, 0xfff
inc ebx
mov dword [ebp - 4], ebx
push dword [ebp - 4]
call fcn.00402cd8
mov esi, eax
pop ecx
cmp esi, edi
jne 0x401a98
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret

Function at 0x438c97
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
and esi, esi
add esi, 0xd924a968
dec ecx
call fcn.00438ce2
mov esi, esi
xor dword [edi], edx
add ecx, 0x2e840183
add esi, 0x9b9e1a3c
sub esp, 4
mov dword [esp], 0xe786b0ec
pop ecx
inc edi
sub ecx, 0x2aaf007d
or ecx, ecx
add esi, 0x26979ffc
cmp edi, eax
jne fcn.00438c97
add esi, ecx
or ecx, esi
ret
Function at 0x1000cd10
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100109c0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp + 0xc]
call fcn.10007550
mov ecx, eax
xor eax, eax
lea eax, [ebp - 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
sub esp, 0x1c
cmp eax, 0
jne 0x1000cdcb
lea ecx, [ebp - 0x2c]
lea eax, str.Failed_to_calculate_base64_decoded_size.
mov dword [esp], eax
call fcn.1000ced0
sub esp, 4
lea ecx, [ebp - 0x2c]
lea eax, [0x101e84f0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.101698b1
mov byte [ebp - 0x2d], 0
lea ecx, [ebp - 0x2e]
call fcn.10001570
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x2e]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.1000cf10
sub esp, 8
mov ecx, dword [ebp - 0x44]
call fcn.1000cf60
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp + 0xc]
call fcn.10007550
mov ecx, dword [ebp - 0x48]
mov edx, eax
xor eax, eax
lea eax, [ebp - 0x20]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
sub esp, 0x1c
cmp eax, 0
jne 0x1000ce7e
mov eax, esp
mov dword [eax], str.Failed_to_decode_base64_string.
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x4c], ecx
call fcn.1000ced0
sub esp, 4
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x10], 0
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], 0x101e84f0
call fcn.101698b1
jmp 0x1000cea9
mov byte [ebp - 0x2d], 1
test byte [ebp - 0x2d], 1
jne 0x1000ce94
mov ecx, dword [ebp - 0x44]
call fcn.1000cf80
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
nop dword [eax]
push ebp
sub esp, 0x1c
add ebp, 0xc
mov ecx, dword [ebp - 0x44]
call fcn.1000cf80
add esp, 0x1c
pop ebp
ret
Function at 0x1001c220
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0xc]
lea eax, [ebp - 0x104]
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x14
cmp eax, 0
jne 0x1001c293
mov ecx, dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
mov dword [esp], eax
call fcn.100062d0
sub esp, 4
jmp 0x1001c2d5
lea ecx, [0x101ffeb0]
lea eax, str.Error_retrieving_folder_path
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100037c0
mov ecx, eax
lea eax, [0x10011a60]
mov dword [esp], eax
call fcn.10011a40
sub esp, 4
mov ecx, dword [ebp - 0x10c]
lea eax, [0x101d67a4]
mov dword [esp], eax
call fcn.100062d0
sub esp, 4
mov eax, dword [ebp - 0x108]
add esp, 0x120
pop ebp
ret

Function at 0x1001c2f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
cmp eax, 0
je 0x1001c31a
mov byte [ebp - 1], 1
jmp 0x1001c31e
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
and al, 1
movzx eax, al
add esp, 8
pop ebp
ret
Function at 0x10021c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, esp
mov dword [esi + 0x10], ebp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov edi, esp
mov dword [esi + 0x44], edi
mov dword [esi + 0x50], 0xffffffff
lea edi, [esi + 0x48]
mov dword [esi + 0x4c], 0x10024860
mov ebx, dword fs:[0]
mov dword [esi + 0x48], ebx
mov dword fs:[0], edi
mov dword [esi + 0x3c], edx
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], ecx
mov eax, dword [esi + 0x34]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
lea ecx, [esi + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.10016210
sub esp, 8
lea ecx, [esi + 0x28]
call fcn.100055e0
test al, 1
jne 0x10021ca0
jmp 0x10021d62
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
sub ecx, 1
sbb eax, 0
jl 0x10021d62
jmp 0x10021cb7
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add ecx, eax
call fcn.10005640
mov ecx, eax
mov edi, dword [esi + 0x38]
mov ebx, dword [esi + 0x3c]
mov edx, dword [ebp + 8]
mov dword [esi + 0x50], 1
mov eax, esp
mov dword [eax + 8], ebx
mov dword [eax + 4], edi
mov dword [eax], edx
call fcn.100241e0
sub esp, 0xc
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], eax
jmp 0x10021d11
mov dword [esi + 0x50], 0
jmp 0x10021d62
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], ecx
movsd xmm0, qword [esi + 0x20]
movsd qword [eax + 8], xmm0
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x38]
mov edi, dword [esi + 0x3c]
xor ecx, edi
xor eax, edx
or eax, ecx
je 0x10021d5d
jmp 0x10021d47
mov eax, dword [esi + 0x30]
mov ecx, eax
and ecx, 3
xor ecx, 0xffffffff
add eax, 3
add eax, 1
add eax, ecx
mov dword [esi + 0x30], eax
jmp 0x10021d05
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [esi + 0x30]
mov dword [esi + 0x50], 0
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], 0
call fcn.100057b0
sub esp, 8
jmp 0x10021d8e
lea ecx, [esi + 0x28]
call fcn.100165a0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x48]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x10021e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10024720
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x21], 0x363572
mov dword [ebp - 0x24], 0x72657776
mov dword [ebp - 0x28], 0x31346572
mov dword [ebp - 0x2c], 0x35366976
mov eax, esp
lea ecx, [ebp - 0x2c]
mov dword [eax], ecx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
call fcn.100062d0
sub esp, 4
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov eax, esp
mov dword [eax + 8], edx
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x44]
mov dword [eax], ecx
call fcn.1000dd10
jmp 0x10021ec7
mov eax, esp
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x64], ecx
mov dword [eax], ecx
mov ecx, 0x101fdf38
call fcn.1000c790
sub esp, 4
mov ecx, dword [ebp - 0x64]
call fcn.10006b40
lea ecx, [ebp - 0x5c]
call fcn.10006b40
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10021f20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x101a43a4]
mov dword [ebp - 0xd], eax
mov eax, dword [0x101a43a8]
mov dword [ebp - 9], eax
mov eax, dword [0x101a43ac]
mov dword [ebp - 5], eax
mov al, byte [0x101a43b0]
mov byte [ebp - 1], al
lea eax, [ebp - 0xd]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [0x101a43b2]
mov dword [ebp - 0x22], eax
mov eax, dword [0x101a43b6]
mov dword [ebp - 0x1e], eax
mov eax, dword [0x101a43ba]
mov dword [ebp - 0x1a], eax
mov ax, word [0x101a43be]
mov word [ebp - 0x16], ax
lea ecx, [ebp - 0x46]
lea eax, [0x101a43c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x24
call fcn.1016b630
lea eax, [ebp - 0x46]
lea ecx, [ebp - 0x22]
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x10022081
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub esp, 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x10022077
mov eax, dword [ebp - 0x54]
sub eax, 0xb7adba9
add eax, 1
add eax, 0xb7adba9
mov dword [esp], eax
call fcn.10027b4d
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x54]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1016b630
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x54]
mov byte [eax + ecx], 0
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call fcn.10021040
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
cmp eax, 0
je 0x10022072
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call fcn.10027b56
jmp 0x1002207c
jmp 0x1002207c
jmp 0x10022086
jmp 0x10022086
add esp, 0x6c
pop ebp
ret
Function at 0x10022140
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [ebp + 8]
xor eax, eax
mov dword [esp], 2
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 8], eax
mov eax, 0xffffffff
cmp dword [ebp - 8], eax
jne 0x1002217f
mov byte [ebp - 1], 0
jmp 0x100222c6
lea eax, [ebp - 0x234]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x22c
call fcn.1016bbb0
mov dword [ebp - 0x234], 0x22c
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x234]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32FirstW
sub esp, 8
cmp eax, 0
je 0x100222b3
jmp 0x100221cf
lea eax, [ebp - 0x338]
lea ecx, [ebp - 0x234]
add ecx, 0x24
xor edx, edx
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sub esp, 0x20
lea eax, [ebp - 0x338]
lea ecx, [ebp - 0x350]
mov dword [esp], eax
call fcn.100062d0
sub esp, 4
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x350]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.100222e0
mov byte [ebp - 0x351], al
lea ecx, [ebp - 0x350]
call fcn.10006b40
mov al, byte [ebp - 0x351]
test al, 1
jne 0x10022270
jmp 0x10022288
mov eax, dword [ebp - 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov byte [ebp - 1], 1
jmp 0x100222c6
jmp 0x1002228d
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x234]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32NextW
sub esp, 8
cmp eax, 0
jne 0x100221cf
jmp 0x100222b3
mov eax, dword [ebp - 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
and al, 1
movzx eax, al
add esp, 0x374
pop ebp
ret
Function at 0x10022310
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x190
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10024740
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
xor eax, eax
lea eax, [ebp - 0x120]
mov dword [esp], 0
mov dword [esp + 4], 0x10
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x14
cmp eax, 0
jne 0x10022474
mov eax, dword [ebp + 8]
mov dword [ebp - 0x188], eax
mov eax, esp
lea ecx, [ebp - 0x120]
mov dword [eax], ecx
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x184], ecx
call fcn.100062d0
sub esp, 4
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 0x10], 0
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x168]
mov dword [eax], ecx
mov dword [eax + 8], 0x101d6340
call fcn.10011890
jmp 0x100223d4
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x10], 1
mov eax, esp
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x168]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x150]
mov dword [eax], ecx
call fcn.1001dc90
jmp 0x10022401
mov dword [ebp - 0x10], 2
mov eax, esp
lea ecx, [ebp - 0x150]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x138]
mov dword [eax], ecx
mov dword [eax + 8], str..lnk
call fcn.10011890
jmp 0x1002242c
lea ecx, [ebp - 0x150]
call fcn.10006b40
lea ecx, [ebp - 0x168]
call fcn.10006b40
lea ecx, [ebp - 0x180]
call fcn.10006b40
lea ecx, [ebp - 0x138]
call fcn.10007550
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
lea ecx, [ebp - 0x138]
call fcn.10006b40
jmp 0x10022474
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x190
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10026020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1002605e
mov dword [ebp - 4], 0
jmp 0x10026154
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
sub esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10026086
mov dword [ebp - 4], 0
jmp 0x10026154
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf
or eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xf
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], 0
mov byte [ebp - 0x19], al
jbe 0x100260ea
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
setb al
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x19]
test al, 1
jne 0x100260fa
jmp 0x1002611b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
movzx ecx, word [ecx]
shl ecx, 1
add ecx, 2
add eax, ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
add eax, 0xffffffff
mov dword [ebp - 0x18], eax
jmp 0x100260cf
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jb 0x10026133
mov dword [ebp - 4], 0
jmp 0x10026154
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0
jne 0x1002614e
mov dword [ebp - 4], 0
jmp 0x10026154
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 0x24
pop ebp
ret

Function at 0x10027f12
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x10027f47
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x10027f44
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x10027f50
add edx, 0x28
cmp edx, esi
jne 0x10027f32
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x10027f4d
Function at 0x1002efef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.1003e580
push 0xf1
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1002f0bd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1002f0bd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1002f0bd
movzx eax, word [edi + 6]
push ebx
push 4
pop ecx
mul ecx
push 0xffffffffffffffff
pop ecx
cmovb eax, ecx
push eax
call fcn.10027b4d
pop ecx
movzx ecx, word [edi + 6]
xor esi, esi
xor edx, edx
mov ebx, eax
mov eax, ecx
cmp si, cx
jae 0x1002f077
lea ecx, [edi + 8]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov dword [ebx + edx*4], eax
inc edx
movzx esi, word [edi + 6]
cmp edx, esi
jl 0x1002f063
mov eax, esi
mov ecx, dword [ebp - 4]
movzx eax, ax
push eax
push ebx
call fcn.1002f116
push ebx
mov esi, eax
call fcn.10027b56
pop ecx
test esi, esi
je 0x1002f0b8
movzx ecx, word [edi + 4]
movzx esi, word [edi + 2]
push ecx
push esi
lea eax, [ecx + 7]
mov ecx, dword [ebp - 4]
lea edx, [esi + 7]
push eax
push edx
call fcn.1002ef39
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.1002f0c5
mov esi, eax
mov eax, esi
pop ebx
jmp 0x1002f0bf
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x1003252b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x1003256a
call fcn.1003e580
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1003256a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10032572
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.100512be
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1003606d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x100360f9
cmp dword [esi + 0x20], 0
je 0x100360f9
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100360f9
cmp dword [ebp + 8], 0
je 0x100360f9
xor edi, edi
mov ebx, edi
call fcn.1003e580
push 0x101dd734
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x100360dd
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100360f9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.10051748
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100360f5
mov ecx, esi
call fcn.10035f3f
mov eax, edi
jmp 0x100360fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10038bb9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.1003e580
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10038bf9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10038bf9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.10038c01
jmp 0x10038bfb
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x10038ed9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi + 0x84], edi
test edi, 0xffff0000
jne 0x10038f04
cmp dword [esi + 0x80], 0
jne 0x10038f04
movzx eax, di
mov dword [esi + 0x80], eax
call fcn.1003e580
push 5
push edi
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10038f34
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10038f34
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.1003953e
jmp 0x10038f36
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8