joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100564a8
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x1009f6c8
call fcn.10047870
xor esi, esi
cmp dword [0x100c76dc], esi
jne 0x100564ec
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100564d7
mov dword [0x100c76dc], edi
jmp 0x100564ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x100564ec
mov dword [0x100c76dc], 2
mov eax, dword [0x100c76dc]
cmp eax, 2
je 0x100565cd
cmp eax, esi
je 0x100565cd
cmp eax, 1
jne 0x10056531
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x1005651a
mov eax, dword [0x100c7620]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x10056538
xor eax, eax
jmp 0x100565df
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.10043e30
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x1005656e
cmp edi, esi
jne 0x10056589
lea eax, [ebx + ebx]
push eax
call fcn.10043acd
pop ecx
mov edi, eax
cmp edi, esi
je 0x10056531
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100565bc
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x100565a6
push esi
push esi
jmp 0x100565ac
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x100565c8
push edi
call fcn.10043adf
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x100565df
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.100478ab
ret
Function at 0x10056a3c
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x10056a55
or eax, 0xffffffff
jmp 0x10056ab6
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x10056ab2
push 0x3d
push esi
call fcn.10045476
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x10056ab2
cmp esi, eax
je 0x10056ab2
xor ecx, ecx
cmp byte [eax + 1], cl
mov eax, dword [0x100c720c]
sete cl
cmp eax, dword [0x100c7210]
mov dword [ebp - 4], ecx
jne 0x10056a98
mov edi, eax
call fcn.100569db
mov dword [0x100c720c], eax
cmp eax, ebx
jne 0x10056af1
cmp dword [ebp + 0xc], ebx
je 0x10056aba
cmp dword [0x100c7214], ebx
je 0x10056aba
call fcn.10055d63
test eax, eax
je 0x10056af1
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 4], ebx
je 0x10056ac3
xor eax, eax
jmp 0x10056ab5
push 4
call fcn.10043acd
cmp eax, ebx
pop ecx
mov dword [0x100c720c], eax
je 0x10056ab2
mov dword [eax], ebx
cmp dword [0x100c7214], ebx
jne 0x10056af1
push 4
call fcn.10043acd
cmp eax, ebx
pop ecx
mov dword [0x100c7214], eax
je 0x10056ab2
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
mov ebx, dword [0x100c720c]
sub edi, esi
push esi
call fcn.1005698e
mov edi, eax
test edi, edi
pop ecx
jl 0x10056b58
cmp dword [ebx], 0
je 0x10056b58
lea esi, [ebx + edi*4]
push dword [esi]
call fcn.10043adf
xor eax, eax
cmp dword [ebp - 4], eax
pop ecx
jne 0x10056b38
mov ecx, dword [ebp - 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x10056b99
mov ecx, dword [esi + 4]
inc edi
mov dword [esi], ecx
lea esi, [ebx + edi*4]
cmp dword [esi], eax
jne 0x10056b2f
mov eax, edi
shl eax, 2
push eax
push dword [0x100c720c]
call fcn.100456c5
test eax, eax
mov esi, dword [ebp - 8]
pop ecx
pop ecx
je 0x10056b99
jmp 0x10056b94
cmp dword [ebp - 4], 0
jne 0x10056c00
test edi, edi
jge 0x10056b68
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x100c720c]
call fcn.100456c5
test eax, eax
pop ecx
pop ecx
je 0x10056ab2
lea ecx, [eax + edi*4]
and dword [ecx + 4], 0
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
and dword [ecx], 0
mov dword [0x100c720c], eax
cmp dword [ebp + 0xc], 0
je 0x10056beb
push esi
call fcn.10047470
inc eax
inc eax
push eax
call fcn.10043acd
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x10056beb
push esi
push edi
call fcn.1004b020
mov eax, edi
sub eax, esi
add eax, dword [ebp - 0xc]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov byte [eax], 0
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x10056be4
or dword [ebp - 0x10], 0xffffffff
push edi
call fcn.10043adf
pop ecx
cmp dword [ebp - 4], 0
je 0x10056bf8
push esi
call fcn.10043adf
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x10056ab5
push esi
call fcn.10043adf
mov eax, dword [ebp + 8]
and dword [eax], 0
pop ecx
jmp 0x10056abf
Function at 0x1005b440
Capabilities:
Terminate process

Disassembly:
push ecx
mov eax, dword [0x100c8374]
push esi
mov esi, ecx
mov ecx, eax
inc eax
mov dword [0x100c8374], eax
cmp ecx, dword [esi + 0x28]
push edi
jl 0x1005b468
mov ecx, esi
call fcn.1005b1b0
mov dword [0x100c8374], 0
mov eax, dword [esi + 0x200254]
mov edx, dword [esi + 0x200258]
mov edi, dword [esi + 0x20025c]
mov dword [esi + 0x200258], eax
mov dword [esi + 0x20025c], eax
mov eax, dword [esi + 0x20]
sub edi, edx
test eax, eax
mov dword [esi + 0x200254], edx
je 0x1005b4ad
push eax
push edi
mov eax, edx
push 1
push eax
call fcn.100467fa
mov ecx, dword [esi + 0x20]
push ecx
call fcn.1004669a
add esp, 0x14
mov eax, dword [esi + 0x200264]
test eax, eax
je 0x1005b4f1
mov eax, dword [esi + 0x200254]
mov ecx, dword [esi + 0x18]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
test eax, eax
jne 0x1005b4f1
mov edx, dword [esi + 0x1c]
push eax
push 0x100a0954
push 0x100a09f4
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ecx
ret
Function at 0x1006acd0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret

Function at 0x1006af90
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.10043e30
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x1006afd5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1006afd5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x100baba0
call fcn.1006d6e4
add esp, 0xc
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.1006d68e
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1006b04e
call fcn.1006aed0
test eax, eax
je 0x1006b04e
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [ebp - 0x104]
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006e000
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0xc], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x10], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0xc]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x10]
mov dword [esp + 0xc], edi
jb 0x1006e020
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0xc]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x10079fc9
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1008ebab
call fcn.100474fc
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x10079fe3
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1007a02f
call fcn.10078998
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10001260
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x1007c8c4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x1007c8fd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100391f1
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1001d3c0
pop esi
ret 4
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x1007dc24
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x1007dc67
call fcn.10087ae4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1007dc67
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1007dc82
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.1007cd7f
test ebx, ebx
mov esi, eax
je 0x1007dc80
test edi, edi
je 0x1007dc80
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x1007e331
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x54], 0
mov eax, dword [edi + 0x58]
mov esi, dword [edi + 0x5c]
mov dword [ebp - 4], eax
je 0x1007e368
call fcn.10087ae4
mov ebx, dword [eax + 0xc]
push 5
push dword [edi + 0x54]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1007e379
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ebx, ebx
inc ebx
test esi, esi
je 0x1007e3b2
cmp word [esi + 2], 0xffff
mov ecx, dword [esi]
jne 0x1007e397
mov ecx, dword [esi + 0xc]
mov ax, word [esi + 0x12]
mov si, word [esi + 0x14]
jmp 0x1007e39f
mov ax, word [esi + 0xa]
mov si, word [esi + 0xc]
test cx, 0x1801
jne 0x1007e3b0
test ax, ax
jne 0x1007e3b0
test si, si
je 0x1007e3b2
xor ebx, ebx
cmp dword [edi + 0x54], 0
je 0x1007e3c1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1007e613
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1008ed1e
call fcn.100474fc
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ebx, dword [esi + 0x5c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call fcn.10087ae4
cmp dword [esi + 0x54], 0
mov edi, dword [eax + 0xc]
je 0x1007e661
call fcn.10087ae4
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1007e672
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x1007e67e
or eax, 0xffffffff
jmp 0x1007e781
mov ecx, esi
call fcn.1007e155
mov dword [ebp - 0x14], eax
call fcn.1007bc89
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
je 0x1007e6c1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x1007e6c1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1007e6c1
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
and dword [ebp - 4], 0
push esi
call fcn.1007d2b7
push dword [ebp - 0x14]
call fcn.1007bbe1
push edi
push eax
push ebx
mov ecx, esi
call fcn.1007e406
xor ebx, ebx
cmp eax, ebx
je 0x1007e735
test byte [esi + 0x38], 0x10
je 0x1007e703
push 4
pop edi
mov ecx, esi
call fcn.1007988b
test ah, 1
je 0x1007e6fb
push 5
pop edi
push edi
mov ecx, esi
call fcn.1007b685
cmp dword [esi + 0x1c], ebx
je 0x1007e735
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.10079b1e
jmp 0x1007e735
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], ebx
je 0x1007e749
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], ebx
je 0x1007e762
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x1007e762
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.1007e18f
cmp dword [esi + 0x54], ebx
je 0x1007e77e
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x1007e7bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.10087ae4
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1007e7f2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.1007e406
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1007f10c
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1008f304
call fcn.100474fc
sub esp, 0x154
mov eax, dword [0x100ba4f0]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, ebp
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x158]
push eax
push edi
mov esi, 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x1007f153
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x1007f157
cmp eax, esi
jb 0x1007f15e
xor eax, eax
jmp 0x1007f242
call fcn.10078998
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x154], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x154]
push eax
push edi
call fcn.1007f0ca
push dword [ebp - 0x154]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x1007f22f
push eax
push eax
lea ecx, [ebp - 0x15c]
push ecx
lea ecx, [ebp - 0x160]
push ecx
push eax
push eax
push eax
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x1007f1bf
xor esi, esi
jmp 0x1007f232
test byte [ebp - 0x15c], 2
jne 0x1007f1cf
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp - 0x15c], 4
jne 0x1007f22f
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1007f22f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x158], 0
je 0x1007f1bb
cmp dword [ebp - 0x158], edi
jbe 0x1007f1bb
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, edi
add eax, dword [ebp - 0x158]
cmp eax, esi
jge 0x1007f1bb
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x158]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x154]
add ecx, 0xfffffff0
call fcn.10001260
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.10043e9e
leave
ret 8
Function at 0x1007f408
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push pe_nt_image_headers32
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.10047710
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x100986b4]
je 0x1007f556
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x1007f478
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x1007f47f
cmp ebx, ebx
jne 0x1007f47f
xor eax, eax
jmp 0x1007f559
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x1007f48c
mov byte [esi + 0x20], bl
jmp 0x1007f4a0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
lea eax, [ebp - 8]
push eax
call fcn.10040ab5
test eax, eax
je 0x1007f4c7
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.10040b9c
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
jmp 0x1007f4cc
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.10040ab5
test eax, eax
je 0x1007f4f4
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.10040b9c
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
jmp 0x1007f4fe
xor eax, eax
xor ecx, ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
lea eax, [ebp - 0x18]
push eax
call fcn.10040ab5
test eax, eax
je 0x1007f526
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.10040b9c
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0xc], eax
jmp 0x1007f530
xor eax, eax
xor ecx, ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x1007f542
mov eax, dword [esi + 8]
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x1007f556
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4