joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GlobalReAlloc
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052a0
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4050f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052a0
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x4050f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4052bc
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x40517c
xor eax, eax
push ebp
push 0x405175
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404eb8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40515a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4052dc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40515a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40517c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LockResource
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_LoadLibraryA
push eax
call sub.KERNEL32.DLL_GlobalHandle
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405296
cmp byte [ebp - 0xd], 0
jne 0x4051c3
cmp byte [ebp - 0x12], 0
je 0x405296
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MulDiv
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4051dc
dec ebx
cmp byte [ebx], 0x2e
je 0x4051eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4051db
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405296
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405228
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_LockResource
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadResource
mov esi, eax
test esi, esi
jne 0x405296
cmp byte [ebp - 0xd], 0
je 0x405296
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_LockResource
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadResource
mov esi, eax
test esi, esi
jne 0x405296
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_LockResource
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadResource
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b994
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ba6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ea8
lea eax, [ebp - 8]
call fcn.00404320
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042d0
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40ba54
mov eax, ebx
call fcn.004026bc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40ba4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004042d0
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40ba37
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40ba7c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40ba37
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ba54
mov eax, dword [ebp - 0x10]
call fcn.004026dc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ba71
lea eax, [ebp - 8]
call fcn.00403e10
ret

Function at 0x40bf5c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xffffffec
push edi
mov eax, dword [0x450740]
call fcn.0040bee8
push eax
call sub.user32.dll_GetWindowTextA
xor esi, esi
jmp 0x40bfa7
mov al, byte [edi + esi + 6]
mov bl, byte [edi + esi + 7]
sub bl, al
jb 0x40bfa4
inc ebx
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
and eax, 0xff
bts dword [0x44e10c], eax
inc byte [ebp - 1]
dec bl
jne 0x40bf8e
add esi, 2
cmp esi, 0xc
jge 0x40bfb6
mov al, byte [edi + esi + 6]
or al, byte [edi + esi + 7]
jne 0x40bf7e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x41b2c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b2c6
ret
Function at 0x41ca18
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x41ca98]
mov eax, ebx
call fcn.0041cf08
mov dl, byte [0x41ca9c]
mov eax, dword [ebp - 4]
call fcn.0041cf08
mov edx, dword [ebx + 0x20]
push edx
mov edx, dword [edi + 0xc]
sub edx, dword [edi + 4]
push edx
mov edx, dword [edi + 8]
sub edx, dword [edi]
push edx
mov edx, dword [edi + 4]
push edx
mov edx, dword [edi]
push edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
push edx
mov edx, dword [esi + 0xc]
sub edx, dword [esi + 4]
push edx
mov edx, dword [esi + 8]
mov eax, dword [esi]
sub edx, eax
push edx
mov edx, dword [esi + 4]
push edx
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x41caa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x41cb3d
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
jne 0x41cb3d
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x10]
mov dl, byte [0x41cb48]
mov eax, ebx
call fcn.0041cf08
mov eax, dword [ebx + 0x14]
call fcn.0041c7a0
call fcn.0041bb1c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursorPos
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.0041bb1c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
add ecx, edi
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004121cc
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41cfa4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0xc]
call fcn.0041bff0
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClientRect
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x18]
call fcn.0041bb1c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetKeyNameTextA
pop ebx
ret
Function at 0x41d000
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
call fcn.0041c7dc
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx + 0x14]
call fcn.0041c7dc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetClientRect
mov eax, dword [ebx + 0x14]
call fcn.0041c8bc
test al, al
jne 0x41d053
mov eax, dword [ebx + 0x14]
call fcn.0041c7a0
call fcn.0041bb1c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursorPos
push 2
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetDC
pop ebx
ret
mov eax, dword [ebx + 0x14]
call fcn.0041c7a0
call fcn.0041bb1c
not eax
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetCursorPos
push 1
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_GetDC
pop ebx
ret
Function at 0x41d230
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
push 0
call sub.user32.dll_CallNextHookEx
mov dword [ebp - 0x18], eax
push 0
call sub.user32.dll_CallNextHookEx
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x41d37e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
push 0x18
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DrawIconEx
test bl, bl
je 0x41d292
push 0
push 1
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_CharLowerA
mov dword [ebp - 0x10], eax
jmp 0x41d2f4
push 0
call fcn.00406308
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41d2a7
call fcn.0041d178
xor eax, eax
push ebp
push 0x41d2ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_BeginPaint
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41d2d4
call fcn.0041d178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d2f4
mov eax, dword [ebp - 0x14]
push eax
push 0
call fcn.00406540
ret
cmp dword [ebp - 0x10], 0
je 0x41d35e
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetClientRect
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetClientRect
mov esi, eax
push 0xcc0020
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetKeyboardLayoutList
test ebx, ebx
je 0x41d350
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_GetClientRect
test esi, esi
je 0x41d35e
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_GetClientRect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d385
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_DefMDIChildProcA
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_DefMDIChildProcA
ret
Function at 0x42acc0
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push esp
push ebx
call sub.user32.dll_EnumThreadWindows
push 0
mov eax, dword [esp + 8]
sub eax, edi
push eax
mov eax, dword [esp + 8]
sub eax, esi
push eax
push ebx
call sub.user32.dll_GetKeyboardLayout
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x430a74
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or word [ebx + 0x54], 0x80
push esi
call sub.user32.dll_GetClassNameA
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.0042acc0
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0
push 0
push esi
call sub.user32.dll_EnumWindows
xor edi, edi
xor eax, eax
mov dword [ebp - 8], eax
push 0xffffffffffffffec
mov eax, ebx
call fcn.00432a38
push eax
call fcn.00406408
test ah, 2
je 0x430ad9
mov dword [ebp - 8], 0xa
mov edi, 0x200f
jmp 0x430afb
push 0xfffffffffffffff0
mov eax, ebx
call fcn.00432a38
push eax
call fcn.00406408
test eax, 0x800000
je 0x430afb
mov dword [ebp - 8], 3
mov edi, 0xa00f
test edi, edi
je 0x430b48
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.004065c0
push edi
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00406250
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.0042acc0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push 0
push 0
push esi
call sub.user32.dll_EnumWindows
push 0
mov ecx, esi
mov edx, 0x14
mov eax, ebx
call fcn.0042d4f0
push 0
mov ecx, esi
mov edx, 0xf
mov eax, ebx
call fcn.0042d4f0
mov eax, dword [ebx + 0x19c]
test eax, eax
je 0x430baf
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x430baf
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x19c]
call fcn.00413600
cmp byte [eax + 0x57], 0
je 0x430ba7
mov edx, dword [eax + 0x44]
push edx
mov ecx, dword [eax + 0x40]
mov edx, esi
call fcn.00430a74
inc dword [ebp - 4]
dec dword [ebp - 0x10]
jne 0x430b85
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.user32.dll_GetClassInfoA
and word [ebx + 0x54], 0xff7f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409d20
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa88
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.004084d0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x409d50
mov eax, dword [ebp - 0xc]
jmp 0x409e71
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
lea ecx, [ebp - 0x678]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
add eax, 0x218
push eax
lea ecx, [ebp - 0x880]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str..png
lea edx, [ebp - 0x678]
push edx
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x268]
push ecx
lea edx, [ebp - 0x470]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x409e6f
lea eax, [ebp - 0x23c]
push eax
call fcn.0040a140
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x409ddd
mov edx, dword [ebp - 0x268]
and edx, 0x10
je 0x409ddf
jmp 0x409e4c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x23c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x678]
push ecx
lea edx, [ebp - 0x470]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp - 0x880]
push ecx
lea edx, [ebp - 0xa88]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [ebp - 0xa88]
push ecx
lea edx, [ebp - 0x470]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00409e80
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x268]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x409dbc
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x40a0a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov dword [ebp - 8], ecx
push 0x438fa0
mov eax, dword [ebp - 8]
add eax, 0x10
push eax
lea ecx, [ebp - 0x460]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40a133
lea ecx, [ebp - 0x22c]
push ecx
call fcn.0040a140
add esp, 4
movzx edx, al
test edx, edx
jne 0x40a103
mov eax, dword [ebp - 0x258]
and eax, 0x10
jne 0x40a105
jmp 0x40a114
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp - 8]
call fcn.00409d20
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x40a0e2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov esp, ebp
pop ebp
ret
Function at 0x40b2e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov dword [ebp - 4], ecx
push 0x104
mov eax, dword [ebp - 4]
add eax, 0xa4
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov ecx, dword [ebp - 4]
add ecx, 0xa4
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.cache.db
mov edx, dword [ebp - 4]
add edx, 0xa4
push edx
mov eax, dword [ebp - 4]
add eax, 0x2ac
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.folders.lst
mov ecx, dword [ebp - 4]
add ecx, 0xa4
push ecx
mov edx, dword [ebp - 4]
add edx, 0x4b4
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [ebp - 4]
add eax, 0x2ac
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b3d5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x64]
mov dword [ebp - 0x10], edx
push str.Building_cache...
push 0
push 0x40b
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40b38e
mov dword [ebp - 0x14], 1
jmp 0x40b395
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x44c]
call fcn.00409ba0
mov ecx, dword [ebp - 4]
add ecx, 0xa4
push ecx
lea ecx, [ebp - 0x44c]
call fcn.00409c50
mov edx, dword [ebp - 4]
add edx, 0x2ac
push edx
lea ecx, [ebp - 0x44c]
call fcn.00409cb0
lea ecx, [ebp - 0x44c]
call fcn.00409bf0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x64]
mov dword [ebp - 0x18], ecx
push str.Loading_icons...
push 0
push 0x40b
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40b401
mov dword [ebp - 0x1c], 1
jmp 0x40b408
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 4]
call fcn.0040b4e0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x40b41e
jmp 0x40b49f
mov eax, dword [ebp - 4]
add eax, 0x4b4
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x40
call fcn.0040a970
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x40b43d
jmp 0x40b49f
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x74]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0x21
push 0x30
push 0x48
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0xa4]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x40b472
jmp 0x40b49f
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x74]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
push 0
push 0x1003
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0040b6f0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x64]
mov dword [ebp - 0x24], eax
push 0
push 0
push 0x40b
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x40b4c8
mov dword [ebp - 0x28], 1
jmp 0x40b4cf
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b86a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push esi
push edi
push eax
push dword [esp + 0x24]
push edx
push ecx
call fcn.1001cef6
mov dword [esp + 0x20], 0x9de1
lea edi, [eax + 4]
add dword [esp + 0x20], 0xffffa523
or dword [esp + 0x20], 0x2eef3145
xor dword [esp + 0x20], 0x2eef2ead
mov dword [esp + 0x1c], 0x4c91
xor dword [esp + 0x1c], 0x474d33a8
shr dword [esp + 0x1c], 6
xor dword [esp + 0x1c], 0x11d03dc
mov dword [esp + 0x34], 0x2337
shl dword [esp + 0x34], 0xc
or dword [esp + 0x34], 0xf7dc17ba
xor dword [esp + 0x34], 0xf7ff792b
mov ecx, dword [eax]
mov eax, dword [edi]
add edi, 4
xor eax, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea esi, [eax + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
add esp, 8
mov eax, dword [esp + 0x18]
lea ecx, [esi + esi]
call fcn.10011b46
mov ebx, eax
mov dword [esp + 0x2c], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x1000b98c
shr esi, 2
xor eax, eax
push ebp
xor ebp, ebp
mov edx, ebx
lea ecx, [edi + esi*4]
mov esi, ecx
sub esi, edi
add esi, 3
shr esi, 2
cmp edi, ecx
cmova esi, eax
test esi, esi
je 0x1000b981
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
movzx eax, cl
mov word [edx], ax
mov eax, ecx
shr eax, 8
lea edx, [edx + 8]
movzx eax, al
mov word [edx - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebp
mov word [edx - 4], ax
movzx eax, cl
mov word [edx - 2], ax
cmp ebp, esi
jb 0x1000b948
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
pop ebp
mov word [ebx + eax*2], cx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x1000c0ab
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
push dword [esp + 0x24]
mov eax, 0x10001024
mov edi, ecx
push eax
push edx
push edi
call fcn.1001cef6
push edi
push eax
call fcn.1001cef6
mov dword [esp + 0x28], 0xfd7d
shl dword [esp + 0x28], 6
xor dword [esp + 0x28], 0x3bfaa88d
xor dword [esp + 0x28], 0xfa2b5c92
xor dword [esp + 0x28], 0xc1ee9a30
mov dword [esp + 0x24], 0x159a
add dword [esp + 0x24], 0xffffbe10
add dword [esp + 0x24], 0xb7da
xor dword [esp + 0x24], 0x8fab1617
xor dword [esp + 0x24], 0x8fabd8ed
mov dword [esp + 0x2c], 0x800a
xor dword [esp + 0x2c], 0xd68af5f8
xor dword [esp + 0x2c], 0xd68a4ed6
mov eax, dword [0x10001024]
mov ebp, dword [0x10001028]
xor ebp, eax
mov dword [esp + 0x30], eax
mov eax, ebp
mov ecx, ebp
and eax, 0xfffffffc
mov esi, ebp
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
add esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, esi
call fcn.10011b46
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test eax, eax
je 0x1000c1be
shr esi, 2
mov edx, 0x1000102c
push ebx
xor ebx, ebx
and dword [esp + 0x18], ebx
lea ecx, [esi*4 + 0x1000102c]
mov esi, ecx
sub esi, edx
add esi, 3
shr esi, 2
cmp ecx, edx
cmovb esi, dword [esp + 0x18]
test esi, esi
je 0x1000c1b7
mov ecx, eax
sub ecx, edx
mov eax, dword [edx]
xor eax, dword [esp + 0x1c]
inc ebx
mov dword [ecx + edx], eax
lea edx, [edx + 4]
cmp ebx, esi
jb 0x1000c1a2
mov eax, dword [esp + 0x14]
pop ebx
test edi, edi
je 0x1000c1be
mov dword [edi], ebp
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x1000f396
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
push edx
push ecx
call fcn.1001cef6
and dword [ebp - 8], 0
add esp, 0x10
and dword [ebp - 4], 0
xor edx, edx
mov dword [ebp - 0xc], 0x2d320
mov dword [ebp + 8], 0xf760
mov eax, dword [ebp + 8]
push 0x48
pop ecx
div ecx
mov dword [ebp + 8], eax
or dword [ebp + 8], 0x44468609
xor dword [ebp + 8], 0x44468664
cmp dword [esi + 4], 0x40
jae 0x1000f3e9
xor eax, eax
jmp 0x1000f410
mov ecx, dword [esi]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1000f3e5
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000f3e5
movzx edx, word [eax + 0x18]
xor esi, esi
mov ecx, dword [ebp + 8]
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret