joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40596d
pop dword [ebp - 0x48]
mov eax, 0x449d1997
sub eax, 0x445cc02a
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x5509cf23
add dword [ebp - 0x58], 0xf9487628
mov dword [ebp - 0x54], 0x4cbcaacc
sub dword [ebp - 0x54], 0x1a895e87
mov dword [ebp - 0x50], 0x2cef1a02
add dword [ebp - 0x50], 0x1f5d2a2c
mov dword [ebp - 0x4c], 0x799295a2
sub dword [ebp - 0x4c], 0x799295a2
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x64edc96a
sub dword [ebp - 0x58], 0xf07b6014
mov dword [ebp - 0x54], 0x2d6ff5cf
add dword [ebp - 0x54], 0x13fc6ba6
mov dword [ebp - 0x50], 0x578e864d
sub dword [ebp - 0x50], 0xf41f19e1
mov dword [ebp - 0x4c], 0x32b4874e
sub dword [ebp - 0x4c], 0x32b4874e
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x99b11ae
add eax, 0xf6a55f52
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x38ebf
push 0
call eax
mov ecx, 0x50d2
xor ebx, ebx
add ebx, eax
mov edx, 0x97e52b09
sub edx, 0x97a42b09
add edx, dword [ebp - 0x48]
mov edi, 0x285c4e43
xor dword [ebp - 0x18], edx
mov esi, dword [edx]
sub dword [ebp - 0x38], esi
sub esi, edi
add dword [ebp - 0x18], edi
mov dword [ebx], esi
add ebx, 4
add edx, 4
loop 0x405a80
add eax, 0x645f01dd
add eax, 0x9ba2343e
mov ebx, eax
add eax, 0xe6653577
add eax, 0x199aca8e
mov ecx, 0xb248da67
sub ecx, 0xb208da67
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x1006205
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100b2d0]
push edi
xor edi, edi
cmp word [0x100c898], di
mov dword [ebp - 4], eax
jne 0x1006247
cmp dword [0x100c884], edi
jne 0x100623e
call fcn.010043ec
test eax, eax
je 0x1006259
cmp word [0x100c898], di
jne 0x1006247
call fcn.01004bc8
test eax, eax
je 0x1006259
call fcn.0100435e
test eax, eax
je 0x1006259
call fcn.01005f21
test eax, eax
jne 0x1006260
xor eax, eax
jmp 0x100636a
push ebx
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x1001264
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.010066cf
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, edi
mov ebx, 0x100bc44
je 0x10062b3
push 0x10014a8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10062b3
push edi
push ebx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x100c884], edi
jne 0x10062da
cmp dword [0x100c490], edi
jne 0x10062da
call fcn.010047b3
test eax, eax
jne 0x10062da
xor eax, eax
jmp 0x1006368
push ebx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1006301
push edi
push 0x10
push edi
push edi
push 0x4bc
push edi
call fcn.01003ebe
call fcn.01003aa1
mov dword [0x100ba5c], eax
jmp 0x10062d3
cmp dword [0x100c88c], edi
jne 0x1006312
call fcn.01005a36
test eax, eax
je 0x10062d3
test byte [0x100cba8], 0xc0
jne 0x1006330
xor eax, eax
mov ax, word [0x100ba64]
push eax
call fcn.01001f93
mov dword [0x100bb84], eax
jmp 0x1006336
mov dword [0x100bb84], edi
cmp dword [0x100c884], edi
jne 0x100634f
cmp dword [0x100c490], edi
jne 0x100634f
call fcn.01005abc
test eax, eax
je 0x10062d3
cmp word [0x100c898], di
jne 0x1006365
cmp dword [0x100c884], edi
jne 0x1006365
call fcn.01004de5
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010064de
leave
ret

Function at 0x100645c
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.0131e000
jmp fcn.010063e0

Function at 0x100672a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1006741
xor eax, eax
jmp 0x1006749
shr eax, 4
not eax
and eax, 1
pop ebp
ret 4
Function at 0x10004c1d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x14
pop ebp
jmp fcn.10002548
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x405a12
pop dword [ebp - 0x30]
mov eax, 0xdec64219
add eax, 0x217a17f9
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x95aab45a
add dword [ebp - 0x40], 0xb8a790f1
mov dword [ebp - 0x3c], 0xc262999d
sub dword [ebp - 0x3c], 0x902f4d58
mov dword [ebp - 0x38], 0x8cec9996
sub dword [ebp - 0x38], 0x40a05568
mov dword [ebp - 0x34], 0xb3fe64be
sub dword [ebp - 0x34], 0xb3fe64be
lea eax, [ebp - 0x40]
push eax
mov eax, 0x7cd18a73
add eax, 0x836ef691
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x42ab8812
sub dword [ebp - 0x40], 0xce391ebc
mov dword [ebp - 0x3c], 0x3604f265
sub dword [ebp - 0x3c], 0xf49890f0
mov dword [ebp - 0x38], 0x5df70d86
add dword [ebp - 0x38], 0x5785ee6
mov dword [ebp - 0x34], 0x489c268f
sub dword [ebp - 0x34], 0x489c268f
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3689c
push 0
call eax
mov ecx, 0xf69d6c92
add ecx, 0x962d9a9
xor edx, edx
add edx, eax
mov esi, 0x7ec2be45
sub esi, 0x7e7bda45
add esi, dword [ebp - 0x30]
mov ebx, 0x239b1f83
xor dword [ebp - 0x10], 0x6209da7d
mov edi, dword [esi]
sub edi, ebx
add dword [ebp - 0x14], edx
mov dword [edx], edi
sub dword [ebp - 0x18], 0x96cf5a8f
add edx, 0xe019adef
add edx, 0x1fe65215
add esi, 4
loop 0x405b2b
add eax, 0x10bbf
xor ebx, ebx
add ebx, eax
add eax, 0xea6f000a
sub eax, 0xea6f0005
mov ecx, 0xc71c76c6
sub ecx, 0xc6dc76c6
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x10003a10
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x204]
sub esp, 0x204
push 0xffffffffffffffff
push 0x1006108d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp + 0x200], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x20c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov edi, dword [ebx + 4]
push ecx
or edi, 0x2001f
mov dword [ebp - 0x20], 0
push edi
push 0
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x18]
test esi, esi
jne 0x10003b4f
test eax, eax
je 0x10003ab1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x20]
and edi, 0x300
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
test esi, esi
jne 0x10003b4f
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0x100
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp]
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10003b27
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x18]
call fcn.10003a10
mov esi, eax
test esi, esi
jne 0x10003b4f
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10003af1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10003b3c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0
push dword [ebp - 0x24]
mov ecx, ebx
mov dword [ebp - 0x14], 0
call fcn.10003c00
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10003b6b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 0
mov eax, esi
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.1004d46a
lea esp, [ebp + 0x204]
pop ebp
ret 4
Function at 0x10004ae0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x10061155
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x10004b87
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x10004b87
call fcn.10002e80
mov edi, eax
jmp 0x10004c8d
push dword [ebp - 0x14]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10004ba2
call fcn.10002e80
jmp 0x10004c80
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x10004bbd
call fcn.10002e80
jmp 0x10004c80
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x1c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x10004bdb
mov edi, 0x8007000e
jmp 0x10004c82
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
test edx, edx
ja 0x10004ccf
jb 0x10004bff
cmp eax, 0xffffffff
ja 0x10004ccf
cmp eax, 0x400
jbe 0x10004c18
push eax
lea ecx, [ebp]
call fcn.10002e50
mov dword [ebp - 4], 1
jmp 0x10004c3d
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x10004c3d
mov eax, dword [ebp]
test eax, eax
jne 0x10004c4b
mov edi, 0x8007000e
jmp 0x10004c82
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x10004c66
call fcn.10002e80
jmp 0x10004c80
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x41c]
push dword [ebp]
lea ecx, [ebp - 0x24]
call fcn.10004980
mov edi, eax
test esi, esi
je 0x10004c8d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x10004ca1
lea ecx, [ebp]
call fcn.10002e00
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.1004d46a
lea esp, [ebp + 0x408]
pop ebp
ret 0x10
push 0x80070216
call fcn.10005390
int3
Function at 0x1000b500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100620b1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x100ae614]
mov edx, dword [eax + edx*4]
mov eax, dword [0x100aeee8]
cmp eax, dword [edx + 4]
jle 0x1000b582
push 0x100aeee8
call fcn.1004d957
add esp, 4
cmp dword [0x100aeee8], 0xffffffff
jne 0x1000b582
mov dword [ebp - 4], 0
push 0x1006d650
call fcn.1004d8c6
mov dword [ebp - 4], 0xffffffff
push 0x100aeee8
call fcn.1004d906
add esp, 8
mov edx, dword [ebp + 8]
mov edi, edx
cmp dword [edx + 0x14], 7
mov ebx, dword [edx + 0x10]
jbe 0x1000b592
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x1000b5b1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1000b5a0
push esi
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push edx
push eax
mov ecx, esi
call fcn.1000fc00
mov edx, dword [eax + 4]
mov eax, 0x100adb0c
test edx, edx
je 0x1000b5d6
cmp edx, dword [esi + 4]
lea ecx, [edx + 0x20]
cmovne eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10010410
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062de0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 7
mov eax, dword [edx + 0x10]
jbe 0x1001044a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x1001046b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10010457
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.1000fc00
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1001049c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x100105fb
lea eax, [ebx + 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x38
push 0x40
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0x14], edi
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.100057f0
mov byte [ebp - 4], 1
lea ecx, [edi + 0x20]
mov eax, dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.100057f0
mov dword [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1009d870]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1009d870]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x1001058f
divss xmm0, xmm3
call fcn.100106e0
call fcn.10060ce0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10010573
cmp eax, 0x200
jae 0x10010571
shl eax, 3
cmp eax, ecx
jae 0x10010573
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1000e760
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1000fc00
mov edx, dword [eax]
jmp 0x10010592
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov dword [ebp - 0x14], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x100105c1
mov dword [ecx + eax*8], edi
jmp 0x100105d3
cmp esi, edx
jne 0x100105ca
mov dword [ecx + eax*8], edi
jmp 0x100105d7
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100105d7
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1004cc5a
int3
Function at 0x100116c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100610c0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10011747
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10011747
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10011727
cmp esi, edx
jae 0x10011747
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10011715
cmp esi, edx
jae 0x10011747
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100122f0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100631a7
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.10009d60
add eax, 0x10
mov dword [ebp - 0x280], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x280]
call fcn.10012280
push 1
push 0x10093f1c
lea ecx, [ebp - 0x280]
call fcn.10011800
lea ecx, [ebp - 0x278]
call fcn.10012500
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x278]
mov esi, dword [ebp - 0x280]
push esi
call fcn.10018110
or ebx, 0xffffffff
test eax, eax
je 0x100124a8
cmp dword [ebp - 0x1c], 0
je 0x100123c5
mov eax, dword [ebp - 0x274]
shr eax, 4
test eax, 1
je 0x100123c5
cmp word [ebp - 0x248], 0x2e
jne 0x100123c5
mov ax, word [ebp - 0x246]
test ax, ax
je 0x1001247f
cmp ax, 0x2e
jne 0x100123c5
cmp word [ebp - 0x244], 0
je 0x1001247f
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x278]
call fcn.10018680
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], 0
je 0x10012424
test byte [ebp - 0x274], 0x10
je 0x10012424
mov dl, 1
lea ecx, [ebp - 0x27c]
call fcn.100122f0
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x10012417
and eax, 0xfffffffe
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x27c]
call fcn.10012690
jmp 0x1001244f
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x10012444
and eax, 0xfffffffe
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x27c]
call fcn.100129b0
mov byte [ebp - 4], 2
mov eax, ebx
mov ecx, dword [ebp - 0x27c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1001247f
mov ebx, dword [ecx]
push ecx
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x1006e578]
mov ecx, ebx
call edi
or ebx, 0xffffffff
mov eax, dword [ebp - 0x278]
test eax, eax
je 0x100124a8
cmp dword [ebp - 0x1c], 0
je 0x100124a8
lea ecx, [ebp - 0x274]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10012381
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x278]
call fcn.100125d0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x100124df
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d46a
mov esp, ebp
pop ebp
ret
Function at 0x10013210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100633f7
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x220], edi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x224], edi
push 0
push eax
mov dword [ebp - 0x21c], 0
call fcn.1004f1c0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
lea ecx, [ebp - 0x218]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
lea edx, [ecx + 2]
mov dword [edi + 0x14], 0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100132a0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.10002cb0
mov dword [ebp - 4], 0
mov dword [ebp - 0x21c], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d46a
mov esp, ebp
pop ebp
ret
Function at 0x100132f0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063456
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x4c], esi
movups xmm0, xmmword [ebx + 8]
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x40], xmm0
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0x400
lea eax, [ebp - 0x40]
mov dword [ebp - 0x48], 1
push eax
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x10013461
mov edx, dword [ebp - 0x44]
xorps xmm0, xmm0
mov ecx, edx
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100133c0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.10002cb0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x2c]
cmp esi, eax
je 0x10013416
mov ecx, esi
call fcn.10005610
movups xmm0, xmmword [ebp - 0x2c]
mov eax, 7
xor ecx, ecx
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
jmp 0x10013419
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0
cmp eax, 7
jbe 0x1001344d
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov edx, ecx
cmp eax, 0x1000
jb 0x10013442
mov ecx, dword [edx - 4]
sub edx, ecx
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1001348f
test ecx, ecx
je 0x1001344d
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x1001346f
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1004d46a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10050fef
int3