joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1023cd6
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
push dword [esi + 0x88]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push dword [esi + 0x80]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x80]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 6
push dword [esi + 0x80]
call fcn.0100d5cb
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push dword [esi + 0x88]
call edi
mov ecx, esi
call fcn.0100e35f
and dword [esi + 0x80], 0
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x41b
add esi, 0x84
push dword [esi]
call ebx
push eax
call edi
push 1
push 0x41c
push dword [esi]
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x1023f58
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x104c674
call fcn.01002009
mov esi, ecx
cmp dword [ebp + 8], 0
jne 0x1024020
mov eax, dword [esi + 0x368]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov eax, dword [esi + 0x130]
push 5
push eax
call edi
push 0x1f0
call fcn.01002286
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
test ecx, ecx
je 0x102401c
push dword [esi + 0x120]
lea eax, [esi + 0x364]
push eax
push dword [esi + 0xec]
lea eax, [esi + 0x358]
push dword [esi + 0xe8]
push dword [esi + 0xe4]
push eax
push 0xb4
push 0xaa
lea eax, [esi + 0x1b8]
push eax
lea eax, [esi + 0x12c]
push eax
call fcn.010241a2
or dword [ebp - 4], 0xffffffff
mov ecx, eax
mov dword [esi + 0x128], eax
push dword [ebp + 8]
call fcn.0102402d
cmp dword [ebp + 8], 0
jne 0x1024014
mov ecx, dword [esi + 0xf0]
push 1
push dword [esi + 0x128]
call fcn.0100bfef
call fcn.01001f6b
ret 4
xor eax, eax
jmp 0x1023fe7
mov ecx, dword [esi + 0x128]
jmp 0x1023ff3

Function at 0x1032a00
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push 0
push dword [esi + 0x120]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x1054304], 3
jne 0x1032a2c
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov ecx, esi
call fcn.0101515a
push 1
mov ecx, 0x1054210
call fcn.0100ecc9
mov ecx, 0x1054574
pop esi
jmp 0x10338c3
xor eax, eax
push eax
cmp byte [ecx + 8], al
je 0x10338d4
mov byte [ecx + 8], al
call fcn.0100d4d6
ret
mov byte [ecx + 8], 1
call fcn.01003349
ret

Function at 0x1033990
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x40
lea eax, [ebp - 0x84]
mov esi, ecx
push eax
push dword [esi + 0x410]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x88]
push eax
push 0x40
lea eax, [ebp - 0x84]
push eax
call fcn.01003235
mov edi, eax
test edi, edi
jne 0x1033a0a
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 8]
add eax, eax
mov word [ebp + eax - 0x84], cx
xor ecx, ecx
mov word [ebp + eax - 0x82], cx
lea eax, [ebp - 0x84]
push eax
push dword [esi + 0x410]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
sete al
pop edi
xor ecx, ebp
pop esi
call fcn.01001e8f
leave
ret 4
Function at 0x10364c5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x404], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x3e6
push eax
mov word [ebp - 0x400], ax
lea eax, [ebp - 0x3fe]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
push 0xa
mov word [esi], ax
lea eax, [ebp - 0x18]
push eax
push 0xc
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x18]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1036523
sub eax, ecx
sar eax, 1
add eax, eax
push 0x20
pop ecx
mov word [ebp + eax - 0x18], cx
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
mov word [ebp + eax - 0x16], cx
mov ebx, 0x10366e4
mov edi, 0x1f4
jle 0x103659e
push dword [ebp + 0x10]
lea eax, [ebp - 0x400]
push ebx
push edi
push eax
call fcn.01013d45
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
test eax, eax
jne 0x1036594
cmp dword [ebp + 0x10], 1
push dword [ebp + 0xc]
push esi
jle 0x103658a
push 0x390
jmp 0x103658f
push 0x391
call fcn.0103645d
mov dword [ebp - 0x404], 1
cmp dword [ebp + 0x14], 0
jle 0x1036609
cmp dword [ebp - 0x404], 0
je 0x10365bc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
jmp 0x10365c6
mov dword [ebp - 0x404], 1
push dword [ebp + 0x14]
lea eax, [ebp - 0x400]
push ebx
push edi
push eax
call fcn.01013d45
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
test eax, eax
jne 0x1036609
cmp dword [ebp + 0x14], 1
push dword [ebp + 0xc]
push esi
jle 0x10365ff
push 0x392
jmp 0x1036604
push 0x393
call fcn.0103645d
cmp dword [ebp + 0x18], 0
jle 0x1036674
cmp dword [ebp - 0x404], 0
je 0x1036627
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
jmp 0x1036631
mov dword [ebp - 0x404], 1
push dword [ebp + 0x18]
lea eax, [ebp - 0x400]
push ebx
push edi
push eax
call fcn.01013d45
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
test eax, eax
jne 0x1036674
cmp dword [ebp + 0x18], 1
push dword [ebp + 0xc]
push esi
jle 0x103666a
push 0x394
jmp 0x103666f
push 0x395
call fcn.0103645d
cmp dword [ebp + 0x1c], 0
jle 0x10366d3
cmp dword [ebp - 0x404], 0
je 0x1036690
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
push dword [ebp + 0x1c]
lea eax, [ebp - 0x400]
push ebx
push edi
push eax
call fcn.01013d45
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
test eax, eax
jne 0x10366d3
cmp dword [ebp + 0x1c], 1
push dword [ebp + 0xc]
push esi
jle 0x10366c9
push 0x396
jmp 0x10366ce
push 0x397
call fcn.0103645d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001e8f
leave
ret 0x18
Function at 0x1038ee2
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x580
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x57c], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x64
pop ebx
push ebx
lea eax, [ebp - 0xcc]
mov esi, ecx
push eax
push dword [esi + 0x80]
call edi
cmp word [ebp - 0xcc], 0
mov byte [ebp - 0x575], 0
jne 0x1038f41
cmp dword [ebp + 8], 0x2b
jne 0x1038f3a
mov ecx, esi
call fcn.01038b99
mov al, 1
jmp 0x10390ee
push ebx
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [0x1054300]
mov ecx, dword [eax + 0x10]
call fcn.010039b1
push dword [0x1054054]
lea eax, [ebp - 0xcc]
push 4
push ebx
push eax
call fcn.0100428a
mov dword [ebp - 0x580], eax
test eax, eax
jne 0x103908f
mov ecx, dword [0x1054300]
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.01035bac
test eax, eax
je 0x103908f
push ebx
lea eax, [ebp - 0xcc]
push eax
push dword [esi + 0x80]
call edi
cmp dword [ebp + 8], 0xd
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x1038fbc
cmp dword [ebp + 8], 9
jne 0x1038fca
cmp word [ebp - 0xcc], 0
je 0x103905d
push 0
push dword [esi + 0x90]
push 0x182
push dword [esi + 0x88]
call edi
cmp word [ebp - 0xcc], 0
je 0x103905d
mov eax, dword [0x1054300]
mov ecx, dword [eax + 0x10]
call fcn.0100e845
test eax, eax
je 0x103902f
push 0x54
lea eax, [ebp - 0x174]
push eax
mov eax, dword [ebp - 0x57c]
push eax
push 0x2d
pop ecx
xor edx, edx
cmp cx, word [eax]
sete dl
push edx
push dword [0x1054050]
push 0x1055580
call fcn.0104275e
lea eax, [ebp - 0x174]
push eax
jmp 0x1039035
push dword [ebp - 0x57c]
push dword [esi + 0x90]
push 0x181
push dword [esi + 0x88]
call edi
push 0
push dword [esi + 0x90]
push 0x186
push dword [esi + 0x88]
jmp 0x103907d
mov ebx, dword [esi + 0x90]
mov ecx, esi
call fcn.01038965
push 0
cmp eax, ebx
jne 0x1039071
dec ebx
push ebx
push 0x186
push dword [esi + 0x88]
call edi
mov ecx, esi
call fcn.01038a4c
mov byte [ebp - 0x575], 1
jmp 0x10390db
xor eax, eax
cmp dword [ebp - 0x57c], eax
je 0x10390a1
push dword [ebp - 0x57c]
jmp 0x10390d4
cmp dword [ebp - 0x580], 0x77
push 0x200
lea ecx, [ebp - 0x574]
push ecx
jne 0x10390ba
push 0x77
jmp 0x10390bf
push 0xdd
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x574]
push eax
mov ecx, esi
call fcn.01038446
push dword [ebp - 0x57c]
call dword [sym.imp.msvcrt.dll_free]
mov al, byte [ebp - 0x575]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001e8f
leave
ret 4
Function at 0x10417c9
Capabilities:
Get geographical location
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1041934
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1041920
push eax
mov dword [esi + 0x1c], eax
call edi
push 0x1041900
push dword [esi + 0x1c]
mov dword [esi], eax
call edi
push 0x10418e0
push dword [esi + 0x1c]
mov dword [esi + 8], eax
call edi
push 0x10418c8
push dword [esi + 0x1c]
mov dword [esi + 4], eax
call edi
push 0x10418b0
push dword [esi + 0x1c]
mov dword [esi + 0xc], eax
call edi
push 0x1041894
push dword [esi + 0x1c]
mov dword [esi + 0x10], eax
call edi
push 0x104187c
push dword [esi + 0x1c]
mov dword [esi + 0x14], eax
call edi
push 8
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x2c]
push eax
push 0x1009
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x20], eax
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01001e8f
leave
ret
Function at 0x10440c2
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push 0x43c
mov eax, 0x104fd4e
call fcn.01001ea1
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x428], ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 4], ebx
mov edi, ecx
mov dword [ebp - 0x42c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x100247c
mov ecx, esi
call fcn.010127cb
push ebx
push 0x1a
lea eax, [ebp - 0x218]
push eax
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x104420f
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.010127f7
push 0x1044220
mov ecx, esi
call fcn.0103c2e7
lea eax, [edi + 0x1c]
push eax
mov ecx, esi
mov dword [ebp - 0x424], eax
call fcn.0103c04e
push 0x104421c
mov ecx, esi
call fcn.0103c2e7
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x104417b
mov eax, dword [edi]
jmp 0x104417d
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10441a1
cmp dword [esi + 0x18], 8
jb 0x1044193
mov eax, dword [edi]
jmp 0x1044195
mov eax, edi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, ebx
jne 0x10441e9
mov eax, dword [ebp - 0x424]
cmp dword [eax + 0x18], 8
jb 0x10441b2
mov eax, dword [eax + 4]
jmp 0x10441b5
add eax, 4
cmp dword [esi + 0x18], 8
jb 0x10441bd
mov edi, dword [edi]
lea ecx, [ebp - 0x420]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0x100247c
mov ecx, esi
call fcn.010127f7
lea eax, [ebp - 0x420]
push eax
mov ecx, esi
call fcn.0103c2e7
jmp 0x104420f
lea ecx, [ebp - 0x448]
call fcn.010167e3
xor edi, edi
inc edi
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.01017387
push ebx
push edi
lea ecx, [ebp - 0x448]
call fcn.0101212a
mov eax, esi
call fcn.01001f5c
ret 4
Function at 0x1045f80
Capabilities:
Delete file

Disassembly:
push 0x60
mov eax, 0x1050399
call fcn.01001ea1
mov esi, ecx
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x6c]
push 0x1030388
push eax
call fcn.01043751
push 0x103036c
push eax
lea eax, [ebp - 0x2c]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.01043f80
add esp, 0x18
push edi
push 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0101212a
push 0x100247c
mov ecx, esi
call fcn.0103ab0e
test eax, eax
jne 0x1045fec
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0101212a
mov eax, esi
call fcn.01001f5c
ret
push 0xffffffffffffffff
push edi
push esi
lea ecx, [ebp - 0x2c]
call fcn.0103b23f
mov edi, 0x1030324
push edi
lea ecx, [ebp - 0x50]
call fcn.010127cb
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x34]
lea ebx, [esi + 0x48]
push eax
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.01043de6
mov eax, dword [eax]
push 0
push 1
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 2
call fcn.0101212a
mov eax, dword [esi + 0x4c]
cmp dword [ebp - 0x30], eax
je 0x1046072
push edi
lea ecx, [ebp - 0x50]
call fcn.010127cb
lea eax, [ebp - 0x50]
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.01045626
cmp dword [eax + 0x18], 8
jb 0x104605c
mov eax, dword [eax + 4]
jmp 0x104605f
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.0101212a
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x104607e
lea eax, [ebp - 0x28]
push eax
push 0x80000001
mov ecx, esi
call fcn.0104395a
mov esi, eax
jmp 0x1045fd8
Function at 0x1046196
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x46c
mov eax, 0x1050474
call fcn.01001ea1
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x418], ax
xor esi, esi
lea eax, [ebp - 0x416]
push esi
push eax
mov ebx, ecx
call sub.msvcrt.dll_memset
push 0x60
mov dword [ebp - 0x448], 0x104
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x43c], esi
call fcn.01002286
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0x420], ecx
mov dword [ebp - 4], esi
cmp ecx, esi
je 0x1046225
add ebx, 0x1c
push ebx
call fcn.0101677e
mov dword [ebp - 0x41c], eax
jmp 0x104622b
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x45c]
push eax
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x424]
push eax
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x10463cd
cmp dword [ebp - 0x424], esi
je 0x10463ca
lea ecx, [ebp - 0x454]
call fcn.0101749f
mov dword [ebp - 4], 1
mov dword [ebp - 0x428], esi
cmp dword [ebp - 0x424], esi
jbe 0x1046381
lea eax, [ebp - 0x45c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x440], 0xff
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x1046369
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x478]
call fcn.010127cb
mov ecx, dword [ebp - 0x41c]
lea eax, [ebp - 0x478]
push eax
mov byte [ebp - 4], 2
call fcn.01045aa5
push esi
push 1
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 1
call fcn.0101212a
mov ecx, dword [ebp - 0x41c]
call fcn.01046097
test eax, eax
je 0x1046342
mov ecx, dword [ebp - 0x41c]
call fcn.010438f4
test eax, eax
je 0x1046369
lea eax, [ebp - 0x420]
mov dword [ebp - 0x420], ebx
push eax
lea ecx, [ebp - 0x454]
inc ebx
call fcn.01045715
lea ecx, [ebp - 0x210]
push ecx
mov ecx, eax
call fcn.010127f7
inc dword [ebp - 0x428]
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x424]
jb 0x10462b7
xor edi, edi
cmp ebx, esi
jbe 0x10463bb
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x420], edi
call fcn.01045715
mov ecx, dword [ebp - 0x41c]
push eax
call fcn.01045aa5
mov ecx, dword [ebp - 0x41c]
call fcn.01045f80
inc edi
cmp edi, ebx
jb 0x1046387
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.01045092
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x41c]
cmp ecx, esi
je 0x10463de
push 1
call fcn.01018a85
mov eax, ebx
call fcn.01001f5c
ret 4
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x31130e3f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x5f855f3c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10096eb
Capabilities:
Inspect load icon resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
push 1
push 0x261
push 0x1001da4
lea ecx, [ebp - 0x24]
call fcn.0101a2c6
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esi + 4], edi
call fcn.01012793
mov dword [ebp - 0x24], eax
test eax, eax
mov eax, 0x265
jge 0x100972c
mov word [ebp - 0x1e], ax
jmp 0x10097b0
cmp dword [ebp - 0x24], 0
mov word [ebp - 0x20], ax
jne 0x100973d
mov dword [esi + 0x14], 1
push esi
call fcn.010095bb
mov dword [ebp - 0x24], eax
test eax, eax
mov eax, 0x26b
jl 0x1009723
push 0x1001d88
mov word [ebp - 0x20], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 8], eax
test eax, eax
jne 0x1009774
call fcn.0101df25
mov dword [ebp - 0x24], eax
mov eax, 0x26e
jmp 0x1009723
and dword [ebp - 0x24], 0
push 0x9b
mov eax, 0x26e
push edi
mov word [ebp - 0x20], ax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10097a3
call fcn.0101df25
mov dword [ebp - 0x24], eax
mov eax, 0x273
jmp 0x1009723
and dword [ebp - 0x24], 0
mov eax, 0x273
mov word [ebp - 0x20], ax
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
call fcn.0101a59c
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x100a690
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
push 0xa19
push 0x1001e98
lea ecx, [ebp - 0x30]
call fcn.0101a2c6
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, 0xa21
cmp edi, ebx
jne 0x100a6d2
mov dword [ebp - 0x30], 0x80070057
mov word [ebp - 0x2a], ax
jmp 0x100a85b
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x2c], ax
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp eax, ebx
jne 0x100a6f4
call fcn.0101df25
mov dword [ebp - 0x30], eax
mov eax, 0xa27
jmp 0x100a6c9
mov ecx, 0xa27
mov word [ebp - 0x2c], cx
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 0x30], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x100a724
call fcn.0101df25
mov dword [ebp - 0x30], eax
mov eax, 0xa2a
jmp 0x100a848
mov eax, 0xa2a
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x2c], ax
cmp dword [ebp - 4], esi
jne 0x100a746
add eax, 5
mov dword [edi], esi
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x2c], ax
jmp 0x100a84c
cmp dword [ebp - 4], esi
mov dword [ebp + 8], esi
jle 0x100a832
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea esi, [eax + ecx*4]
mov ecx, dword [esi]
mov eax, ecx
lea edx, [eax + 2]
mov bx, word [eax]
inc eax
inc eax
test bx, bx
jne 0x100a762
sub eax, edx
sar eax, 1
mov dword [ebp - 0xc], eax
cmp eax, 9
jbe 0x100a7ae
push 9
push 0x1001cc0
push ecx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x100a7ae
mov dword [edi], 2
mov eax, dword [esi]
add eax, 0x12
push eax
lea eax, [edi + 4]
push eax
call fcn.0101b7b3
mov dword [ebp - 0x30], eax
test eax, eax
mov eax, 0xa39
jmp 0x100a81b
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x1001cd4
push dword [esi]
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x100a7cb
mov dword [edi], 3
jmp 0x100a821
push 0x1001ce8
push dword [esi]
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x100a7e2
mov dword [edi], 4
jmp 0x100a821
cmp dword [ebp - 0xc], 0xb
jbe 0x100a86f
push 0xb
push 0x1001d08
push dword [esi]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x100a86f
mov eax, dword [esi]
add eax, 0x16
push eax
lea eax, [edi + 8]
push eax
call fcn.0101b7b3
mov dword [ebp - 0x30], eax
test eax, eax
mov eax, 0xa45
jl 0x100a848
mov word [ebp - 0x2c], ax
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jl 0x100a752
xor ebx, ebx
cmp dword [edi], 2
jne 0x100a84c
cmp dword [edi + 4], ebx
jne 0x100a84c
mov eax, 0xa51
mov dword [ebp - 0x30], 0x80070057
mov word [ebp - 0x2a], ax
cmp dword [ebp - 8], 0
je 0x100a85b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x30]
call fcn.0101a59c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
mov eax, 0xa49
jmp 0x100a841
Function at 0x100acf1
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push 1
push 0xbb5
push 0x1001efc
lea ecx, [ebp - 0x28]
call fcn.0101a2c6
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, 0xbbb
cmp dword [ebp + 8], ebx
jne 0x100ad2e
mov dword [ebp - 0x28], 0x80070057
mov word [ebp - 0x22], ax
jmp 0x100ae76
mov word [ebp - 0x24], ax
mov eax, 0xbbc
cmp dword [ebp + 0xc], ebx
je 0x100ad1e
mov word [ebp - 0x24], ax
inc eax
cmp dword [ebp + 0x10], ebx
je 0x100ad1e
push 0x18
mov dword [ebp - 0x28], ebx
mov word [ebp - 0x24], ax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x100ad69
mov dword [ebp - 0x28], 0x8007000e
mov eax, 0xbc2
jmp 0x100ad25
push edi
push 6
pop ecx
push ebx
push ebx
xor eax, eax
mov edi, esi
push 1
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
call edi
mov dword [esi], eax
mov ebx, 0x80070000
test eax, eax
jne 0x100adb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100ad9c
and eax, 0xffff
or eax, ebx
mov dword [ebp - 0x28], eax
test eax, eax
mov eax, 0xbce
jl 0x100ae71
mov word [ebp - 0x24], ax
xor eax, eax
push eax
push eax
push 1
push eax
call edi
xor edi, edi
mov dword [esi + 4], eax
cmp eax, edi
jne 0x100ade7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100add3
and eax, 0xffff
or eax, ebx
mov dword [ebp - 0x28], eax
cmp eax, edi
mov eax, 0xbd8
jl 0x100ae71
mov word [ebp - 0x24], ax
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x100ab5d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x100ae21
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100ae11
and eax, 0xffff
or eax, ebx
mov dword [ebp - 0x28], eax
test eax, eax
mov eax, 0xbde
jl 0x100ae71
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
mov dword [eax], esi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100ae62
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100ae52
and eax, 0xffff
or eax, ebx
mov dword [ebp - 0x28], eax
test eax, eax
mov eax, 0xbe8
jl 0x100ae71
mov word [ebp - 0x24], ax
mov esi, dword [esi + 0x14]
test esi, esi
jge 0x100ae75
mov dword [ebp - 0x28], esi
mov eax, 0xbee
mov word [ebp - 0x22], ax
pop edi
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.0101a59c
mov eax, esi
pop esi
pop ebx
leave
ret 0xc