joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e793
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001e92b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jle 0x1001e808
mov dword [ebp - 0x10], 1
jmp 0x1001e80c
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x8e49
jle 0x1001e81e
mov dword [ebp - 0x14], 1
jmp 0x1001e822
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jl 0x1001e835
mov dword [ebp - 0x18], 1
jmp 0x1001e839
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jle 0x1001e84c
mov dword [ebp - 0x1c], 1
jmp 0x1001e850
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c]
jl 0x1001e863
mov dword [ebp - 0x54], 1
jmp 0x1001e867
and dword [ebp - 0x54], 0
push 3
mov ecx, dword [ebp - 0xc]
call fcn.10018040
mov esi, eax
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10018040
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1001e88c
mov dword [ebp - 0x20], 1
jmp 0x1001e890
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x20]
jge 0x1001e8a3
mov dword [ebp - 0x24], 1
jmp 0x1001e8a7
and dword [ebp - 0x24], 0
push 0
mov ecx, dword [ebp - 8]
call fcn.10018040
mov ecx, dword [ebp - 0x24]
sub ecx, 0x4e4a
mov eax, dword [eax]
sub eax, ecx
cmp eax, 0xfffffffb
je 0x1001e8cc
mov dword [ebp - 0x2c], 1
jmp 0x1001e8d0
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
cmp dword [ebp - 0x2c], eax
jl 0x1001e8e3
mov dword [ebp - 0x58], 1
jmp 0x1001e8e7
and dword [ebp - 0x58], 0
push 0
mov ecx, dword [ebp - 8]
call fcn.10018040
push 0
mov ecx, dword [ebp - 8]
call fcn.10018040
mov esi, eax
push 0
mov ecx, dword [ebp - 8]
call fcn.10018040
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1001e916
mov dword [ebp - 0x30], 1
jmp 0x1001e91a
and dword [ebp - 0x30], 0
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10018040
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1001e949
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x1001e949
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001ecfa
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ed0f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1001ed2c
push 0
push 0x17ca
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
pop ebp
ret
Function at 0x1002b310
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002b33e
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002b33c
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1002b35b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002b35b
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov esp, ebp
pop ebp
ret
Function at 0x1002dfb6
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002dfcc
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1002dfe2
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002dfe2
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov esp, ebp
pop ebp
ret

Function at 0x1002fa23
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x5005
push 1
lea eax, [ebp + 8]
push eax
push 0x155
push 0x6b54
push 0x20b6
call fcn.1002f6b7
add esp, 0x1c
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002fa67
xor eax, eax
jmp 0x1002fbbc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
push 0x7ce5
call fcn.1002f8b3
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002fa94
xor eax, eax
jmp 0x1002fbbc
push dword [ebp - 8]
push 0x6bda
push 0x4d35
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.1002f045
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1002fabc
xor eax, eax
jmp 0x1002fbbc
push 0xc6
lea eax, [ebp - 0xc]
push eax
push 0x1818
push dword [ebp - 0x10]
push 0x4437
push 1
push 0x22fb
push 0x4c12
push 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call fcn.1002f3a3
add esp, 0x30
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 1
push 0x610a
lea eax, [ebp - 4]
push eax
push 0x3b35
push 0x4150
call fcn.1002f90f
add esp, 0x1c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002fb45
push 0x1bab
push 1
lea eax, [ebp - 4]
push eax
push 0x5b3b
lea eax, [ebp - 0x14]
push eax
call fcn.1002f9a1
add esp, 0x14
push dword [ebp - 4]
call fcn.1002ef06
pop ecx
test eax, eax
jne 0x1002fb56
xor eax, eax
jmp 0x1002fbbc
push 1
push dword [ebp - 4]
call fcn.10029480
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002fba4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002fb81
xor eax, eax
jmp 0x1002fbbc
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002fb9a
xor eax, eax
jmp 0x1002fbbc
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002fbb5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002fbb9
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004593d
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10045955
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x100459a0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10045983
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x100459a0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018040
mov dword [eax], 0x941ce3cb
jmp 0x10045978
mov esp, ebp
pop ebp
ret

Function at 0x1004674f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10046777
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10046784
push 0
push 0x1202
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret

Function at 0x10047236
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10047257
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
and dword [eax], 0
jmp 0x1004725f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret
Function at 0x1005dbd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.1005dc50
movzx eax, al
test eax, eax
je 0x1005dc01
push 0x10001948
push 0x10670318
call fcn.10050400
add esp, 8
push 0
call fcn.10065faf
mov ecx, dword [ebp - 4]
call fcn.1005df10
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.1005dd40
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10079295
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008438c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100690c4
mov dword [ebp - 0x14], eax
cmp dword [0x106713c8], esi
jne 0x10079388
push 0x800
push esi
push 0x10007fa8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10079315
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10079468
push esi
push esi
push 0x10007fa8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10079468
push 0x10007fc0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10079468
push eax
call ebx
push 0x10007fcc
push edi
mov dword [0x106713c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007fdc
push edi
mov dword [0x106713cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007ff0
push edi
mov dword [0x106713d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106713d8], eax
test eax, eax
je 0x10079385
push 0x1000800c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106713d4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100793ad
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100793a0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100793c2
push 4
pop eax
jmp 0x1007946a
cmp dword [ebp - 0x14], esi
je 0x100793c2
push dword [0x106713c8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100793a7
mov eax, dword [0x106713d4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10079420
cmp dword [0x106713d8], edi
je 0x10079420
push eax
call ebx
push dword [0x106713d8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10079420
test eax, eax
je 0x10079420
call ecx
test eax, eax
je 0x10079415
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10079415
test byte [ebp - 8], 1
jne 0x10079420
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10079450
mov eax, dword [0x106713cc]
cmp eax, edi
je 0x1007944d
push eax
call ebx
test eax, eax
je 0x1007944d
call eax
mov esi, eax
test esi, esi
je 0x1007944d
mov eax, dword [0x106713d0]
cmp eax, edi
je 0x1007944d
push eax
call ebx
test eax, eax
je 0x1007944d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106713c8]
call ebx
test eax, eax
je 0x10079468
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007946a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x80fe63
Capabilities:
Encode data using xor

Disassembly:
jmp 0x80fea6
mov dword [esp + 0x1d], ebp
mov cl, dh
mov cl, 0x55
mov ebp, edi
mov ch, byte [esp]
call fcn.0080fe90
cmc
push ebp
lds ebp, [edi + ebx*2 + 0x54c644da]
pop edi
fiadd dword [esi + eax*8 + 0x54]
xor ecx, esi
jp 0x80febc
fisubr word [ecx]
dec eax

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10002910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x10002978
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x10002970
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10008084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x1000293a
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x10002ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x10008094]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x100030d8
mov dword [esp], esi
call dword [0x10008094]
mov cl, byte [ebp + 8]
and eax, 0xff
sar eax, cl
test al, 1
je 0x10003138
mov edi, dword [0x10008084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edi
je 0x100030c8
test byte [0x10004030], 8
jne 0x10003050
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10004040], 8
jne 0x10003008
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
mov dword [esp], edi
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10002f89
cmp dword [ebp + 8], 3
jbe 0x10002fc8
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 0x10]
add eax, edi
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 8]
inc esi
mov dword [esp + 8], str._s:_s:_s
mov edx, dword [ecx*4 + 0x10006608]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
mov dword [esp], eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10002f89
mov ecx, dword [0x10008094]
test ecx, ecx
je 0x10003118
mov dword [esp], 0x10004040
call dword [0x10008094]
test al, 8
je 0x10002f5f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str._04x:
call dbg.sprintf
add edi, eax
jmp 0x10002f5f
mov ebx, dword [0x10008094]
test ebx, ebx
je 0x100030f8
mov dword [esp], 0x10004030
call dword [0x10008094]
test al, 8
je 0x10002f4a
call dword [sym.imp.kernel32.dll_GetTickCount]
mov ebx, 0x10624dd3
mov ecx, eax
mov dword [esp + 4], str._3u._03u:
mul ebx
mov eax, edx
mov edx, ecx
shr eax, 6
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
sub edx, eax
mov eax, ecx
mov dword [esp + 0xc], edx
mul ebx
shr edx, 6
lea ebx, [ebp - 0xd4]
mov dword [esp + 8], edx
mov dword [esp], ebx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x10002f52
add esp, 0xe0
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10008094
call sym._load_func.part.0
jmp 0x10002f0d
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10008094
call sym._load_func.part.0
jmp 0x1000305e
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10008094
call sym._load_func.part.0
jmp 0x10003016
or eax, 0xffffffff
jmp 0x10002fba
Function at 0xc46058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c461a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc4607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc4606a
add dl, dl
jne 0xc46089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc460dc
xor eax, eax
add dl, dl
jne 0xc46096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc4617d
add dl, dl
jne 0xc460a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc460b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc460bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc460c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc460d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc46075
mov eax, 1
add dl, dl
jne 0xc460ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc460f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc460e1
sub eax, ebx
mov ebx, 1
jne 0xc46128
mov ecx, 1
add dl, dl
jne 0xc4610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc46119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc46105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc46075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc4613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc4614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc46136
cmp eax, 0x7d00
jae 0xc4616d
cmp eax, 0x500
jb 0xc46168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc46075
cmp eax, 0x7f
ja 0xc46170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc46075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc4619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc46075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100060e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10006112
jl 0x10006105
test ecx, ecx
jne 0x10006112
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100061d2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.100081f0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000617e
jg 0x1000613d
test esi, esi
je 0x1000617e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10006155
mov eax, dword [esp + 0x10]
jl 0x1000614f
cmp eax, esi
jae 0x10006155
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1014a590
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000619f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x100061bb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10006124
jl 0x100061bb
test ecx, ecx
jne 0x10006124
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10006216
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10006216
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1014a590
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10006287
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000623c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10006272
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1015481f
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10006287
cmp edi, eax
ja 0x10006250
test edi, edi
je 0x10006287
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1015481f
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008ca0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101746f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10361e80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [ebp - 0x10], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1000c995
mov edi, eax
add esp, 4
test edi, edi
je 0x10008d57
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10147e58
add esp, 4
mov dword [edi + 4], eax
jmp 0x10008d59
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.10008e00
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov eax, esi
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov ecx, dword [0x1036b23c]
mov edx, dword [0x1036b240]
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], edx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000e8d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000e92c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000e92c
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x1000e91d
cmp esi, ecx
jae 0x1000e92c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x1000e90b
cmp esi, ecx
jae 0x1000e92c
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1000e92e
xor eax, eax
pop esi
pop ebp
ret