joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10119af0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x1036a00c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x10119b72
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x10119b72
test ecx, ecx
je 0x10119b6e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x10119b30
xor eax, eax
jmp 0x10119b77
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10119b81
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.102af9d5
add esp, 0xc
ret 0xc

Function at 0x10119c00
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x1036a00c]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x10119c2e
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.102af9d5
add esp, 8
ret 4
mov eax, dword [ecx + 0xc]
cmp eax, 0xffffffff
je 0x10119c17
push edi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10119c74
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10119c74
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.102af9d5
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, edi
mov dword [esi], eax
adc ecx, 0
xor eax, eax
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0xc]
pop edi
pop esi
xor ecx, esp
call fcn.102af9d5
add esp, 8
ret 4

Function at 0x1011c1f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102d7f18
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1036a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1011c226
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1011c28a
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1011c2b0
test al, al
je 0x1011c27b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10018a30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102af9d5
mov esp, ebp
pop ebp
ret
Function at 0x10121650
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
je 0x1012166a
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x1012166a
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x1012166a
push 1
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1013af80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1013af8b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1013afc0
Function at 0x1013b900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
mov edi, ecx
call fcn.1013b7b0
test eax, eax
je 0x1013b913
mov eax, 0xfffffffe
pop edi
ret
push esi
mov esi, dword [edi + 0x1c]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x2c], 2
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], 0
test eax, eax
jns 0x1013b94c
neg eax
mov dword [esi + 0x18], eax
cmp eax, 2
jne 0x1013b956
lea ecx, [eax + 0x37]
jmp 0x1013b965
test eax, eax
mov ecx, 0x71
mov edx, 0x2a
cmovne ecx, edx
mov dword [esi + 4], ecx
cmp eax, 2
jne 0x1013b971
xor eax, eax
jmp 0x1013b97f
push 0
xor edx, edx
xor ecx, ecx
call fcn.1013acf0
add esp, 4
mov dword [edi + 0x30], eax
mov ecx, esi
lea eax, [esi + 0x94]
mov dword [esi + 0x28], 0
mov dword [esi + 0xb18], eax
lea eax, [esi + 0x988]
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0xb20], 0x102e0414
mov dword [esi + 0xb2c], 0x102e3284
mov dword [esi + 0xb38], 0x102e336c
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
call fcn.1013e4e0
mov esi, dword [edi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x102e2caa]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x102e2ca8]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x102e2cac]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x102e2cae]
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop edi
ret
Function at 0x1014ce90
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebx
mov ebx, edx
mov edx, ecx
push esi
mov ecx, ebx
xor esi, esi
push edi
shr ecx, 2
xor edi, edi
test ecx, ecx
je 0x1014cec7
imul eax, dword [edx + esi*4], 0xcc9e2d51
inc esi
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edi, eax
rol edi, 0xd
add edi, 0xfaddaf14
lea edi, [edi + edi*4]
cmp esi, ecx
jb 0x1014cea4
mov eax, ebx
lea edx, [edx + ecx*4]
and eax, 3
xor ecx, ecx
sub eax, 1
je 0x1014cef0
sub eax, 1
je 0x1014cee7
sub eax, 1
jne 0x1014cf06
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edi, eax
xor edi, ebx
mov eax, edi
shr eax, 0x10
xor eax, edi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x10169540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [0x1036a00c]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
xorps xmm1, xmm1
push ebx
mov ebx, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x74]
push ebp
mov ebp, dword [esp + 0x7c]
movss xmm2, dword [ebx]
movss xmm0, dword [ebx + 8]
subss xmm0, xmm2
mov dword [esp + 0xc], eax
push esi
mov esi, dword [esp + 0x78]
push edi
comiss xmm1, xmm0
movss dword [esp + 0x1c], xmm0
jae 0x10169727
test eax, eax
je 0x10169727
lea edi, [eax + esi]
movzx eax, word [ebp + 0x42]
and eax, 3
mov dword [esp + 0x30], edi
sub eax, 0
je 0x101695b5
sub eax, 1
jne 0x101695b8
mulss xmm0, dword [0x103000e8]
jmp 0x101695b8
xorps xmm0, xmm0
addss xmm2, xmm0
mov ecx, ebp
lea eax, [esp + 0x34]
push eax
movss dword [esp + 0x30], xmm2
xorps xmm2, xmm2
call fcn.1014eef0
cmp byte [ebx + 0x18], 1
movaps xmm2, xmm0
movss xmm0, dword [ebx + 0x10]
movss xmm1, dword [ebx + 0xc]
mulss xmm0, xmm2
movss dword [esp + 0x24], xmm2
addss xmm0, dword [ebx + 0x14]
movss dword [esp + 0x20], xmm0
movss xmm0, dword [ebx + 4]
subss xmm1, xmm0
movss dword [esp + 0x18], xmm1
jne 0x10169646
cmp byte [ebx + 0x19], 0
je 0x10169646
movss xmm3, dword [esp + 0x1c]
mov ecx, esi
mov edx, dword [esp + 0x14]
push ebp
call fcn.101694a0
movss xmm2, dword [esp + 0x28]
add esp, 4
movss xmm1, dword [esp + 0x18]
dec eax
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [esp + 0x20]
addss xmm2, xmm0
movss xmm0, dword [ebx + 4]
movzx eax, byte [ebx + 0x19]
sub eax, 0
je 0x10169662
subss xmm1, xmm2
sub eax, 1
jne 0x10169665
mulss xmm1, dword [0x103000e8]
jmp 0x10169665
xorps xmm1, xmm1
subss xmm0, dword [esp + 0x3c]
addss xmm0, xmm1
movss dword [esp + 0x14], xmm0
movss xmm3, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
push ebp
mov edx, edi
mov ecx, esi
call fcn.101692b0
movss xmm0, dword [esp + 0x48]
add esp, 8
movss xmm1, dword [esp + 0x14]
mov edi, eax
addss xmm0, xmm1
addss xmm0, dword [esp + 0x48]
comiss xmm0, dword [0x102fffdc]
jbe 0x101696d8
mov ecx, dword [esp + 0x28]
movss xmm0, dword [esp + 0x2c]
sub eax, dword [esp + 0x18]
push ebp
mov edx, dword [ecx]
sub esp, 8
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
push eax
push esi
call dword [edx + 4]
movss xmm1, dword [esp + 0x14]
add esi, edi
mov edi, dword [esp + 0x30]
cmp esi, edi
jae 0x10169702
addss xmm1, dword [esp + 0x20]
movss xmm0, dword [esp + 0x3c]
addss xmm0, xmm1
movss dword [esp + 0x14], xmm1
comiss xmm0, dword [ebx + 0xc]
jb 0x10169675
movss xmm0, dword [esp + 0x40]
addss xmm0, xmm1
addss xmm0, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.102af9d5
add esp, 0x64
ret 0x10
movss xmm0, dword [ebx + 4]
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.102af9d5
add esp, 0x64
ret 0x10
Function at 0x10196990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [0x1036a00c]
xor eax, esp
mov dword [esp + 0x60], eax
mov edx, dword [edx]
push ebx
mov ebx, dword [esp + 0x74]
push esi
mov eax, dword [edx + 0x1c]
mov esi, ecx
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
mov eax, dword [edx + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 0x20]
sub eax, dword [edx + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x30]
push edi
mov edi, dword [esp + 0x78]
sub eax, 4
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x50]
push 1
push eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov word [esp + 0x3c], 0
mov byte [esp + 0x3f], 0
call fcn.10153c50
cmp eax, 6
je 0x10196b72
movss xmm1, dword [0x103000e8]
nop
cmp eax, 5
ja case.0x10196a29.3
jmp dword [eax*4 + 0x10196b84]
push ebx
push edi
push 1
lea edx, [esp + 0x58]
lea ecx, [esp + 0x40]
call fcn.10196800
add esp, 0xc
lea ecx, [esp + 0xc]
push 0
push 0
push esi
call fcn.10194b30
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push 0
xorps xmm2, xmm2
mov eax, dword [eax + 0x28]
mov dword [esi + 4], eax
call fcn.101534a0
movss xmm0, dword [esp + 0x34]
mov cl, 2
movss dword [eax], xmm0
movss xmm0, dword [esp + 0x38]
movss dword [eax + 4], xmm0
lea eax, [esi + 0xa]
mov byte [esi + 9], 0
xchg byte [eax], cl
jmp case.0x10196a29.3
movss xmm0, dword [esp + 0x54]
lea edx, [esp + 0x4c]
addss xmm0, dword [esp + 0x4c]
mulss xmm0, xmm1
movss dword [esp + 0x4c], xmm0
movss xmm0, dword [esp + 0x58]
addss xmm0, dword [esp + 0x50]
mulss xmm0, xmm1
movss dword [esp + 0x50], xmm0
push ebx
push edi
push 2
lea ecx, [esp + 0x40]
call fcn.10196800
movss xmm0, dword [esp + 0x4c]
add esp, 8
movss xmm3, dword [esp + 0x40]
mov ecx, esi
movss xmm2, dword [esp + 0x3c]
movss xmm1, dword [esp + 0x38]
movss dword [esp], xmm0
call fcn.10155270
jmp case.0x10196a29.3
lea edx, [esp + 0x54]
jmp 0x10196abd
push ebx
push edi
push 3
lea edx, [esp + 0x60]
lea ecx, [esp + 0x40]
call fcn.10196800
movss xmm0, dword [esp + 0x54]
mov ecx, esi
movss xmm3, dword [esp + 0x48]
movss xmm2, dword [esp + 0x44]
movss xmm1, dword [esp + 0x40]
movss dword [esp + 8], xmm0
movss xmm0, dword [esp + 0x50]
movss dword [esp + 4], xmm0
movss xmm0, dword [esp + 0x4c]
movss dword [esp], xmm0
call fcn.101554c0
jmp case.0x10196a29.3
mov ecx, esi
call fcn.10155580
push 0
push 1
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
call fcn.10153c50
movss xmm1, dword [0x103000e8]
cmp eax, 6
jne 0x10196a20
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.102af9d5
add esp, 0x68
ret
Function at 0x101b4bf0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push ecx
mov ebx, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x101b4c94
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x101b4c94
mov eax, dword [esp + 0x14]
test eax, eax
jl 0x101b4c94
mov ecx, dword [esp + 0x10]
jg 0x101b4c94
test ecx, ecx
jb 0x101b4c94
test eax, eax
jg 0x101b4c94
jl 0x101b4c40
cmp ecx, 0xffffffff
ja 0x101b4c94
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x101b4c82
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x101b4c82
mov eax, dword [esp + 0x10]
push esi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101efd60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sar dword [esp + 4], 3
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov ebp, ecx
push edi
sub ebp, edx
movzx eax, word [edx]
lea edx, [edx + 2]
movzx ecx, word [edx + ebp - 2]
mov esi, eax
and esi, 0x7e0
mov edi, ecx
and edi, 0x7e0
shl esi, 0x10
shl edi, 0x10
or esi, eax
or edi, ecx
and esi, 0xfffff81f
and edi, 0xfffff81f
dec ebx
sub edi, esi
imul edi, dword [esp + 0x14]
shr edi, 5
add edi, esi
mov eax, edi
shr eax, 0x10
xor eax, edi
and eax, 0x7e0
xor eax, edi
mov word [edx - 2], ax
test ebx, ebx
jg 0x101efd71
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10222b20
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp byte [0x10372ab2], 0
jne 0x10222b87
push esi
or eax, 0xffffffff
mov esi, 0x1036a39c
lock xadd dword [esi], eax
test eax, eax
jg 0x10222b4b
mov ecx, esi
call fcn.10172cf0
push 0xffffffffffffffff
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x10372ab2], 0
jne 0x10222b66
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10372ad0], eax
mov byte [0x10372ab2], 1
mov eax, 1
lock xadd dword [esi], eax
test eax, eax
jns 0x10222b86
mov ecx, esi
call fcn.10172cf0
push 0
push 1
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop esi
push dword [0x10372ad0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
ret

Function at 0x10222bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 3
je 0x10222bbd
test eax, eax
jne 0x10222c11
cmp byte [0x10372ab2], 0
je 0x10222c11
push esi
push dword [0x10372ad0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10222c10
push edi
nop word [eax + eax]
mov eax, dword [esi + 0xc]
mov edi, dword [esi]
test eax, eax
je 0x10222bf1
push dword [esi + 4]
call eax
add esp, 4
push 0x10
push esi
call fcn.102aff42
add esp, 8
mov esi, edi
test edi, edi
jne 0x10222be0
push edi
push dword [0x10372ad0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
ret 0xc
Function at 0x102aceb0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1036a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x102acfaa
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x102acfa3
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x102acf89
call ebx
cmp dword [ebp - 0x14], eax
jne 0x102acf89
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x102acf89
mov edx, dword [esi]
test edx, edx
jne 0x102acf52
push 0x200
push edx
push dword [0x1036f5fc]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x102acfa3
jmp 0x102acf7d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x102acf7d
shl eax, 3
push eax
push edx
push 0
push dword [0x1036f5fc]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x102acfa3
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x102acf11
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x102acfef
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x102acfef
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x102acfe9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.102acc40
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x102acfb6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102af9d5
mov esp, ebp
pop ebp
ret

Function at 0x102ad000
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx]
test eax, eax
je 0x102ad04e
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x102ad03e
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x102ad035
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x102ad012
mov eax, dword [ebx]
pop edi
push eax
push 0
push dword [0x1036f5fc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x102ad050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10372fe0]
mov al, byte [esi + 0x14]
mov edi, dword [esi]
and al, 1
je 0x102ad06c
sub edi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x102ad094
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x102ad0af
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa0f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a0f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa0f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0f06a
add dl, dl
jne 0xa0f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0f0dc
xor eax, eax
add dl, dl
jne 0xa0f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa0f17d
add dl, dl
jne 0xa0f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa0f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa0f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa0f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa0f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa0f075
mov eax, 1
add dl, dl
jne 0xa0f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa0f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa0f0e1
sub eax, ebx
mov ebx, 1
jne 0xa0f128
mov ecx, 1
add dl, dl
jne 0xa0f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa0f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa0f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa0f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa0f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa0f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa0f136
cmp eax, 0x7d00
jae 0xa0f16d
cmp eax, 0x500
jb 0xa0f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa0f075
cmp eax, 0x7f
ja 0xa0f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa0f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa0f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa0f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x424a60
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 8]
push eax
push ebx
mov edi, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x424b0b
mov eax, dword [edi + 0x20c]
test eax, eax
je 0x424a95
push eax
call fcn.00562255
add esp, 4
push esi
call fcn.00562686
add esp, 4
mov dword [edi + 0x20c], eax
test eax, eax
je 0x424b0b
push eax
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x424b0b
mov eax, dword [edi + 0x20c]
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 4]
push edx
push str.VarFileInfoTranslation
push eax
mov dword [ebp + 8], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x424b0b
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04x
push 0x208
add edi, 4
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x425eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x425ecb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x425f04
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x425f00
jmp 0x425ef0
cmp esi, eax
jae 0x425f04
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x425ef0
cmp esi, eax
jb 0x425f0b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret