joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042910
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1007f31b
call fcn.100589b8
sub esp, 0x2d8
cmp dword [0x101a3304], 0
je 0x10042b14
call fcn.10029fc5
test eax, eax
jne 0x10042b14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x101b729c]
add ecx, 0x3e8
cmp eax, ecx
jbe 0x10042b14
push 1
lea ecx, [ebp - 0xe4]
call fcn.10002483
xor eax, eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
push str.friends.ini
push 0x101b7348
push str._s_trabzon_s
lea eax, [ebp - 0x2e4]
mov byte [ebp - 4], 1
push 0x200
push eax
call fcn.10006b5a
add esp, 0x14
lea eax, [ebp - 0x2e4]
lea ecx, [ebp - 0xe4]
push 0x40
push 1
push eax
call fcn.10005a13
mov eax, dword [0x1015a628]
push 0xfb0
add eax, 0x2ae9
push 0
push eax
call fcn.1005af40
mov eax, dword [0x1015a628]
push 0x14e4
add eax, 0x121
push 0
push eax
call fcn.1005af40
and dword [0x101b7298], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.10001a3d
add esp, 0x20
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x10042abc
push esi
push edi
mov ecx, dword [0x101a3304]
xor esi, esi
movzx eax, word [ecx]
cmp eax, esi
je 0x10042a64
cmp dword [ecx + esi*4 + 0x26], 0
je 0x10042a64
cmp dword [ebp - 0x18], 0x10
lea edi, [ebp - 0x2c]
push esi
cmovae edi, dword [ebp - 0x2c]
call fcn.1003ef83
pop ecx
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x10042a55
test cl, cl
je 0x10042a51
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x10042a55
add edi, 2
add eax, 2
test cl, cl
jne 0x10042a35
xor eax, eax
jmp 0x10042a5a
sbb eax, eax
or eax, 1
test eax, eax
je 0x10042a6f
mov ecx, dword [0x101a3304]
inc esi
cmp esi, 0x3ec
jl 0x10042a15
jmp 0x10042a98
mov ecx, dword [0x101b7298]
mov eax, dword [0x1015a628]
mov dword [eax + ecx*4 + 0x2ae9], esi
inc ecx
mov eax, dword [0x1015a628]
mov dword [0x101b7298], ecx
mov dword [eax + esi*4 + 0x121], 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.10001a3d
pop ecx
pop ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x10042a0d
pop edi
pop esi
lea ecx, [ebp - 0xe4]
call fcn.100045b2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101b729c], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x10042b09
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, 0x1000
jb 0x10042b00
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10003b4f
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.10058799
pop ecx
pop ecx
lea ecx, [ebp - 0xe4]
call fcn.10002e44
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x10043036
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1fc
push ebp
push esi
push str.LoadSpriteTexture__
call fcn.10056bb4
pop ecx
mov ecx, dword [0x101aaf68]
xor ebp, ebp
mov esi, ebp
test ecx, ecx
je 0x1004305d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [0x101aaf64]
mov edx, 0x100
push ebp
push 0x101aaf68
push 1
push 0x15
push ebp
push 1
push edx
mov dword [0x101aaf68], ebp
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x5c]
test eax, eax
jns 0x1004308d
push str.Failed_to_create_sprite_texture_
jmp 0x100430f1
push str.trabzon.raw
push 0x101b7348
push str._s_trabzon_s
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.10006b5a
lea eax, [esp + 0x24]
push 0x10083ff4
push eax
call fcn.100679fa
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x100430d5
lea eax, [esp + 0x10]
push eax
push str.Failed_to_open__s_
call fcn.100565e7
pop ecx
jmp 0x100430f6
mov eax, dword [0x101aaf68]
lea edx, [esp + 8]
push ebp
push ebp
push edx
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x4c]
test eax, eax
jns 0x1004311a
push str.Failed_to_lock_texture_
call fcn.100565e7
pop ecx
mov ecx, dword [0x101aaf68]
test ecx, ecx
je 0x1004310d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x101aaf68], ebp
test esi, esi
je 0x10043184
push esi
call fcn.1005eceb
pop ecx
jmp 0x10043184
push ebx
push edi
mov edi, dword [esp + 0x14]
push 0x78
pop ebx
push esi
push 1
lea eax, [esp + 0x124]
push 0xf0
push eax
call fcn.1005f57a
add esp, 0x10
lea edx, [edi + 2]
mov cl, byte [esp + ebp + 0x11c]
mov al, cl
shl cl, 5
and al, 0xf8
mov byte [edx + 1], cl
inc ebp
mov byte [edx - 2], al
mov byte [edx - 1], al
mov byte [edx], al
lea edx, [edx + 4]
cmp ebp, 0xf0
jl 0x1004313e
add edi, dword [esp + 0x10]
push 0
pop ebp
sub ebx, 1
jne 0x10043123
mov eax, dword [0x101aaf68]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
push esi
call fcn.1005eceb
pop ecx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x1fc
ret
Function at 0x10048243
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push str.renderObjectTexts__
call fcn.10056bb4
xor esi, esi
push esi
push 0xffffffffffffffff
call fcn.10029c26
mov ecx, dword [0x1015a628]
add esp, 0xc
mov ebx, eax
cmp dword [ecx + 0x2649b], esi
jne 0x100483e8
test ebx, ebx
je 0x100483e8
mov ecx, dword [0x101a3300]
mov ecx, dword [ecx + 0x3de]
cmp dword [ecx + 0x14], esi
je 0x100483e8
push 9
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100482ac
cmp dword [0x10186b6f], esi
jne 0x100483e8
mov eax, dword [0x101a3318]
cmp dword [eax], esi
jne 0x100483e8
push edi
mov edi, 0x20d4
mov eax, dword [0x101a3300]
mov eax, dword [eax + 0x3de]
mov eax, dword [eax + 0x14]
cmp dword [edi + eax - 0x20d0], 1
jne 0x100483d7
mov eax, dword [edi + eax]
test eax, eax
je 0x100483d7
mov eax, dword [eax + 0x40]
test eax, eax
je 0x100483d7
mov eax, dword [eax + 0x14]
lea ecx, [ebp - 0x10]
push ecx
add eax, 0x30
push eax
call fcn.1003e2fd
lea eax, [ebp - 0x10]
push eax
call fcn.1003e3f3
add esp, 0xc
test eax, eax
jne 0x100483d7
mov eax, dword [ebx + 0x14]
add eax, 0x30
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1003e30d
fstp dword [ebp - 4]
movss xmm0, dword [ebp - 4]
comiss xmm0, dword [0x1019dd3b]
pop ecx
pop ecx
ja 0x100483d7
movss xmm0, dword [ebp - 0x10]
lea eax, [ebp - 0x28]
movss dword [ebp - 0x1c], xmm0
movss xmm0, dword [ebp - 0xc]
push eax
movss dword [ebp - 0x18], xmm0
lea eax, [ebp - 0x1c]
movss xmm0, dword [ebp - 8]
push eax
movss dword [ebp - 0x14], xmm0
call fcn.10041b51
movss xmm0, dword [0x10080f60]
comiss xmm0, dword [ebp - 0x20]
pop ecx
pop ecx
ja 0x100483d7
mov eax, dword [0x101a3300]
mov eax, dword [eax + 0x3de]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + edi]
mov eax, dword [eax + 0x40]
movzx eax, word [eax + 0x22]
push eax
push esi
push str.Object:__d__ModelID:__d
lea eax, [ebp - 0x48]
push 0x1f
push eax
call fcn.10041a2a
movss xmm0, dword [ebp - 0x24]
lea eax, [ebp - 0x48]
subss xmm0, dword [0x10086860]
add esp, 0x14
push eax
push 0xffc8c800
push ecx
push ecx
mov ecx, dword [0x101ab0e4]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 0x28]
movss dword [esp], xmm0
call fcn.100416a6
add edi, 4
inc esi
cmp edi, 0x41a4
jl 0x100482bf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004856c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x48
push ebp
push str.renderPickupTexts__
call fcn.10056bb4
mov eax, dword [0x1015a628]
xor ebp, ebp
pop ecx
cmp dword [eax + 0x2649b], ebp
jne 0x10048713
mov eax, dword [0x101a3300]
mov eax, dword [eax + 0x3de]
cmp dword [eax + 0x10], ebp
je 0x10048713
push ebx
push ebp
push 0xffffffffffffffff
call fcn.10029c26
pop ecx
pop ecx
push 9
mov ebx, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100485c8
cmp dword [0x10186b6f], ebp
jne 0x10048712
mov eax, dword [0x101a3318]
cmp dword [eax], ebp
jne 0x10048712
test ebx, ebx
je 0x10048712
push esi
push edi
mov edi, ebp
mov esi, ebp
mov eax, dword [0x101a3300]
mov eax, dword [eax + 0x3de]
mov eax, dword [eax + 0x10]
cmp dword [eax + esi + 0xf004], ebp
je 0x10048700
cmp dword [eax + esi + 0xf008], ebp
je 0x10048700
lea ecx, [esp + 0x14]
add eax, 0xf00c
push ecx
add eax, esi
push eax
call fcn.1003e2fd
lea eax, [esp + 0x1c]
push eax
call fcn.1003e3f3
add esp, 0xc
test eax, eax
jne 0x10048700
mov eax, dword [ebx + 0x14]
add eax, 0x30
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1003e30d
fstp dword [esp + 0x18]
movss xmm0, dword [esp + 0x18]
comiss xmm0, dword [0x1019dd33]
pop ecx
pop ecx
ja 0x10048700
movss xmm0, dword [esp + 0x14]
lea eax, [esp + 0x2c]
movss dword [esp + 0x20], xmm0
movss xmm0, dword [esp + 0x18]
push eax
movss dword [esp + 0x28], xmm0
lea eax, [esp + 0x24]
movss xmm0, dword [esp + 0x20]
push eax
movss dword [esp + 0x30], xmm0
call fcn.10041b51
movss xmm0, dword [0x10080f60]
comiss xmm0, dword [esp + 0x3c]
pop ecx
pop ecx
ja 0x10048700
mov eax, dword [0x101a3300]
mov eax, dword [eax + 0x3de]
mov eax, dword [eax + 0x10]
push dword [eax + esi + 0xf004]
lea eax, [esp + 0x3c]
push edi
push str.Pickup:__d__ModelID:__d
push 0x1f
push eax
call fcn.10041a2a
movss xmm0, dword [esp + 0x44]
lea eax, [esp + 0x4c]
subss xmm0, dword [0x10086860]
add esp, 0x14
push eax
push 0xff00c800
push ecx
push ecx
mov ecx, dword [0x101ab0e4]
movss dword [esp + 4], xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [esp], xmm0
call fcn.100416a6
add esi, 0x14
inc edi
cmp esi, 0x14000
jl 0x100485e3
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x48
ret

Function at 0x1004a18b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push str.getFPS__
call fcn.10056bb4
inc dword [0x101aaf5c]
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xf0
cmp eax, dword [0x101ab114]
jbe 0x1004a224
mov eax, dword [0x101aaf5c]
movss xmm2, dword [0x101aaf50]
movss xmm3, dword [0x101aaf54]
movss xmm0, dword [0x101aaf4c]
shl eax, 2
and dword [0x101aaf5c], 0
movss dword [0x101aaf54], xmm2
addss xmm2, xmm3
movss dword [0x101aaf58], xmm3
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movss dword [0x101aaf50], xmm0
movss dword [0x101aaf4c], xmm1
addss xmm1, xmm0
addss xmm1, xmm2
mulss xmm1, dword [0x100867d8]
movss dword [0x101aaf48], xmm1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101ab114], eax
fld dword [0x101aaf48]
ret
Function at 0x1004a2db
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.mapMenuTeleport__
call fcn.10056bb4
cmp dword [0x1019dd4b], 0
pop ecx
je 0x1004a302
cmp byte [0xba68a5], 5
jne 0x1004a3ab
cmp dword [0xba6774], 0
je 0x1004a3ab
push dword [0x1019dd47]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, 0x10000
je 0x1004a3ab
cmp dword [0x101b7564], 0
je 0x1004a3ab
push esi
push edi
mov esi, 0xba8720
mov edi, 0xaf
mov eax, 0x1203
cmp word [esi + 0x1d], ax
jne 0x1004a3a1
push 0
call fcn.10029f89
movss xmm0, dword [esi]
pop ecx
mov ecx, dword [0x101b7564]
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [esi + 4]
movss dword [ebp - 8], xmm0
mov eax, dword [ecx]
call dword [eax + 0x38]
movss xmm0, dword [ebp - 8]
push ecx
push ecx
mov edx, dword [eax]
mov ecx, eax
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 0xc]
movss dword [esp], xmm0
call dword [edx + 0x18]
fadd dword [0x10086840]
lea eax, [ebp - 0xc]
push 0
push eax
fstp dword [ebp - 4]
call fcn.1002e4bf
pop ecx
pop ecx
add esi, 0x28
sub edi, 1
jne 0x1004a33c
pop edi
pop esi
leave
ret
Function at 0x100564f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1015a628]
sub eax, dword [ecx + 0x253e1]
cmp eax, 0x3e8
jbe 0x10056527
inc dword [ecx + 0x253f3]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1015a628]
mov dword [ecx + 0x253e1], eax
mov ecx, dword [0x1015a628]
cmp dword [ecx + 0x253f3], 2
jle 0x10056543
mov byte [ecx + 0x253f1], 0
mov eax, dword [0x1015a628]
and dword [eax + 0x253f3], 0
ret

Function at 0x10056917
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push edi
push str.init__
call fcn.10056bb4
cmp dword [0x101b7318], 0
pop ecx
jne 0x10056aac
push 0xe4
mov edi, 0x101b7348
push edi
push dword [0x101b7340]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ebx, ebx
test eax, eax
je 0x10056973
push 0x5c
push edi
call fcn.1005ced0
pop ecx
pop ecx
test eax, eax
je 0x10056973
push 0x5c
push edi
call fcn.1005ced0
pop ecx
pop ecx
mov byte [eax], bl
jmp 0x1005697c
push 0x2e
pop eax
mov word [0x101b7348], ax
push esi
push str.trabzon_4.4.2.0____Project_Trabzon
push str.Initializing__s
call fcn.100565e7
mov eax, dword [0xc9ac08]
mov dword [0x101b7574], eax
pop ecx
pop ecx
mov ecx, dword [0xc9ac0c]
mov dword [0x101b7578], ecx
mov edx, dword [0xc9ac10]
mov dword [0x101b757c], edx
mov esi, dword [0xc9ac14]
mov dword [0x101b7580], esi
push ecx
push edx
push esi
cmp eax, 2
jne 0x100569cb
push str.OS:_Windows_Version__d._d._d
jmp 0x100569d0
push str.OS:_Not_Windows___d._d._d_
call fcn.100565e7
add esp, 0x10
call fcn.1003d4f5
pop esi
cmp dword [0x101822d0], ebx
jne 0x10056a18
push ebx
push str.Youre_a_retard.
push str.Looks_like_youve_not_edited_the_.ini_file_like_you_were_told_to__n_nBefore_you_can_use_mod_sa__you_have_to_set__i_have_edited_the_ini_file__to_true._nWe_did_this_so_you_would_read_the_INI_file_to_see_the_configurability_of_mod_sa._n
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push edi
push str.trabzon_trabzon.ini
push str.notepad
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x10056aaf
call fcn.1003f23d
push 0xfa
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea eax, [ebp - 0x104]
push 0x100938a4
push eax
call fcn.1002be9c
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x101b7318], eax
test eax, eax
jne 0x10056a73
lea eax, [ebp - 0x104]
push eax
push str.Failed_to_load__s
call fcn.100565e7
pop ecx
pop ecx
jmp 0x10056a11
push 0x100938c4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101ab084], eax
test eax, eax
jne 0x10056aac
lea eax, [ebp - 0x104]
push eax
push str._s_does_not_export_Direct3DCreate9__
call fcn.100565e7
pop ecx
pop ecx
push dword [0x101b7318]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10056a11
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret

Function at 0x1006ec05
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006ea7b
Function at 0x10056536
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10056575
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10056575
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10056575
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10056575
cmp dword [ecx + 0x74], 0xe
jbe 0x10056575
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100578b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100578dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100578dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10057c00
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10061620
push 0x10061618
push str.FlsAlloc
push 0x1f
call fcn.10057ee3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10057c34
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x10057c3a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10057c7e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10061630
push 0x10061628
push str.FlsGetValue
push 0x21
call fcn.10057ee3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10057cb5
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10057cbd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10061638
push 0x10061630
push str.FlsSetValue
push 0x22
call fcn.10057ee3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10057cf7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1005abbe
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005ac5b
push ebx
push esi
call fcn.1005ac5e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005aac2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005ac08
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005ac5a
push edi
push eax
call fcn.1005aebc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005ac28
call fcn.100591b0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005ac59
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005aac2
add esp, 0x20
test eax, eax
jne 0x1005ac47
push edi
call fcn.100591b0
jmp 0x1005ac4f
push ebx
call fcn.100591b0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x410a37
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x410a76
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410a76
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410a76
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x410a76
cmp dword [ecx + 0x74], 0xe
jbe 0x410a76
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x411fe8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x411ff7
pop dword [ebp - 0x4c]
mov eax, 0x1e33732d
add eax, 0xe20dacca
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x620af624
add dword [ebp - 0x5c], 0xec474f27
mov dword [ebp - 0x58], 0x4682859d
add dword [ebp - 0x58], 0xebb0c6a8
mov dword [ebp - 0x54], 0x64069e17
add dword [ebp - 0x54], 0xe845a617
mov dword [ebp - 0x50], 0x3df120a3
add dword [ebp - 0x50], 0xc20edf5d
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x5b6e52cc
add eax, 0xa4d2fdb4
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x6d8081e7
sub dword [ebp - 0x5c], 0xf90e1891
mov dword [ebp - 0x58], 0x96f29f38
sub dword [ebp - 0x58], 0x55863dc3
mov dword [ebp - 0x54], 0xc7bf4925
add dword [ebp - 0x54], 0x9bb02347
mov dword [ebp - 0x50], 0x3f5ba76d
sub dword [ebp - 0x50], 0x3f5ba76d
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xb740e8ce
add eax, 0x4900677e
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a939
push 0
call eax
mov ecx, 0x48bf
mov esi, eax
mov edx, 0x41f400
add edx, dword [ebp - 0x4c]
mov edi, 0x421c9757
sub edi, 0x2638537
mov ebx, dword [edx]
mov dword [ebp - 0x24], 0x5a3923d5
xor ebx, edi
sub dword [ebp - 0x48], 0xa78d0823
mov dword [esi], ebx
xor dword [ebp - 4], eax
add esi, 0xdd329ac6
sub esi, 0xdd329ac2
add edx, 4
loop 0x41210d
add eax, 0x115cf
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0xe28370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xe2838e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xe51074
push ecx
mov edi, eax
call fcn.00e3c198
mov esi, eax
add esp, 8
test esi, esi
jne 0xe283cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00e3c02e
push esi
call fcn.00e3bfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xe2b850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xe2b8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xe56720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe2b8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00e3c1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xe2b8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xe56720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe2b92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00e3d082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xe2b957
mov word [eax], si
add eax, 2
push eax
call fcn.00e3d030
add esp, 4
jmp 0xe2b959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xe2b8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xe2b8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xe2bff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret