joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c86f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.1002bfb4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1002bf69
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.1002bfb4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1002bf69
add esp, 0xc

Function at 0x1003767b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x100376ac
call fcn.1002b779
mov dword [eax], esi
call fcn.1002b766
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10031806
add esp, 0x14
push 0x16
pop eax
jmp 0x10037701
test dword [ebp + 0xc], 0xfffffff9
jne 0x10037688
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100376d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1002b78c
pop ecx
call fcn.1002b766
mov eax, dword [eax]
jmp 0x10037701
test al, 0x10
jne 0x100376ff
test al, 1
je 0x100376ff
test byte [ebp + 0xc], 2
je 0x100376ff
call fcn.1002b779
mov dword [eax], 5
call fcn.1002b766
mov dword [eax], 0xd
jmp 0x100376d0
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1004003c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10032943
and dword [ebp - 4], 0
cmp dword [0x1005f190], 0
mov ebx, eax
jne 0x100400ed
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1004019e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1004019e
push eax
call fcn.100328d1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1005f190], eax
call esi
push eax
call fcn.100328d1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1005f194], eax
call esi
push eax
call fcn.100328d1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1005f198], eax
call esi
push eax
call fcn.100328d1
pop ecx
mov dword [0x1005f1a0], eax
test eax, eax
je 0x100400ed
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100328d1
pop ecx
mov dword [0x1005f19c], eax
mov eax, dword [0x1005f19c]
cmp eax, ebx
je 0x10040145
cmp dword [0x1005f1a0], ebx
je 0x10040145
push eax
call fcn.1003294c
push dword [0x1005f1a0]
mov esi, eax
call fcn.1003294c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10040145
test edi, edi
je 0x10040145
call esi
test eax, eax
je 0x1004013c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1004013c
test byte [ebp - 0xc], 1
jne 0x10040145
or dword [ebp + 0x10], 0x200000
jmp 0x1004017e
mov eax, dword [0x1005f194]
cmp eax, ebx
je 0x1004017e
push eax
call fcn.1003294c
pop ecx
test eax, eax
je 0x1004017e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1004017e
mov eax, dword [0x1005f198]
cmp eax, ebx
je 0x1004017e
push eax
call fcn.1003294c
pop ecx
test eax, eax
je 0x1004017e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1005f190]
call fcn.1003294c
pop ecx
test eax, eax
je 0x1004019e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100401a0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002e2f
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
mov ebx, 0x80004005
je 0x1002e4c
and dword [edi], 0
push 0x50
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
call dword [sym.imp.WINMM.dll_mixerGetDevCapsW]
test eax, eax
jne 0x1002e4c
push esi
mov esi, dword [ebp - 4]
dec esi
test esi, esi
jl 0x1002e4b
push 0
lea eax, [ebp - 0x168]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x168], 0x118
mov dword [ebp - 0x164], esi
call dword [sym.imp.WINMM.dll_mixerGetLineInfoW]
test eax, eax
jne 0x1002e42
lea eax, [ebp - 0x168]
push eax
push dword [ebp + 8]
call fcn.01006942
test eax, eax
jne 0x1002e47
dec esi
jns 0x1002e09
jmp 0x1002e4b
mov dword [edi], esi
xor ebx, ebx
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x100414f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x7f00
xor esi, esi
mov edi, 0x100134c
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x1003fce
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
jne 0x1004174
xor eax, eax
jmp 0x100418b
push ebx
push dword [ebx]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x10013dc
push edi
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1004601
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
neg edi
sbb edi, edi
and edi, 6
add edi, 0x12
cmp dword [ebp + 0x1c], 0
je 0x1004618
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
jmp 0x100461b
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [edi + esi]
cmp word [eax], 0xffff
jne 0x100462d
add edi, 4
jmp 0x1004638
push eax
call fcn.01008ec1
pop ecx
lea edi, [edi + eax*2 + 2]
lea eax, [edi + esi]
cmp word [eax], 0xffff
jne 0x1004647
add edi, 4
jmp 0x1004652
push eax
call fcn.01008ec1
pop ecx
lea edi, [edi + eax*2 + 2]
lea eax, [edi + 5]
mov edi, dword [ebp + 8]
and eax, 0xfffffffc
test edi, edi
je 0x10046c2
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [ebp + 0x1c], 0
rep movsb byte es:[edi], byte [esi]
je 0x100469b
mov dx, word [ebp + 0x14]
mov ecx, dword [ebp - 4]
add word [ecx + 0xc], dx
mov dx, word [ebp + 0x18]
add word [ecx + 0xe], dx
mov edx, dword [ecx + 0x14]
cmp edx, 0xffffffff
je 0x10046c2
movzx esi, word [ebp + 0x10]
add esi, edx
mov dword [ecx + 0x14], esi
jmp 0x10046c2
mov cx, word [ebp + 0x14]
add word [ebx + 8], cx
mov cx, word [ebp + 0x18]
add word [ebx + 0xa], cx
xor ecx, ecx
mov cx, word [ebx + 0x10]
movzx edx, cx
cmp edx, 0xffffffff
je 0x10046c2
mov edx, dword [ebp + 0x10]
add ecx, edx
mov word [ebx + 0x10], cx
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x1004dc3
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x138
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
mov edi, dword [esp + 0x14c]
push 0x3f5
push edi
call esi
push 0x3f6
push edi
mov dword [esp + 0x28], eax
call esi
push 0x3f7
push edi
mov dword [esp + 0x2c], eax
call esi
push 0x3f8
push edi
mov dword [esp + 0x1c], eax
call esi
mov edi, dword [esp + 0x148]
mov ecx, dword [edi + 8]
xor ebx, ebx
cmp dword [ecx], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
jne 0x1004d67
xor eax, eax
jmp 0x1004ef5
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x14b
push eax
call ebp
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x5c]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push ebx
push dword [esp + 0x28]
mov dword [esp + 0x28], eax
call esi
push ebx
push dword [esp + 0x2c]
call esi
push ebx
push dword [esp + 0x1c]
call esi
cmp dword [esp + 0x20], 0
jbe 0x1004ec5
push 0
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 8]
mov dword [esp + 0x38], 0x118
mov dword [esp + 0x3c], ebx
push dword [eax + 4]
call dword [sym.imp.WINMM.dll_mixerGetLineInfoW]
test eax, eax
jne 0x1004eba
cmp dword [esp + 0x48], 4
jne 0x1004e19
cmp dword [esp + 0x1c], eax
jne 0x1004e60
push 1
push dword [esp + 0x28]
call esi
cmp ebx, dword [edi + 0xc]
jne 0x1004e06
mov eax, 0x3f5
push eax
push 0x3f7
push eax
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [edi + 8]
mov dword [eax + 8], ebx
mov dword [esp + 0x1c], 1
jmp 0x1004eba
cmp dword [esp + 0x48], 7
jne 0x1004e60
cmp dword [esp + 0x14], 0
jne 0x1004e60
push 1
push dword [esp + 0x2c]
call esi
cmp ebx, dword [edi + 0xc]
jne 0x1004e50
push 0x3f6
push 0x3f7
push 0x3f5
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [edi + 8]
mov dword [eax + 0xc], ebx
mov dword [esp + 0x14], 1
jmp 0x1004eba
push 1
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x78]
push eax
push 0
push 0x143
push dword [esp + 0x1c]
call ebp
push ebx
push eax
push 0x151
push dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
call ebp
cmp ebx, dword [edi + 0xc]
jne 0x1004eba
mov eax, 0x3f7
push eax
push eax
push 0x3f5
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push dword [esp + 0x30]
push 0x14e
push dword [esp + 0x1c]
call ebp
inc ebx
cmp ebx, dword [esp + 0x20]
jb 0x1004da8
push 0x3f7
push dword [esp + 0x154]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
jne 0x1004ef1
xor edi, edi
push edi
push edi
push 0x14e
push dword [esp + 0x1c]
call ebp
push edi
push dword [esp + 0x14]
call esi
xor eax, eax
inc eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x138
ret 8
Function at 0x1004e50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x138
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
mov edi, dword [esp + 0x14c]
push 0x3f5
push edi
call esi
push 0x3f6
push edi
mov dword [esp + 0x28], eax
call esi
push 0x3f7
push edi
mov dword [esp + 0x2c], eax
call esi
push 0x3f8
push edi
mov dword [esp + 0x1c], eax
call esi
mov edi, dword [esp + 0x148]
mov ecx, dword [edi + 8]
xor ebx, ebx
cmp dword [ecx], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
jne 0x1004d67
xor eax, eax
jmp 0x1004ef5
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x14b
push eax
call ebp
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x5c]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push ebx
push dword [esp + 0x28]
mov dword [esp + 0x28], eax
call esi
push ebx
push dword [esp + 0x2c]
call esi
push ebx
push dword [esp + 0x1c]
call esi
cmp dword [esp + 0x20], 0
jbe 0x1004ec5
push 0
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 8]
mov dword [esp + 0x38], 0x118
mov dword [esp + 0x3c], ebx
push dword [eax + 4]
call dword [sym.imp.WINMM.dll_mixerGetLineInfoW]
test eax, eax
jne 0x1004eba
cmp dword [esp + 0x48], 4
jne 0x1004e19
cmp dword [esp + 0x1c], eax
jne 0x1004e60
push 1
push dword [esp + 0x28]
call esi
cmp ebx, dword [edi + 0xc]
jne 0x1004e06
mov eax, 0x3f5
push eax
push 0x3f7
push eax
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [edi + 8]
mov dword [eax + 8], ebx
mov dword [esp + 0x1c], 1
jmp 0x1004eba
cmp dword [esp + 0x48], 7
jne 0x1004e60
cmp dword [esp + 0x14], 0
jne 0x1004e60
push 1
push dword [esp + 0x2c]
call esi
cmp ebx, dword [edi + 0xc]
jne 0x1004e50
push 0x3f6
push 0x3f7
push 0x3f5
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [edi + 8]
mov dword [eax + 0xc], ebx
mov dword [esp + 0x14], 1
jmp 0x1004eba
push 1
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x78]
push eax
push 0
push 0x143
push dword [esp + 0x1c]
call ebp
push ebx
push eax
push 0x151
push dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
call ebp
cmp ebx, dword [edi + 0xc]
jne 0x1004eba
mov eax, 0x3f7
push eax
push eax
push 0x3f5
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push dword [esp + 0x30]
push 0x14e
push dword [esp + 0x1c]
call ebp
inc ebx
cmp ebx, dword [esp + 0x20]
jb 0x1004da8
push 0x3f7
push dword [esp + 0x154]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
jne 0x1004ef1
xor edi, edi
push edi
push edi
push 0x14e
push dword [esp + 0x1c]
call ebp
push edi
push dword [esp + 0x14]
call esi
xor eax, eax
inc eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x138
ret 8
Function at 0x1004ee6
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x138
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
mov edi, dword [esp + 0x14c]
push 0x3f5
push edi
call esi
push 0x3f6
push edi
mov dword [esp + 0x28], eax
call esi
push 0x3f7
push edi
mov dword [esp + 0x2c], eax
call esi
push 0x3f8
push edi
mov dword [esp + 0x1c], eax
call esi
mov edi, dword [esp + 0x148]
mov ecx, dword [edi + 8]
xor ebx, ebx
cmp dword [ecx], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
jne 0x1004d67
xor eax, eax
jmp 0x1004ef5
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x14b
push eax
call ebp
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x5c]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push ebx
push dword [esp + 0x28]
mov dword [esp + 0x28], eax
call esi
push ebx
push dword [esp + 0x2c]
call esi
push ebx
push dword [esp + 0x1c]
call esi
cmp dword [esp + 0x20], 0
jbe 0x1004ec5
push 0
lea eax, [esp + 0x34]
push eax
mov eax, dword [edi + 8]
mov dword [esp + 0x38], 0x118
mov dword [esp + 0x3c], ebx
push dword [eax + 4]
call dword [sym.imp.WINMM.dll_mixerGetLineInfoW]
test eax, eax
jne 0x1004eba
cmp dword [esp + 0x48], 4
jne 0x1004e19
cmp dword [esp + 0x1c], eax
jne 0x1004e60
push 1
push dword [esp + 0x28]
call esi
cmp ebx, dword [edi + 0xc]
jne 0x1004e06
mov eax, 0x3f5
push eax
push 0x3f7
push eax
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [edi + 8]
mov dword [eax + 8], ebx
mov dword [esp + 0x1c], 1
jmp 0x1004eba
cmp dword [esp + 0x48], 7
jne 0x1004e60
cmp dword [esp + 0x14], 0
jne 0x1004e60
push 1
push dword [esp + 0x2c]
call esi
cmp ebx, dword [edi + 0xc]
jne 0x1004e50
push 0x3f6
push 0x3f7
push 0x3f5
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [edi + 8]
mov dword [eax + 0xc], ebx
mov dword [esp + 0x14], 1
jmp 0x1004eba
push 1
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x78]
push eax
push 0
push 0x143
push dword [esp + 0x1c]
call ebp
push ebx
push eax
push 0x151
push dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
call ebp
cmp ebx, dword [edi + 0xc]
jne 0x1004eba
mov eax, 0x3f7
push eax
push eax
push 0x3f5
push dword [esp + 0x15c]
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push dword [esp + 0x30]
push 0x14e
push dword [esp + 0x1c]
call ebp
inc ebx
cmp ebx, dword [esp + 0x20]
jb 0x1004da8
push 0x3f7
push dword [esp + 0x154]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
jne 0x1004ef1
xor edi, edi
push edi
push edi
push 0x14e
push dword [esp + 0x1c]
call ebp
push edi
push dword [esp + 0x14]
call esi
xor eax, eax
inc eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x138
ret 8
Function at 0x1006a8d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push edi
mov edi, eax
test edi, edi
je 0x1006b1c
test ebx, ebx
je 0x1006b1c
xor edx, edx
inc edx
test byte [esi + 0xd0], dl
jne 0x1006ac9
push dword [esi + 0xc8]
lea edx, [ebp - 0x130]
push dword [ebx + 0xc]
call fcn.01006a50
test eax, eax
jne 0x1006b1f
mov edx, dword [ebp - 0x114]
mov eax, edx
shl eax, 2
cmp dword [ebp + 8], 0
jne 0x1006ada
mov dword [edi], eax
xor eax, eax
jmp 0x1006b1f
cmp dword [edi], eax
jb 0x1006b1c
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xcc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x80000000
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 0xc]
mov dword [ebp - 0x18], 0x18
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], 4
call dword [sym.imp.WINMM.dll_mixerGetControlDetailsW]
jmp 0x1006b1f
push 0xb
pop eax
pop edi
leave
ret 4

Function at 0x10080f5
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x24]
push ecx
push 0x1008011
push dword [eax + 4]
mov dword [ebp - 0x24], eax
push 0x6e
push dword [eax]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
pop edi
leave
ret 0xc
Function at 0x10087c6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jne 0x100879e
xor eax, eax
inc eax
jmp 0x1008884
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x100]
push dword [ebp + 8]
push 0x1001604
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [ebp + 0x18], 0
je 0x1008889
lea eax, [ebp + 0xc]
push eax
mov esi, 0x1001618
push esi
lea eax, [ebp - 0x100]
push eax
call fcn.01005750
test eax, eax
je 0x10087e6
xor eax, eax
jmp 0x1008882
push dword [ebp + 0xc]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
je 0x10087df
push dword [ebp + 0xc]
lea eax, [ebp - 0x100]
push edi
push 0
push esi
push eax
call fcn.010056c3
test eax, eax
jne 0x1008908
mov eax, dword [ebp + 0xc]
mov ebx, 0x84
xor edx, edx
mov ecx, ebx
div ecx
cmp eax, dword [ebp + 0x14]
jbe 0x1008832
mov eax, dword [ebp + 0x14]
test eax, eax
jbe 0x1008865
mov esi, dword [ebp + 0x10]
add esi, 0xc
mov dword [ebp + 0x14], eax
lea eax, [esi + 0x28]
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1008855
mov eax, dword [edi]
or dword [esi], eax
add edi, ebx
add esi, 0x104
dec dword [ebp + 0x14]
jne 0x100883f
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x14
mov esi, ebx
imul esi, esi, 0x84
push esi
push 0x42
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
je 0x10087df
test ebx, ebx
jbe 0x10088eb
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x14], ebx
add esi, 0xc
mov ebx, 0x84
lea eax, [esi + 0x28]
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esi]
and eax, 4
mov dword [edi], eax
add esi, 0x104
add edi, ebx
dec dword [ebp + 0x14]
jne 0x10088c3
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
push edi
push 3
push 0x1001618
lea eax, [ebp - 0x100]
push eax
call fcn.010057e6
test eax, eax
je 0x1008865
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10087df
Function at 0x1009a1b
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x44
push 0x100
call fcn.0100a9d2
test eax, eax
pop ecx
jne 0x10098d0
or eax, 0xffffffff
jmp 0x1009a5d
mov dword [0x10100a0], eax
mov dword [0x1010088], 0x20
lea ecx, [eax + 0x100]
jmp 0x1009901
and byte [eax + 4], 0
or dword [eax], 0xffffffff
mov byte [eax + 5], 0xa
mov ecx, dword [0x10100a0]
add eax, 8
add ecx, 0x100
cmp eax, ecx
jb 0x10098e7
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp word [esp + 0x3e], 0
je 0x10099e6
mov eax, dword [esp + 0x40]
test eax, eax
je 0x10099e6
mov esi, dword [eax]
push ebp
lea ebp, [eax + 4]
mov eax, 0x800
cmp esi, eax
lea ebx, [esi + ebp]
jl 0x100993f
mov esi, eax
cmp dword [0x1010088], esi
jge 0x1009999
mov edi, 0x10100a4
push 0x100
call fcn.0100a9d2
test eax, eax
pop ecx
je 0x1009993
add dword [0x1010088], 0x20
mov dword [edi], eax
lea ecx, [eax + 0x100]
jmp 0x1009982
and byte [eax + 4], 0
or dword [eax], 0xffffffff
mov byte [eax + 5], 0xa
mov ecx, dword [edi]
add eax, 8
add ecx, 0x100
cmp eax, ecx
jb 0x100996c
add edi, 4
cmp dword [0x1010088], esi
jl 0x100994c
jmp 0x1009999
mov esi, dword [0x1010088]
xor edi, edi
test esi, esi
jle 0x10099e5
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x10099dc
mov cl, byte [ebp]
test cl, 1
je 0x10099dc
test cl, 8
jne 0x10099be
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10099dc
mov eax, edi
sar eax, 5
mov eax, dword [eax*4 + 0x10100a0]
mov ecx, edi
and ecx, 0x1f
lea eax, [eax + ecx*8]
mov ecx, dword [ebx]
mov dword [eax], ecx
mov cl, byte [ebp]
mov byte [eax + 4], cl
inc edi
inc ebp
add ebx, 4
cmp edi, esi
jl 0x100999f
pop ebp
xor ebx, ebx
mov eax, dword [0x10100a0]
lea esi, [eax + ebx*8]
cmp dword [esi], 0xffffffff
jne 0x1009a42
test ebx, ebx
mov byte [esi + 4], 0x81
jne 0x1009a02
push 0xfffffffffffffff6
pop eax
jmp 0x1009a0c
mov eax, ebx
dec eax
neg eax
sbb eax, eax
add eax, 0xfffffff5
push eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, 0xffffffff
je 0x1009a31
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1009a31
and eax, 0xff
cmp eax, 2
mov dword [esi], edi
jne 0x1009a37
or byte [esi + 4], 0x40
jmp 0x1009a46
cmp eax, 3
jne 0x1009a46
or byte [esi + 4], 8
jmp 0x1009a46
or byte [esi + 4], 0x80
inc ebx
cmp ebx, 3
jl 0x10099e8
push dword [0x1010088]
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x44
ret