joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bb15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x4bb168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x4bb14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x4bb145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x4bb145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x4bb1d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
jmp edx
mov ecx, dword [ebx + 0x28]
cmp ecx, 1
je 0x4bb1c1
mov ecx, ebx
sub ecx, dword [ebx + 4]
xor cx, cx
mov dword [ebx + 0x24], ecx
add ecx, dword [ebx + 8]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 1
add edx, 2
sub edx, 1
sub edx, 1
add edx, 3
push edx
push ecx
pop ecx
pop edx
cmp edx, ecx
jl 0x4bb1f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x1c]
mov esi, ecx
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 1
add edx, 2
sub edx, 1
sub edx, 1
add edx, 3
push edx
push ecx
pop ecx
pop edx
cmp edx, ecx
jl 0x4bb285
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x28], 1
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
mov dword [esp + 0x34], edx
jmp edx
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x408386
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
movzx esi, word [edi + ecx*4]
inc dword [esp + esi*4 + 0x30]
movzx esi, word [edi + ecx*4 + 4]
pop dword [edi + edi*8]
inc esp
mov ah, 0x30
movzx esi, word [edi + ecx*4 + 8]
inc dword [esp + esi*4 + 0x30]
movzx esi, word [edi + ecx*4 + 0xc]
inc dword [esp + esi*4 + 0x30]
add ecx, 4
cmp edx, ecx
jne fcn.0040836a
test eax, eax
je 0x4083b7
lea ecx, [edi + ecx*4]
xor edx, edx
nop
nop
nop
nop
nop
nop
sal byte [ebp - 0xd], 1

Function at 0x40a328
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x74], 0xacbfa0b7
mov dword [esp + 0x78], 0xb2b5b0af
mov byte [esp + 0x7c], 0xdc
mov word [esp + 0x7d], 0
mov byte [esp + 0x7f], 0
add byte [ecx], dh
rcl byte [eax - 0x6f6f6f70], 0x90
add byte [ecx], dh
rcl byte [eax - 0x6f6f6f70], 0x90
mov ecx, eax
add cl, 0xce
xor cl, byte [esp + eax + 0x70]
add cl, 0xfa
mov byte [esp + eax + 0x70], cl
inc eax
cmp eax, 0x10
jne 0x40a331
mov dword [esp + 0x10], 0xf37e1211
mov word [esp + 0x14], 0
mov byte [esp + 0x16], 0
xor eax, eax
nop
nop
nop
nop
movzx edx, byte [esp + eax + 0x10]
mov edi, eax
cmp byte [eax], 0x13
lodsd eax, dword [esi]
out 4, eax
xor edi, 0x42a7e6d4
mov ecx, eax
and ecx, 3
sub dword [esi], ecx
add al, 0xeb
jns 0x40a308
iretd

Function at 0x40baa9
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
nop
nop
nop
nop
add al, ah
dec esi
mov bh, 0xb6
inc esp
adc al, 0xc
lea ecx, [edx + 0x305e2a9d]
and ecx, eax
add eax, edx

Function at 0x43abfb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add bl, ch
xor bh, al
inc esi
add al, 1
add byte [eax], al
add cl, ch
pop ecx
add dword [eax], eax
add byte [ebp + 0x50502444], cl
call 0x440b12
add esp, 4
test al, al
je 0x43ac30
mov eax, dword [esp + 0x50]
mov ecx, 2
cmp eax, 3
je 0x43ac2d
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
add al, ah
dec esi
mov bh, 0x85
sub dword [ecx], eax
add byte [eax], al
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], 0x2a47157a
mov dword [esp + 0x14], 0x492b2b59
mov dword [esp + 0x18], 0x22222f59
Function at 0x10001120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp method.CDialog.virtual_312
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x1000630c
cmp dword [edi + 0x54], 0
jne 0x1000630c
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.1001dad9
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.100062b3
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x10001460
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push ebp
mov ebp, dword [ebx + 4]
push esi
push edi
mov dword [esp + 0x14], ebp
lea esi, [ecx + eax + 0x18]
mov dword [esp + 0x10], 0
jbe 0x10001554
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x100014dd
mov edx, dword [esp + 0x20]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0x10001538
mov eax, dword [esi - 4]
push 4
push 0x1000
push edi
add eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1000156b
mov eax, dword [esi - 4]
add eax, ebp
test edi, edi
mov dword [esi - 8], eax
je 0x10001538
push edi
push 0
push eax
call fcn.100345a0
add esp, 0xc
jmp 0x10001538
mov ecx, dword [esi + 4]
add ecx, eax
cmp ecx, 0x22600
ja 0x10001563
mov edx, dword [esi - 4]
push 4
push 0x1000
push eax
add edx, ebp
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1000156b
mov eax, dword [esi - 4]
mov edx, dword [esi + 4]
mov ebx, dword [esi]
add edx, dword [esp + 0x1c]
add eax, ebp
test ebx, ebx
jbe 0x10001531
mov edi, edx
mov ecx, eax
sub edi, eax
mov ebp, ebx
lea esp, [esp]
mov dl, byte [edi + ecx]
mov byte [ecx], dl
add ecx, 1
sub ebp, 1
jne 0x10001520
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x24]
mov dword [esi - 8], eax
mov ecx, dword [ebx]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
add eax, 1
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x10001492
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 0xc
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 0xc
Function at 0x10001620
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x30]
mov esi, dword [ecx + eax + 0x20]
sub edx, 1
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
test esi, esi
mov dword [esp + 0x18], edx
jne 0x10001666
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x1000165f
mov esi, dword [eax + 0x20]
jmp 0x10001666
test bl, bl
jns 0x10001666
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
cmp word [eax + 6], si
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], esi
jbe 0x10001746
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x30]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
sub esi, 1
not esi
and esi, ebp
test edi, edi
jne 0x100016b9
mov ecx, dword [ebx]
test cl, 0x40
je 0x100016b2
mov edi, dword [eax + 0x20]
jmp 0x100016b9
test cl, cl
jns 0x100016b9
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x100016f2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x100016f2
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10001580
test eax, eax
je 0x10001769
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x1000171e
mov eax, dword [ebx]
test eax, 0x2000000
je 0x1000170b
test dword [esp + 0x20], 0x2000000
je 0x1000170b
or dword [esp + 0x20], eax
jmp 0x10001718
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
add ecx, 1
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x10001692
lea ecx, [esp + 0x14]
mov edx, edi
mov dword [esp + 0x24], 1
call fcn.10001580
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 4
Function at 0x10002ba0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10048f12
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1005e8f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, esi
call fcn.10015149
call fcn.10015a56
test eax, eax
jne 0x10002bf9
push 0xffffffffffffffff
push eax
push 0x64
call fcn.1000c9b4
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
push 0
call fcn.10016319
add esp, 4
push str.Local_AppWizard_Generated_Applications
mov ecx, esi
call fcn.1001688e
push 4
mov ecx, esi
call fcn.10014bef
push 0x6c
call fcn.10005893
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov dword [esp + 0x38], 0
je 0x10002c4f
push 0x10052864
push 0x10052220
push 0x10052758
push 0x80
mov ecx, eax
call fcn.10016c7e
jmp 0x10002c51
xor eax, eax
test eax, eax
mov dword [esp + 0x38], 0xffffffff
je 0x10002be6
push eax
mov ecx, esi
call fcn.100170c8
mov ecx, esi
call fcn.100172f1
push 1
mov ecx, esi
call fcn.10016f13
lea ecx, [esp + 0xc]
call fcn.100157ae
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x3c], 1
call fcn.10014c75
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.10016f4a
test eax, eax
jne 0x10002cc6
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.100157ed
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
mov ecx, dword [esi + 0x20]
push 5
call fcn.1000d2e3
mov eax, dword [esi + 0x20]
mov edx, dword [eax + 0x20]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [esi + 0x20]
mov eax, dword [esi + 0x20]
push 1
push eax
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.100157ed
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x10003e00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10048e10
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1005e8f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.1001c97f
mov esi, dword [esi + 0x54]
mov ebp, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x2c]
imul ecx, ecx, 0x2710
add ecx, dword [eax + 0x28]
mov eax, 0x68db8bad
imul ecx
sar edx, 0xc
mov esi, edx
shr esi, 0x1f
add esi, edx
mov edx, esi
imul edx, edx, 0xffffd8f0
add ecx, edx
mov eax, ecx
imul eax, eax, 0x12c
cdq
idiv ebx
mov dword [esp + 0x18], vtable.CBitmap.0
mov edi, eax
mov eax, esi
imul eax, eax, 0x12c
cdq
idiv dword [esp + 0x14]
add edi, 0xa
mov esi, eax
xor eax, eax
add esi, 0xa
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], eax
call fcn.1001dad9
mov eax, dword [eax + 0xc]
push 0x84
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x1c]
call fcn.1001cc3e
lea ecx, [esp + 0x20]
call fcn.1001c398
test ebp, ebp
mov byte [esp + 0x38], 1
jne 0x10003ed9
xor eax, eax
jmp 0x10003edc
mov eax, dword [ebp + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x24]
call fcn.1001c98d
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10003f01
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, 0x12c
cdq
idiv ebx
mov ecx, dword [esp + 0x24]
push 0xff00ff
push 8
push 8
push 0
push 0
push ecx
mov ecx, dword [ebp + 4]
push 8
push 8
cdq
sub eax, edx
sar eax, 1
lea edx, [eax + esi - 5]
push edx
lea eax, [eax + edi - 5]
push eax
push ecx
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.1001c9f1
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.CGdiObject.0
call fcn.1001cc91
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x1000625d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.1001dad9
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10006294
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.10005e7f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1000a737
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1000a770
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1000658c
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10006567
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x1000c6c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x1000c703
call fcn.1001dad9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1000c703
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1000c71e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.1000c277
test ebx, ebx
mov esi, eax
je 0x1000c71c
test edi, edi
je 0x1000c71c
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1000d7d8
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x10047bdf
call fcn.100349e1
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1000d7fd
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1000d849
call fcn.10019691
push eax
lea ecx, [ebp - 0x10]
call fcn.10003570
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000d0b3
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100034a0
mov eax, esi
call fcn.10034ab9
ret 8
Function at 0x10012aeb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.1001dad9
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x10012b16
xor eax, eax
jmp 0x10012bba
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x10012b0f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10012b0f
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10005893
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x10012b6b
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x10012b5a
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.100118af
push edi
mov ebx, eax
call fcn.100058be
test ebx, ebx
pop ecx
je 0x10012bad
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.10011f71
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.10012023
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4

Function at 0x10015f4f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x10015f95
call fcn.1001dad9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10015f95
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x10015fd8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x10015fc1
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x10015fc1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x10015fd5
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10032e07
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005e8f0]
jne 0x10032e11
repz ret
jmp fcn.1003820a

Function at 0x100417b2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1003a06e
xor ebx, ebx
cmp dword [0x10084f34], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x10041887
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x100417f2
xor eax, eax
jmp 0x1004194b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10050bf8
push edi
call esi
cmp eax, ebx
je 0x100417eb
push eax
call fcn.1003a00b
mov dword [esp], 0x10050be8
push edi
mov dword [0x10084f34], eax
call esi
push eax
call fcn.1003a00b
mov dword [esp], 0x10050bd4
push edi
mov dword [0x10084f38], eax
call esi
push eax
call fcn.1003a00b
mov dword [0x10084f3c], eax
lea eax, [ebp - 8]
push eax
call fcn.100368db
test eax, eax
pop ecx
pop ecx
je 0x10041855
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10033782
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x10041887
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1003a00b
cmp eax, ebx
pop ecx
mov dword [0x10084f44], eax
je 0x10041887
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1003a00b
pop ecx
mov dword [0x10084f40], eax
mov eax, dword [0x10084f40]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x10041900
cmp dword [0x10084f44], esi
je 0x10041900
push eax
call fcn.1003a077
pop ecx
call eax
cmp eax, ebx
je 0x100418cd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x10084f44]
call fcn.1003a077
pop ecx
call eax
test eax, eax
je 0x100418cd
test byte [ebp - 0x18], 1
jne 0x10041900
lea eax, [ebp - 0xc]
push eax
call fcn.10036912
test eax, eax
pop ecx
je 0x100418e8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10033782
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x100418f7
or dword [ebp + 0x10], 0x200000
jmp 0x10041931
or dword [ebp + 0x10], 0x40000
jmp 0x10041931
mov eax, dword [0x10084f38]
cmp eax, esi
je 0x10041931
push eax
call fcn.1003a077
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10041931
mov eax, dword [0x10084f3c]
cmp eax, esi
je 0x10041931
push dword [ebp - 4]
push eax
call fcn.1003a077
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x10084f34]
call fcn.1003a077
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret