joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd378
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46d437
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4cd429
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4cd412
test esi, esi
jbe 0x4cd429
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a708
test eax, eax
jne 0x4cd404
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4cd429
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4cd3e1
jmp 0x4cd429
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4cd429
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d43e
ret
Function at 0x4cde58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x46e007
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004049cc
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4cde93
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4cdeac
lea eax, [ebp - 0x10]
mov edx, dword [0x4edfdc]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404a2c
jmp 0x4cdebf
lea eax, [ebp - 0x10]
mov edx, dword [0x4edfdc]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404a2c
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4cdecb
adc edx, 0
mov edx, dword [edx*4 + 0x4db790]
call fcn.00404c2c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404c10
push eax
call fcn.00406bb4
mov esi, eax
cmp esi, 0xffffffff
je 0x4cdfd9
mov eax, 0x40
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4cdfcc
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.0040705c
mov eax, edi
call fcn.00402744
mov eax, 0x18
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4cdfcc
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4cdfcc
cmp dx, 0x150
ja 0x4cdfcc
mov eax, edi
call fcn.00402744
mov eax, 0xe0
call fcn.00402724
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406fe4
test eax, eax
je 0x4cdfcc
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4cdfcc
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404a08
mov eax, edi
call fcn.00402744
push esi
call fcn.00406b6c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404d38
jne 0x4cdff1
inc ebx
cmp ebx, 0x19
jne 0x4cde85
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e00e
lea eax, [ebp - 0x10]
call fcn.004049cc
ret
Function at 0x51feb8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4f7580
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x51feda
shr eax, 1
xor eax, 0xedb88320
jmp 0x51fedc
shr eax, 1
dec edx
jne 0x51fec8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x51fec1
mov byte [0x4f7980], 1
pop esi
pop ebx
ret

Function at 0x51fef8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4f7980], 0
jne 0x51ff0f
call fcn.0051feb8
mov eax, edi
dec eax
test eax, eax
jl 0x51ff38
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4f7580]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x51ff19
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1002022b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005a8ca
call fcn.10059bc0
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0xe68
cmp dword [ebp - 0x14], 0xef2
push edi
mov dword [ebp - 0x10], esp
jle 0x1002028e
push 0xd70
call dword [sym.imp.GDI32.dll_EndDoc]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10602dd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000fdea
inc ebx
cmp ebx, 0x5d7a
jl 0x1002025e
inc edi
cmp edi, 0x5f36
jl 0x1002025c
inc esi
cmp esi, 0x3f4d
jl 0x1002025a
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0xb87
jge 0x100202aa
mov edx, 0x10008d60
mov ecx, 0x10602dd8
call fcn.10012a98
fldz
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031545
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100315ac
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10031593
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10031591
push 0x1a07
push 0
push 0x3dd
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x100315aa
push 0x1275
push 0x14d5
push 0
push 0x1a70
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1003161b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100315e1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1003161b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10031603
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jg 0x1003161b
mov dword [ebp - 0xc], 5
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x100315f8
mov esp, ebp
pop ebp
ret
Function at 0x1003377f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100337b0
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0x120e
push dword [ebp - 0xc]
push 1
call fcn.1003382a
add esp, 0x10
jmp 0x10033826
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10033819
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100337fa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10033817
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.100101dd
mov dword [eax], 6
jmp 0x100337ef
jmp 0x10033826
push 0x2380
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x100355c3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005aef4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100356fd
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1003561a
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100356fb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x48c7
mov dword [ebp - 0x40], 0x1000a518
cmp dword [ebp - 0x1c], 0x4a09
jle 0x100356a6
and dword [ebp - 0x14], 0
jmp 0x1003564a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x160a
jge 0x100356a6
and dword [ebp - 0x18], 0
jmp 0x10035660
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3cf3
jge 0x100356a4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.1000cbfe
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000fdca
push eax
call fcn.100448f6
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1000fdc0
jmp 0x10035659
jmp 0x10035643
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x45b6
jge 0x100356d5
push dword [ebp - 0x40]
call fcn.100448f6
pop ecx
jmp 0x100356f1
or dword [ebp - 4], 0xffffffff
jmp 0x100356fb
jmp 0x10035723
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
push 0x3268
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 0x6705
push 0
call fcn.10036b20
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d0cf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1003d155
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003d146
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.100101dd
mov esi, eax
mov eax, dword [ebp - 0x28]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.100101dd
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003d153
push 0x2380
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1003d194
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push 0
push 0x2406
push dword [ebp - 0x2c]
push 0x7532
push 0x6936
push dword [ebp - 0x30]
push 0x760a
push 0x2768
push 0x6cfd
push 0x2503
call fcn.1002bd42
add esp, 0x28
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003d891
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1003d90f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003d8f9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x1003d90d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003d90d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1003d98c
lea eax, [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1003d944
push 0x1275
push 0x14d5
push 0
push 0x1a70
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1003d98c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003d972
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1003d98c
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.100101dd
and dword [eax], 0
jmp 0x1003d967
mov esp, ebp
pop ebp
ret
Function at 0x1003eb8e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b0bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003ec5c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1003ec45
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
jmp 0x1003ebf4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0xffffffe2
jle 0x1003ec43
mov dword [ebp - 0x18], 0xfffffff9
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1003ec21
push 0
push 0x56b
push 0xaae
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [ebp - 0x18], 0xffffffe7
jmp 0x1003ec31
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x13
jl 0x1003ec41
cmp dword [ebp - 0x18], 0
je 0x1003ec3f
jmp 0x1003ec41
jmp 0x1003ec2a
jmp 0x1003ebe9
jmp 0x1003ec57
push 0x1a07
push 0
push 0x3dd
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1003ed55
mov dword [ebp - 0x2c], 0x624
mov dword [ebp - 0x40], 0x1000b430
cmp dword [ebp - 0x2c], 0x897
jle 0x1003ecfc
and dword [ebp - 0x20], 0
jmp 0x1003ec84
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3317
jge 0x1003ecfc
and dword [ebp - 0x24], 0
jmp 0x1003ec9a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1352
jge 0x1003ecfa
and dword [ebp - 0x28], 0
jmp 0x1003ecb0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x5600
jge 0x1003ecf8
mov eax, dword [ebp - 0x20]
cdq
idiv dword [ebp - 0x24]
and edx, dword [ebp - 0x28]
mov eax, edx
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.1000cbfe
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.1000fdca
push eax
call fcn.100448f6
pop ecx
lea ecx, [ebp - 0x64]
call fcn.1000fdc0
jmp 0x1003eca9
jmp 0x1003ec93
jmp 0x1003ec7d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x2b9
jge 0x1003ed18
push dword [ebp - 0x40]
call fcn.100448f6
pop ecx
jmp 0x1003ed34
or dword [ebp - 4], 0xffffffff
jmp 0x1003ed3e
push 0x3f0d
push dword [ebp - 0x44]
push 0x2328
push 0
call fcn.1003382a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f4ce
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b0e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003f50b
push 0x3bad
push 1
call fcn.1003f65e
pop ecx
pop ecx
jmp 0x1003f64d
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x79a5
mov dword [ebp - 0x40], 0x1000b4b8
cmp dword [ebp - 0x24], 0x79d9
jle 0x1003f5a3
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
and dword [ebp - 0x18], 0
jmp 0x1003f549
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1e55
jge 0x1003f5a3
and dword [ebp - 0x1c], 0
jmp 0x1003f55f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x41a3
jge 0x1003f5a1
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
call fcn.1000cbfe
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.1000fdca
push eax
call fcn.100448f6
pop ecx
lea ecx, [ebp - 0x60]
call fcn.1000fdc0
jmp 0x1003f558
jmp 0x1003f542
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003f607
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1003f5db
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jg 0x1003f605
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.100101dd
mov esi, eax
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.100101dd
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003f5d0
jmp 0x1003f611
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7862
jge 0x1003f627
push dword [ebp - 0x40]
call fcn.100448f6
pop ecx
jmp 0x1003f643
or dword [ebp - 4], 0xffffffff
jmp 0x1003f64d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10056085
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10060750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10048228
mov dword [ebp - 0x14], eax
cmp dword [0x10603e3c], esi
jne 0x10056178
push 0x800
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10056105
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10056258
push esi
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10056258
push 0x10007528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10056258
push eax
call ebx
push 0x10007534
push edi
mov dword [0x10603e3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007544
push edi
mov dword [0x10603e40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007558
push edi
mov dword [0x10603e44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10603e4c], eax
test eax, eax
je 0x10056175
push 0x10007574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10603e48], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005619d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10056190
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100561b2
push 4
pop eax
jmp 0x1005625a
cmp dword [ebp - 0x14], esi
je 0x100561b2
push dword [0x10603e3c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10056197
mov eax, dword [0x10603e48]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10056210
cmp dword [0x10603e4c], edi
je 0x10056210
push eax
call ebx
push dword [0x10603e4c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10056210
test eax, eax
je 0x10056210
call ecx
test eax, eax
je 0x10056205
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10056205
test byte [ebp - 8], 1
jne 0x10056210
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10056240
mov eax, dword [0x10603e40]
cmp eax, edi
je 0x1005623d
push eax
call ebx
test eax, eax
je 0x1005623d
call eax
mov esi, eax
test esi, esi
je 0x1005623d
mov eax, dword [0x10603e44]
cmp eax, edi
je 0x1005623d
push eax
call ebx
test eax, eax
je 0x1005623d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10603e3c]
call ebx
test eax, eax
je 0x10056258
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005625a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004573c
mov esp, ebp
pop ebp
ret