joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50cdc7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x569910]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004efc0e
mov dword [ebp - 0x14], eax
cmp dword [0x57463c], esi
jne 0x50ceba
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x50ce47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x50cf9a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x50cf9a
push 0x543c78
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x50cf9a
push eax
call ebx
push 0x543c84
push edi
mov dword [0x57463c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x574640], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x574644], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x57464c], eax
test eax, eax
je 0x50ceb7
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x574648], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x50cedf
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x50ced2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x50cef4
push 4
pop eax
jmp 0x50cf9c
cmp dword [ebp - 0x14], esi
je 0x50cef4
push dword [0x57463c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x50ced9
mov eax, dword [0x574648]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x50cf52
cmp dword [0x57464c], edi
je 0x50cf52
push eax
call ebx
push dword [0x57464c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x50cf52
test eax, eax
je 0x50cf52
call ecx
test eax, eax
je 0x50cf47
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x50cf47
test byte [ebp - 8], 1
jne 0x50cf52
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x50cf82
mov eax, dword [0x574640]
cmp eax, edi
je 0x50cf7f
push eax
call ebx
test eax, eax
je 0x50cf7f
call eax
mov esi, eax
test esi, esi
je 0x50cf7f
mov eax, dword [0x574644]
cmp eax, edi
je 0x50cf7f
push eax
call ebx
test eax, eax
je 0x50cf7f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x57463c]
call ebx
test eax, eax
je 0x50cf9a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x50cf9c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e0222
mov esp, ebp
pop ebp
ret
Function at 0x1000abe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov eax, dword [0x1008f080]
xor eax, ebp
mov dword [esi + 0x78], eax
mov dword [esi + 0xc], 0xa21b0046
mov eax, dword [esi + 0xc]
mov dword [esi], eax
sub eax, 0xa21b0046
je 0x1000ac6d
jmp 0x1000ac20
mov eax, dword [esi]
sub eax, 0xac9aa8b6
je 0x1000ad80
jmp 0x1000ac32
mov eax, dword [esi]
sub eax, 0xb3c1a7fb
je 0x1000ad74
jmp 0x1000ac44
mov eax, dword [esi]
sub eax, 0xb8cc2ddd
je 0x1000acb3
jmp 0x1000ac56
mov eax, dword [esi]
sub eax, 0xc3faf893
je 0x1000add9
jmp 0x1000ac68
jmp 0x1000ae28
mov eax, dword [0x1009070c]
mov ecx, dword [0x10090708]
xor edi, edi
sub edi, 1
mov edx, eax
add edx, edi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc3faf893
mov ecx, 0xb8cc2ddd
test dl, 1
cmovne eax, ecx
mov dword [esi + 0xc], eax
jmp 0x1000ae28
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push eax
mov edx, esp
mov dword [esi + 0x44], edx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x3c], eax
movsd xmm0, qword [0x1003b2e0]
movsd qword [esi + 0x30], xmm0
movsd xmm0, qword [0x1003b2d8]
movsd qword [esi + 0x28], xmm0
mov dword [esi + 0x24], 0x2cd
lea ecx, [esi + 0x60]
lea eax, str.pioakuunmiudqimrsshzyctluoaqeedmsuilcljhmbgregixmihxveppljtcszxqxqwjxcjnigpbrewtpdpfktl
sub esp, 4
mov dword [esp], eax
call fcn.1001a760
mov dword [esi + 0x20], 0x86
mov ecx, dword [0x1009070c]
mov eax, dword [0x10090708]
mov edx, ecx
add edx, 0x6a4f56cd
sub edx, 1
sub edx, 0x6a4f56cd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc3faf893
mov ecx, 0xb3c1a7fb
test dl, 1
cmovne eax, ecx
mov dword [esi + 0xc], eax
jmp 0x1000ae28
mov dword [esi + 0xc], 0xac9aa8b6
jmp 0x1000ae28
movsd xmm0, qword [0x1003b2e8]
movsd qword [esi + 0x18], xmm0
mov byte [esi + 0x17], 1
lea ecx, [esi + 0x48]
lea eax, str.viitowuezczuwwsrwnqrxojjvwlhrqikiymdxlkjnbtoekusozwsj
sub esp, 4
mov dword [esp], eax
call fcn.1001a760
mov dword [esi + 0x10], 0xf62
mov eax, dword [esi + 0x44]
mov dword [eax], 0x41f
lea ecx, [esi + 0x48]
call fcn.1001a8e0
lea ecx, [esi + 0x60]
call fcn.1001a8e0
mov ecx, dword [esi + 0x78]
xor ecx, ebp
call fcn.1002ca30
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esi + 0x40], ecx
mov dword [esi + 0x3c], eax
movsd xmm0, qword [0x1003b2e0]
movsd qword [esi + 0x30], xmm0
movsd xmm0, qword [0x1003b2d8]
movsd qword [esi + 0x28], xmm0
mov dword [esi + 0x24], 0x2cd
lea ecx, [esi + 0x60]
lea eax, str.pioakuunmiudqimrsshzyctluoaqeedmsuilcljhmbgregixmihxveppljtcszxqxqwjxcjnigpbrewtpdpfktl
sub esp, 4
mov dword [esp], eax
call fcn.1001a760
mov dword [esi + 0x20], 0x86
mov dword [esi + 0xc], 0xb8cc2ddd
jmp 0x1000ac0b
Function at 0x1003460e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100346ab
push ebx
push esi
call fcn.100345d7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1003456b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10034658
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100346aa
push edi
push eax
call fcn.10035537
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10034678
call fcn.100330b0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100346a9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1003456b
add esp, 0x20
test eax, eax
jne 0x10034697
push edi
call fcn.100330b0
jmp 0x1003469f
push ebx
call fcn.100330b0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10034918
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003da10
push 0x1003da08
push str.FlsAlloc
push 0x1f
call fcn.10034834
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003494c
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003b174]
call esi
jmp 0x10034952
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10034996
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003da20
push 0x1003da18
push str.FlsGetValue
push 0x21
call fcn.10034834
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100349cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003b174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100349d5
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003da28
push 0x1003da20
push str.FlsSetValue
push 0x22
call fcn.10034834
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10034a0f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003b174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41d063
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x408f9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40c], eax
test esi, esi
jne 0x41d0ac
xor eax, eax
jmp 0x41d226
and dword [esi], 0
push ebx
push edi
xor edi, edi
inc edi
push edi
push eax
push ecx
push 0x400
lea eax, [ebp - 0x404]
push eax
call fcn.004207ef
mov ecx, dword [ebp - 0x40c]
and dword [ebp - 0x408], 0
and dword [ebp - 0x41c], 0
mov ebx, eax
mov eax, ecx
shr eax, 0x1a
not eax
and eax, edi
mov dword [ebp - 0x410], eax
test ebx, ebx
je 0x41d113
mov eax, ecx
shr eax, 0x17
push ebx
and eax, edi
push eax
push 0x120001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ecx, dword [ebp - 0x40c]
mov dword [esi], eax
mov eax, dword [ebp - 0x410]
cmp dword [esi], 0
jne 0x41d1c0
test eax, eax
je 0x41d1c0
and dword [ebp - 0x418], 0
push edi
lea eax, [ebp - 0x414]
push eax
push ecx
call fcn.00420676
test eax, eax
je 0x41d1a2
mov eax, dword [ebp - 0x40c]
shr eax, 0x19
push ebx
and eax, edi
push eax
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x418], eax
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x40c]
call fcn.004207aa
mov ecx, dword [ebp - 0x418]
cmp ecx, 5
jne 0x41d1a8
cmp dword [ebp - 0x41c], 0
jne 0x41d1a8
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x41c], edi
jmp 0x41d0ed
mov ecx, dword [ebp - 0x418]
cmp dword [esi], 0
je 0x41d1c0
xor eax, eax
cmp ecx, 0xb7
setne al
mov dword [ebp - 0x408], eax
jmp 0x41d1c6
mov eax, dword [ebp - 0x408]
cmp dword [esi], 0
je 0x41d1d0
cmp dword [esi], 0xffffffff
jne 0x41d1f0
cmp dword [ebp - 0x410], 0
je 0x41d1e3
push 0x6b633230
call fcn.0041c827
and dword [esi], 0
xor eax, eax
mov dword [ebp - 0x408], eax
xor edi, edi
mov ecx, dword [ebp - 0x420]
test ecx, ecx
je 0x41d216
test ebx, ebx
jne 0x41d203
mov ebx, 0x408d8d
push dword [ebp + 0x14]
push ecx
push ebx
call fcn.0041d00c
mov eax, dword [ebp - 0x408]
add esp, 0xc
mov ecx, dword [ebp - 0x424]
test ecx, ecx
je 0x41d222
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041d31a
leave
ret 0x1c

Function at 0x41d31a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408f9c]
jne fcn.0041dfde
ret
Function at 0x41d5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x401ef4
push 0x80000000
mov dword [ebp - 8], ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41d68e
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call esi
test eax, eax
jne 0x41d684
push 4
pop esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x408fb4
push dword [ebp - 4]
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d684
cmp dword [ebp + 8], esi
jne 0x41d684
mov esi, dword [ebp - 0xc]
cmp esi, 3
ja 0x41d684
cmp dword [ebp - 4], ebx
je 0x41d676
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x41d680
push dword [ebp - 8]
call edi
mov eax, esi
jmp 0x41d69a
cmp dword [ebp - 4], ebx
je 0x41d68e
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x41d698
push dword [ebp - 8]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41da1b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x459884], 0
je 0x41da30
mov eax, dword [0x459888]
leave
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x409098
push 0x80000001
mov dword [ebp - 4], esi
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41daa7
lea eax, [ebp - 8]
push eax
push 0x459888
push esi
push esi
push dword [0x458798]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call edi
test eax, eax
jne 0x41daa7
cmp dword [ebp - 8], 4
jne 0x41daa7
mov esi, dword [0x459888]
mov byte [0x459884], 1
cmp dword [ebp - 4], eax
je 0x41daa0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x41db32
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x41daba
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4090e4
push 0x80000001
call ebx
test eax, eax
jne 0x41db17
push 4
pop ebx
lea eax, [ebp - 8]
push eax
push 0x459888
push 0
push 0
push dword [0x458798]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call edi
test eax, eax
jne 0x41db17
cmp dword [ebp - 8], ebx
jne 0x41db17
mov edi, dword [0x459888]
mov byte [0x459884], 1
cmp dword [ebp - 4], eax
je 0x41db13
push dword [ebp - 4]
call esi
mov eax, edi
jmp 0x41db32
and dword [0x459888], 0
cmp dword [ebp - 4], 0
mov byte [0x459884], 1
je 0x41db30
push dword [ebp - 4]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41dfde
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4599b8], eax
mov dword [0x4599b4], ecx
mov dword [0x4599b0], edx
mov dword [0x4599ac], ebx
mov dword [0x4599a8], esi
mov dword [0x4599a4], edi
mov word [0x4599d0], ss
mov word [0x4599c4], cs
mov word [0x4599a0], ds
mov word [0x45999c], es
mov word [0x459998], fs
mov word [0x459994], gs
pushfd
pop dword [0x4599c8]
mov eax, dword [ebp]
mov dword [0x4599bc], eax
mov eax, dword [ebp + 4]
mov dword [0x4599c0], eax
lea eax, [ebp + 8]
mov dword [0x4599cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x459908], 0x10001
mov eax, dword [0x4599c0]
mov dword [0x4598bc], eax
mov dword [0x4598b0], 0xc0000409
mov dword [0x4598b4], 1
mov eax, dword [0x408f9c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x458794]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x459900], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x409190
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x459900], 0
jne 0x41e0ca
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x4200ac
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x904
mov eax, dword [0x408f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x100
lea eax, [ebp - 0x904]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push esi
xor edi, edi
call fcn.004160d0
push 0x5c
pop esi
lea eax, [ebp - 0x804]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x420112
xor ecx, ecx
mov dword [ebp + edi*4 - 0x904], eax
mov word [eax], cx
inc edi
cmp edi, 0x40
jge 0x420155
test eax, eax
je 0x42014b
lea eax, [ebp - 0x804]
push eax
call fcn.00425487
test eax, eax
js 0x4200f1
jmp 0x42014b
mov eax, dword [ebp + edi*4 - 0x908]
dec edi
mov word [eax], si
push 0
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x420155
cmp edi, 1
jg 0x42012d
xor eax, eax
inc eax
jmp 0x420157
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041d31a
leave
ret 4

Function at 0x420179
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4201c1
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4201c1
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4201c1
cmp word [eax + 2], 0
je 0x4201c1
cmp dword [eax + 0x28], 0xfeef04bd
jne 0x4201c1
add eax, 0x30
jmp 0x4201c6
mov eax, 0x409214
pop esi
pop ebp
ret
Function at 0x6d599f48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6d59a02b
jmp 0x6d59a0fd
jmp 0x6d59a1cf
jmp 0x6d59a2a1
jmp 0x6d59a373
jmp 0x6d59a445
jmp 0x6d59a517
jmp 0x6d59a5e9
jmp 0x6d59a6bb
jmp 0x6d59a78d
jmp 0x6d59a85f
jmp 0x6d59a931
jmp 0x6d59aa03
jmp 0x6d59aad5
jmp 0x6d59aba7
jmp 0x6d59ac79
jmp 0x6d59ad4b
jmp 0x6d59ae1d
jmp 0x6d59aeef
jmp 0x6d59afc1
jmp 0x6d59b093
jmp 0x6d59b165
jmp 0x6d59b237
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6d59b30f
jmp 0x6d59b3e1
jmp 0x6d59b4b3
jmp 0x6d59b585
jmp 0x6d59b657
jmp 0x6d59b729
jmp 0x6d59b7fb
jmp 0x6d59b8cd
jmp 0x6d59b99f
jmp 0x6d59ba71
jmp 0x6d59bb43
jmp 0x6d59bc15
jmp 0x6d59bce7
jmp 0x6d59bdb9
jmp 0x6d59be8b
jmp 0x6d59bf5d
jmp 0x6d59c02f
jmp 0x6d59c101
jmp 0x6d59c1d3
jmp 0x6d59c2a5
jmp 0x6d59c377
jmp 0x6d59c449
jmp 0x6d59c51b
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6d59c607
jmp 0x6d59c6d9
jmp 0x6d59c7ab
jmp 0x6d59c87d
jmp 0x6d59c94f
jmp 0x6d59ca21
jmp 0x6d59caf3
jmp 0x6d59cbc5
jmp 0x6d59cc97
jmp 0x6d59cd69
jmp 0x6d59ce3b
jmp 0x6d59cf0d
jmp 0x6d59cfdf
jmp 0x6d59d0b1
jmp 0x6d59d183
jmp 0x6d59d255
jmp 0x6d59d327
jmp 0x6d59d3f9
jmp 0x6d59d4cb
jmp 0x6d59d59d
jmp 0x6d59d66f
jmp 0x6d59d741
jmp 0x6d59d813
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6d59d8ee
jmp 0x6d59d9c0
jmp 0x6d59da92
jmp 0x6d59db64
jmp 0x6d59dc36
jmp 0x6d59dd08
jmp 0x6d59ddda
jmp 0x6d59deac
jmp 0x6d59df7e
jmp 0x6d59e050
jmp 0x6d59e122
jmp 0x6d59e1f4
jmp 0x6d59e2c6
jmp 0x6d59e398
jmp 0x6d59e46a
jmp 0x6d59e53c
jmp 0x6d59e60e
jmp 0x6d59e6e0
jmp 0x6d59e7b2
jmp 0x6d59e884
jmp 0x6d59e956
jmp 0x6d59ea28
jmp 0x6d59eafa
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6d59ebe5
jmp 0x6d59ecb7
jmp 0x6d59ed89
jmp 0x6d59ee5b
jmp 0x6d59ef2d
jmp 0x6d59efff
jmp 0x6d59f0d1
jmp 0x6d59f1a3
jmp 0x6d59f275
jmp 0x6d59f347
jmp 0x6d59f419
jmp 0x6d59f4eb
jmp 0x6d59f5bd
jmp 0x6d59f68f
jmp 0x6d59f761
jmp 0x6d59f833
jmp 0x6d59f905
jmp 0x6d59f9d7
jmp 0x6d59faa9
jmp 0x6d59fb7b
jmp 0x6d59fc4d
jmp 0x6d59fd1f
jmp 0x6d59fdf1
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x1c]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x2c], eax
jmp 0x6d59fedd
jmp 0x6d59ffaf
jmp 0x6d5a0081
jmp 0x6d5a0153
jmp 0x6d5a0225
jmp 0x6d5a02f7
jmp 0x6d5a03c9
jmp 0x6d5a049b
jmp 0x6d5a056d
jmp 0x6d5a063f
jmp 0x6d5a0711
jmp 0x6d5a07e3
jmp 0x6d5a08b5
jmp 0x6d5a0987
Function at 0x6d5d085f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6dc33018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6dc33018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6d5d0951
jmp 0x6d5d0a23
jmp 0x6d5d0af5
jmp 0x6d5d0bc7
jmp 0x6d5d0c99
jmp 0x6d5d0d6b
jmp 0x6d5d0e3d
jmp 0x6d5d0f0f
jmp 0x6d5d0fe1
jmp 0x6d5d10b3
jmp 0x6d5d1185
jmp 0x6d5d1257
jmp 0x6d5d1329
jmp 0x6d5d13fb
jmp 0x6d5d14cd
jmp 0x6d5d159f
jmp 0x6d5d1671
jmp 0x6d5d1743
jmp 0x6d5d1815
jmp 0x6d5d18e7
jmp 0x6d5d19b9
jmp 0x6d5d1a8b
jmp 0x6d5d1b5d
mov dword [ebp - 0x14], 0
jmp 0x6d5d1c36
jmp 0x6d5d1d08
jmp 0x6d5d1dda
jmp 0x6d5d1eac
jmp 0x6d5d1f7e
jmp 0x6d5d2050
jmp 0x6d5d2122
jmp 0x6d5d21f4
jmp 0x6d5d22c6
jmp 0x6d5d2398
jmp 0x6d5d246a
jmp 0x6d5d253c
jmp 0x6d5d260e
jmp 0x6d5d26e0
jmp 0x6d5d27b2
jmp 0x6d5d2884
jmp 0x6d5d2956
jmp 0x6d5d2a28
jmp 0x6d5d2afa
jmp 0x6d5d2bcc
jmp 0x6d5d2c9e
jmp 0x6d5d2d70
jmp 0x6d5d2e42
mov dword [ebp - 0x18], 0

Function at 0x10002a50
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x10002a84
test esi, esi
je 0x10002a84
or eax, 0xffffffff
xor edx, edx
test esi, esi
je 0x10002a7f
movzx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1005d5e0]
cmp edx, esi
jb 0x10002a67
pop edi
not eax
pop esi
ret
pop edi
xor eax, eax
pop esi
ret