joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.10011a30
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80
Function at 0x1003bf00
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043278
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
mov dword [esp + 0x10], 0
test eax, eax
je 0x1003bf53
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1003bf53
mov esi, dword [eax + 0x14]
test esi, esi
je 0x1003bf53
mov eax, dword [esp + 0x18]
cmp dword [esi], eax
je 0x1003bfc0
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x1003bf48
call fcn.1003bc40
lea esi, [eax + 0x14]
push esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.10011a30
add esp, 0x10
mov dword [esi], eax
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], 0xffffffff
test esi, esi
je 0x1003bfaf
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bfaf
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bfaf
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret
cmp byte [esp + 0x28], 0
je 0x1003bfd9
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1003bfd9
mov eax, dword [ecx]
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 4]
push edx
call eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 4]
call fcn.1003bb20
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], edx
jmp 0x1003bf75
Function at 0x1003bff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.10011a30
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80

Function at 0x1003c1ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006b894]
jne 0x1003c1f4
repz ret
jmp fcn.1003c9ee
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1001aefd
pop dword [ebp - 0x18]
mov eax, 0x1001aefd
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x4b549b46
sub dword [ebp - 0x28], 0xfd0255fb
mov dword [ebp - 0x24], 0x6f1665a
add dword [ebp - 0x24], 0x2b41e5eb
mov dword [ebp - 0x20], 0x29ac4320
sub dword [ebp - 0x20], 0xdd5ffef2
mov dword [ebp - 0x1c], 0x5b6566d2
add dword [ebp - 0x1c], 0xa49a992e
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x878b9c2f
add dword [ebp - 0x28], 0xece6cd27
mov dword [ebp - 0x24], 0x9723973
sub dword [ebp - 0x24], 0xc805d7fe
mov dword [ebp - 0x20], 0xa8ecdce1
add dword [ebp - 0x20], 0xba828f8b
mov dword [ebp - 0x1c], 0xf866fa3d
add dword [ebp - 0x1c], 0x79905c3
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3885e
push 0
call eax
mov ecx, 0x4fea1ea7
add ecx, 0xb0162db9
xor esi, esi
add esi, eax
mov edi, 0x10026800
add edi, dword [ebp - 0x18]
mov ebx, 0x50a830aa
sub ebx, 0x1c109768
xor dword [ebp - 0xc], 0xf4381f47
mov edx, dword [edi]
xor dword [ebp - 0xc], 0xf101d7d8
add edx, ebx
sub dword [ebp - 8], 0xfa4bbef0
mov dword [esi], edx
mov dword [ebp - 0xc], 0xc8b8851f
add esi, 0x55bbb72a
sub esi, 0x55bbb726
add edi, 0xd2854048
sub edi, 0xd2854044
loop 0x1001b00c
add eax, 0x9e212267
sub eax, 0x9e1ffe14
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x479a3bd4
add ecx, 0xc865c42c
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x29801a89
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x298601b4]
jne 0x29801a93
repz ret
jmp fcn.2983e792

Function at 0x298050c5
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x2983eb59
call fcn.29801f91
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x298050e5
xor eax, eax
call fcn.298029c6
ret 4
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x29805113
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
mov edi, dword [eax]
add edi, dword [ecx]
mov ecx, esi
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, edi
jae 0x29805113
mov ecx, esi
call dword [sym.imp.MSVCP100.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x298050dd
xor edi, edi
cmp dword [esi + 0x54], edi
jne 0x2980511f
or eax, 0xffffffff
jmp 0x298050dd
mov ecx, esi
call fcn.29803ec2
cmp dword [esi + 0x44], edi
jne 0x2980513c
push dword [esi + 0x54]
push ebx
call fcn.2982edf9
pop ecx
pop ecx
test al, al
je 0x2980511a
jmp 0x2980510f
push edi
push 8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.2982edf9
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051f1
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2f]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x2980520f
cmp eax, 1
jg 0x298051f9
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051a4
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x298051cb
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298051b7
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x2980520f
lea eax, [ebp - 0x30]
mov byte [esi + 0x49], 1
cmp dword [ebp - 0x38], eax
jne 0x29805229
test edi, edi
jne 0x2980515b
cmp dword [ebp - 0x1c], 0x20
jae 0x2980520f
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.2982edf9
jmp 0x2980515b
mov ecx, dword [ebp - 0x2c]
jmp 0x2980516d
cmp eax, 3
jne 0x2980520f
push dword [esi + 0x54]
push dword [ebp - 0x30]
call fcn.2982edf9
pop ecx
pop ecx
test al, al
jne 0x29805229
or esi, 0xffffffff
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2982edf9
mov eax, esi
jmp 0x298050dd
mov esi, ebx
jmp 0x29805212
Function at 0x2980522d
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x2983fd5f
call fcn.29801f91
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x44], edi
je 0x29805323
cmp byte [esi + 0x49], 0
je 0x29805323
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x29805263
xor al, al
jmp 0x29805325
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.2982edf9
mov dword [ebp - 4], edi
lea ebx, [esi + 0x4c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052c5
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x298052ca
dec eax
je 0x298052ce
dec eax
dec eax
je 0x2980531f
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2982edf9
mov al, bl
jmp 0x29805325
mov ecx, dword [ebp - 0x2c]
jmp 0x29805290
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052da
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x29805301
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x298052ed
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x298052af
cmp byte [esi + 0x49], 0
je 0x2980531f
test edi, edi
jne 0x29805282
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.2982edf9
jmp 0x29805282
mov bl, 1
jmp 0x298052b1
mov al, 1
call fcn.298029c6
ret
Function at 0x2982092f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x29840d8f
call fcn.2983e23c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x298209dd
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.2982edf9
add esp, 0xc
test eax, eax
js 0x298209dd
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x298209c3
push edi
call fcn.2981d496
pop ecx
test al, al
je 0x298209c3
mov eax, edi
call fcn.2983e480
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x298209cf
push edi
lea ecx, [ebp - 0x428]
call fcn.2982edf9
push 3
push edi
push esi
push eax
call fcn.2982edf9
cmp eax, ebx
jne 0x29820a1a
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x298209f6
lea ecx, [ebp - 0x418]
call fcn.2981cb8c
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.2981cb0e
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.2983e275
ret 0x10
push 2
push ebx
push eax
call fcn.2981d73e
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x29820a3b
call fcn.2981c3ab
mov esi, eax
jmp 0x29820b05
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x29820a5e
call fcn.2981c3ab
jmp 0x29820af7
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x29820a54
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x29820a8e
mov esi, 0x8007000e
jmp 0x29820af9
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2982edf9
mov dword [ebp - 4], 1
jmp 0x29820abc
cmp dword [ebp - 0x418], ebx
je 0x29820a87
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.2982edf9
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.2982edf9
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x298209fb
lea ecx, [ebp - 0x418]
call fcn.2981cb8c
jmp 0x298209fb
Function at 0x2982edf9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x2982ee08
pop dword [ebp - 0x24]
mov eax, 0x755f7832
sub eax, 0x4bdc8a2a
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x4302f02b
sub dword [ebp - 0x34], 0xf4b0aae0
mov dword [ebp - 0x30], 0x9e810932
add dword [ebp - 0x30], 0x93b24313
mov dword [ebp - 0x2c], 0x9a621e3d
add dword [ebp - 0x2c], 0xb1ea25f1
mov dword [ebp - 0x28], 0x282e4448
sub dword [ebp - 0x28], 0x282e4448
lea eax, [ebp - 0x34]
push eax
mov eax, 0x304f0904
sub eax, 0x6cac80c
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xfff52a3
sub dword [ebp - 0x34], 0x9b8ce94d
mov dword [ebp - 0x30], 0xd500d551
sub dword [ebp - 0x30], 0x939473dc
mov dword [ebp - 0x2c], 0x5c018b26
add dword [ebp - 0x2c], 0x76de146
mov dword [ebp - 0x28], 0x8cf3803
add dword [ebp - 0x28], 0xf730c7fd
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x44da9
push 0
call eax
mov ecx, 0xc3ee1df4
sub ecx, 0xc3edd44c
xor ebx, ebx
add ebx, eax
mov edx, 0x2987c000
add edx, dword [ebp - 0x24]
mov edi, 0xd6271c83
sub edi, 0xb6172346
add dword [ebp - 4], 0x4db1d1c6
mov esi, dword [edx]
xor dword [ebp - 0x1c], edi
xor esi, edi
add dword [ebp - 0xc], ecx
mov dword [ebx], esi
xor dword [ebp - 4], 0x44ee3bda
add ebx, 4
add edx, 0x7559dd9d
sub edx, 0x7559dd99
loop 0x2982ef21
add eax, 0x39796b55
sub eax, 0x397851e2
xor ebx, ebx
add ebx, eax
add eax, 0x46380ef0
add eax, 0xb9c7f115
mov ecx, 0x9bf4f04e
add ecx, 0x8d8b0fb2
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x100011e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x278
xor eax, eax
lea ecx, [esp + 0x1c8]
lea edx, [esp + 0x78]
lea esi, [esp + 0x108]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x68], edx
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
mov ecx, esp
mov dword [ecx + 8], 0x409
mov dword [ecx + 4], 0x7b06da
mov dword [ecx], 0x9a197
mov ecx, dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [esp + 0x5c], eax
call ecx
sub esp, 0xc
xor ecx, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], ecx
mov eax, dword [esp + 0x54]
mov ecx, 0x4ec4ec4f
mov dword [esp + 0x50], eax
mul ecx
shr edx, 2
imul eax, edx, 0xd
mov ecx, dword [esp + 0x50]
sub ecx, eax
mov eax, ecx
sub eax, 8
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], eax
je 0x100012a7
jmp 0x10001277
mov eax, dword [esp + 0x4c]
sub eax, 4
mov dword [esp + 0x44], eax
jne 0x10001315
jmp 0x1000128a
mov eax, esp
mov dword [eax + 4], 0x4d6
mov dword [eax], 0x73e011
mov eax, dword [sym.imp.GDI32.dll_SetTextAlign]
call eax
sub esp, 8
mov dword [esp + 0x40], eax
xor eax, eax
mov ecx, 0x90
mov edx, 0xc0
mov esi, dword [esp + 0x64]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], edx
call fcn.100028c0
mov eax, dword [esp + 0x68]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x90
call fcn.100028c0
mov eax, esp
lea ecx, [esp + 0x78]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x108]
mov dword [eax], ecx
call sub.POWRPROF.dll_GetCurrentPowerPolicies
sub esp, 8
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x50]
add eax, 1
cmp eax, 0x39f
mov dword [esp + 0x54], eax
jne 0x1000124b
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x5c]
sub edx, 0x11
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
je 0x10001378
jmp 0x10001348
mov eax, dword [esp + 0x5c]
sub eax, 0x63
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jne 0x10001390
jmp 0x1000135f
mov eax, esp
lea ecx, [esp + 0x1c8]
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
call eax
sub esp, 4
mov dword [esp + 0x18], eax
mov eax, esp
mov dword [eax], 0xbcc86c
mov eax, dword [sym.imp.USER32.dll_ShowCaret]
call eax
sub esp, 4
mov dword [esp + 0x14], eax
jmp 0x100013cb
mov eax, dword [esp + 0x1c]
add eax, 1
mov ecx, esp
lea edx, [esp + 0x70]
mov dword [ecx + 4], edx
mov dword [ecx], 0x42a36e
mov ecx, dword [sym.imp.GDI32.dll_GetBrushOrgEx]
mov dword [esp + 0x10], eax
call ecx
sub esp, 8
mov ecx, dword [esp + 0x10]
cmp ecx, 0xa
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], ecx
jne 0x10001390
mov eax, dword [esp + 0x5c]
add eax, 1
cmp eax, 0x121
mov dword [esp + 0x60], eax
jne 0x10001218
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x10002cfc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001ec00]
jne 0x10002d06
repz ret
jmp fcn.10002fad
Function at 0x100035c8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1001ebd4], 0xa6f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x100035f4
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x100066f6]
mov dh, byte [eax + 0x100066c7]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x100035f4
lea eax, [ebp - 0x24]
mov dword [0x1001ebd8], 0x24b7
mov dword [ebp - 0x34], eax
call fcn.10003bb5
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10003346
mov dword [0x1001ebd8], 0x1689
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x100035ec
mov eax, dword [0x1001ebd4]
mov ecx, dword [ebp - 0x38]
add eax, 0xffffff6a
mov dword [0x1001ebd4], eax
mov eax, esp
mov dword [eax + 0xc], 0x40
mov dword [eax + 8], 0x1000
mov dword [eax + 4], 0x6000
mov dword [eax], 0
call ecx
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.10003490
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x1001ebd4], 0xefb
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x50], ecx
mov ecx, dword [0x1001ebd4]
add ecx, 0x1cd0
mov dword [0x1001ebd4], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x38], ecx
add ecx, 0x176d
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10003702
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret