joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100295b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101c6240
mov dword [ebp - 0x1c], 0x2d002d
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x450054
mov dword [ebp - 0x14], 0x44004e
mov edx, 0xd
mov dword [ebp - 0x10], 0x46005f
sub esi, eax
mov dword [ebp - 0xc], 0x41004c
mov dword [ebp - 8], 0x47
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x1002961e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002961e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029600
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c6240
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x10029640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101c61ac
mov dword [ebp - 0x20], 0x4e002f
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x43004f
mov dword [ebp - 0x18], 0x450048
mov edx, 0xf
mov dword [ebp - 0x14], 0x4b0043
sub esi, eax
mov dword [ebp - 0x10], 0x55004d
mov dword [ebp - 0xc], 0x450054
mov dword [ebp - 8], 0x58
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x100296af
movzx ecx, word [esi + eax]
test cx, cx
je 0x100296af
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029691
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c61ac
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x100296d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101c6164
mov dword [ebp - 0x1c], 0x4e002f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x53004f
mov dword [ebp - 0x14], 0x4f0048
mov edx, 0xd
mov dword [ebp - 0x10], 0x540052
sub esi, eax
mov dword [ebp - 0xc], 0x550043
mov dword [ebp - 8], 0x54
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x1002973e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002973e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029720
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c6164
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret
Function at 0x10029760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x4e002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x101c60f4
mov dword [ebp - 0x1c], 0x53004f
mov dword [ebp - 0x18], 0x410054
mov edx, 0xe
mov dword [ebp - 0x14], 0x540052
sub esi, eax
mov dword [ebp - 0x10], 0x45004d
mov dword [ebp - 0xc], 0x55004e
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x100297ce
movzx ecx, word [esi + eax]
test cx, cx
je 0x100297ce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100297b0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c60f4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x100297f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101c6144
mov dword [ebp - 0x20], 0x42002f
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x4e0041
mov dword [ebp - 0x18], 0x4e0055
mov edx, 0xf
mov dword [ebp - 0x14], 0x4e0049
sub esi, eax
mov dword [ebp - 0x10], 0x540053
mov dword [ebp - 0xc], 0x450052
mov dword [ebp - 8], 0x47
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x1002985f
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002985f
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029841
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c6144
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x10029880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x4e002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x101c604c
mov dword [ebp - 0x1c], 0x50004f
mov dword [ebp - 0x18], 0x4f0052
mov edx, 0xe
mov dword [ebp - 0x14], 0x4f004d
sub esi, eax
mov dword [ebp - 0x10], 0x490054
mov dword [ebp - 0xc], 0x4e004f
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x100298ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x100298ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100298d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c604c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret
Function at 0x10029aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x4e002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x101c61ec
mov dword [ebp - 0x18], 0x4f004f
mov dword [ebp - 0x14], 0x450050
mov edx, 0xc
mov dword [ebp - 0x10], 0x57004e
sub esi, eax
mov dword [ebp - 0xc], 0x420045
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x10029b0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10029b0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029af0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c61ec
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x10029ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101c6220
mov dword [ebp - 0x20], 0x4e002f
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x53004f
push edi
mov dword [ebp - 0x18], 0x540045
mov edx, 0xf
mov dword [ebp - 0x14], 0x550041
sub esi, eax
mov dword [ebp - 0x10], 0x4f0054
mov dword [ebp - 0xc], 0x550052
mov dword [ebp - 8], 0x4e
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x10029d10
movzx ecx, word [esi + eax]
test cx, cx
je 0x10029d10
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029cf2
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x101c6220
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x10029d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x20], 0x4e002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x20]
mov eax, 0x101c6204
mov dword [ebp - 0x1c], 0x53004f
mov dword [ebp - 0x18], 0x410054
mov edx, 0xe
mov dword [ebp - 0x14], 0x540052
sub esi, eax
mov dword [ebp - 0x10], 0x540053
mov dword [ebp - 0xc], 0x540041
lea ecx, [edx + 0x7ffffff0]
test ecx, ecx
je 0x10029dae
movzx ecx, word [esi + eax]
test cx, cx
je 0x10029dae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029d90
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c6204
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret
Function at 0x10029e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], 0x49002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x101c607c
mov dword [ebp - 0x18], 0x53004e
mov dword [ebp - 0x14], 0x5f0054
mov edx, 0xc
mov dword [ebp - 0x10], 0x570048
sub esi, eax
mov dword [ebp - 0xc], 0x44004e
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x10029ebe
movzx ecx, word [esi + eax]
test cx, cx
je 0x10029ebe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029ea0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c607c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x10029ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x4e002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x101c61cc
mov dword [ebp - 0x20], 0x51004f
mov dword [ebp - 0x1c], 0x490055
mov edx, 0x10
mov dword [ebp - 0x18], 0x4b0043
sub esi, eax
mov dword [ebp - 0x14], 0x41004c
mov dword [ebp - 0x10], 0x4e0055
mov dword [ebp - 0xc], 0x480043
nop word [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x10029f5e
movzx ecx, word [esi + eax]
test cx, cx
je 0x10029f5e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029f40
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c61cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret

Function at 0x10029f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x101c6180
mov dword [ebp - 0x1c], 0x4f002f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x540050
mov dword [ebp - 0x14], 0x4d0049
mov edx, 0xd
mov dword [ebp - 0x10], 0x5a0049
sub esi, eax
mov dword [ebp - 0xc], 0x570045
mov dword [ebp - 8], 0x50
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x10029ffe
movzx ecx, word [esi + eax]
test cx, cx
je 0x10029ffe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10029fe0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x101c6180
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret
Function at 0x1002a160
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101551e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x101c0618]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x1002a268
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1002a229
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
shrd ecx, eax, 0x14
shr eax, 0x14
test eax, eax
ja 0x1002a1fc
jb 0x1002a1dc
cmp ecx, 0x400
jae 0x1002a1e5
push eax
push ecx
push 0x101761b8
jmp 0x1002a20a
test eax, eax
ja 0x1002a1fc
jb 0x1002a1f3
cmp ecx, 0x100000
jae 0x1002a1fc
shrd ecx, eax, 0xa
shr eax, 0xa
jmp 0x1002a203
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push 0x101761c0
lea eax, [ebp - 0x10]
push eax
call fcn.10012500
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
add esp, 0x10
mov ecx, edi
push eax
call fcn.10020cf0
mov esi, dword [ebp - 0x10]
jmp 0x1002a238
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x101761c8
call fcn.1000b130
or eax, 0xffffffff
add esi, 0xfffffff0
mov dword [ebp - 4], eax
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1002a253
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.10007270
int3
Function at 0x1002aee0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101553c6
mov eax, dword fs:[0]
push eax
mov eax, 0x402c
call fcn.100b4660
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x2000
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.100ec480
add esp, 0xc
lea eax, [ebp - 0x2010]
push 0x1000
push eax
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebx + 4]
mov dword [ebp - 0x4038], eax
lea eax, [ebp - 0x2010]
mov dword [ebp - 0x4030], eax
mov dword [ebp - 0x4020], eax
lea eax, [ebp - 0x4038]
push eax
mov dword [ebp - 0x402c], 0x10176140
mov dword [ebp - 0x4028], 0x59
mov dword [ebp - 0x401c], 0
mov dword [ebp - 0x4024], 0x1002a070
mov dword [ebp - 0x4034], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
je 0x1002b0e9
push 0x2000
lea eax, [ebp - 0x4010]
push 0
push eax
call fcn.100ec480
add esp, 0xc
lea eax, [ebp - 0x4010]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1002b0e9
lea eax, [ebp - 0x4010]
push eax
lea ecx, [ebp - 0x4014]
call fcn.1000b130
mov ecx, dword [str.YxhGamebox]
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002aff1
mov eax, dword [ebp - 0x4014]
sub ecx, edx
xor esi, esi
sar ecx, 1
cmovns esi, ecx
mov edi, dword [eax - 0xc]
cmp esi, edi
jl 0x1002b026
lea eax, [ebp - 0x4014]
push eax
lea ecx, [ebp - 0x4018]
call fcn.10020cf0
jmp 0x1002b05b
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x1002b036
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x1002b042
call fcn.1000d010
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
mov eax, dword [ebp - 0x4014]
lea ecx, [ebp - 0x4018]
sub edi, esi
push esi
lea eax, [eax + edi*2]
push eax
call fcn.1000dd10
mov eax, dword [str.YxhGamebox]
mov byte [ebp - 4], 1
test eax, eax
je 0x1002b109
mov esi, dword [ebp - 0x4018]
push eax
push esi
call fcn.1010927f
add esp, 8
test eax, eax
je 0x1002b09a
push dword [0x101c0168]
lea eax, [ebp - 0x4014]
push 0x101735f8
push eax
call fcn.1000efe0
add esp, 0xc
push dword [ebp - 0x4014]
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002b0c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4014]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1002b0e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.10007270
int3
Function at 0x1002b270
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10155448
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101c0618]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 8], 0x300
jne 0x1002b428
call fcn.1000d010
mov ecx, eax
test ecx, ecx
je 0x1002b43c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
push dword [ebx + 0x54]
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x1002b446
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x1002b2fc
push edi
lea ecx, [ebp + 8]
call fcn.1000ad50
mov esi, dword [ebp + 8]
push edi
push esi
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x1002b318
push dword [esi - 8]
push esi
call fcn.101090c8
add esp, 8
test eax, eax
js 0x1002b446
cmp eax, dword [esi - 8]
jg 0x1002b446
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
or ebx, 0xffffffff
cmp dword [esi - 0xc], ecx
jl 0x1002b40c
push 0x10176030
push esi
call fcn.100ec7f4
add esp, 8
test eax, eax
je 0x1002b40c
sub eax, esi
sar eax, 1
cmp eax, ebx
je 0x1002b40c
mov ecx, dword [esi - 0xc]
cmp ecx, 2
jl 0x1002b40c
xor edi, edi
add eax, 1
cmovns edi, eax
cmp edi, ecx
jl 0x1002b386
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.10020cf0
jmp 0x1002b3ad
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x1002b396
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x1002b3a2
call fcn.1000d010
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
push eax
push edi
push esi
lea ecx, [ebp - 0x10]
call fcn.1000dd10
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
push edi
push eax
mov byte [ebp - 4], 1
call fcn.1002a160
mov ecx, dword [ebp - 0x14]
push dword [eax]
mov byte [ebp - 4], 2
mov ecx, dword [ecx + 0x70]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x28]
mov edx, dword [ebp - 0x18]
mov eax, ebx
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1002b3f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1002b40c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1002b428
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10007270
push 0x80070057
call fcn.10007270
int3
Function at 0x1002c100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 1
mov eax, dword [esi + 0x60]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esi + 0x5c]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 5
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x58]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x64]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x68]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x6c]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x74]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x70]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x90]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x80]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x88]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x84]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x78]
lea edx, [ebp - 0x14]
movaps xmm0, xmmword [0x10176290]
movups xmmword [ebp - 0x14], xmm0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x78]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
movaps xmm0, xmmword [0x101762a0]
mov eax, dword [esi + 0x7c]
movups xmmword [ebp - 0x24], xmm0
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x7c]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x8c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x94]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100b4568
mov esp, ebp
pop ebp
ret
Function at 0x1002c230
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0x60]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esi + 0x5c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
push 0
push dword [esi + 0x54]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x58]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x64]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x68]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x6c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x74]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x70]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x90]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x80]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x88]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x84]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esi + 0x78]
lea edx, [ebp - 0x14]
movaps xmm0, xmmword [0x10176290]
movups xmmword [ebp - 0x14], xmm0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x78]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
movaps xmm0, xmmword [0x101762a0]
mov eax, dword [esi + 0x7c]
movups xmmword [ebp - 0x24], xmm0
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x7c]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
call fcn.10073040
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov ecx, dword [esi + 0x8c]
neg eax
sbb eax, eax
inc eax
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x14]
mov eax, dword [esi + 0x94]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100b4568
mov esp, ebp
pop ebp
ret
Function at 0x1002e890
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov esi, 0x10000000
cmovne esi, eax
movzx eax, word [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1002e8f1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x1002e8f1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1002e8f1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x1002e8f8
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x1002e918
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push edi
push ebx
push eax
call fcn.100eb980
add esp, 0xc
mov dword [ebp + 0xc], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
je 0x1002e940
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1002e985
mov ebx, dword [ebp + 0xc]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
test edi, edi
je 0x1002e983
lea eax, [ebp + 8]
mov dword [edi], vtable.Gdiplus::Bitmap.0
push eax
push ebx
mov dword [ebp + 8], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
jmp 0x1002e985
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1002e999
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret