joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422bb0
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00421f00
cmp dword [0x8a3718], 0x37
jne 0x422c65
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x4044d0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4044f0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x404]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov ecx, dword [0x8a371c]
mov eax, dword [0x89fb88]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1004
ret
Function at 0x10002c70
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x220]
push 0xf00021
mov edx, dword [edi + 4]
mov ecx, dword [edi]
mov eax, dword [edi + 0xc]
sub eax, edx
push eax
mov eax, dword [edi + 8]
sub eax, ecx
push eax
push edx
mov esi, dword [esp + 0x22c]
push ecx
push esi
call sub.GDI32.dll_PatBlt
lea eax, [esp + 0x14]
push 0x200
push eax
mov eax, dword [esp + 0x220]
push eax
call sub.USER32.dll_GetWindowTextA
or eax, eax
je 0x10002d28
mov ebx, dword [esp + 0x224]
mov eax, ebx
and al, 0xf
cmp al, 0xc
jne 0x10002cd6
mov bp, 0x140
jmp 0x10002ce1
mov ebp, ebx
and bp, 0xf
or bp, 0x150
test bl, 0x80
je 0x10002ceb
or bp, 0x800
and ebx, 0x8000000
je 0x10002d03
mov eax, dword [0x10043470]
push eax
push esi
call sub.GDI32.dll_SetTextColor
mov dword [esp + 0x10], eax
mov eax, ebp
and eax, 0xffff
push eax
push edi
lea eax, [esp + 0x1c]
push 0xffffffffffffffff
push eax
push esi
call sub.USER32.dll_DrawTextA
or ebx, ebx
je 0x10002d28
mov eax, dword [esp + 0x10]
push eax
push esi
call sub.GDI32.dll_SetTextColor
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x204
ret

Function at 0x10004b30
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
jge 0x10004b55
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push edx
push ecx
mov ecx, dword [0x1003e1a0]
push ecx
call dword [sym.imp.USER32.dll_CallNextHookEx]
pop esi
ret 0xc
cmp dword [esp + 0xc], 0x74
jne 0x10004b9e
mov eax, dword [esp + 0x10]
shr eax, 0x10
test ah, 0xc0
jne 0x10004b9e
push 0x11
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
test ax, ax
jl 0x10004b9e
push 0x10
call esi
test ax, ax
jl 0x10004b9e
push 0
mov eax, dword [0x10042e80]
push 0
push 0x8006
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
pop esi
ret 0xc
xor eax, eax
pop esi
ret 0xc

Function at 0x10005d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, 0x45
mov byte [esp + 1], al
push ebx
mov byte [esp + 4], 0x4e
mov byte [esp + 6], 0x54
mov byte [esp + 7], 0x53
mov byte [esp + 8], 0x43
mov byte [esp + 9], 0x41
mov byte [esp + 0xa], 0x50
push esi
push edi
push ebp
mov byte [esp + 0x18], 0x32
mov byte [esp + 0x19], 0x2e
mov ebx, dword [esp + 0x38]
mov byte [esp + 0x17], al
push 1
mov ecx, ebx
mov byte [esp + 0x1e], 0x30
mov byte [esp + 0x1f], 3
mov byte [esp + 0x20], 1
push 0
mov ebp, dword [ebx]
call dword [ebp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
mov ebp, dword [eax + 8]
lea eax, [esp + 0x24]
push 0xd
push eax
mov ecx, ebx
call ebp
test eax, eax
jne 0x10005db7
lea esi, [esp + 0x24]
lea edi, [esp + 0x10]
mov ecx, 0xd
repe cmpsb byte [esi], byte es:[edi]
jne 0x10005d73
lea eax, [esp + 0x24]
push 2
push eax
mov ecx, ebx
call ebp
test eax, eax
jne 0x10005db7
push 1
mov ecx, ebx
push 1
mov eax, dword [ebx]
call dword [eax + 0x10]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
mov eax, dword [esp + 0x20]
push 0
push eax
mov ecx, ebx
mov ebx, dword [ebx]
call dword [ebx + 0x10]
mov eax, 0xb
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x10009330
Capabilities:
Read file on windows

Disassembly:
sub esp, 4
lea eax, [esp]
push esi
mov esi, dword [esp + 0x14]
push 0
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10009364
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 2
pop esi
add esp, 4
ret
mov eax, dword [esp + 4]
sub eax, esi
pop esi
cmp eax, 1
mov eax, 0
adc eax, 0xffffffff
add esp, 4
and eax, 2
ret

Function at 0x10009380
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
sub esp, 4
lea eax, [esp]
push 0
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov dword [esp + 0xc], 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
add esp, 4
ret
Function at 0x10013c90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x10013ca3
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov bp, word [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp word [edi + 2], bp
jne 0x10013d07
mov al, byte [edi]
and al, 0x10
je 0x10013cc6
cmp esi, 0x104
je 0x10013cd2
test al, al
jne 0x10013d07
cmp esi, 0x100
jne 0x10013d07
push 0x11
call ebx
test byte [edi], 8
movsx eax, ax
je 0x10013ce4
test eax, eax
jl 0x10013ce8
jmp 0x10013d07
test eax, eax
jl 0x10013d07
push 0x10
call ebx
test byte [edi], 4
movsx eax, ax
je 0x10013d03
test eax, eax
jge 0x10013d07
xor eax, eax
pop ebp
mov ax, word [edi + 4]
pop edi
pop esi
pop ebx
ret
test eax, eax
jge 0x10013d11
test byte [edi], 0x80
jne 0x10013d1c
add edi, 8
jmp 0x10013cb2
xor eax, eax
pop ebp
mov ax, word [edi + 4]
pop edi
pop esi
pop ebx
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10014070
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x70
mov eax, dword [0x1003e9e0]
push ebx
push esi
mov esi, dword [esp + 0x7c]
push edi
push ebp
push eax
push esi
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
jne 0x10014249
lea eax, [esp + 0x40]
push 0x40
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0xfffffffffffffff0
mov edi, dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
call edi
mov ebp, eax
push str.Static
lea eax, [esp + 0x44]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push eax
call ebx
test eax, eax
jne 0x100140e1
cmp bp, 0xb
jne 0x10014249
push sym.CNCS232.dll_Ordinal_21
push esi
call fcn.10013fe0
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x70
ret
cmp word [0x10043432], 0x400
jb 0x10014249
lea eax, [esp + 0x40]
push str.KnpTab
push eax
call ebx
test eax, eax
jne 0x10014249
push 0
push 0
push 0x805a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x20], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
mov ebp, dword [sym.imp.USER32.dll_GetParent]
call ebp
mov ebx, eax
mov ebp, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
lea ecx, [esp + 0x18]
push ecx
push ebx
call ebp
push 0
push 0xfffffffffffffffa
push ebx
call edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
push ebx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
sub eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push eax
push ecx
push edx
push 0x50000000
push 0x1003ea34
push str.SysTabControl32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, eax
test edi, edi
je 0x10014249
push 0
push 0
push 0x31
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x100141b6
push 0
push eax
push 0x30
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x40]
mov ebp, 0x3e9
mov dword [esp + 0x24], 3
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x30], eax
push ebp
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x1001421a
lea ecx, [esp + 0x40]
push 0x3f
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0x24]
lea ecx, [ebp - 0x3e9]
push eax
push ecx
push 0x1307
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x1001420d
inc ebp
jmp 0x100141d3
push edi
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
xor edi, edi
call ebx
jmp 0x10014220
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
test edi, edi
je 0x10014249
push sym.CNCS232.dll__CusTabProc_16
push edi
call fcn.10013fe0
mov eax, dword [esp + 0x28]
add esp, 8
dec eax
push 0
push eax
push 0x130c
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
call ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x70
ret
Function at 0x10030a10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x1003fde0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
jne 0x10030a73
push 0x74
push 1
call fcn.1002e710
add esp, 8
mov edi, eax
test edi, edi
je 0x10030a69
push edi
mov eax, dword [0x1003fde0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x10030a69
push edi
call fcn.100309f0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [edi], eax
mov dword [edi + 4], 0xffffffff
jmp 0x10030a73
push 0x10
call fcn.1002f1a0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x10031480
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.10031540
cmp dword [0x10040650], 1
mov esi, dword [esp + 0x10]
jne 0x100314a3
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x1004064c], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x10040648], bl
jne 0x100314fd
cmp dword [0x100447c8], 0
je 0x100314eb
mov edi, dword [0x100447c4]
sub edi, 4
cmp edi, dword [0x100447c8]
jb 0x100314eb
mov eax, dword [edi]
test eax, eax
je 0x100314e0
call eax
sub edi, 4
cmp edi, dword [0x100447c8]
jae 0x100314d8
push 0x1003e038
push 0x1003e030
call fcn.10031560
add esp, 8
push 0x1003e040
push 0x1003e03c
call fcn.10031560
add esp, 8
test ebx, ebx
je 0x1003151c
call fcn.10031550
pop edi
pop esi
pop ebx
ret
mov dword [0x10040650], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10033d20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x10040b58
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x10033d47
add eax, 8
inc ecx
cmp eax, 0x10040be8
jb 0x10033d38
cmp dword [ecx*8 + 0x10040b58], edx
lea ebx, [ecx*8]
jne 0x10033f0b
cmp dword [0x1003f9f4], 1
je 0x10033ec7
cmp dword [0x1003f9f4], 0
jne 0x10033d7e
cmp dword [0x1003f9f8], 1
je 0x10033ec7
cmp edx, 0xfc
je 0x10033f0b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x10033dbb
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x10033dff
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x1003bd8c
push ebp
call fcn.1002ead0
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1003bd6c
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x10040b5c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.100365d0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x100446c0], 0
je 0x10033edd
mov eax, dword [0x100446c0]
mov esi, dword [eax + 0x48]
cmp esi, 0xffffffff
jne 0x10033ee7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x10040b5c]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x10036d50
Capabilities:
Get geographical location

Disassembly:
push ebx
mov eax, dword [0x10041bc4]
push esi
test eax, eax
push edi
push ebp
jne 0x10036d98
push 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 1
push 0
call esi
test eax, eax
je 0x10036d78
mov eax, 1
jmp 0x10036d9e
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10036d91
mov eax, 2
jmp 0x10036d9e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [0x10041bc4], eax
cmp eax, 1
jne 0x10036dc3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov ebx, dword [esp + 0x18]
push ecx
push edx
push ebx
call esi
pop ebp
pop edi
pop esi
pop ebx
ret
mov dword [0x10041bc4], eax
cmp eax, 2
jne 0x10036e51
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x10036ddf
mov edi, dword [0x1003fad8]
mov eax, dword [esp + 0x18]
push 0
mov ebx, dword [esp + 0x18]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ebp, eax
test ebp, ebp
jne 0x10036e00
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push ebp
call fcn.1002e640
add esp, 4
mov esi, eax
test esi, esi
jne 0x10036e16
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10036e46
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x10036e56
push 0
push 0
push 0xffffffffffffffff
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jne 0x10036e6e
push esi
call fcn.1002e7c0
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xffffffffffffffff
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x10036e46
push esi
call fcn.1002e7c0
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10036e80
Capabilities:
Get geographical location

Disassembly:
push ebx
mov eax, dword [0x10041bc8]
push esi
test eax, eax
push edi
push ebp
jne 0x10036ec8
push 0
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0
push 1
push 0
call esi
test eax, eax
je 0x10036ea8
mov eax, 2
jmp 0x10036ece
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10036ec1
mov eax, 1
jmp 0x10036ece
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [0x10041bc8], eax
cmp eax, 2
jne 0x10036ef3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov ebx, dword [esp + 0x18]
push ecx
push edx
push ebx
call esi
pop ebp
pop edi
pop esi
pop ebx
ret
mov dword [0x10041bc8], eax
cmp eax, 1
jne 0x10036f8f
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x10036f0f
mov edi, dword [0x1003fad8]
mov eax, dword [esp + 0x18]
push 0
mov ebx, dword [esp + 0x18]
push 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebp, eax
test ebp, ebp
jne 0x10036f30
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
lea eax, [ebp*2]
push eax
call fcn.1002e640
add esp, 4
mov esi, eax
test esi, esi
jne 0x10036f4d
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x18]
push ebp
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10036f84
mov eax, dword [esp + 0x20]
push 0
push 0
test eax, eax
jne 0x10036f94
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x10036faf
push esi
call fcn.1002e7c0
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push eax
mov eax, dword [esp + 0x28]
push eax
push 0xffffffffffffffff
push esi
push 0x220
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x10036f84
push esi
call fcn.1002e7c0
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x10038510
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
push ebp
xor edi, edi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], edi
cmp ebp, edi
jne 0x10038538
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov edx, dword [esp + 0x42c]
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x100446c0
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ebx, dword [esp + 0x18]
shl eax, 2
lea ecx, [eax + eax*8]
mov eax, dword [ebx]
mov dword [esp + 0x1c], ecx
test byte [eax + ecx + 4], 0x20
je 0x10038579
push 2
push 0
push edx
call fcn.10038f10
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x10038615
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x1003864e
lea esi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x100385dc
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x100385ca
mov byte [esi], 0xd
inc edi
inc esi
mov byte [esi], al
inc esi
mov eax, esi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x100385b1
lea eax, [esp + 0x24]
push 0
sub esi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push esi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10038644
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, esi
jge 0x1003859c
jmp 0x1003864e
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10038644
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x1003864e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x100386fa
cmp dword [esp + 0x10], 0
je 0x100386aa
cmp dword [esp + 0x10], 5
jne 0x1003868d
call fcn.1002fbb0
mov dword [eax], 9
call fcn.1002fbc0
mov ecx, dword [esp + 0x10]
pop ebp
pop edi
mov dword [eax], ecx
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1002fb30
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x100386d4
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x100386d4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
call fcn.1002fbb0
mov dword [eax], 0x1c
call fcn.1002fbc0
pop ebp
mov dword [eax], 0
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, edi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x1003a670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, dword [esp + 0x18]
push 2
mov esi, dword [esp + 0x18]
push eax
push esi
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
or edi, edi
jne 0x1003a694
sub eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret 0x20
push edi
push esi
call sub.KERNEL32.dll_SizeofResource
mov ebp, eax
push edi
push esi
call sub.KERNEL32.dll_LoadResource
mov esi, eax
or esi, esi
jne 0x1003a6b3
sub eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret 0x20
push ebp
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov ebx, eax
or ebx, ebx
jne 0x1003a6ca
sub eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret 0x20
mov edi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x44], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x48], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x64], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x54], eax
mov eax, dword [esp + 0x30]
mov dword [ebx + 0x50], eax
push 0
call sub.USER32.dll_GetDC
mov edi, eax
push 0
push ebx
lea eax, [ebx + 0x68]
push eax
push 4
push ebx
push edi
call sub.GDI32.dll_CreateDIBitmap
mov esi, eax
push edi
push 0
call sub.USER32.dll_ReleaseDC
push ebx
call sub.KERNEL32.dll_GlobalFree
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret 0x20