joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000dae7
Capabilities:
Packed with generic packer

Disassembly:
pop esi
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
leave
push 0xfffffffffffffffb
push dword [esp + 4]
push dword [esp + 8]
push 0x18
push 0xfffa610
call fcn.10003cc0
dec dword [edi]
jne 0x1000dabf
mov eax, dword [edi + 4]
push edi
call dword [eax + 0x18]

Function at 0x1000e1a8
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push 0x10003c18
call 0x1000e1a8
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
jne fcn.1000e1d1
xor eax, eax
pop esi
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
push edx
push eax
lea esp, [esp + 8]
mov ecx, dword [esp + 8]
push 0x10001fb0
push 0xffffffffffffffc1
push 0x66
push 0xffffffffffffffa7
push dword [esp - 0x1b]
call fcn.1000e1e4
push ecx
mov ecx, dword [esp + 0xc]
jmp loc.1002fbc0

Function at 0x1000e5bc
Capabilities:
Packed with generic packer

Disassembly:
cmp eax, 0xb
ja 0x1000c0d1
jmp loc.1002e336

Function at 0x1000e7d4
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [esp + 8]
mov dword [eax], ecx
mov eax, dword [0x1001c2f3]
inc dword [eax]
mov eax, dword [0x1001c3b9]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
push eax
push 0xffffffffffffffb4
call fcn.1000e81b
jmp loc.1002f747

Function at 0x1000e9dc
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
pop edi
pop esi
mov esp, ebp
pop ebp
lea eax, [esp + 0x10]
push 0x1001d1af
push 0x1001d21d
push eax
call dword [sym.imp.USER32.dll_PtInRect]
lea ecx, [esp + 0x1c]
push esi
push 0x38
push esi
push dword [esp - 0xa5]
call 0x1000e994
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xb0]
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
mov edx, dword [ecx + 0x14]
lea esp, [esp + 0x10]
mov esi, dword [esp + 8]
push dword [esp - 0x26]
push dword [esp - 0x89]
push 0x10002cc0
push 0x10001e70
push esi
call 0x1000e9dc
push 0x1001cfb9
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.1000dc71
push eax
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
test eax, eax
jbe 0x1000e98a
call fcn.1000c64f
call fcn.1000a625
lea esp, [esp + 0x18]
add dword [esp + 4], esi
push dword [esp + 0x5f]
jmp loc.1002d4d4

Function at 0x1000eb28
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov eax, dword [esp + 8]
push 0x4e
push dword [esp - 0x38]
push 0x6f
push edx
push dword [esp - 0x14]
call 0x1000eb68
sub esp, 0x1001d130
mov eax, dword [0x1001d31f]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c763
lea edi, [esp + 9]
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push dword [esp - 0x50]
push dword [esp - 0x72]
push 0x10005fb8
push 0x7c
push ebx
jmp loc.1002b860
Function at 0x1000eb68
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov eax, dword [esp + 8]
push 0x4e
push dword [esp - 0x38]
push 0x6f
push edx
push dword [esp - 0x14]
call 0x1000eb68
sub esp, 0x1001d130
mov eax, dword [0x1001d31f]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c763
lea edi, [esp + 9]
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push dword [esp - 0x50]
push dword [esp - 0x72]
push 0x10005fb8
push 0x7c
push ebx
jmp loc.1002b860

Function at 0x1000ecf6
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x18], 0x14
mov dword [esp + 0x1c], edi
call dword [ecx + 0x1c]
mov esi, eax
push esi
push edi
jmp loc.1002f1fe

Function at 0x1000eda8
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.1002cbf9
push eax
push 0x10004700
push 0x5f
push edx
call 0x1000edd7
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea esp, [esp + 0x10]
mov eax, dword [esp + 8]
push 0x100014a8
push 0x10003148
push 0x10001528
push 0x10003620
push 0x10004d90
call 0x1000ee0a
push 0
call edi
push esi
call dword [sym.imp.USER32.dll_GetTopWindow]
push eax
push esi
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push 0xffffffffffffffac
push dword [esp + 0x50]
call 0x1000ee43
push 0
push 0
push 0x1001cb65
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x100097e2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, eax
lea esp, [esp + 0xc]
pop eax
ret 8

Function at 0x1000edd7
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.1002cbf9
push eax
push 0x10004700
push 0x5f
push edx
call 0x1000edd7
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea esp, [esp + 0x10]
mov eax, dword [esp + 8]
push 0x100014a8
push 0x10003148
push 0x10001528
push 0x10003620
push 0x10004d90
call 0x1000ee0a
push 0
call edi
push esi
call dword [sym.imp.USER32.dll_GetTopWindow]
push eax
push esi
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push 0xffffffffffffffac
push dword [esp + 0x50]
call 0x1000ee43
push 0
push 0
push 0x1001cb65
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x100097e2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, eax
lea esp, [esp + 0xc]
pop eax
ret 8
Function at 0x1000ee0a
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.1002cbf9
push eax
push 0x10004700
push 0x5f
push edx
call 0x1000edd7
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea esp, [esp + 0x10]
mov eax, dword [esp + 8]
push 0x100014a8
push 0x10003148
push 0x10001528
push 0x10003620
push 0x10004d90
call 0x1000ee0a
push 0
call edi
push esi
call dword [sym.imp.USER32.dll_GetTopWindow]
push eax
push esi
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push 0xffffffffffffffac
push dword [esp + 0x50]
call 0x1000ee43
push 0
push 0
push 0x1001cb65
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x100097e2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, eax
lea esp, [esp + 0xc]
pop eax
ret 8

Function at 0x1000f2f8
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x10
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc]

Function at 0x1000f30e
Capabilities:
Packed with generic packer

Disassembly:
push edx
push dword [esp - 0x9a]
jmp loc.10030160

Function at 0x1000f427
Capabilities:
Packed with generic packer

Disassembly:
add al, byte [eax]
add al, byte [ecx]
add byte [eax], al
add ah, cl
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001d315
mov eax, dword fs:[0]
push eax
dec ecx
jmp loc.1002cf7a

Function at 0x1000f90c
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [esp]
push edi
push 0x59
push 0x1e
push 0x10005d58
call 0x1000f90c
push esi
push edi
je 0x1000f8db
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x1000f8b7
mov esi, dword [esp + 0x20]
test esi, esi
je 0x1000f976
mov dl, byte [esp + 0x18]
lea esp, [esp + 0x10]
mov edi, dword [esp + 8]
push 0x10003760
push dword [esp + 0x47]
push dword [esp + 0x24]
push esp
jmp loc.1002cb6f

Function at 0x1000fc22
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax + 0x1000935c], bh
push esi
push 0
mov esi, ecx
call fcn.10004c4b
mov dword [esi], 0x10009380
mov eax, esi
pop esi
call fcn.1000a9c7
pop edx
push dword [esp + 0xc]
push 0x100005ef
push ebx
push 0xfffffffffffffffc
push 0xfffeb33
call fcn.10003ea8
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0xc

Function at 0x1000fd9a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov esi, dword [esp + 8]
push dword [esp - 0x45]
push ebp
push dword [esp - 0xf]
push dword [esp - 0x34]
push 0xffffffffffffffe7
jmp loc.1002d8c9
Function at 0x1000fe7f
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [esp + 8], 1
jne 0x1000feaf
push 0x1001ccf0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1000fec3
push ecx
push ebp
push dword [esp + 8]
push ecx
push dword [esp + 4]
jmp loc.1002ff55
mov eax, dword [esp + 4]
mov dword [0x1001ce22], eax
mov eax, 0x1001c409
sub esp, 0x1001c92d
mov eax, dword [0x1001c7e5]
mov dword [esp + 0x114], eax
lea eax, [esp]
push eax

Function at 0x1000ff4e
Capabilities:
Set thread local storage value

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
test eax, eax
je 0x1000ff71
xor eax, eax
push eax
push 0x100011f0
call 0x1000ff87
pop esp
and al, 0x10
test ah, 5
jp fcn.1000fef6
xor eax, eax
pop esi
push ebx
push edi
push 0x1001c8b9
call fcn.10013565
and al, 0x1c
lea esp, [esp + 8]
mov eax, dword [esp + 8]
push dword [esp + 0xc]
push dword [esp - 0x3d]
push 0xffffffffffffffd7
push ebp
call 0x1000ffb3
add byte [eax], al
mov eax, 0x1001c3dd
push esi
push 0
mov esi, ecx
call fcn.10007dcb
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push 0xffffffffffffffc4
call 0x1000ffda
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push str.ngine__D
lea esp, [esp + 8]
pop eax
ret 4

Function at 0x100102db
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1001c84d
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
leave
push 0x78
push 0x10000151
push ecx
push dword [esp + 8]
push 0xfff7ca3
call fcn.100038e6
lea edx, [esp + 0xe10]
push edx
push 0x1001c5c4
lea eax, [esp + 0x1c20]
push eax
mov ecx, esi
call fcn.1000cbd4
lea ecx, [esp + 0xa10]
push ecx
push 0x1001c2fa

Function at 0x100103d0
Capabilities:
Packed with generic packer

Disassembly:
je 0x100103ce
cmp eax, 0x8001
jmp 0x1002da71
lea esp, [esp + 0x10]
mov edi, dword [esp + 8]
push dword [esp - 0x46]
push ebp
push 0xffffffffffffff8d
push dword [esp - 0x1c]
call 0x100103d0
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x100103c4
test cl, cl
je 0x10010360
jmp 0x1002b5a3
mov cl, dl
lea esp, [esp + 0x14]
add dword [esp + 4], edi
push 0x10005108
push dword [esp - 0x3a]
jmp 0x1002ee35

Function at 0x100105dc
Capabilities:
Packed with generic packer

Disassembly:
test ax, ax
je 0x100105f4
movzx eax, ax
push eax
push edi
call ebx
xor ecx, ecx
mov cx, word [esi]
push ecx
call dword [sym.imp.USER32.dll_GetFocus]
add esi, 2
cmp esi, 0x1001d300
push eax
push ecx
push dword [esp + 4]
push 0x10000066
push dword [esp + 0xc]
push 0x10003db2
call fcn.10003abc
push 1
push eax
mov eax, dword [0x1001c948]
jmp loc.1002b7eb

Function at 0x10010742
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
sub esp, 0xc
mov eax, dword [0x1001cf4e]
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 7
lea ecx, [esp + 8]
push ecx
push 0x1001c7ec
push eax
jmp loc.1002e434
Function at 0x100107db
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x14]
test eax, eax
jmp loc.1002b346

Function at 0x100107fe
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push eax
push ebx
push dword [esp - 0xcc]
push ebx
call 0x1001081d
mov byte [ebp - 4], 1
je fcn.100107b6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
lea esp, [esp + 0x14]
mov ebx, dword [esp + 8]
push 0x31
call 0x10010862
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 0xc
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001c7df
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea esp, [esp + 8]
add dword [esp + 4], ebx
push dword [esp + 0x2e]
push dword [esp - 0xa1]
push 0x16
push 0xffffffffffffff97
push ebp
call 0x10010898
sub al, 0xd1
add byte [eax], dl
xchg esp, eax
rol dword [eax], 1
adc byte [esi - 0x37efff2f], ch
rol dword [eax], 1
adc dl, ah
rol dword [eax], 1
adc ah, bh
rol dword [eax], 1
adc byte [esi], dl
lea esp, [esp + 0x18]
pop ebx
ret 8

Function at 0x1001081d
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push eax
push ebx
push dword [esp - 0xcc]
push ebx
call 0x1001081d
mov byte [ebp - 4], 1
je fcn.100107b6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
lea esp, [esp + 0x14]
mov ebx, dword [esp + 8]
push 0x31
call 0x10010862
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 0xc
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001c7df
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
lea esp, [esp + 8]
add dword [esp + 4], ebx
push dword [esp + 0x2e]
push dword [esp - 0xa1]
push 0x16
push 0xffffffffffffff97
push ebp
call 0x10010898
sub al, 0xd1
add byte [eax], dl
xchg esp, eax
rol dword [eax], 1
adc byte [esi - 0x37efff2f], ch
rol dword [eax], 1
adc dl, ah
rol dword [eax], 1
adc ah, bh
rol dword [eax], 1
adc byte [esi], dl
lea esp, [esp + 0x18]
pop ebx
ret 8

Function at 0x100108f6
Capabilities:
Query environment variable

Disassembly:
push 0x1001ce91
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
push 0x1001ca3e
jmp loc.100300f2

Function at 0x10010968
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [esp]
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 1
mov dword [esp + 0x20], 0x10009588
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x1001c042
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x54], 0
mov dword [esp + 0x24], 0x10009590
call fcn.100118d5
push 0xffffffffffffffff
push ebx
push dword [esp - 1]
push dword [esp - 0xe2]
call fcn.100109d1
jmp loc.1002f36f

Function at 0x100109d1
Capabilities:
Packed with generic packer
Query environment variable

Disassembly:
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push 0xffffffffffffff8f
push ecx
push dword [esp - 1]
push dword [esp - 0x97]
push dword [esp - 0x6d]
jmp loc.1002bfa6
Function at 0x10010afc
Capabilities:
Packed with generic packer

Disassembly:
push edi
inc ebx
call dword [eax + 0xc]
xor esi, esi
cmp ebx, eax
jmp loc.1002e264
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push esp
push 0x10003858
push dword [esp - 0x49]
push dword [esp - 0x1e]
call 0x10010b2e
lea edx, [ebp - 0x9c]
push edx
call fcn.100108cd
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10010b23
dec dword [eax]
jne 0x10010aed
lea esp, [esp + 0x14]
add dword [esp + 4], ecx
push dword [esp - 0x49]
push 0xffffffffffffffdd
push dword [esp - 0x59]
push ebp
push 0x52
call 0x10010b6a
mov eax, dword [0x1001c0ec]
lea ecx, [esp + 8]
push 1
push ecx
mov ecx, dword [esp + 0xc]
call fcn.10013288
cmp eax, 0xffffffff
jne 0x10010af2
xor eax, eax
lea esp, [esp + 0x18]
pop ecx
ret 0xc

Function at 0x10010b2e
Capabilities:
Packed with generic packer

Disassembly:
push edi
inc ebx
call dword [eax + 0xc]
xor esi, esi
cmp ebx, eax
jmp loc.1002e264
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push esp
push 0x10003858
push dword [esp - 0x49]
push dword [esp - 0x1e]
call 0x10010b2e
lea edx, [ebp - 0x9c]
push edx
call fcn.100108cd
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10010b23
dec dword [eax]
jne 0x10010aed
lea esp, [esp + 0x14]
add dword [esp + 4], ecx
push dword [esp - 0x49]
push 0xffffffffffffffdd
push dword [esp - 0x59]
push ebp
push 0x52
call 0x10010b6a
mov eax, dword [0x1001c0ec]
lea ecx, [esp + 8]
push 1
push ecx
mov ecx, dword [esp + 0xc]
call fcn.10013288
cmp eax, 0xffffffff
jne 0x10010af2
xor eax, eax
lea esp, [esp + 0x18]
pop ecx
ret 0xc

Function at 0x10010bc3
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esi + 0x14]
test eax, eax
mov ebx, dword [esp]
push esi
push 0xffffffffffffffd9
push 0x10000b9e
push 0x1000067f
push 0xffff365
call fcn.10003ea8
mov dword [ebp + 0x7c], 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov eax, dword [ebp + 0x7c]
test eax, eax
jmp loc.1002d0b4
je 0x10010b66
mov eax, dword [0x1001d182]
mov ecx, dword [esp]
lea edx, [esp + 4]
push 1
push edx
call fcn.10010968
cmp eax, 0xffffffff
jne 0x10010b8b
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.100136c0
push eax
xchg dword [esp], eax
push 0x100003aa
push edx
push 0xffffffffffffff9b
push 0x38
push 0xfff3cb5
call fcn.10003abc
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
push edi
mov dword [esp + 8], 0
mov eax, dword [esi + 4]

Function at 0x10010bf5
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esi + 0x14]
test eax, eax
mov ebx, dword [esp]
push esi
push 0xffffffffffffffd9
push 0x10000b9e
push 0x1000067f
push 0xffff365
call fcn.10003ea8
mov dword [ebp + 0x7c], 0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov eax, dword [ebp + 0x7c]
test eax, eax
jmp loc.1002d0b4
je 0x10010b66
mov eax, dword [0x1001d182]
mov ecx, dword [esp]
lea edx, [esp + 4]
push 1
push edx
call fcn.10010968
cmp eax, 0xffffffff
jne 0x10010b8b
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.100136c0
push eax
xchg dword [esp], eax
push 0x100003aa
push edx
push 0xffffffffffffff9b
push 0x38
push 0xfff3cb5
call fcn.10003abc
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
push edi
mov dword [esp + 8], 0
mov eax, dword [esi + 4]
Function at 0x10010f60
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x18]
mov eax, dword [esp + 8]
push 0xffffffffffffffac
push 0x10005748
call 0x10010f92
xor eax, eax
mov ecx, dword [esp + 4]
push ecx
mov ecx, dword [esp + 0xc]
call fcn.100086e4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 8
mov ecx, dword [esp + 0x10]
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push dword [esp - 0xb9]
push ebx
push ebx
push esi
jmp loc.1002cac3

Function at 0x10010f92
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x18]
mov eax, dword [esp + 8]
push 0xffffffffffffffac
push 0x10005748
call 0x10010f92
xor eax, eax
mov ecx, dword [esp + 4]
push ecx
mov ecx, dword [esp + 0xc]
call fcn.100086e4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 8
mov ecx, dword [esp + 0x10]
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push dword [esp - 0xb9]
push ebx
push ebx
push esi
jmp loc.1002cac3

Function at 0x1001107b
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea ecx, [esi + 0x30]
pop esi
jmp loc.1003045b

Function at 0x1001125b
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push dword [esp + 0x33]
push 0xffffffffffffffba
push 0x10002990
push 0x6b
push 0xffffffffffffffc8
call fcn.10011286
xor eax, eax
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0xc]
push eax
jmp loc.1002bf58

Function at 0x100113a5
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.1002e04c
mov edi, edi
mov dword [ecx], 0
mov dword [ecx + 4], 0
add ecx, 8
dec edx
jne 0x1001135f
mov dword [edi + 0xcc], eax
pop edi
mov eax, 0x1001c2e4
pop esi
xor eax, eax
call fcn.10004e4d
push dword [esp + 0xc]
push ecx
push 0xffffffffffffffe0
push eax
push 0xfff94ec
call fcn.10003abc
mov dword [esp + 0x9e], edx
mov dword [esp + 0x96], eax
mov eax, dword [0x1001c9cb]
mov dword [esp + 0x9a], ecx
mov ecx, dword [0x1001d1cd]
mov dword [esp + 0xa2], edx
mov dword [esp + 0xb0], edx
add byte [eax], al
mov eax, 0x1001ccff
push esi
push 0
mov esi, ecx
call fcn.1000ecf6
mov dword [esi], 0x10009380
mov eax, esi
pop esi
call fcn.1000c2b7
mov eax, 0x1001c664
push esi
mov esi, ecx
call fcn.10007f47

Function at 0x100114e6
Capabilities:
Write file on windows

Disassembly:
push esi
push dword [esp - 0xc5]
push dword [esp - 0x78]
push dword [esp + 0x43]
push ebx
push dword [esp - 0x69]
call 0x10011532
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c821
mov eax, dword [0x1001c7c2]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c57e
lea edi, [esp + 9]
lea esp, [esp + 0x18]
mov esi, dword [esp + 8]
push dword [esp + 0x53]
jmp loc.1002b990
Function at 0x10011509
Capabilities:
Write file on windows

Disassembly:
push esi
push dword [esp - 0xc5]
push dword [esp - 0x78]
push dword [esp + 0x43]
push ebx
push dword [esp - 0x69]
call 0x10011532
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c821
mov eax, dword [0x1001c7c2]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c57e
lea edi, [esp + 9]
lea esp, [esp + 0x18]
mov esi, dword [esp + 8]
push dword [esp + 0x53]
jmp loc.1002b990

Function at 0x10011532
Capabilities:
Write file on windows

Disassembly:
push esi
push dword [esp - 0xc5]
push dword [esp - 0x78]
push dword [esp + 0x43]
push ebx
push dword [esp - 0x69]
call 0x10011532
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c821
mov eax, dword [0x1001c7c2]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c57e
lea edi, [esp + 9]
lea esp, [esp + 0x18]
mov esi, dword [esp + 8]
push dword [esp + 0x53]
jmp loc.1002b990

Function at 0x10011561
Capabilities:
Write file on windows

Disassembly:
add eax, edx
cmp eax, edi
mov dword [ebp + 0x10], ecx
jae 0x10012a76
mov edx, dword [ebp + 8]
push edx
lea eax, [edi + edi*4]
shl eax, 2
mov dword [ebp + 0x10], eax
push esi
add eax, ebx
push eax
lea esp, [esp + 8]
add dword [esp + 4], esi
push dword [esp - 0x4a]
push 0x37
push dword [esp - 0x7e]
push 0x10005b00
call fcn.100115a0
and ecx, 0xf
movzx edx, ax
push ecx
push edx
push edi
mov word [esi*2 + 0x10040f98], ax
call dword [sym.imp.USER32.dll_EnableMenuItem]
inc esi
cmp esi, 0x10
jl 0x10011543

Function at 0x1001178a
Capabilities:
Packed with generic packer

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
pop ecx
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx

Function at 0x100117ab
Capabilities:
Packed with generic packer

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
sub esp, 0x14
xor eax, eax

Function at 0x1001199c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x10]
mov edi, dword [esp + 8]
push dword [esp - 0x12]
push dword [esp - 0x32]
push 0x10002230
call 0x1001199c
mov esp, ebp
pop ebp
push 0x1001caa9
lea ecx, [esp + 0x14]
push ecx
call esi
lea edx, [esp + 0x10]
push edx
push 0x1001c30c
call fcn.10006254
lea eax, [esp + 0x18]
lea esp, [esp + 0x10]
add dword [esp + 4], edi
push dword [esp - 0x21]
jmp loc.1003060a

Function at 0x10011b21
Capabilities:
Check os version

Disassembly:
mov edx, 0x1001c532
push esi
mov si, word [ecx + eax]
mov word [eax], si
add eax, 2
dec edx
call eax
push 0x10000817
push esi
push 0x10000404
push 0xffffffffffffffed
push 0xfffe640
call fcn.10003abc
mov esi, eax
cmp esi, ebp
jl 0x10011b53
mov eax, dword [edi + 0x108]
cmp eax, ebp
je 0x10011b2d
jmp loc.1002f476