joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d9688
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call sym.XNewLookSch.dll_public:_class_LString___thiscall_LString::get_real_file_from_env_format_void_
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
cmp esi, 0xffffffff
jne 0x10074680
or eax, esi
jmp 0x100746fc
and esi, 0x10
jne 0x1007468a
lea eax, [esi - 2]
jmp 0x100746fc
lea ecx, [ebp - 0x74]
call sym.XNewLookSch.dll_public:_void___thiscall_LDirSnap::constructor_void_
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x74]
push edi
mov byte [ebp - 0x74], 1
call sym.XNewLookSch.dll_public:_void___thiscall_LDirSnap::set_file_class_LString_const__
push 8
call fcn.1008bfb4
mov esi, eax
lea ecx, [ebp - 0x74]
add esp, 4
mov dword [esi], vtable.SnapAndDecryCB2.0
mov dword [esi + 4], ebx
mov dword [ebp - 0x60], esi
mov byte [ebp - 0x64], 1
call sym.XNewLookSch.dll_public:_int___thiscall_LDirSnap::snap_void_
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
lea ecx, [ebp - 0x38]
call fcn.10011ab0
lea ecx, [ebp - 0x44]
call fcn.10011ab0
lea ecx, [ebp - 0x50]
call fcn.10011ab0
lea ecx, [ebp - 0x5c]
call fcn.10011ab0
lea ecx, [ebp - 0x70]
call fcn.100310d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret 4
Function at 0x10075de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
or edx, 0x100
mov ecx, edx
mov eax, edx
shr ecx, 7
add edx, edx
shr eax, 8
and ecx, 1
neg ecx
sar ecx, 4
and ecx, 0x7f
movzx esi, word [ebx + eax*2]
mov eax, dword [ebp + 8]
shr esi, 4
xor esi, ecx
add edi, dword [eax + esi*4]
cmp edx, 0x10000
jb 0x10075df0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10075e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x10075e46
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10076150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], edi
movzx esi, word [edi]
movzx ecx, word [edi + 2]
mov eax, esi
shr eax, 4
xor esi, 0x7f0
shr esi, 4
mov eax, dword [ebx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [ebx + eax*4]
add eax, dword [ebx + esi*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + ecx*4]
add eax, dword [ebx + esi*4]
xor esi, esi
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x10], esi
cmp esi, dword [ebp + 8]
jae 0x100762c4
mov edx, esi
mov dword [ebp - 8], 0
mov esi, dword [ebp - 8]
or edx, 8
nop dword [eax]
mov eax, dword [ebp - 4]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 4]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x100761c0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
add eax, esi
mov esi, dword [ebp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov dword [ebp + 0x10], esi
cmp esi, 8
jb 0x100761a4
cmp esi, 0x10
jae 0x1007626a
lea eax, [esi - 8]
mov dword [ebp - 8], eax
nop dword [eax + eax]
cmp esi, dword [ebp + 8]
jae 0x100762c4
mov edx, eax
xor esi, esi
or edx, 8
mov eax, dword [ebp - 4]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 0x104]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x10076220
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add eax, esi
mov esi, dword [ebp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
cmp esi, 0x10
jb 0x10076210
cmp esi, dword [ebp + 8]
jae 0x100762c4
lea eax, [esi - 0x10]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 0x14]
xor edi, edi
or eax, 0x100
nop
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [esi + edx*2 + 0x204]
shr ecx, 4
xor ecx, eax
mov eax, edx
add edi, dword [ebx + ecx*4]
cmp eax, 1
jne 0x10076280
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
cmp esi, dword [ebp + 8]
jb 0x10076275
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10077e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
mov dword [ebp - 0x10], ecx
lea edx, [ecx + 0x32550]
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0xc], edx
push edi
nop word [eax + eax]
xor ebx, ebx
mov dword [ebp - 4], 4
mov edi, eax
lea eax, [ebx + 1]
nop
movzx edx, word [ecx + eax*2 + 0x32bf4]
mov esi, edi
and esi, 1
shr edx, 4
mov ecx, esi
shr edi, 1
neg ecx
add eax, eax
sar ecx, 4
or eax, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [ebp - 0x10]
add ebx, dword [ecx + edx*4 + 0x30ea0]
sub dword [ebp - 4], 1
jne 0x10077e90
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov dword [edx], ebx
add edx, 4
mov dword [ebp - 0xc], edx
cmp eax, 0x10
jb 0x10077e80
pop edi
pop esi
mov dword [ecx + 0x32590], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10077ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 4
push edi
mov edi, ecx
mov dword [ebp - 0x208], ebx
nop dword [eax]
nop word [eax + eax]
movzx ecx, byte [edi + ebx + 0x306a0]
mov esi, 1
mov eax, ecx
mov dword [ebp - 0x218], ecx
mov edx, ecx
shr eax, 1
dec eax
mov dword [ebp - 0x20c], 0
and edx, 1
mov dword [ebp - 0x210], eax
or edx, 2
mov ecx, eax
shl edx, cl
mov ecx, ebx
sub ecx, edx
mov dword [ebp - 0x214], edx
test eax, eax
je 0x10077fc0
mov ebx, eax
mov eax, esi
mov edx, ecx
sub eax, dword [ebp - 0x218]
and edx, 1
add eax, dword [ebp - 0x214]
add esi, esi
shr ecx, 1
or esi, edx
mov dword [ebp - 0x210], ecx
movzx ecx, word [edi + eax*2 + 0x32b0e]
mov eax, edx
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp - 0x20c]
add eax, dword [edi + ecx*4 + 0x30ea0]
mov ecx, dword [ebp - 0x210]
mov dword [ebp - 0x20c], eax
sub ebx, 1
jne 0x10077f64
mov ebx, dword [ebp - 0x208]
jmp 0x10077fc2
xor eax, eax
mov dword [ebp + ebx*4 - 0x204], eax
inc ebx
mov dword [ebp - 0x208], ebx
cmp ebx, 0x80
jb 0x10077f20
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x210], 4
sub ecx, edi
lea esi, [edi + 0x31950]
lea eax, [edi + 0x32910]
mov dword [ebp - 0x208], esi
lea edx, [edi + 0x31d58]
mov dword [ebp - 0x21c], eax
sub ecx, 0x31d50
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], ecx
nop
mov eax, dword [edi + 0x32594]
xor ebx, ebx
mov dword [ebp - 0x214], ebx
test eax, eax
je 0x10078092
mov eax, ebx
xor esi, esi
mov ebx, dword [ebp - 0x21c]
or eax, 0x40
nop
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [edi + ecx*4 + 0x30ea0]
cmp eax, 1
jne 0x10078040
mov ebx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x208]
mov dword [eax + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x32594]
mov dword [ebp - 0x214], ebx
cmp ebx, eax
jb 0x10078032
mov esi, dword [ebp - 0x208]
mov edx, dword [ebp - 0x20c]
mov ecx, 0xe
cmp eax, ecx
jbe 0x100780b6
nop dword [eax + eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x32594]
jb 0x100780a0
mov eax, dword [esi]
mov ecx, 4
mov ebx, dword [ebp - 0x218]
mov dword [edx - 8], eax
mov eax, dword [esi + 4]
mov dword [edx - 4], eax
mov eax, dword [esi + 8]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 4], eax
add edx, 8
nop word [eax + eax]
movzx eax, byte [edi + ecx + 0x306a0]
lea edx, [edx + 4]
inc ecx
mov eax, dword [esi + eax*4]
add eax, dword [edx + ebx - 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x100780e0
mov edx, dword [ebp - 0x20c]
add esi, 0x100
sub dword [ebp - 0x21c], 0xffffff80
add edx, 0x200
sub ebx, 0x200
mov dword [ebp - 0x208], esi
sub dword [ebp - 0x210], 1
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], ebx
jne 0x10078020
mov ecx, dword [ebp - 4]
mov dword [edi + 0x3bcf8], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
Function at 0x1007ad90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
mov eax, dword [0x101120a8]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 8]
push edi
mov edx, dword [eax]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi]
mov dword [esi], 0
mov dword [eax], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [edi], 0
cmp ecx, 5
jae 0x1007adff
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
movzx ecx, byte [edx + 4]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, 0x1000
cmp ecx, eax
cmovb ecx, eax
mov al, byte [edx]
mov dword [esp + 0x2c], ecx
cmp al, 0xe1
jae 0x1007af42
xor edx, edx
movzx eax, al
mov ecx, 9
div ecx
mov ecx, 5
mov dword [esp + 0x20], edx
xor edx, edx
movzx eax, al
div ecx
push ecx
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], eax
call fcn.1007ad30
add esp, 4
test eax, eax
jne 0x1007af47
mov ecx, dword [esp + 0x10]
mov edx, ecx
movups xmm0, xmmword [esp + 0x20]
mov eax, dword [esp + 0xc]
push edi
push ecx
push esi
push dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x48]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x94], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x98], 1
mov dword [esi], eax
call fcn.1007aa90
mov ecx, dword [esp + 0x6c]
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov dword [eax], ecx
test esi, esi
jne 0x1007af1a
cmp dword [edi], 3
mov eax, 6
cmove esi, eax
push dword [esp + 0x48]
push 0x10112a78
call dword [0x10112a7c]
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [esp + 0xac]
pop edi
pop esi
xor ecx, esp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
Function at 0x1007b1b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 4], edx
cmp dword [esi], 0
je 0x1007b1c8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea ecx, [esi + 0x30]
call fcn.1007d180
test eax, eax
jne 0x1007b2bb
push eax
push eax
push eax
push eax
mov dword [esi + 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 1
mov dword [esi + 0x14], eax
test eax, eax
jne 0x1007b20e
call ebx
test eax, eax
mov ecx, edi
cmovne ecx, eax
test ecx, ecx
jne 0x1007b2bb
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x18], eax
test eax, eax
jne 0x1007b234
call ebx
test eax, eax
mov ecx, edi
cmovne ecx, eax
test ecx, ecx
jne 0x1007b2bb
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x1007b256
call ebx
test eax, eax
mov ecx, edi
cmovne ecx, eax
test ecx, ecx
jne 0x1007b2bb
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x20]
push eax
mov edx, eax
call fcn.1007d140
add esp, 4
test eax, eax
jne 0x1007b2bb
push dword [ebp + 0xc]
lea ecx, [esi + 0x24]
xor edx, edx
call fcn.1007d140
add esp, 4
test eax, eax
jne 0x1007b2bb
lea eax, [ebp - 8]
mov dword [esi + 4], edi
push eax
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push 0
push 0
call fcn.100cc9fe
add esp, 0x18
mov dword [esi + 0x10], eax
test eax, eax
jne 0x1007b2ac
call ebx
test eax, eax
cmovne edi, eax
test edi, edi
jne 0x1007b2bb
pop edi
pop ebx
mov dword [esi], 1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.1007b0a0
pop edi
pop ebx
mov eax, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10080620
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d9e36
mov eax, dword fs:[0]
push eax
sub esp, 0x1d0
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c0], esi
mov eax, dword [ebp + 8]
lea edi, [esi + 0x14]
push eax
mov ecx, edi
mov dword [ebp - 0x1c4], esi
mov byte [esi], 0
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_class_LString_const__
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [esi + 0x34], eax
test eax, eax
jg 0x1008068a
mov dword [esi + 0x34], 0xa
lea eax, [ebp - 0x1bc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1008072e
mov eax, 2
mov word [esi + 4], ax
movzx eax, word [esi + 0x30]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 6], ax
lea eax, [ebp - 0x2c]
push edi
push eax
call sym.XNewLookSch.dll_class_LString___cdecl_LNetwork::get_ip_by_host_name_class_LString_const__
add esp, 8
push 0
lea eax, [ebp - 0x1dc]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2c]
call sym.XNewLookSch.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_LString::get_str_int_
cmp dword [eax + 0x14], 0x10
jb 0x100806e6
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [ebp - 0x1c8]
mov dword [esi + 8], eax
cmp edx, 0x10
jb 0x10080726
mov ecx, dword [ebp - 0x1dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008071c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008074d
push edx
push ecx
call fcn.1008bfe4
add esp, 8
lea ecx, [ebp - 0x2c]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret 0xc
call fcn.10092486
int3
Function at 0x100809a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d9e83
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x101120a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
call sym.XNewLookSch.dll_public:_void___thiscall_AutoSerialize::constructor_void_
sub esp, 0x1c
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [esi], vtable.MsgBase.0
mov dword [esi + 4], 0
push 0x100f1774
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_char_const__
sub esp, 0x1c
mov byte [ebp - 4], 1
mov ecx, esp
push str.m_i_mark
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_char_const__
movzx eax, byte [0x101144d0]
lea ecx, [ebp - 0xd]
push 4
push 0x101144c4
push eax
mov byte [ebp - 4], 0
call fcn.1006da90
sub esp, 0x1c
mov dword [esi + 0xc], 0
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x100f1774
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_char_const__
sub esp, 0x1c
mov byte [ebp - 4], 2
mov ecx, esp
push str.m_i_type
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_char_const__
movzx eax, byte [0x101144d0]
lea ecx, [ebp - 0xd]
push 0xc
push 0x101144c4
push eax
mov byte [ebp - 4], 0
call fcn.1006da90
push 0x100ee7b8
lea ecx, [esi + 0x14]
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_wchar_t_const__
push 0x100ee7b8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call sym.XNewLookSch.dll_public:_void___thiscall_LString::constructor_wchar_t_const__
mov byte [0x101144d0], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008a6b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100db1b6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x430], 0
push 0x404
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x420]
movq qword [ebp - 0x1c], xmm0
push 0
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
call fcn.1008da10
add esp, 0xc
mov dword [ebp - 0x420], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x42c], esi
test esi, esi
jne 0x1008a774
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x42c], eax
test esi, esi
jne 0x1008a774
call fcn.10089330
mov edi, eax
jmp 0x1008a890
push dword [ebp - 0x424]
push dword [ebp - 0x428]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1008a797
call fcn.10089330
jmp 0x1008a883
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x428], ebx
test ebx, ebx
jne 0x1008a7b5
call fcn.10089330
jmp 0x1008a883
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x424], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x1008a7d6
mov edi, 0x8007000e
jmp 0x1008a885
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x1008a8d0
jb 0x1008a7f4
cmp eax, 0xffffffff
ja 0x1008a8d0
cmp eax, 0x400
jbe 0x1008a809
push eax
lea ecx, [ebp - 0x420]
call fcn.10088f50
jmp 0x1008a82f
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], eax
jmp 0x1008a82f
cmp dword [ebp - 0x420], 0
mov dword [ebp - 4], 1
jne 0x1008a846
mov edi, 0x8007000e
jmp 0x1008a885
push edi
push dword [ebp - 0x420]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1008a866
call fcn.10089330
jmp 0x1008a883
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x420]
call fcn.1008a510
mov edi, eax
test esi, esi
je 0x1008a890
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x1008a8b0
lea ecx, [ebp - 0x420]
call fcn.10089d50
nop dword [eax]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.100898f0
int3
Function at 0x100a9387
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a904a

Function at 0x100a9392
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a91cb

Function at 0x100ae714
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ae3d4

Function at 0x100b9d3f
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x100db69f
call fcn.100cbbde
mov edi, ecx
mov dword [ebp - 0x30], edi
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x100b9e74
cmp byte [edi + 0x3e], bl
je 0x100b9e74
mov eax, dword [edi]
mov ecx, 0xffff
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100df59c]
mov ecx, edi
call esi
mov ecx, 0xffff
cmp cx, ax
jne 0x100b9d8c
xor al, al
jmp 0x100b9e76
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.10019bb0
lea eax, [edi + 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
cmp ecx, 0x10
jb 0x100b9dc1
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x100b9dcb
mov edx, eax
mov edi, dword [edi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov esi, dword [edi]
push eax
push edx
push dword [ebp - 0x34]
mov ecx, dword [esi + 0x20]
call dword [0x100df59c]
mov ecx, edi
call dword [esi + 0x20]
sub eax, ebx
je 0x100b9dfb
sub eax, 1
jne 0x100b9e59
mov edi, dword [ebp - 0x30]
jmp 0x100b9e01
mov edi, dword [ebp - 0x30]
mov byte [edi + 0x3e], bl
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x10
jb 0x100b9e11
mov edx, eax
mov esi, dword [ebp - 0x38]
sub esi, edx
je 0x100b9e3b
lea edx, [ebp - 0x28]
cmp ecx, 0x10
jb 0x100b9e22
mov edx, eax
push dword [edi + 0x4c]
push esi
push 1
push edx
call fcn.100a04c8
add esp, 0x10
cmp esi, eax
jne 0x100b9e64
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [edi + 0x3e], 0
je 0x100b9e62
test esi, esi
jne 0x100b9db3
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.10019ce0
jmp 0x100b9dad
dec eax
sub eax, 1
jne 0x100b9e68
inc eax
jmp 0x100b9e66
mov bl, 1
mov al, bl
mov bl, al
lea ecx, [ebp - 0x28]
call sym.XNewLookSch.dll_public:_void___thiscall_LFileEncry::destructor_void_
mov al, bl
jmp 0x100b9e76
mov al, 1
call fcn.100cbb88
ret