joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11ca6515
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x11ca6667
xor edx, edx
cmp eax, edx
je 0x11ca6667
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x11ca654a
cmp eax, ecx
jb 0x11ca654a
xor ecx, ecx
jmp 0x11ca654f
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x11ca6569
jg 0x11ca6667
cmp eax, dword [esi + 8]
ja 0x11ca6667
cmp ecx, edx
jne 0x11ca6583
cmp eax, dword [esi + 0x42c]
ja 0x11ca6583
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x11ca65c8
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x11ca65a3
cmp edi, edx
jb 0x11ca65a3
xor edx, edx
jmp 0x11ca65a8
mov edx, 1
cmp ecx, ebx
ja 0x11ca65c8
cmp dword [esp + 0x14], edx
jg 0x11ca65c8
jl 0x11ca65b8
cmp eax, edi
ja 0x11ca65c8
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.11ca6680
test eax, eax
je 0x11ca6667
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x11ca6616
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push closesocket
push ecx
call edi
cmp eax, 0xffffffff
je 0x11ca6657
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x11ca6657
jmp 0x11ca6626
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x11ca6657
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x11ca6657
cmp dword [edi], ebp
jne 0x11ca6657
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004c61c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub eax, dword [ebp - 0x10c]
jmp 0x1002a74e
inc ebx
jmp 0x1003c07c
jg 0x1004db3e
jmp 0x1004c873
mov eax, ecx
jmp 0x1004be1d
mov ax, word [edx + ebx*2]
jmp 0x1004fe00
add ebx, edi
jmp 0x1003aeed
mov ebx, edi
jmp 0x1004fdf2
mov eax, dword [ebx + 8]
jmp 0x10021904
add esi, edi
jmp 0x10050282
lea ebx, [ebx + 0x78]
jmp 0x10002a8f
or edx, edx
jmp 0x1004cc23
jl 0x1004db3e
jmp 0x1003b887
add eax, edi
jmp 0x1003b830
xor eax, eax
jmp 0x10029e83
mov edi, dword [ecx + 0x18]
jmp 0x10002a3d
mov eax, dword [ebp + 0x10]
jmp 0x10001282
push dword [ebx + 0x18]
jmp 0x1004b63f
mov ebx, dword [ebx]
jmp 0x10002a36
ret 0x10
sub ecx, 1
jmp 0x100020c4
jmp 0x1003b830
push ebx
jmp 0x1003c1b8
mov edi, dword [ebp + 8]
jmp 0x1004bc1d
jmp 0x1004f220
pop edi
jmp 0x1004e11a
inc ecx
jmp 0x1004b8ea
add eax, dword [ebx + 0x24]
jmp 0x1004f023
mov ecx, dword [ecx + 0xc]
jmp 0x1003bd48
xor ebx, ebx
jmp 0x1000257d
jne 0x10021088
jmp 0x10021592
je 0x10021a85
jmp 0x1004b725
or eax, eax
jmp 0x1004c24d
push edi
jmp 0x1004c0c8
jne 0x1000257d
jmp 0x1004fbce
xor eax, dword [ebp + 0xc]
jmp 0x1004fcdf
push dword [ebx + 0x10]
jmp 0x1004fbbc
push edi
jmp 0x1004b406
pop ecx
jmp 0x1003bb8d
mov eax, dword [esi]
jmp 0x1002b68f
call 0x10011fff
jmp 0x1003a8a8
jmp 0x10011baa
pop esi
jmp 0x1002a963
add eax, edi
jmp 0x1004dcf8
cmp al, 0x5b
jmp 0x100015fb
pop ebx
jmp 0x1004d121
push edx
jmp 0x1003b05a
mov ecx, dword [ecx + 0xc]
jmp 0x1004b71e
jmp 0x10002a3d
test ax, ax
jmp 0x1003a774
push ecx
jmp 0x1003bcdd
mov edx, dword [edx]
jmp 0x100119dd
movzx eax, word [eax]
jmp 0x1004f9c6
mov esi, dword [ebx + 0x20]
jmp 0x10002b1b
push esi
jmp 0x1004e03a
pop dword [ebp - 0x108]
jmp 0x1004b3fe
mov ecx, dword [ecx]
jmp 0x1004e172
cmp dword [ebp - 0x108], ecx
jmp 0x1004db73
call 0x10011fff
jmp 0x1004d3d8
jmp 0x10002a3d
shl eax, 1
jmp 0x1002ac93
mov ecx, dword fs:[0x30]
jmp 0x1002ad17
lea edx, [ecx + 0x30]
jmp 0x1004b338
jne 0x1003b84b
jmp 0x1003b573
test eax, eax
jmp 0x1002b2d1
jmp 0x10011baa
push ebp
jmp 0x1004c904
add al, 0x20
jmp 0x1004db3e
mov ebp, esp
jmp 0x1004dd41
jne 0x1002adda
jmp 0x1005057a
mov eax, dword [eax]
jmp 0x10011aa5
leave
jmp 0x1002190b
xor eax, dword [ebp + 0x10]
jmp 0x1004c309
jmp 0x1004b725
je 0x1004c05d
jmp 0x1002a689
stosb byte es:[edi], al
jmp 0x1000149c
jne 0x1003b398
jmp 0x1004c4c0
add esi, 4
jmp 0x1002ab01
add esp, 0xfffffef4
jmp 0x1002a09f
cmp dword [ebp + 8], 0
jmp 0x1004d9a4
pop edx
jmp 0x1003b357
lea edi, [ebp - 0x104]
jmp 0x1002b6b8
add eax, edi
jmp 0x1004ce12
cmp dword [ebp + 0x14], 0
jmp 0x1002ae8c
add eax, edi
jmp 0x1004b3ac
add eax, dword [ebx + 0x1c]
jmp 0x1004e5d6
shl eax, 2
jmp 0x1004f220
pop dword [ebp - 0x10c]
jmp 0x1004e7fb
pop eax
jmp 0x1003b535
jne 0x1004b71e
jmp 0x10011f2e
add ebx, dword [ebx + 0x3c]
jmp 0x100119d5
cmp al, 0x40
jmp 0x10011a1f
xor ecx, ecx
jmp 0x1004d698
mov edi, dword [ebp + 0xc]
jmp 0x1003bdb8

Function at 0x10054670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.100586ce
Function at 0x10055880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100558db
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100558db
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100558ca
cmp esi, edx
jae 0x100558db
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100558b8
cmp esi, edx
jae 0x100558db
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10058638
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x84], 0
mov esi, dword [ebx + 0x8c]
mov edi, dword [ebx + 0x88]
je 0x10058680
call fcn.1005ddcb
push 5
push dword [ebx + 0x84]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10058680
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1005868d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor eax, eax
inc eax
test esi, esi
je 0x100586c9
mov edx, 0xffff
lea ecx, [esi + 0xc]
cmp word [esi + 2], dx
jne 0x100586ac
movzx edi, word [esi + 0x12]
movzx edx, word [esi + 0x14]
jmp 0x100586b5
movzx edx, word [ecx]
mov ecx, esi
movzx edi, word [esi + 0xa]
test dword [ecx], 0x1801
jne 0x100586c7
test di, di
jne 0x100586c7
test dx, dx
je 0x100586c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10058732
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
call fcn.1005ddcb
push 5
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10058772
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10058772
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.1005877a
jmp 0x10058774
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x10058a6a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x101bb696
call fcn.101ba877
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
mov dword [ebp - 0x18], ebx
call fcn.1005ddcb
cmp dword [edi + 0x84], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
je 0x10058ac9
call fcn.1005ddcb
push 5
push dword [edi + 0x84]
mov ebx, dword [eax + 0xc]
push ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10058add
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [ebp - 0x18]
mov esi, eax
test esi, esi
je 0x10058ad9
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 0x18], eax
test ebx, ebx
jne 0x10058ae5
or eax, 0xffffffff
jmp 0x10058c37
mov ecx, edi
call fcn.10059074
mov ebx, eax
mov dword [ebp - 0x2c], ebx
call fcn.10060b1d
xor esi, esi
and dword [ebp - 0x1c], esi
and dword [ebp - 0x28], esi
mov dword [ebp - 0x14], esi
test ebx, ebx
je 0x10058b71
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ebx, eax
je 0x10058b71
push ebx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x10058b71
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x14], 1
call fcn.100585a2
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x10058b6e
mov ecx, dword [esi]
mov esi, dword [ecx + 0x150]
mov ecx, esi
call dword [fcn.101cb988]
mov ecx, dword [ebp - 0x1c]
call esi
test eax, eax
je 0x10058b6e
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call fcn.1006744e
test eax, eax
je 0x10058b6e
push 0
mov ecx, esi
call fcn.10066d6c
mov dword [ebp - 0x28], 1
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
push edi
call fcn.100607a0
push ebx
call fcn.10061e9d
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.10058a0d
test eax, eax
jne 0x10058bba
cmp dword [edi + 0x9c], eax
jne 0x10058bba
call fcn.1005ddcb
push ebx
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
call fcn.10061e9d
push dword [ebp - 0x20]
mov ecx, edi
push eax
push dword [ebp - 0x18]
call fcn.10058a0d
and dword [edi + 0x9c], 0
jmp 0x10058be5
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x28], 0
je 0x10058bf9
mov ecx, dword [ebp - 0x1c]
push 1
call fcn.10066d6c
test esi, esi
je 0x10058c06
push 1
push ebx
call dword [sym.imp.USER32.dll_EnableWindow]
test ebx, ebx
je 0x10058c1c
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [edi + 0x20]
jne 0x10058c1c
push ebx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [edi]
mov esi, dword [eax + 0x60]
mov ecx, esi
call dword [fcn.101cb988]
mov ecx, edi
call esi
mov ecx, edi
call fcn.1005902b
mov eax, dword [edi + 0x68]
call fcn.101ba7dc
ret
Function at 0x1005f835
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.10066ee9
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x1005f871
call fcn.1005fa75
mov dword [esi + 0xc], 1
jmp 0x1005f876
call fcn.1005fa75
cmp dword [esi], 0
je 0x1005f8c1
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x1005f89c
push edi
call fcn.1005fa52
lea ecx, [edi + 1]
push ecx
jmp 0x1005f8ab
push 0xff
call fcn.1005767d
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.1005ba99
pop edi
jmp 0x1005f8e5
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x1005f8e5
push dword [esi]
push dword [ebp - 4]
call fcn.10069bfd
pop esi
leave
ret 0xc

Function at 0x1005f9a9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.1005fa75
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x1005f9f1
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1005fa52
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1005ba99
jmp 0x1005f9fc
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10069bfd
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10061e30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x10061e6f
call fcn.1005ddcb
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10061e6f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10061e77
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.1006a313
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1006287c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10062908
cmp dword [esi + 0x20], 0
je 0x10062908
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10062908
cmp dword [ebp + 8], 0
je 0x10062908
xor edi, edi
mov ebx, edi
call fcn.1005ddcb
push 0x101d09e8
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x100628ec
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10062908
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1007c2fe
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10062904
mov ecx, esi
call fcn.1006261a
mov eax, edi
jmp 0x1006290a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1006730e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101bb80c
call fcn.101ba80e
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x10067334
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1006738e
lea ecx, [ebp - 0x10]
call fcn.10056f78
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [fcn.101cb988]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.101a2a74
push eax
call fcn.10055450
add esp, 0x14
test esi, esi
je 0x10067381
push esi
call fcn.101a2ae3
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10057707
mov eax, ebx
call fcn.101ba7dc
ret 8

Function at 0x100684cf
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x100684f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100684ff
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop esi
leave
ret
lea ecx, [esi + 0xc]
call fcn.10057018
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.1007ee03
int3

Function at 0x100687da
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
jne 0x100687eb
xor eax, eax
jmp 0x10068807
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006880c
mov eax, dword [ebp - 4]
pop esi
leave
ret 8
lea ecx, [esi + 0xc]
call fcn.10057018
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.1007ee03
int3
Function at 0x100688aa
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0
push dword [ebp + 0xc]
mov eax, dword [edi]
push dword [ebp + 8]
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [fcn.101cb988]
mov ecx, edi
call esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x100688dd
pop edi
pop esi
pop ebp
ret 8
lea ecx, [edi + 0xc]
call fcn.10057018
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.1007ee03
int3

Function at 0x100689b6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
je 0x100689e1
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100689e7
cmp dword [ebp - 4], esi
jne 0x100689fe
pop edi
pop esi
leave
ret 8
lea ecx, [edi + 0xc]
call fcn.10057018
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
call fcn.1007ee03
lea ecx, [edi + 0xc]
call fcn.10057018
push eax
push 0xffffffffffffffff
push 0xd
call fcn.1007ea59
int3

Function at 0x10069245
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x101bc0f4
call fcn.101ba877
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + 0x1c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
test edi, edi
jle 0x1006933c
cmp edi, dword [ebx + 0xc]
jge 0x1006933c
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1006929c
cmp edi, dword [esi + 8]
jl 0x1006932a
cmp dword [ebp + 0xc], 0
je 0x1006932a
xor edi, edi
jmp 0x100692ce
xor edi, edi
push 0x10
mov dword [ebp - 4], edi
call fcn.10068e57
mov esi, eax
test esi, esi
je 0x100692b6
mov dword [esi], vtable.CThreadData.0
jmp 0x100692b8
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
mov dword [esi + eax], ecx
mov dword [ebx + 0x14], esi
push 4
push dword [ebx + 0xc]
call fcn.10067cf9
cmp dword [esi + 0xc], 0
pop ecx
pop ecx
jne 0x100692ea
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x100692f6
push 2
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x10069363
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], edx
mov eax, dword [ebx + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push edi
push eax
call fcn.1019e180
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1006933c
cmp edi, dword [esi + 8]
jge 0x1006933c
mov eax, dword [ebp + 0xc]
mov dword [ecx + edi*4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.101ba7dc
ret 8
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10056cf9
int3
Function at 0x1006b925
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1021d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [0x102250f8]
mov dword [ebp - 0x20], ebx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
test eax, eax
jne 0x1006b97e
push 0x101cff78
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1006b9a3
push 0x101d1050
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [0x102250f8], eax
jmp 0x1006b987
push eax
call dword [sym.imp.KERNEL32.dll_DecodePointer]
mov esi, eax
test esi, esi
je 0x1006b9a3
mov eax, dword [ebp - 0x18]
mov ecx, esi
push eax
push edi
push ebx
push dword [ebp + 8]
call dword [fcn.101cb988]
call esi
jmp 0x1006bae5
and dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.1006bd9e
lea eax, [ebp - 0x14]
push eax
call fcn.101a2ae3
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push edi
call fcn.101a2a7f
mov eax, dword [ebp - 0x20]
lea edi, [esi + 1]
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.1006bd9e
lea eax, [ebp - 0x14]
push eax
call fcn.101a2ae3
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
sub ecx, edi
push ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + edi*2]
push ecx
call fcn.101a2a7f
mov eax, dword [ebp - 0x20]
add esp, 0x38
add edi, esi
inc dword [eax]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx ebx, ax
lea eax, [ebp - 0x14]
push 7
push eax
push ebx
call fcn.1006bd9e
lea eax, [ebp - 0x14]
push eax
call fcn.101a2ae3
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.101a2a7f
mov eax, dword [ebp - 0x20]
add edi, esi
push 7
and ebx, 0x3ff
inc dword [eax]
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.1006bd9e
lea eax, [ebp - 0x14]
push eax
call fcn.101a2ae3
lea esi, [eax + 1]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.101a2a7f
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 7
push eax
add edi, esi
inc dword [ebx]
push 0x800
call fcn.1006bd9e
add esp, 0x44
lea eax, [ebp - 0x14]
push eax
call fcn.101a2ae3
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub ecx, edi
push ecx
lea ecx, [eax + edi*2]
push ecx
call fcn.101a2a7f
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + esi]
add esp, 0x10
xor edx, edx
inc dword [ebx]
mov word [ecx + eax*2 + 2], dx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10055f18
leave
ret
Function at 0x1007de0b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
test byte [edi + 4], 1
mov esi, dword [edi + 0xc]
jne 0x1007de61
push 5
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1007de3a
call fcn.1005ea83
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x1007de4f
call fcn.1005ea83
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x1007de61
call fcn.1005ea83
call fcn.1005ddcb
cmp dword [eax + 0x3c], 0
je 0x1007de76
push esi
mov ecx, ebx
call fcn.1007d531
mov esi, eax
push dword [ebp + 0xc]
push esi
call fcn.1007e060
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x1007de9f
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x1007deab
mov esi, ebx
mov dword [eax + 0x88], ebx
or dword [edi + 4], 1
mov dword [edi + 0xc], esi
pop edi
pop esi
pop ebx
leave
ret 8