joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008bce
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x10008bb8
mov edx, dword [ecx + 0x1c]
test edx, edx
mov eax, dword [esp + 0x30]
inc esi
cmp esi, eax
jb 0x10008b97
xor esi, esi
push 2
call dword [sym.imp.USER32.dll_RegisterClassA]
push ebx
push dword [esp - 0x33]
push dword [esp + 0x6d]
push dword [esp + 0x37]
push 0x6e
call 0x10008c10
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1001c16a
push eax
mov dword fs:[0], esp
sub esp, 0x10
lea esp, [esp + 0x14]
mov ebx, dword [esp + 8]
push dword [esp - 0xf1]
push 0xf
call 0x10008c40
add byte [eax], al
mov eax, 0x1001c593
push esi
push 0
mov esi, ecx
call fcn.1000d48b
mov dword [esi], 0x10009380
mov eax, esi
pop esi
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push 0xffffffffffffff9c
call 0x10008c5a
push edx
push eax
push ebp
push ebx
push edi
call fcn.10013288
push eax
lea esp, [esp + 8]
pop ebx
ret 4

Function at 0x10008e3e
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
mov eax, dword [ebx + 0xd4]
lea esi, [ebx + 0xd4]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x1c], esi
jne 0x10008e0f
push esi
push esi
mov esi, dword [esp + 0x10]
cmp ebx, esi
je 0x10008e11
push edi
push ecx
push 0x10003638
push 0x100025d8
push 0x10001aa8
push 0x1e
push esp
call 0x10008e3e
mov eax, dword [ecx + 0x14]
sub esp, 8
test eax, eax
je 0x10008deb
lea edx, [esp]
lea esp, [esp + 0x18]
mov ecx, dword [esp + 8]
push dword [esp]
push ebx
push edx
call 0x10008e66
push esi
call dword [eax + 0x24]
mov edi, eax
push edi
push 0x1001c734
call fcn.100095f2
xor ecx, ecx
test edi, edi
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push 0x100032e8
push dword [esp + 0x7c]
push dword [esp - 0x4b]
push dword [esp - 0x2f]
call fcn.10008eb3
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
jmp loc.1002e837

Function at 0x10008e66
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ebp
push esi
mov ebx, ecx
mov eax, dword [ebx + 0xd4]
lea esi, [ebx + 0xd4]
push edi
xor edi, edi
cmp eax, edi
mov dword [esp + 0x1c], esi
jne 0x10008e0f
push esi
push esi
mov esi, dword [esp + 0x10]
cmp ebx, esi
je 0x10008e11
push edi
push ecx
push 0x10003638
push 0x100025d8
push 0x10001aa8
push 0x1e
push esp
call 0x10008e3e
mov eax, dword [ecx + 0x14]
sub esp, 8
test eax, eax
je 0x10008deb
lea edx, [esp]
lea esp, [esp + 0x18]
mov ecx, dword [esp + 8]
push dword [esp]
push ebx
push edx
call 0x10008e66
push esi
call dword [eax + 0x24]
mov edi, eax
push edi
push 0x1001c734
call fcn.100095f2
xor ecx, ecx
test edi, edi
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push 0x100032e8
push dword [esp + 0x7c]
push dword [esp - 0x4b]
push dword [esp - 0x2f]
call fcn.10008eb3
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
jmp loc.1002e837

Function at 0x1000923a
Capabilities:
Packed with generic packer

Disassembly:
push edx
push eax
call dword [ecx + 0x34]
mov eax, dword [esp + 8]
test eax, eax
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
je 0x10009243
jmp loc.1002f94d
Function at 0x1000938f
Capabilities:
Accept command line arguments
Packed with generic packer

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x100092fd
xor eax, eax
pop ecx
mov eax, dword [ecx + 0x14]
mov dword [esp], 0
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
lea edx, [esp]
push edx
push eax
call dword [ecx + 8]
mov eax, dword [esp]
add esp, 0xc
mov dword [ebp - 0x1ac], 1
push 4
push 0x10000a7e
push 0x10000bdf
push ecx
push 0x2c
push 0x1000b602
call fcn.10003ea8
push eax
call dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
sub esp, 0x10
jmp loc.1002b4c0

Function at 0x100093ab
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1001cb94
push esi
push 0x10004b20
push 0xfffffffffffffffb
call 0x100093e5
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c5c0
mov eax, dword [0x1001cf40]
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp - 0x92]
push dword [esp + 0x6f]
push dword [esp - 0x29]
push 0x10004e18
call 0x10009428
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push dword [esp - 0x76]
push 0x10003430
call 0x10009455
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c36f
mov eax, dword [0x1001ce3e]
lea esp, [esp + 0xc]
pop esi
ret 8

Function at 0x100093e5
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1001cb94
push esi
push 0x10004b20
push 0xfffffffffffffffb
call 0x100093e5
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c5c0
mov eax, dword [0x1001cf40]
lea esp, [esp + 0xc]
mov esi, dword [esp + 8]
push dword [esp - 0x92]
push dword [esp + 0x6f]
push dword [esp - 0x29]
push 0x10004e18
call 0x10009428
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push dword [esp - 0x76]
push 0x10003430
call 0x10009455
add byte [eax], al
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
sub esp, 0x1001c36f
mov eax, dword [0x1001ce3e]
lea esp, [esp + 0xc]
pop esi
ret 8

Function at 0x100097df
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push edx
push 0x10004058
call fcn.100097e7
add byte [eax], al
mov eax, 0x1001ca28
push esi
push 0
mov esi, ecx
call fcn.1000f82b
mov dword [esi], 0x10009380
mov eax, esi
pop esi
call fcn.1000e3c4
mov eax, 0x1001cddd
push esi
mov esi, ecx
Function at 0x10009a15
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
add esp, 4
push 0x10000e53
push 0xffffffffffffff90
push ecx
push 0xffffffffffffff89
push 0xfffd5cb
jmp loc.1002b7a3

Function at 0x10009a9a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
mov eax, dword [esp + 8]
push ecx
push fcn.10005ce8
push 0x10001b68
push dword [esp - 3]
push dword [esp - 0x6d]
call 0x10009ada
xor eax, eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push ebx
call fcn.10009b0b
mov eax, dword [ecx + 0x70]
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x10009b63
jmp loc.1002f011
mov eax, 0x1001c1ae
lea ecx, [ebp + 4]
mov eax, 0x1001c6c2
mov ecx, 0x1001c424
mov ecx, 0x1001c506
call fcn.1000ce55
push 0x1001cc44
call fcn.100101bd
pop ecx

Function at 0x10009ada
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
mov eax, dword [esp + 8]
push ecx
push fcn.10005ce8
push 0x10001b68
push dword [esp - 3]
push dword [esp - 0x6d]
call 0x10009ada
xor eax, eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push ebx
call fcn.10009b0b
mov eax, dword [ecx + 0x70]
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x10009b63
jmp loc.1002f011
mov eax, 0x1001c1ae
lea ecx, [ebp + 4]
mov eax, 0x1001c6c2
mov ecx, 0x1001c424
mov ecx, 0x1001c506
call fcn.1000ce55
push 0x1001cc44
call fcn.100101bd
pop ecx

Function at 0x10009c0a
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push 0x43
push 0x100039c8
push 0x100032b8
push 0x10005700
call 0x10009c43
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1001cb56
push ecx
call dword [sym.imp.GDI32.dll_GetClipBox]
test eax, eax
je 0x10009c77
lea esp, [esp + 0x14]
add dword [esp + 4], ecx
push 0x10004960
call 0x10009c68
mov ecx, dword [esp + 0x24]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push 0x1001ccdb
lea esp, [esp + 8]
pop ecx
ret 0xc
mov eax, dword [esp + 4]
movzx ecx, word [eax + 2]
push eax
xor dword [esp], eax
push esp
push 0x3e
push 0x10000f9f
push 0xffffffffffffffec
push 0xfffe0fb
call fcn.10003cc0
mov eax, dword [ecx + 0x14]
sub esp, 0x10
test eax, eax
je 0x10009c7b
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x10009d02
push 0x1001c447
push 0x1001cf2a

Function at 0x10009cbd
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x1001cf30]
push esi
push edi
push 0x1001cae9
mov dword [esp + 0x41c], eax

Function at 0x10009db8
Capabilities:
Packed with generic packer

Disassembly:
wait
dec ecx
add dword [eax], eax
push eax
push eax
push 0x1001ccf5
call ebp
push eax
Function at 0x10009dc6
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push dword [esp - 0x35]
push 0xffffffffffffff84
call 0x10009df5
mov eax, 0x1001cb6b
mov ecx, dword [ebp - 0x62c]
mov eax, 0x1001cc79
mov ecx, dword [ebp - 0x10]
mov eax, 0x1001c214
lea ecx, [ebp - 0x10]
mov eax, 0x1001c8a8
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push 0x10002d80
push esp
call 0x10009e2f
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001d102
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1001d165
mov eax, dword [0x1001c4a4]
push ebx
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push dword [esp + 0x3d]
push dword [esp + 0x60]
jmp loc.1002d420

Function at 0x10009df5
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push dword [esp - 0x35]
push 0xffffffffffffff84
call 0x10009df5
mov eax, 0x1001cb6b
mov ecx, dword [ebp - 0x62c]
mov eax, 0x1001cc79
mov ecx, dword [ebp - 0x10]
mov eax, 0x1001c214
lea ecx, [ebp - 0x10]
mov eax, 0x1001c8a8
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push 0x10002d80
push esp
call 0x10009e2f
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001d102
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1001d165
mov eax, dword [0x1001c4a4]
push ebx
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push dword [esp + 0x3d]
push dword [esp + 0x60]
jmp loc.1002d420

Function at 0x10009e2f
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push dword [esp - 0x35]
push 0xffffffffffffff84
call 0x10009df5
mov eax, 0x1001cb6b
mov ecx, dword [ebp - 0x62c]
mov eax, 0x1001cc79
mov ecx, dword [ebp - 0x10]
mov eax, 0x1001c214
lea ecx, [ebp - 0x10]
mov eax, 0x1001c8a8
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push 0x10002d80
push esp
call 0x10009e2f
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001d102
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1001d165
mov eax, dword [0x1001c4a4]
push ebx
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push dword [esp + 0x3d]
push dword [esp + 0x60]
jmp loc.1002d420

Function at 0x10009ec6
Capabilities:
Packed with generic packer

Disassembly:
pop edi
mov ecx, dword [0x1001c828]
push 1
mov dword [esi + 8], eax
pop edi
mov al, 1
pop esi
push 0x18
call fcn.1000b71e
test eax, eax
je 0x10009ef9
mov dword [eax], eax
lea ecx, [eax + 4]
test ecx, ecx
je 0x10009e4a
xor dword [esp], eax
push dword [esp + 4]
push dword [esp + 8]
push ebx
push 0x33
push 0xfffd835
call fcn.100038e6
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0x1001c54d
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x10009f25
mov ecx, dword [esp]
push 0x1001ccfd
push edx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
test eax, eax
je 0x10009e9f
mov ecx, dword [esp]
lea eax, [esp + 4]
push 1
push eax
mov eax, dword [0x1001c13e]
jmp 0x1002c04f
Function at 0x10009f06
Capabilities:
Packed with generic packer

Disassembly:
pop edi
mov ecx, dword [0x1001c828]
push 1
mov dword [esi + 8], eax
pop edi
mov al, 1
pop esi
push 0x18
call fcn.1000b71e
test eax, eax
je 0x10009ef9
mov dword [eax], eax
lea ecx, [eax + 4]
test ecx, ecx
je 0x10009e4a
xor dword [esp], eax
push dword [esp + 4]
push dword [esp + 8]
push ebx
push 0x33
push 0xfffd835
call fcn.100038e6
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0x1001c54d
push edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x10009f25
mov ecx, dword [esp]
push 0x1001ccfd
push edx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
test eax, eax
je 0x10009e9f
mov ecx, dword [esp]
lea eax, [esp + 4]
push 1
push eax
mov eax, dword [0x1001c13e]
jmp 0x1002c04f

Function at 0x1000a3a1
Capabilities:
Packed with generic packer

Disassembly:
push 0x100000d9
push edx
push dword [esp + 4]
push 0xffffffffffffff9e
push 0x1000b045
call fcn.10003abc
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp], ecx
lea ecx, [esp]
jmp loc.1002f90d

Function at 0x1000a5e8
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0x6c8f02ee
push ebp
push 0x1000048b
push dword [esp + 4]
push ebx
push 0x10002860
call fcn.100038e6
lea ecx, [ebp + 4]
mov eax, 0x1001cce8
mov ecx, 0x1001d189
call fcn.10007733
push 0x1001c6cb
jmp loc.1002cae5

Function at 0x1000a8bc
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x1000a8c1
push eax
jmp loc.1002b5d1

Function at 0x1000aaaf
Capabilities:
Allocate thread local storage

Disassembly:
je 0x1000aa40
mov eax, dword [0x1001ca1a]
lea ecx, [esp + 0x18]
push 1
push ecx
mov ecx, dword [esp + 0x14]
jmp loc.1002d55b

Function at 0x1000ac5e
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.1002bfcd
lea esp, [esp + 0x14]
mov eax, dword [esp + 8]
push eax
push dword [esp + 7]
push 0xc
push ecx
push 0x55
call 0x1000ac88
push 1
push edx
call fcn.1000ea72
cmp eax, 0xffffffff
jne 0x1000ac16
xor eax, eax
mov ecx, dword [esp + 4]
lea esp, [esp + 0x18]
add dword [esp + 4], eax
push 0x6a
push dword [esp - 0x29]
push dword [esp - 0x58]
call fcn.1000acb5
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1000acfc
mov eax, dword [esp + 0x1c]
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1001ca0e
mov eax, dword [0x1001d1b8]
mov dword [esp + 0x110], eax
push edi
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x1001c3ba
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0x1001cb13
push edx
Function at 0x1000b2a0
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x18]
mov edi, dword [esp + 8]
push 0x10002ad8
push esi
push dword [esp - 6]
push dword [esp - 0xac]
push 0x100055d0
call 0x1000b2a7
mov eax, esi
pop esi
mov dword fs:[0], ecx
push 0xffffffffffffffff
push 0x1001c43b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
lea ecx, [esp + 4]
lea esp, [esp + 0x18]
add dword [esp + 4], edi
push esp
push esi
push ecx
push 0x17
call fcn.1000b2d0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1000b295
jmp loc.1002b672

Function at 0x1000ba49
Capabilities:
Check os version

Disassembly:
sub edx, ebx
mov eax, 0x1001d1e2
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
mov dword [ebp + 0x10], ecx
jmp loc.1002dea7

Function at 0x1000bdff
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx

Function at 0x1000c035
Capabilities:
Packed with generic packer

Disassembly:
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.1000aaaf
push eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
sub esp, 8
mov ecx, dword [esp + 0x10]
xchg dword [esp], esi
mov edx, dword [ebp - 8]
push 0xffffffffffffffcb
push edx
push 0xffffffffffffffa8
push 0xffffffffffffffc1
push 0x10007c57
call fcn.10003abc
lea ecx, [ebp - 0x844]
lea ecx, [ebp - 0x840]
mov eax, 0x1001c4a9
mov ecx, dword [ebp - 0x10]
mov eax, 0x1001d06f
lea ecx, [ebp + 4]
mov eax, 0x1001ce43
mov eax, dword [0x1001cf28]
mov ecx, dword [0x1001cc73]
mov edx, dword [0x1001caf3]
mov dword [0x1001cec8], eax

Function at 0x1000c09c
Capabilities:
Packed with generic packer

Disassembly:
pop ecx
mov edx, dword [esp]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
push eax
call fcn.10004f76
mov ecx, dword [0x1001d17a]
push 0
jmp loc.1002d588

Function at 0x1000c4ee
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x18]
mov edx, dword [esp + 8]
push dword [esp + 0x2a]
push dword [esp - 0x32]
call 0x1000c4ee
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.1000fc69
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], eax
lea esp, [esp + 0xc]
add dword [esp + 4], edx
push 0x10002848
push esi
push 0x100051b0
call fcn.1000c51d
mov eax, dword [esp]
pop ecx
cmp edx, 0x1001c09a
jne 0x1000c4d7
jmp loc.1002ef8d

Function at 0x1000c82c
Capabilities:
Packed with generic packer

Disassembly:
pop esi
mov dword [ecx], 0x10022d34
mov eax, dword [ecx]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
pop ecx
mov eax, ecx
mov dword [eax], 0
mov dword [eax + 4], 0
push esi
push 0x38
push 0x10005f90
push 0x11
push ebx
push 0x76
call 0x1000c82c
push ebp
push 0x1001cada
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 1
mov edi, eax
lea esp, [esp + 0x18]
mov esi, dword [esp + 8]
push dword [esp + 0x7b]
push dword [esp + 0x64]
push eax
call fcn.1000c855
je 0x1000c82a
mov ecx, dword [esp]
mov eax, dword [ecx + 4]
jmp loc.1002c42d
Function at 0x1000c8ee
Capabilities:
Allocate thread local storage
Create thread
Packed with generic packer

Disassembly:
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x84c]
call fcn.10008250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ebp
push eax
push dword [esp - 0x29]
push ebp
push 0x10005808
push 0x49
call fcn.1000c935
add byte [eax], al
add byte [eax + 0x1000935c], bh
push esi
push 0
mov esi, ecx
call fcn.100056ff
jmp loc.1002dc7e

Function at 0x1000c935
Capabilities:
Allocate thread local storage

Disassembly:
lea esp, [esp + 0x14]
mov eax, dword [esp + 8]
push 0x10005038
push 0x4e
push 0x10004388
push 0x6f
call 0x1000c973
push eax
call fcn.1000c6f5
push eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
push 0x1001c5cf
push edx
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push 0x7c
push esp
push 0x10005698
push dword [esp - 0xd0]
push esp
call 0x1000c9a6
push 0x1001c267
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
lea esp, [esp + 0x18]
pop eax
ret 8

Function at 0x1000cc6b
Capabilities:
Packed with generic packer

Disassembly:
pop ebp
pop ebx
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 8]
test edi, edi
je fcn.1000cc6b
mov ebp, dword [esp + 0x18]
mov eax, dword [edi]
mov esi, ebp
or edi, dword [esp]
push 0x10000e2d
push dword [esp + 4]
push 0x62
push dword [esp + 4]
jmp loc.1003000e

Function at 0x1000cfbe
Capabilities:
Packed with generic packer

Disassembly:
push 5
push 1
push eax
call dword [ecx + 0x64]
xor ecx, ecx
test eax, eax
setge cl
pop esi
jmp loc.100303d3
push edi
push dword [esp - 0x91]
call 0x1000cfef
cmp dword [ecx + 0x24], 0x10
jb 0x1000cfa9
mov eax, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
push esi
mov esi, ecx
call fcn.1000b92a
test byte [esp + 8], 1
je 0x1000d024
push esi
call fcn.10010742
mov eax, esi
pop esi
lea esp, [esp + 8]
mov edi, dword [esp + 8]
push edx
push dword [esp - 0x58]
push 0x10005518
push 0x36
push 0x10005da0
call 0x1000d030
mov eax, dword [ecx + 0x20]
test eax, eax
je 0x1000cfad
jmp loc.1002bb01
mov eax, 0x1001cb8d
push esi
mov esi, dword [esp + 8]
test esi, esi
lea esp, [esp + 0x18]
add dword [esp + 4], edi
push 0x37
push 0x10001810
push 0x100059d8
call 0x1000d06b
xor eax, eax
mov word [esi + 0xc], 1
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov ecx, dword [ebx + 0x34]
mov eax, dword [ecx]
add esi, 0x28
lea esp, [esp + 0x10]
pop edi
ret 0xc
Function at 0x1000d21a
Capabilities:
Packed with generic packer

Disassembly:
push edi
push dword [esp + 0x6c]
push edx
push 0x100021a8
push 0xffffffffffffffe6
push esi
call 0x1000d1e6
call edi
push esi
mov dword [esp + 0x470], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x250]
push eax
mov ecx, esi
call fcn.1000eca7
lea esp, [esp + 0x18]
mov edi, dword [esp + 8]
push dword [esp - 0x43]
push 0x27
push 0x10005408
push 0xffffffffffffffd4
push dword [esp - 0x3e]
call 0x1000d21a
mov eax, dword [0x1001c036]
inc dword [eax]
mov eax, dword [0x1001d031]
pop esi
sub esp, 8
lea esp, [esp + 0x18]
add dword [esp + 4], edi
push eax
push 0x10005908
push dword [esp + 0xb]
push dword [esp + 0x59]
call fcn.1000d265
mov esi, ecx
call fcn.1000aaaf
mov eax, 0x1001c7a9
push 0x1001cc73
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
jmp loc.1002ffe0

Function at 0x1000d66b
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne fcn.1000d6df
xor eax, eax
push esi
push dword [esp - 0x21]
call fcn.1000d6a7
lea eax, [esp]
push eax
push 0x1001cc21
push ecx
call dword [sym.imp.USER32.dll_GetDC]
test eax, eax
je 0x1000d656
jmp loc.1002d6bf

Function at 0x1000d6e4
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
add dword [esp + 4], esi
push 0x10004e68
jmp loc.1002ca5d

Function at 0x1000d79a
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d1ad
jmp loc.1002f0f6

Function at 0x1000d7c8
Capabilities:
Packed with generic packer

Disassembly:
push esi
lea eax, [esp + 8]
jmp loc.1002b493

Function at 0x1000d846
Capabilities:
Packed with generic packer

Disassembly:
cmp eax, ebp
je 0x1000d850
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
jmp loc.1002d26c

Function at 0x1000d93d
Capabilities:
Packed with generic packer

Disassembly:
xor eax, eax
mov ecx, dword [esp]
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ecx, dword [esp + 0xc]

Function at 0x1000d9fb
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x14]
mov edx, dword [esp + 8]
push ecx
push dword [esp - 0x52]
push 0xffffffffffffffdf
push 0x2c
push 0x100037d8
call fcn.1000da31
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
pop edi
pop esi
mov ecx, dword [esp + 0x218]
call fcn.1000754d
add esp, 0x1001ce33

Function at 0x1000da31
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x18]
add dword [esp + 4], edx
push dword [esp - 0x12]
push dword [esp - 0x8d]
push dword [esp - 0x93]
push dword [esp - 0xad]
jmp loc.1002f602

Function at 0x1000da9e
Capabilities:
Packed with generic packer

Disassembly:
push 1
push ecx
mov ecx, dword [esp + 8]
call fcn.100067b2
cmp eax, 0xffffffff
jne fcn.1000db1a
xor eax, eax
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push edx
push eax
jmp loc.1002f3bf