joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bb99c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5bba3e
cmp dword [ebx + 0xac], 0
jne 0x5bba38
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5bb8d8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5bba38
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5bb9fe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5bba38
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004a693c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5bba0d
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5bbc7c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5f1760]
cmp dword [eax + 0x188], 0
je 0x5bbdf6
test bl, bl
jne 0x5bbd41
cmp dword [esi + 0xb4], 0
jne 0x5bbd36
mov eax, esi
call fcn.005bec40
push eax
push 0x5bbb70
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5bbd07
mov eax, dword [0x5f1760]
cmp byte [eax + 0xeb], 0
je 0x5bbd07
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5bbce8
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5bbd07
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5bbcf0
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5bbd36
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a693c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5bbd16
inc dword [esi + 0xb4]
jmp 0x5bbdf6
cmp dword [esi + 0xb4], 0
jle 0x5bbdf6
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5bbdf6
cmp dword [esi + 0x58], 0
je 0x5bbdab
mov eax, dword [0x5f1760]
cmp byte [eax + 0xeb], 0
je 0x5bbdab
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5bbd8c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5bbdab
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5bbd94
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5bbdda
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a693c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5bbdba
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5ad768]
call fcn.0040b7e0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5bca50
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5bcaad
cmp byte [ebx + 0xeb], 0
jne 0x5bcaad
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409888
mov eax, dword [esi]
test eax, eax
je 0x5bca9a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5bcaba
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
jmp 0x5bcaba
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.00409ae0
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5be36c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5be3dd
mov eax, esi
call fcn.0051eaf8
test al, al
je 0x5be3dd
mov eax, dword [ebx + 0x98]
call fcn.0051e728
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5be3dd
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x118]
test al, al
je 0x5be3ce
push 0
mov eax, dword [ebx + 0x98]
call fcn.0051e728
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.0051536c
jmp 0x5be3dd
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005be1a4
pop esi
pop ebx
ret
Function at 0x4050cb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], edx
push edi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov edi, dword [ecx]
and edi, 7
cmp dword [ebp - 4], 5
jb 0x405210
sub dword [ebp - 4], 4
add dword [ebp + 8], 5
push ebx
push esi
mov ecx, dword [ebp - 4]
lea esi, [eax + edx]
lea ebx, [edx + ecx]
cmp esi, ebx
jae 0x405112
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x405112
inc esi
jmp 0x405101
mov ecx, esi
sub ecx, eax
mov eax, esi
sub ecx, edx
sub eax, edx
cmp esi, ebx
jae 0x4051fc
cmp ecx, 2
jbe 0x40512d
xor edi, edi
jmp 0x405157
shr edi, cl
test edi, edi
je 0x405157
cmp edi, 4
ja 0x4051f1
cmp edi, 3
je 0x4051f1
mov ecx, edi
shr ecx, 1
mov cl, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
je 0x4051f1
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x4051f1
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, eax
add eax, 5
cmp dword [ebp + 0x10], 0
mov dword [ebp - 8], ecx
je 0x405199
add ebx, ecx
jmp 0x40519b
sub ebx, ecx
test edi, edi
je 0x4051ce
and edi, 6
mov edx, ebx
shl edi, 2
mov ecx, edi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x4051c9
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x10], 0
je 0x4051c6
add ebx, dword [ebp - 8]
jmp 0x4051c9
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor edi, edi
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [esi + 3], cl
mov byte [esi + 4], bl
jmp 0x4050f8
or edi, 8
shr edi, 1
inc eax
jmp 0x4050f8
push 2
pop edx
pop esi
shr edi, cl
cmp edx, ecx
mov edx, dword [ebp + 0xc]
sbb ecx, ecx
pop ebx
not ecx
and ecx, edi
mov dword [edx], ecx
pop edi
leave
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2feb2a6f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7bd80aff
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov dword [0x403cdc], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp + 4]
mov dword [0x403b2d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401031
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403b2d]
mov dword [ebp - 0x48], eax
mov eax, 0x40168b
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x403b2d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.klavesn
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403d28], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403d28]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010ce
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010c0
mov esp, ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408e54
nop
nop
mov ecx, 0x42c43b37
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x37be67ab
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x15c27046
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x642b4a97
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x70951a7
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x4f5e2a44
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x41d252
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x41d261
pop dword [ebp - 0x3c]
mov eax, 0x7c876341
add eax, 0x83ba6f20
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x95e2e8c8
add dword [ebp - 0x4c], 0xb86f5c83
mov dword [ebp - 0x48], 0xbe02bc34
add dword [ebp - 0x48], 0x74309011
mov dword [ebp - 0x44], 0x551ff248
sub dword [ebp - 0x44], 0x8d3ae1a
mov dword [ebp - 0x40], 0x1e63f943
add dword [ebp - 0x40], 0xe19c06bd
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x8083a5ff
add eax, 0x7fbeaa55
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x3b155f53
add dword [ebp - 0x4c], 0x395d0a03
mov dword [ebp - 0x48], 0x44c3542f
sub dword [ebp - 0x48], 0x356f2ba
mov dword [ebp - 0x44], 0x24d815a9
add dword [ebp - 0x44], 0x3e9756c3
mov dword [ebp - 0x40], 0xb4033c83
sub dword [ebp - 0x40], 0xb4033c83
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x5171562d
sub eax, 0x512f05d5
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3afaa
push 0
call eax
mov ecx, 0xfcf151b9
sub ecx, 0xfcf114d4
mov edi, eax
mov ebx, 0x43da00
add ebx, dword [ebp - 0x3c]
mov esi, 0xd71210a1
xor dword [ebp - 0x34], ecx
mov edx, dword [ebx]
add dword [ebp - 0x14], 0x530a7be6
sub edx, esi
mov dword [edi], edx
sub dword [ebp - 0x30], esi
add edi, 0xafaf2126
add edi, 0x5050dede
add ebx, 4
loop 0x41d377
add eax, 0xd938ed6a
add eax, 0x26c7f8fd
mov ebx, eax
add eax, 0xd8bde99
add eax, 0xf274216c
mov ecx, 0xe135ddc5
sub ecx, 0xe0f5ddc5
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x1013a6b7
Capabilities:
Create thread

Disassembly:
lea edi, [edx*4 + 0x5c86280e]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0xc]
bswap edi
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
call fcn.100cfce7

Function at 0x1013b773
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edi, [edi + ecx - 0x67844d38]
lea edx, [ecx + 0x4698a18f]
mov dword [esp + ecx - 0x67844d3c], 0x34bbaabb
movzx edx, byte [esi + ecx - 0x67844d3c]
neg byte [esp + ecx - 0x67844d37]
jb 0x1012b79d

Function at 0x1013b9af
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov cx, word ss:[edx]
mov edx, 0xf1075098
call fcn.10128e4c

Function at 0x4283d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4283e8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42848c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x428487
mov ecx, dword [ebp - 8]
push ecx
call fcn.004289b0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x428446
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x428446
xor eax, eax
jmp 0x42848c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4283df
mov esp, ebp
pop ebp
ret
Function at 0x4011d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0x28], 0x43
mov byte [ebp - 0x27], 0x1b
mov byte [ebp - 0x26], 0x73
mov byte [ebp - 0x25], 0x5f
mov byte [ebp - 0x24], 0xa8
mov byte [ebp - 0x23], 0xb6
mov byte [ebp - 0x22], 0x18
mov byte [ebp - 0x21], 0x7d
mov byte [ebp - 0x20], 0xa7
mov byte [ebp - 0x1f], 0x3c
mov dword [ebp - 0x10], 0x4de34767
mov dword [ebp - 8], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0xa
jae 0x401248
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx]
sub edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x10]
rol dl, cl
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f6d
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x401212
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401262
xor eax, eax
jmp 0x40132d
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x40127c
xor eax, eax
jmp 0x40132d
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0x4550
je 0x40129a
xor eax, eax
jmp 0x40132d
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0xc], ecx
jne 0x4012b5
xor eax, eax
jmp 0x40132d
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x20]
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x1c]
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x24]
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x10], 0
je 0x401322
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
je 0x401322
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x401322
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x401322
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
jne 0x401328
xor eax, eax
jmp 0x40132d
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x5045cb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x50460a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50460a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50460a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x50460a
cmp dword [ecx + 0x74], 0xe
jbe 0x50460a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x50a0fc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x50a199
push ebx
push esi
call fcn.0050a0c5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0050a059
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x50a146
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x50a198
push edi
push eax
call fcn.0050a98f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x50a166
call fcn.00508ba1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x50a197
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0050a059
add esp, 0x20
test eax, eax
jne 0x50a185
push edi
call fcn.00508ba1
jmp 0x50a18d
push ebx
call fcn.00508ba1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x50b095
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x513338
push 0x513330
push str.FlsAlloc
push 0x1f
call fcn.0050afb1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x50b0c9
push dword [ebp + 8]
mov ecx, esi
call dword [0x511344]
call esi
jmp 0x50b0cf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x50b113
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x513348
push 0x513340
push str.FlsGetValue
push 0x21
call fcn.0050afb1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x50b14a
push dword [ebp + 8]
mov ecx, esi
call dword [0x511344]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x50b152
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x513350
push 0x513348
push str.FlsSetValue
push 0x22
call fcn.0050afb1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x50b18c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x511344]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x510040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51006d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51006d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret