joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5857ef
Capabilities:
Encode data using xor

Disassembly:
popfd
sahf
dec esp
or dword [ebp - 0x1b], esi
ret 0xd818
jg 0x585832
push eax
ror dword [ecx + 0x9db83f2], cl
xchg dword [ecx + 0x71], ebp
add edi, dword [edx]
popfd
rcr byte [eax - 0x3c00276a], 1
invalid
push edx
cmp eax, 0xd7a0097b
and dword [ebx], esi
sbb byte [eax - 0x70], bh
xor ebx, dword [eax]
js 0x5857c6
sub byte [ecx + 0x46c223fd], bl
push esi
jns 0x58588d
push esi
adc esi, dword [esi]
outsb dx, byte [esi]
out dx, eax
and eax, 0x8ad93e0
das
push es
dec ebx
fld dword [ecx + ecx*8 + 0x23c39e8f]
and edx, edx
ja 0x5858d4
into
frstor dword [edi - 0x15aab021]
not byte [ebp + 0x68]
mov cl, 0x1f
in al, 0x7d
stc
fistp word [ecx - 0x37]
stc
inc eax
fnsave dword [esi + 0x25]
cdq
ja 0x58582b
inc edi
mov ecx, 0xadbd71c5
push ds
mov ebx, 0x2989df84
mov esi, 0x4431c07d
enter 0xffffffffffff9c19, 0x72
std
push es
sbb byte [edi], 0xc7
cdq
adc byte [edx + 0x73a7b579], ch
cdq
in eax, dx
pop eax
cli
sub eax, 0xf28719b7
mov eax, 0x1729b4ef
adc eax, 0x81248e8
cmp dh, byte [0x780aeb13]
xor dword [edx], ebp
das
push esi
cdq
stc
mov word [ecx], gs
imul ecx
push cs
mov dl, bh
adc al, 0xbc
mov eax, cs
retf
lodsd eax, dword [esi]
mov gs, word [eax]
jbe 0x585858
jge 0x585858
jae 0x585883
vpmulhw ymm5, ymm2, ymmword [ebx - 0x6724acb9]
daa
sbb byte [edi + 0x37], dl
pushfd
ja 0x585925
add ah, byte [edx - 5]
invalid
dec ebp
invalid
sbb al, 0x33
sbb ecx, ebp
pop ecx
shl al, 5
lahf
out 0x71, eax
loopne 0x5858d1
jmp 0x585902

Function at 0x5c93df
Capabilities:
Encode data using xor

Disassembly:
add al, 0x47
and ch, dl
push cs
aam 0x2a
push esi
fldcw word [edx]
loope 0x5c93d5
mov dword [0x6eb0453], eax
mov byte [0x774e8237], al
xchg edx, eax
stosd dword es:[edi], eax
sub byte [esi + 0x234f0576], dh
cwde
dec ecx
mov gs, word [ecx]
hlt
insd dword es:[edi], dx
sbb eax, 0x3f8bdea3
or byte [eax + ecx*8 - 0x566fb14d], cl
dec esi
nop
test eax, 0x7aa829fc
fld dword [eax + 0x30e6acd5]
dec esi
nop
test eax, 0x7aa829fc
fld dword [eax + 0x30e6acd5]
xor byte [ebp + 0x5ab1743e], ch
lodsd eax, dword [esi]
je 0x5c93a1
pop edx
outsb dx, byte [esi]
push es
xlatb
adc dword [esi], 0xffffff94
or al, 0xe9
adc al, 0xd7
push cs
mov dh, 0x14
mov ecx, dword [eax - 0x68713f91]
pop eax
cli
and eax, 0x218341e4
in al, 0xf5
mov eax, 0x4d056dcf
sbb dword [esi - 0x43], edx
mov al, 0xbb
and eax, 0x87ff859
add dword [edi - 0x3400c4b0], eax
mov byte [0xa4fba4ce], al
insb byte es:[edi], dx
jb 0x5c93eb
xchg edx, eax
into
xchg esp, eax
loopne 0x5c9492
lodsb al, byte [esi]
push es
test al, 0x70
push 0x48
cmp eax, 0x7107d3c
add al, 0x65
jle 0x5c9415
popal
cmpsd dword [esi], dword es:[edi]
ror byte [eax], 0xbf
ret 0x5680
or byte [ebx - 0x515318f0], bl
xor dword [eax - 0x45c30764], esp
dec esp
ljmp 0x41e1
Function at 0x636403
Capabilities:
Encode data using xor

Disassembly:
push es
aad 0x97
mov ebx, 0x9bbdecfe
stosb byte es:[edi], al
pop esi
cmp byte [ebp + 0x794ca77c], dl
lodsb al, byte [esi]
push ebx
push 0x3e38967
jecxz 0x63641d
xor al, 0x1e
jnp 0x636453
xor eax, 0x8ce2b945
leave
mov word [ebp - 0x20], ss
int1
inc ebp
mov ecx, 0x8cc98ce2
push ebp
loopne 0x636418
or byte [edi], ah
insb byte es:[edi], dx
or ebx, edi
dec esi
inc edx
pop ds
pop ss
dec edi
jo 0x636481
in eax, dx
xchg ebp, eax
inc edx
mov ss, word [esi - 0x10]
insd dword es:[edi], dx
neg dword [edx + edi*4]
pop ds
std
ret 0x2d65
outsb dx, byte [esi]
push esi
inc eax
adc al, 0x27
je 0x636456
and ch, bh
invalid
in eax, dx
mov edx, 0xe0ab306d
invalid

Function at 0x6378aa
Capabilities:
Encode data using xor

Disassembly:
iretd
lahf
les edi, [ecx + edx*4]
xchg ecx, eax
xlatb
pop edi
or eax, 0xd752dc5
je 0x63792a
push edi
stc
mov ah, 0x82
xor al, 0xb5
inc esp
mov ah, 0x2a
add ebp, ebp
jae 0x6378ba
aaa
fstp qword [edx - 0x535803f8]
lodsd eax, dword [esi]
fisub dword [ebp + 0x1f9d03cd]
mov cl, 0x79
call 0x6a3b199c
xor eax, 0x1517b7d0
sbb ah, byte [ebp + 0x7d]
xlatb
adc dword [edi - 4], ebp
leave
push esp
jle 0x6378a9
jno 0x637885
pop ebp
xchg ecx, eax
or al, 0x74
cmp dword [ebx + eax*2 + 0x55], esi
pop eax
je 0x6378ac
and al, 0xd3
invalid
int 3
and dword [eax + 0x139ae1ee], esp
or byte [edx - 0x712e56af], 0xae
cvtps2pi mm7, xmm1
mov dword [0xfc52ef25], eax
dec esp
mov gs, word [esi - 0x5c06d2f1]
and eax, 0x4cfc52ef
pushal
fld xword [eax - 0x68c4416a]
mov ebp, 0xeb5c229c
out 0x58, eax
adc esp, esp
loop 0x63791d
rcl al, cl
lodsb al, byte [esi]
mov al, 7
daa
sbb al, 0xc3
invalid

Function at 0x639fd7
Capabilities:
Encode data using xor

Disassembly:
push cs
call 0xe23d70fa
and byte [eax - 0x54], 0x3f
call 0x9cd92b53
fmul dword [0xcade5b98]
loop 0x63a04a
test eax, 0xa1ca1e63
test dword [ecx], esi
bound ebx, qword [ebp + 0x51]
fisubr word [edi + 0x22b9721d]
test byte [eax + ecx*8 + 0xfa5fdf5], dl
sub ebp, dword [edi + 0x74]
cmp eax, 0x7c5c12bc
inc eax
add ecx, esi
test al, 0xc2
test dword [edi + 0x60], ecx
arpl word [edi], si
or byte [esp + eax*4], dl
movsb byte es:[edi], byte [esi]
or al, 0x80
pop ebx
adc dword [esp + edi*4 - 0x5e], esi
ja 0x63a098
mov bh, 0x2c
std
cmp dword [ecx + ebp + 0x4c2cc3ea], ebx
push eax
in eax, dx
fcmovb st(0), st(4)
int3
invalid
Function at 0x100048e0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
mov edx, esi
imul edx, eax
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [edi + 8]
cmp edx, ecx
jbe 0x10004900
mov eax, ecx
xor edx, edx
div esi
mov ecx, dword [edi]
mov edx, dword [esp + 0xc]
push ecx
push eax
push esi
push edx
call fcn.100273cd
mov ecx, eax
imul ecx, esi
sub dword [edi + 8], ecx
add esp, 0x10
pop edi
pop esi
ret

Function at 0x10004920
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x10050294]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x58]
push ebp
mov ebp, dword [esp + 0x58]
push edi
push 1
lea ecx, [esp + 0x4c]
push 8
push ecx
mov dword [esp + 0x14], eax
call fcn.100273cd
add esp, 0x10
cmp eax, 1
je 0x10004965
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10026fe4
add esp, 0x4c
ret
push 8
lea edx, [esp + 0x48]
push str.__arch__n
push edx
call fcn.10029560
add esp, 0xc
test eax, eax
jne 0x10004952
push ebx
push esi
push edi
push 1
lea eax, [esp + 0x18]
push 0x3c
push eax
mov ebx, 8
call fcn.100273cd
add esp, 0x10
cmp eax, 1
jne 0x10004a62
nop
push 2
lea ecx, [esp + 0x4e]
push 0x1003f234
push ecx
call fcn.10029560
add esp, 0xc
test eax, eax
jne 0x10004a62
add ebx, 0x3c
cmp byte [esp + 0x10], 0
mov byte [esp + 0x1f], al
lea eax, [esp + 0x10]
je 0x100049e9
mov edi, edi
mov cl, byte [eax]
cmp cl, 0x20
je 0x100049e6
cmp cl, 0x2f
je 0x100049e6
add eax, 1
cmp byte [eax], 0
jne 0x100049d0
jmp 0x100049e9
mov byte [eax], 0
lea edx, [esp + 0x40]
push edx
call fcn.10027805
mov edx, dword [esp + 0x60]
add esp, 4
mov esi, eax
lea ecx, [esp + 0x10]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10004a20
test al, al
je 0x10004a1c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10004a20
add ecx, 2
add edx, 2
test al, al
jne 0x10004a00
xor eax, eax
jmp 0x10004a25
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10004a77
add ebx, esi
test bl, 1
je 0x10004a36
add esi, 1
add ebx, 1
push 1
push esi
push edi
call fcn.1002776f
add esp, 0xc
cmp eax, 0xffffffff
je 0x10004a62
push edi
push 1
lea eax, [esp + 0x18]
push 0x3c
push eax
call fcn.100273cd
add esp, 0x10
cmp eax, 1
je 0x100049a0
pop esi
pop ebx
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.10026fe4
add esp, 0x4c
ret
push 8
lea ecx, [esp + 0x3c]
push 0
push ecx
mov dword [ebp], esi
mov byte [esp + 0x4b], 0
call fcn.10029560
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
add esp, 0xc
pop esi
pop ebx
pop ebp
mov dword [edx], eax
xor ecx, esp
xor eax, eax
call fcn.10026fe4
add esp, 0x4c
ret

Function at 0x10005f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
lea edi, [eax + ebp]
cmp ebp, edi
mov edx, ebp
jae 0x10005f63
nop
mov cl, byte [edx]
mov al, byte [esi]
xor al, cl
mov byte [edx], al
rol cl, 1
add edx, 1
cmp edx, edi
mov byte [esi], cl
jb 0x10005f50
pop edi
mov eax, ebp
pop ebp
ret
Function at 0x1000a620
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x10050294]
xor eax, esp
mov dword [esp + 0x404], eax
push esi
mov esi, dword [esp + 0x410]
push edi
mov ecx, esi
xor edi, edi
call fcn.1000a600
cmp eax, 9
jae 0x1000a665
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.10026fe4
add esp, 0x408
ret
push ebx
push 0x1003f244
push esi
lea ebx, [eax - 9]
call fcn.1002798c
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0xc], esi
jne 0x1000a69c
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.10026fe4
add esp, 0x408
ret
push ebp
push 0
push 0
push 0
call fcn.1000aa00
add esp, 0xc
test ebx, ebx
mov ebp, eax
jbe 0x1000a6f6
mov esi, ebx
sub esi, edi
cmp esi, 0x400
jbe 0x1000a6c2
mov esi, 0x400
mov eax, dword [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.100273cd
add esp, 0x10
cmp eax, esi
jb 0x1000a6f2
push eax
lea edx, [esp + 0x18]
push edx
push ebp
call fcn.1000aa00
add edi, esi
add esp, 0xc
cmp edi, ebx
mov ebp, eax
jb 0x1000a6b1
mov esi, dword [esp + 0x10]
push esi
push 9
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.100273cd
push esi
mov edi, eax
call fcn.100270f4
add esp, 0x14
cmp edi, 9
je 0x1000a71a
or eax, 0xffffffff
jmp 0x1000a73a
push 0x10
lea ecx, [esp + 0x19]
push 0
push ecx
mov byte [esp + 0x29], 0
call fcn.10029560
mov edx, eax
mov eax, ebp
sub eax, edx
add esp, 0xc
neg eax
sbb eax, eax
mov ecx, dword [esp + 0x414]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.10026fe4
add esp, 0x408
ret
Function at 0x100218c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
xor eax, eax
mov cl, byte [eax + str._LS_]
mov dl, byte [esi + edi]
add edi, 1
add eax, 1
cmp cl, dl
jne 0x10021a33
cmp eax, 4
jl 0x100218d2
xor eax, eax
cmp byte [esi + edi], al
sete al
test eax, eax
je 0x10021a33
push ebx
mov ebx, dword [ebp + 4]
cmp ebx, 1
mov dword [esp + 0x10], 0
jbe 0x10021a32
cmp byte [esi + 2], 0
lea eax, [esi + 2]
je 0x10021928
lea esp, [esp]
add eax, 1
cmp byte [eax], 0
jne 0x10021920
sub eax, esi
add eax, 1
mov ecx, eax
cmp ecx, ebx
sbb eax, eax
and eax, ecx
je 0x10021a32
jmp 0x10021940
mov ebp, eax
xor edi, edi
mov cl, byte [edi + str._LS_]
mov dl, byte [esi + ebp]
add ebp, 1
add edi, 1
cmp cl, dl
jne 0x10021968
cmp edi, 4
jl 0x10021944
xor ecx, ecx
cmp byte [esi + ebp], cl
sete cl
test ecx, ecx
jne 0x100219cd
mov ebp, eax
xor edi, edi
lea esp, [esp]
mov cl, byte [edi + str.Odradek1]
mov dl, byte [esi + ebp]
add ebp, 1
add edi, 1
cmp cl, dl
jne 0x1002199c
cmp edi, 9
jl 0x10021970
xor ecx, ecx
cmp byte [esi + ebp], cl
sete cl
test ecx, ecx
je 0x1002199c
mov dword [esp + 0x10], 1
cmp eax, ebx
jae 0x100219d5
cmp byte [esi + eax + 1], 0
lea eax, [esi + eax + 1]
je 0x100219b8
jmp 0x100219b0
add eax, 1
cmp byte [eax], 0
jne 0x100219b0
sub eax, esi
add eax, 1
mov ecx, eax
cmp ecx, ebx
sbb eax, eax
and eax, ecx
jne 0x10021940
jmp 0x100219f9
test eax, eax
je 0x100219f9
cmp eax, ebx
jb 0x100219d9
xor eax, eax
jmp 0x100219f9
cmp byte [esi + eax + 1], 0
lea eax, [esi + eax + 1]
je 0x100219ec
add eax, 1
cmp byte [eax], 0
jne 0x100219e4
sub eax, esi
add eax, 1
mov ecx, eax
cmp ecx, ebx
sbb eax, eax
and eax, ecx
cmp dword [esp + 0x10], 0
je 0x10021a32
test eax, eax
je 0x10021a32
cmp eax, ebx
mov dl, 0x44
ja 0x10021a32
lea ebx, [ebx]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 8]
lea esi, [ecx + eax]
mov cl, byte [esi]
mov bl, cl
xor bl, dl
rol cl, 1
mov dl, cl
mov ecx, dword [esp + 0x18]
add eax, 1
mov byte [esi], bl
cmp eax, dword [ecx + 4]
jbe 0x10021a10
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x100225b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
mov ebx, eax
jne 0x100225c2
pop ebp
or eax, 0xffffffff
pop ebx
ret
cmp dword [edi + 0xc], 0
je 0x100225ec
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
sub ecx, eax
cmp ecx, ebx
jb 0x100225bc
mov edx, dword [edi + 0x14]
push ebx
add edx, eax
push edx
push ebp
call fcn.10029560
add dword [edi + 0x1c], ebx
add esp, 0xc
pop ebp
xor eax, eax
pop ebx
ret
test ebx, ebx
push esi
jbe 0x10022630
cmp ebx, 0x4000
mov esi, 0x4000
ja 0x10022600
mov esi, ebx
sub ebx, esi
cmp dword [edi + 8], 0
je 0x10022617
mov eax, dword [edi + 4]
push eax
push esi
push 1
push ebp
call fcn.100048e0
jmp 0x10022623
mov ecx, dword [edi]
push ecx
push esi
push 1
push ebp
call fcn.100273cd
add esp, 0x10
cmp esi, eax
jne 0x10022636
add ebp, esi
test ebx, ebx
ja 0x100225f1
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x10029560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1002956f
pop dword [ebp - 0x3c]
mov eax, 0x7473b6a1
sub eax, 0x64712132
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3b21e
push 0
mov eax, 0xfceb876
add eax, 0x35383a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x39da5dad
sub ecx, 0x39da100c
xor esi, esi
add esi, eax
mov edi, 0xe0655abf
sub edi, 0xd05fcabf
add edi, dword [ebp - 0x3c]
mov ebx, 0x81ffcc98
sub dword [ebp - 0x38], 0xf715b1fe
mov edx, dword [edi]
xor dword [ebp - 0x24], 0xd0721ad0
xor edx, ebx
xor dword [ebp - 0x14], 0x5208693d
mov dword [esi], edx
xor dword [ebp - 0x18], edx
add esi, 0x129ef199
add esi, 0xed610e6b
add edi, 0x4f3a0813
add edi, 0xb0c5f7f1
loop 0x100295ca
add eax, 0xf3cdad96
add eax, 0xc337bc1
mov ebx, eax
add eax, 0xf7c30763
sub eax, 0xf7c3075e
mov ecx, 0x348210dc
sub ecx, 0x248210dc
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10016254
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x10016263
pop dword [ebp - 4]
mov eax, 0x4508a920
sub eax, 0x350746bd
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x37cb8
push 0
mov eax, 0xaad2029b
sub eax, 0x9ad0814b
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x6bf9a27b
add ecx, 0x94069ead
xor esi, esi
add esi, eax
mov edi, 0x1002b600
add edi, dword [ebp - 4]
mov edx, 0xec24008c
sub edx, 0xe8ff7672
mov ebx, dword [edi]
xor ebx, edx
mov dword [esi], ebx
add esi, 0x6892ac00
sub esi, 0x6892abfc
add edi, 4
loop 0x100162be
add eax, 0x2028b4f7
sub eax, 0x2027bd84
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8574c050
add ecx, 0x8a8b3fb0
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x77ba1582
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and word [esi], 0
lea eax, [edi + edi]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionSetup
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x77ba15d4
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.WinDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dword [ebp - 8], 0xfffffffe
jmp 0x77ba15de
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x77ba15e4
xor eax, eax
leave
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
je 0x77ba15fa
mov word [esi + eax*2], 0x5c
inc eax
push str.config_
lea eax, [esi + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
inc eax
leave
ret
Function at 0x10033b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10033b2f
pop dword [ebp - 0x1c]
mov eax, 0xe3f12711
sub eax, 0xd3edebe2
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xd6a18d3b
add dword [ebp - 0x2c], 0x77b0b810
mov dword [ebp - 0x28], 0xbe55aee0
add dword [ebp - 0x28], 0x73dd9d65
mov dword [ebp - 0x24], 0xfab460eb
sub dword [ebp - 0x24], 0xae681cbd
mov dword [ebp - 0x20], 0xe01866f6
add dword [ebp - 0x20], 0x1fe7990a
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xcba7c7cd
add eax, 0x445ca8fb
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x7b60bcaa
add dword [ebp - 0x2c], 0xf911acac
mov dword [ebp - 0x28], 0xacc9d5bb
sub dword [ebp - 0x28], 0x6b5d7446
mov dword [ebp - 0x24], 0xfe501de2
sub dword [ebp - 0x24], 0x9ae0b176
mov dword [ebp - 0x20], 0x439f86dd
sub dword [ebp - 0x20], 0x439f86dd
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x6fca6c11
add eax, 0xa03a04d3
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x442f4
push 0
call eax
mov ecx, 0x917f5194
sub ecx, 0x917f0257
xor ebx, ebx
add ebx, eax
mov esi, 0x214086ff
add esi, 0xeec5a901
add esi, dword [ebp - 0x1c]
mov edx, 0xa578e17b
sub edx, 0xd687d3ab
sub dword [ebp - 0x14], edi
mov edi, dword [esi]
mov dword [ebp - 4], 0x8eb2b90c
xor edi, edx
mov dword [ebx], edi
sub dword [ebp - 0x18], 0x7a521e02
add ebx, 4
add esi, 4
loop 0x10033c53
add eax, 0xbb2aec17
add eax, 0x44d643b0
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10001d10
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x101635c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov byte [ebp - 0x11c], 0x5c
mov byte [ebp - 0x11b], 0x47
mov byte [ebp - 0x11a], 0x4c
mov byte [ebp - 0x119], 0x2e
mov byte [ebp - 0x118], 0x74
mov byte [ebp - 0x117], 0x78
mov byte [ebp - 0x116], 0x74
mov byte [ebp - 0x115], 0
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x130]
mov dl, byte [ecx]
mov byte [ebp - 0x135], dl
add dword [ebp - 0x130], 1
cmp byte [ebp - 0x135], 0
jne 0x10001d96
mov eax, dword [ebp - 0x130]
sub eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], eax
lea edx, [ebp - 0x110]
add edx, 0xffffffff
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
mov cl, byte [eax + 1]
mov byte [ebp - 0x145], cl
add dword [ebp - 0x144], 1
cmp byte [ebp - 0x145], 0
jne 0x10001de1
mov edi, dword [ebp - 0x144]
mov esi, dword [ebp - 0x13c]
mov edx, dword [ebp - 0x140]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
je 0x10001ec7
push 0
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x128], eax
mov edx, dword [ebp - 0x128]
push edx
call fcn.10003049
add esp, 4
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], 0
push 0
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x120], 0
je 0x10001ec7
mov edx, dword [ebp - 0x120]
push edx
call fcn.100011a0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f687f
mov esp, ebp
pop ebp
ret

Function at 0x100155fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10015643
call fcn.100072f4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10015643
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1001565f
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.100150fc
mov esi, eax
test edi, edi
je 0x1001565d
test ebx, ebx
je 0x1001565d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10015a3e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x10111df1
call fcn.100f79f7
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x10015a63
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10015ab5
call fcn.1000aab3
push eax
lea ecx, [ebp - 0x10]
call fcn.10003dbc
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100fa0fb
push eax
call fcn.10003191
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1000366c
mov eax, esi
call fcn.100f7acf
ret 8

Function at 0x100401a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100072f4
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100401db
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.1003fddf
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x10040239
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x1004025d
cmp dword [edi + 0x74], 0
jne 0x1004025d
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.100072f4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.100401fa
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1004223f
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.10041ee3
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10042289
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1000a9b4
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.10005ba3
jmp 0x10042294
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10009cc8
pop edi
pop esi
pop ebp
ret 0xc