joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4562bc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4562d3
add esp, 0xfffffff0
call fcn.004036a0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421308
mov eax, dword [0x4d12f0]
cmp word [eax + 2], 0
jne 0x4562fb
mov eax, dword [0x4d12f0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457994
mov eax, dword [0x4d1400]
cmp word [eax + 2], 0
jne 0x456315
mov eax, dword [0x4d1400]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457b8c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41934c]
call fcn.0040335c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41934c]
call fcn.0040335c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4234e4]
call fcn.0042912c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45649c
mov eax, dword [0x4d11a4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004294fc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45812c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4d11a4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d0ac
test eax, eax
je 0x45640a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004092f4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d0d4
test eax, eax
je 0x45641e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040441c
mov eax, dword [0x4d0fe4]
cmp byte [eax], 0
jne 0x456452
mov eax, ebx
call fcn.004565c4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00458308
mov eax, ebx
call fcn.00458ccc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x456492
call fcn.004036f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456844
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4d2bb4]
cmp dword [eax + 0x30], 0
je 0x4568ee
cmp dword [ebx + 0x94], 0
jne 0x4568e8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4567d4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4568e8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4568ae
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4568e8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b760
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4568bd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457450
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x457485
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040429c
jmp 0x457492
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404200
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4584e4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x458525
mov eax, esi
call fcn.0043ecac
test al, al
je 0x458525
mov eax, dword [ebx + 0x84]
call fcn.0043e9a8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x458525
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043e9a8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x484298
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x4842b5
add esp, 0xfffffff0
call fcn.004036a0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x484451
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0047aaa4
test al, al
jne 0x4842f2
mov ecx, 0x484484
mov dl, 1
mov eax, dword [0x46f1a0]
call fcn.0040c2b4
call fcn.00403bcc
xor eax, eax
push ebp
push 0x48431e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00479550
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0047943c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48433e
mov eax, dword [ebp - 0x10]
mov edx, 0x4844c0
call fcn.00404b60
je 0x48435b
mov eax, esi
mov edx, 0x4844c0
call fcn.00404b60
jne 0x48437f
mov eax, edi
mov edx, 0x4844d0
call fcn.00404b60
je 0x48437f
mov ecx, 0x4844a8
mov dl, 1
mov eax, dword [0x46f448]
call fcn.0040c2b4
call fcn.00403bcc
mov eax, edi
xor edx, edx
call fcn.00404b60
jne 0x4843ac
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404b60
je 0x4843ac
mov ecx, 0x4844a8
mov dl, 1
mov eax, dword [0x46f448]
call fcn.0040c2b4
call fcn.00403bcc
mov eax, dword [ebp - 0x10]
mov edx, 0x484510
call fcn.00404b60
jne 0x4843df
mov eax, edi
mov edx, 0x48451c
call fcn.00404b60
je 0x4843df
mov ecx, 0x4844a8
mov dl, 1
mov eax, dword [0x46f448]
call fcn.0040c2b4
call fcn.00403bcc
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00482388
lea eax, [ebx + 4]
mov edx, esi
call fcn.004048f4
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004048f4
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004048f4
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004048f4
lea eax, [ebx + 8]
call fcn.004048b8
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x484568]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484458
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004048d0
ret
Function at 0x485d4c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x485d69
add esp, 0xfffffff0
call fcn.004036a0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x485f04
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0047aaa4
test al, al
jne 0x485da6
mov ecx, 0x485f38
mov dl, 1
mov eax, dword [0x46f1a0]
call fcn.0040c2b4
call fcn.00403bcc
xor eax, eax
push ebp
push 0x485dd2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00479550
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0047943c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x485df2
mov eax, edi
xor edx, edx
call fcn.00404b60
jne 0x485e1f
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404b60
je 0x485e1f
mov ecx, 0x485f5c
mov dl, 1
mov eax, dword [0x46f448]
call fcn.0040c2b4
call fcn.00403bcc
mov eax, dword [ebp - 0x10]
mov edx, 0x485f74
call fcn.00404b60
jne 0x485e52
mov eax, edi
mov edx, 0x485f80
call fcn.00404b60
je 0x485e52
mov ecx, 0x485f5c
mov dl, 1
mov eax, dword [0x46f448]
call fcn.0040c2b4
call fcn.00403bcc
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00482388
lea eax, [ebx + 4]
mov edx, esi
call fcn.004048f4
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.004048f4
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.004048f4
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.004048f4
lea eax, [ebx + 8]
call fcn.004048b8
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x41934c]
call fcn.0040335c
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x41934c]
call fcn.0040335c
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x41934c]
call fcn.0040335c
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x485fcc]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4721c4]
call fcn.004815e0
mov dword [ebx + 0x3c], eax
mov ax, word [0x485fd0]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485f0b
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004048d0
ret
Function at 0x488960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x488982
add esp, 0xfffffff0
call fcn.004036a0
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x488aed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0047aaa4
test al, al
jne 0x4889bf
mov ecx, 0x488b20
mov dl, 1
mov eax, dword [0x46f1a0]
call fcn.0040c2b4
call fcn.00403bcc
push dword [0x4d0ccc]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x4d0ccc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b18
mov eax, dword [ebp - 0xc]
call fcn.0047b57c
test al, al
jne 0x488a91
push dword [0x4d0cc8]
push dword [ebp + 8]
push dword [0x4d0cc8]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404b18
mov eax, dword [ebp - 0x14]
call fcn.0047b57c
test al, al
jne 0x488a91
push dword [0x4d0ccc]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x4d0ccc]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404b18
mov eax, dword [ebp - 0x18]
call fcn.0047b694
test al, al
jne 0x488a91
push dword [0x4d0cc8]
push edi
push dword [0x4d0cc8]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404b18
mov eax, dword [ebp - 0x20]
call fcn.0047b694
test al, al
jne 0x488a91
mov ecx, 0x488b20
mov dl, 1
mov eax, dword [0x46f1a0]
call fcn.0040c2b4
call fcn.00403bcc
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00482388
lea eax, [ebx + 4]
mov edx, esi
call fcn.004048f4
lea eax, [ebx + 8]
call fcn.004048b8
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.004048f4
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.004048f4
mov byte [ebx + 0xc], 0xc
mov ax, word [0x488b3c]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488af4
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.004048d0
ret

Function at 0x4bd5f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bd66b
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4bd652
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.0040441c
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.00408754
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd672
lea eax, [ebp - 0x104]
call fcn.004041ac
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x93019c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9301a2
pop ebp
sub ebp, 6
sub ebp, 0x53019c
jmp 0x930200
jmp 0x930209
mov eax, 0x53019c
add eax, ebp
add eax, 0x93
mov ecx, 0x60b
mov edx, 0xb9ff95f7
xor byte [eax], dl
inc eax
dec ecx
jne 0x930220
jmp 0x930233
popfd
mov bh, 0x9f
mul edi
div edi
lahf
idiv dword [ebx]
fcomi st(7)
les esi, [edi]
cmpsd dword [esi], dword es:[edi]
or byte [edx - 0x71], ah
mov dh, 0xbe
mul dword [edi + 0x7e7c3a7c]
retf
Function at 0x1000c2b0
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xf2
mov dword [0xf4df1354], eax
fcompi st(4)
xor al, 0x83
or edx, dword [edi - 0x51]
dec esi
invalid
invalid
invalid

Function at 0x1000e120
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
add al, 0x45
dec ebp
xor dword [esi - 0x2b8b8904], esi
mov dh, 0xdf
inc ecx
pop edx
ja 0x1000e116
mov ebx, 0x259e89da
outsd dx, dword ss:[esi]
invalid
invalid
pop ecx

Function at 0x1000e4b0
Capabilities:
Encode data using xor

Disassembly:
and dword [edi], esp
xor al, 0x5a
lea ebx, [ebx + 0xf]
and al, 0x2e
jg 0x1000e45b
daa
hlt
Function at 0x100015c0
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
push 1
push edi
push ebx
call ebp
mov esi, dword [esp + 0x14]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push ebx
mov esi, eax
call ebp
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1000d9f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, ecx
call edi
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 8]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000daba
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
jmp 0x1000da30
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x20]
push 0
mov edx, dword [ecx + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000da49
call edi
mov dword [esp + 0x10], eax
call edi
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
add edx, ecx
cmp eax, edx
ja 0x1000dac9
xor eax, eax
push 1
mov ecx, 6
lea edi, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], 0
push eax
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
call esi
test eax, eax
je 0x1000daa3
lea ecx, [esp + 0x14]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
call esi
test eax, eax
jne 0x1000da7e
mov ecx, dword [ebx + 8]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1000da2a
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
Function at 0x1000eaf0
Capabilities:
Link many functions at runtime

Disassembly:
mov ecx, 0x100a3aa0
jmp 0x1000eb20
push esi
mov esi, ecx
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [esi + 0x1c], eax
cmp eax, ecx
je 0x1000eba1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.IsAppThemed
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x1c]
push str.IsThemeActive
push eax
call edi
mov ecx, dword [esi + 0x1c]
push str.OpenThemeData
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x1c]
push str.CloseThemeData
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x1c]
push str.GetThemeBackgroundContentRect
push eax
call edi
mov ecx, dword [esi + 0x1c]
push str.DrawThemeBackground
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 0x1c]
push str.GetThemePartSize
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, esi
pop edi
pop esi
ret
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov eax, esi
pop esi
ret

Function at 0x1002ba10
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1002ba69
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1002ba69
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x1002ba70
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x1002ba4d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1002ba6b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret
Function at 0x10031540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10031590
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10031590
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x10031595
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1003157b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x100315a2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x1003c180
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x1003c1d0
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x1003c3a0
push 0
push 0
call fcn.10015348
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x1003c1d0
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], 1
test ecx, ecx
je 0x1003c1bf
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x1003c220
Capabilities:
Terminate thread

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x1003c234
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 8]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 8]
push 0
push ecx
push 2
mov dword [esp + 0x18], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edx, dword [esi + 8]
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1003c281
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResetEvent]
push ecx
call edi
mov edx, dword [esi + 0x14]
push edx
call edi
mov dword [esi + 0xc], 0
pop edi
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x1003e2f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push 0x1009b5ac
push ecx
call fcn.10014835
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1003e3ca
mov edi, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x1003e3b0
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
lea ecx, [eax + eax]
push ecx
call fcn.1006217f
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x1003e3b0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ebx
push edi
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x1003e3e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push 0x1009b5ac
push ecx
call fcn.10014835
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1003e479
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8
Function at 0x1003e6a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1003e73a
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x1003e724
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.1006217f
mov esi, eax
add esp, 4
test esi, esi
je 0x1003e724
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8