joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b500
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4b90a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004ab4e5
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004b0ee3
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004b253c
test eax, eax
je 0x47b61c
mov ecx, dword [esp + 0x3c]
call fcn.004b0f10
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x47b5e0
push edi
mov ecx, esi
call fcn.004ae20e
mov ecx, esi
call fcn.0047b7c0
cmp dword [esp + 0x38], 1
jne 0x47b615
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004ae349
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x47d800
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x47d833
push esi
call fcn.0048bba0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x47d82c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x47d8b9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x47d8a2
mov eax, dword [esi + 8]
test eax, eax
je 0x47d857
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x47d89e
cmp eax, 2
je 0x47d8a2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x47d84a
cmp eax, 3
je 0x47d87d
cmp eax, 1
jne 0x47d84a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x47d84a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x47d84a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0047d8e0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x47d8c8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0047d8e0
add esp, 4
pop esi
ret

Function at 0x47e150
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x47e171
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x47e171
mov eax, dword [eax + 0x44]
test eax, eax
je 0x47e171
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4ac2da
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ac312
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004aa391
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004aa369
jmp 0x4ac31e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4ad9cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4ada0d
call fcn.004b3932
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4ada0d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4ada04
xor eax, eax
jmp 0x4ada15
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004ada1b
pop edi
pop esi
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100011a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1004e884]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x88], eax
cmp esi, 0x80
push edi
mov ecx, str.._c:
lea eax, [esi - 0x80]
lea edx, [esi + 0x41]
cmovae edx, eax
mov eax, str..PhysicalDrive_d
push edx
cmovb eax, ecx
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.10001590
add esp, 0xc
lea eax, [ebp - 0x84]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10001229
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0xc]
mov eax, edx
shr eax, 8
movzx ecx, al
mov eax, edx
and eax, 0xc0
mov dword [ebp - 0x8c], 0
and edx, 0x3f
push 0
lea ecx, [ecx + eax*4]
movzx eax, byte [ebx + 0x1cd71]
imul ecx, eax
movzx eax, word [ebx + 0x1cd6f]
add ecx, dword [ebp + 0x10]
imul ecx, eax
lea eax, [ebp - 0x8c]
push eax
add ecx, edx
shl ecx, 9
sub ecx, 0x200
push ecx
push edi
mov dword [ebp - 0x90], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp + 0x14]
shl eax, 9
push eax
push dword [ebp - 0x88]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100012c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1004e884]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
add eax, 0x41
push edi
push eax
lea eax, [ebp - 0x84]
push str.._c:
push eax
call fcn.10001590
add esp, 0xc
lea eax, [ebp - 0x84]
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000132a
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x88]
push 0
shl eax, 9
push ecx
push eax
push edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1004e884]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x88], eax
cmp esi, 0x80
push edi
mov ecx, str.._c:
lea eax, [esi - 0x80]
lea edx, [esi + 0x41]
cmovae edx, eax
mov eax, str..PhysicalDrive_d
push edx
cmovb eax, ecx
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.10001590
add esp, 0xc
lea eax, [ebp - 0x84]
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10001419
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 0xc]
mov eax, edx
shr eax, 8
movzx ecx, al
mov eax, edx
and eax, 0xc0
mov dword [ebp - 0x8c], 0
and edx, 0x3f
push 0
lea ecx, [ecx + eax*4]
movzx eax, byte [ebx + 0x1cd71]
imul ecx, eax
movzx eax, word [ebx + 0x1cd6f]
add ecx, dword [ebp + 0x10]
imul ecx, eax
lea eax, [ebp - 0x8c]
push eax
add ecx, edx
shl ecx, 9
sub ecx, 0x200
push ecx
push edi
mov dword [ebp - 0x90], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp + 0x14]
shl eax, 9
push eax
push dword [ebp - 0x88]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0x14

Function at 0x100014b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1004e884]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
add eax, 0x41
push edi
push eax
lea eax, [ebp - 0x84]
push str.._c:
push eax
call fcn.10001590
add esp, 0xc
lea eax, [ebp - 0x84]
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000151a
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x88]
push 0
shl eax, 9
push ecx
push eax
push edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp + 0x10]
shl eax, 9
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100015d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
or eax, 0xffffffff
xor esi, esi
test edi, edi
je 0x100015fe
push ebx
mov ebx, dword [ebp + 8]
movzx edx, byte [esi + ebx]
inc esi
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1001e418]
cmp esi, edi
jb 0x100015e5
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x10001fc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
movsx eax, byte [ebx + 0x10]
push esi
movzx esi, word [ebx + 0x14]
push edi
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
push esi
push dword [ebx + 0xc]
pshufd xmm0, xmm0, 0
mov dword [ebp - 4], ecx
movaps xmmword [ebp - 0x20], xmm0
call fcn.10001cf0
test al, al
je 0x100020c0
mov edi, dword [ebx + 8]
mov ecx, dword [ebp - 4]
push esi
push edi
call fcn.10001cf0
test al, al
je 0x100020c0
xor ecx, ecx
test esi, esi
je 0x1000209e
mov edx, dword [ebx + 0xc]
cmp esi, 0x40
jb 0x100020a1
lea eax, [edi - 1]
add eax, esi
cmp edx, eax
ja 0x10002041
lea eax, [edx - 1]
add eax, esi
cmp eax, edi
jae 0x100020a1
movaps xmm1, xmmword [ebp - 0x20]
mov eax, esi
and eax, 0xffffffc0
mov esi, edi
sub esi, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
mov eax, edx
movzx esi, word [ebx + 0x14]
mov edx, dword [ebp - 4]
nop dword [eax]
movups xmm0, xmmword [edx + eax]
lea eax, [eax + 0x40]
pxor xmm0, xmm1
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [edi + ecx + 0x10]
pxor xmm0, xmm1
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [edi + ecx + 0x20]
pxor xmm0, xmm1
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [edi + ecx + 0x30]
add ecx, 0x40
pxor xmm0, xmm1
movups xmmword [eax - 0x10], xmm0
cmp ecx, dword [ebp - 8]
jl 0x10002060
mov edx, dword [ebx + 0xc]
cmp ecx, esi
jge 0x100020c0
sub edi, edx
lea eax, [ecx + edx]
mov dl, byte [ebx + 0x10]
sub esi, ecx
nop
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor cl, dl
mov byte [eax - 1], cl
sub esi, 1
jne 0x100020b0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10

Function at 0x100020d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
movzx ebx, word [ebp + 0x14]
mov eax, ecx
push esi
mov esi, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.10001cf0
test al, al
je 0x10002124
mov ecx, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
call fcn.10001cf0
test al, al
je 0x10002123
test ebx, ebx
je 0x10002123
mov dx, word [ebp + 0x10]
lea ecx, [ebx - 1]
shr ecx, 1
sub edi, esi
inc ecx
nop
mov ax, word [edi + esi]
lea esi, [esi + 2]
xor ax, dx
mov word [esi - 2], ax
sub ecx, 1
jne 0x10002110
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10002920
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
mov esi, ecx
push edi
movzx eax, byte [eax + esi + 0xa7a]
lea edi, [esi + 0x2a7a]
push edi
push eax
movzx eax, word [ebp + 8]
movzx eax, byte [eax + esi + 0xa7a]
push eax
call fcn.10001db0
mov dl, byte [ebp + 0x10]
mov eax, edi
mov ecx, 0x200
xor byte [eax], dl
lea eax, [eax + 1]
sub ecx, 1
jne 0x10002957
cmp byte [esi + 0x1cd6e], 0x80
mov ecx, esi
push edi
jae 0x10002974
call fcn.10001f00
jmp 0x10002979
call fcn.10001f70
mov ecx, eax
xor eax, eax
cmp ecx, 1
pop edi
setne al
pop esi
lea eax, [eax*2 + 3]
pop ebp
ret 0xc
Function at 0x10002c20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
push edi
test esi, esi
je 0x10002c67
mov edi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
push edi
call fcn.10001c70
movzx ecx, word [ebx + 0x2a7a]
xor eax, eax
movzx edx, word [ebx + 0x2a7c]
test esi, esi
jle 0x10002c5b
xor word [eax + edi], cx
inc eax
add ecx, edx
cmp eax, esi
jl 0x10002c50
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor edi, edi
xor ecx, ecx
nop
mov dl, byte [ecx + esi]
movzx eax, dl
add eax, 0xfffffffb
cmp eax, 0xe4
ja case.0x10002c87.6
movzx eax, byte [eax + 0x10002cf8]
jmp dword [eax*4 + 0x10002ce0]
cmp word [ecx + esi + 1], 0
je case.0x10002c87.6
mov word [ebx + 0x2a7a], di
mov ax, word [ecx + esi + 1]
pop edi
mov word [ebx + 0x2a7c], ax
mov eax, 2
pop esi
pop ebx
pop ebp
ret 0xc
add ecx, 2
jmp case.0x10002c87.6
movzx edi, word [ecx + esi + 1]
inc ecx
and dl, 0xf8
lea eax, [ecx + 2]
cmp dl, 0xb8
cmovne eax, ecx
lea ecx, [eax + 1]
cmp ecx, 0x50
jl 0x10002c70
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x100033f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1004e884]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp bl, 2
jae 0x10003511
movzx eax, bl
add eax, 0x41
push eax
lea eax, [ebp - 0x84]
push str._c:_
push eax
call fcn.10001590
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
movzx eax, ax
mov edx, eax
cmp eax, 5
je 0x10003511
cmp eax, 6
je 0x10003511
cmp eax, 1
je 0x10003511
cmp edx, 3
movzx eax, bl
mov ecx, 0x80
cmovne ecx, eax
xor eax, eax
mov byte [esi + 0x1cd6e], cl
mov word [esi + 0x1cd6f], ax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x88]
mov byte [esi + 0x1cd71], 0
push eax
lea eax, [ebp - 0x90]
push eax
movzx eax, byte [esi + 0x1cd6e]
push eax
call fcn.100030c0
add esp, 0x10
test eax, eax
je 0x100034c3
mov ax, word [ebp - 0x88]
mov word [esi + 0x1cd6f], ax
mov al, byte [ebp - 0x8c]
mov byte [esi + 0x1cd71], al
mov eax, 0x12
mov dword [esi + 0x56], 0x200
mov word [esi + 0x18], ax
push esi
mov byte [esi + 0x1cd72], bl
call fcn.100038e0
test eax, eax
jne 0x10003511
push edi
mov edi, dword [ebp + 0x10]
push edi
push esi
call fcn.10003530
test eax, eax
jne 0x100034fc
push esi
call fcn.100038e0
test eax, eax
jne 0x100034e7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10005d28
mov esp, ebp
pop ebp
ret 0xc
Function at 0xf130b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xf13200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf130d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf130c2
add dl, dl
jne 0xf130e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf13134
xor eax, eax
add dl, dl
jne 0xf130ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf131d5
add dl, dl
jne 0xf130fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf13108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf13113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf1311e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf1312a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf130cd
mov eax, 1
add dl, dl
jne 0xf13142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf1314d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf13139
sub eax, ebx
mov ebx, 1
jne 0xf13180
mov ecx, 1
add dl, dl
jne 0xf13166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf13171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf1315d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf130cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf13197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf131a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf1318e
cmp eax, 0x7d00
jae 0xf131c5
cmp eax, 0x500
jb 0xf131c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf130cd
cmp eax, 0x7f
ja 0xf131c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf130cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf131f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf130cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10019cc
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
sub esp, 0x34
mov ecx, dword [0x1005b24]
push ebp
xor ebp, ebp
cmp ecx, ebp
mov dword [esp + 4], ebp
je 0x1001b42
mov eax, dword [0x1005b80]
push ebx
xor ebx, ebx
inc ebx
test byte [0x10056c4], bl
push edi
mov edi, dword [sym.imp.USER32.dll_GetMenuItemRect]
mov dword [0x1005b88], eax
jne 0x10019db
mov edx, dword [reloc.KERNEL32.dll_GetStartupInfoA]
add edx, eax
mov eax, dword [reloc.GDI32.dll_SetDIBitsToDevice]
cmp eax, ebp
mov dword [0x1005b88], edx
je 0x10019db
lea edx, [esp + 0x10]
push edx
push ebp
push eax
push ecx
call edi
test eax, eax
je 0x10019db
lea eax, [esp + 0x20]
push eax
push ebx
push dword [reloc.GDI32.dll_SetDIBitsToDevice]
push dword [0x1005b24]
call edi
test eax, eax
je 0x10019db
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
je 0x10019db
mov eax, dword [reloc.KERNEL32.dll_GetStartupInfoA]
add dword [0x1005b88], eax
mov dword [esp + 0xc], ebx
mov eax, dword [0x1005334]
shl eax, 4
add eax, 0x18
mov dword [reloc.GDI32.dll_GetLayout], eax
mov eax, dword [0x1005338]
shl eax, 4
add eax, 0x43
push ebp
mov dword [0x1005b20], eax
call fcn.01001915
mov ecx, dword [reloc.GDI32.dll_GetLayout]
mov edx, dword [0x10056b0]
add ecx, edx
sub ecx, eax
cmp ecx, ebp
jle 0x1001a20
or dword [esp + 0x44], 2
sub dword [0x10056b0], ecx
push ebx
call fcn.01001915
mov edx, dword [0x10056b4]
mov ecx, dword [0x1005b20]
add ecx, edx
sub ecx, eax
cmp ecx, ebp
jle 0x1001a47
or dword [esp + 0x44], 2
sub edx, ecx
mov dword [0x10056b4], edx
cmp dword [0x1005b38], ebp
jne 0x1001b40
test byte [esp + 0x44], 2
push esi
mov esi, dword [sym.imp.USER32.dll_MoveWindow]
je 0x1001a8d
mov eax, dword [0x1005b88]
mov ecx, dword [0x1005b20]
push ebx
add ecx, eax
mov eax, dword [reloc.GDI32.dll_GetLayout]
push ecx
mov ecx, dword [SetDIBitsToDevice]
add ecx, eax
push ecx
push edx
push dword [0x10056b0]
push dword [0x1005b24]
call esi
cmp dword [esp + 0x10], ebp
je 0x1001b0d
mov eax, dword [reloc.GDI32.dll_SetDIBitsToDevice]
cmp eax, ebp
je 0x1001b0d
lea ecx, [esp + 0x14]
push ecx
push ebp
push eax
push dword [0x1005b24]
call edi
test eax, eax
je 0x1001b0d
lea eax, [esp + 0x24]
push eax
push ebx
push dword [reloc.GDI32.dll_SetDIBitsToDevice]
push dword [0x1005b24]
call edi
test eax, eax
je 0x1001b0d
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x28]
jne 0x1001b0d
mov eax, dword [0x1005b88]
sub eax, dword [reloc.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [0x1005b20]
push ebx
add ecx, eax
push ecx
mov ecx, dword [SetDIBitsToDevice]
mov dword [0x1005b88], eax
mov eax, dword [reloc.GDI32.dll_GetLayout]
add ecx, eax
push ecx
push dword [0x10056b4]
push dword [0x10056b0]
push dword [0x1005b24]
call esi
test byte [esp + 0x48], 4
pop esi
je 0x1001b40
push dword [0x1005b20]
lea eax, [esp + 0x34]
push dword [reloc.GDI32.dll_GetLayout]
push ebp
push ebp
push eax
call dword [sym.imp.USER32.dll_SetRect]
push ebx
lea eax, [esp + 0x34]
push eax
push dword [0x1005b24]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop ebx
pop ebp
add esp, 0x34
ret 4