joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095956
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x100c2070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xac]
push eax
mov dword [esi + 0x10], ebx
call fcn.10039820
mov ecx, dword [esi + 0x10]
mov eax, 0x40000080
mov edi, 0x400000a0
cmp byte [ecx + 0x7c9], 0
cmove edi, eax
mov al, byte [ecx + 0x9f0]
test al, al
je 0x1003967c
and edi, 0xffffff7f
or edi, 4
mov eax, dword [ecx]
call dword [eax + 0x1c]
movups xmm0, xmmword [ebp - 0xac]
sub esp, 0x10
mov ecx, dword [eax]
mov eax, esp
push ecx
push 0
push edi
push ecx
push ecx
mov ecx, esi
movups xmmword [eax], xmm0
call fcn.1001efc0
mov ecx, dword [esi + 0x10]
mov edi, dword [ecx + 0x648]
cmp edi, 0xffffffff
je 0x100396d6
mov eax, dword [ecx]
call dword [eax + 0x1c]
test edi, edi
js 0x100396c9
cmp edi, dword [eax + 0x24c]
jge 0x100396c9
mov eax, dword [eax + 0x248]
mov eax, dword [eax + edi*4]
jmp 0x100396d0
mov ecx, eax
call fcn.10023d50
mov eax, dword [eax]
test eax, eax
jne 0x100396e7
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.10023d50
mov eax, dword [eax]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
push 0x30
push dword [esi + 4]
call edi
mov eax, dword [esi + 0x10]
push 0
push dword [eax + 0x7c4]
push 0xc5
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x10]
mov al, byte [ecx + 0x7c9]
test al, al
je 0x1003972d
movzx eax, word [ecx + 0x7ca]
push 0
push eax
push 0xcc
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0x9c]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
push dword [eax]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x98]
mov eax, dword [ebp - 0x9c]
cmp eax, ecx
je 0x10039767
push eax
call fcn.10079c0c
add esp, 4
push 0
push 0
push 0xb9
mov dword [ebp - 4], 0xffffffff
push dword [esi + 4]
call edi
push 0
push 3
push 0xd3
push dword [esi + 4]
call edi
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
call eax
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0x10]
xor ecx, ecx
push 0
cmp byte [eax + 0x7c8], 1
sete cl
push ecx
push 0xcf
push dword [esi + 4]
call edi
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebx + 0x9e4]
or ecx, eax
push ecx
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [esi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006c6c9
mov esp, ebp
pop ebp
ret 4
Function at 0x10039cc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100c2070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x10], 0
je 0x10039d29
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.1006d550
mov ebx, esp
test ebx, ebx
je 0x10039d29
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push 0xffffffffffffffff
add ecx, 0x1bc
push ebx
call fcn.100258a0
mov ecx, dword [esi + 0x10]
push ecx
push 0
push 0
mov eax, dword [ecx]
push 0x100a64f4
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.100239f0
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006c6c9
mov esp, ebp
pop ebp
ret
Function at 0x10041d40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095956
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x100c2070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov dword [eax + 0x7c8], 0
cmp dword [esi + 4], 0
jne 0x10041de3
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x1c]
movups xmm0, xmmword [ebp - 0x24]
sub esp, 0x10
mov ecx, dword [eax]
mov eax, esp
push ecx
push 0
push 0x40000000
push ecx
push ecx
mov ecx, esi
movups xmmword [eax], xmm0
call fcn.1001efc0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push dword [ecx + 0x648]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.10024220
push 1
push dword [eax]
push 0x30
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x10]
lea edx, [ebp - 0xac]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov eax, dword [eax]
movzx ebx, word [eax]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
cmp eax, ecx
je 0x10041e17
push eax
call fcn.10079c0c
add esp, 4
mov dword [ebp - 4], 0xffffffff
test bx, bx
jne 0x10041e32
mov eax, dword [esi + 0x10]
add eax, 0x7b8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esi + 0x10]
add eax, 0x7b8
push eax
push 0
push 0x1002
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [esi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1006c6c9
mov esp, ebp
pop ebp
ret 4
Function at 0x10042fd0
Capabilities:
Extract resource via kernel32 functions
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
push edi
mov edi, edx
test ecx, ecx
jne 0x10042ffa
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
call fcn.10024c60
mov esi, dword [ebp - 4]
add esp, 4
mov dword [edi], eax
jmp 0x10043079
mov eax, dword [0x100c5d28]
test eax, eax
push ecx
push dword [ebp + 8]
cmove eax, dword [0x100c5d2c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1004307d
mov eax, dword [0x100c5d28]
test eax, eax
push ebx
cmove eax, dword [0x100c5d2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x10043072
mov eax, dword [0x100c5d28]
test eax, eax
push ebx
cmove eax, dword [0x100c5d2c]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [edi], eax
test eax, eax
je 0x10043072
push eax
call fcn.1006cf9e
add esp, 4
mov esi, eax
push dword [edi]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call fcn.1006ea30
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
jne 0x100430f1
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100430fa
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi], eax
test eax, eax
je 0x100430e6
push eax
mov dword [ebp - 4], 0
call fcn.1006cf9e
mov esi, eax
add esp, 4
test esi, esi
je 0x100430e6
push 0
lea eax, [ebp - 4]
push eax
push dword [edi]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
je 0x100430e6
push esi
call fcn.1006c6da
add esp, 4
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100430fa
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004ce60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x674], 0
je 0x1004cecc
cmp dword [ebp + 8], 0x100
jne 0x1004cebc
cmp word [ebp + 0xc], 0xd
jne 0x1004cebc
cmp byte [esi + 0x67a], 0
je 0x1004ce9e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1004cebc
cmp byte [esi + 0x67b], 0
jne 0x1004cebc
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x1004ceb5
push ecx
push 0
push 0
push str.return
push esi
call fcn.100239f0
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x674]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x10050fa0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov byte [ecx + 0x199], al
test al, al
jne 0x10050fce
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x10050fe5
cmp dword [eax + 0x84], ecx
jne 0x10050fe5
mov dword [ebp + 8], 0
mov ecx, eax
pop ebp
jmp fcn.10022f90
cmp byte [ecx + 0x198], 0
je 0x10050fe5
mov eax, dword [ecx]
push dword [ecx + 0x7cc]
call dword [eax + 0x154]
pop ebp
ret 4
Function at 0x1005c8c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1005c8cb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x1005c987
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
sub edi, 1
jne 0x1005c8e0
pop edi
test esi, esi
je 0x1005c9aa
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x100a3960]
sub esi, 1
jne 0x1005c990
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x1005d170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x1005d1b3
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1005d1a5
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
xor edx, edx
pop edi
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
lea eax, [edx + esi]
cmp eax, ecx
jbe 0x1005d1c4
mov esi, ecx
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.1006ea30
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005d1f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov edi, 1
cmp byte [esi], 0
je 0x1005d22b
push 0
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1005d226
mov byte [esi + 8], 1
mov edi, dword [ebp - 8]
jmp 0x1005d258
mov ebx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x1005d23c
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x10]
add eax, ebx
push edi
push eax
lea eax, [ebp - 1]
push eax
call fcn.1006ea30
lea eax, [ebx + edi]
add esp, 0xc
mov ebx, dword [ebp - 8]
mov dword [esi + 0x18], eax
cmp edi, 1
jne 0x1005d26c
movzx eax, byte [ebp - 1]
mov dword [ebx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x1005d263
cmp byte [esi + 8], 0
je 0x1005d263
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005d330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [edi], 0
je 0x1005d364
cmp byte [edi + 1], 0
je 0x1005d35d
push 2
push 0
push 0
push dword [edi + 4]
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1005d36a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
mov dword [edi + 0x18], eax
cmp byte [edi], 0
push ebx
je 0x1005d38d
cmp byte [edi + 1], 0
je 0x1005d386
push 1
push 0
push 0
push dword [edi + 4]
call ecx
sub eax, dword [edi + 0xc]
jmp 0x1005d390
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x1005d39f
mov eax, dword [edi + 0x18]
mov ebx, 0xffff
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jae 0x1005d3a4
mov ebx, eax
mov dword [ebp - 0xc], eax
push esi
push 0x404
call fcn.1007a653
mov esi, eax
add esp, 4
test esi, esi
jne 0x1005d3bf
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x10], 0
cmp ebx, eax
jbe 0x1005d4ba
mov edx, dword [ebp - 4]
add eax, 0x400
cmp eax, ebx
mov ecx, eax
mov eax, 0x404
cmova ecx, ebx
sub edx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x404
mov dword [ebp - 0x18], edx
mov ebx, ecx
cmova ebx, eax
cmp byte [edi], 0
je 0x1005d41e
cmp byte [edi + 1], 0
je 0x1005d4ba
mov eax, dword [edi + 0xc]
push 0
push 0
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1005d421
mov dword [edi + 0x18], edx
cmp byte [edi], 0
mov ecx, ebx
mov dword [ebp - 8], ebx
je 0x1005d449
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1005d444
mov byte [edi + 8], 1
mov eax, dword [ebp - 0x14]
jmp 0x1005d472
mov edx, dword [edi + 0x18]
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x14]
jbe 0x1005d45c
mov ecx, dword [edi + 0x14]
sub ecx, edx
mov dword [ebp - 8], ecx
push ecx
mov ecx, dword [edi + 0x10]
add ecx, edx
push ecx
push esi
call fcn.1006ea30
mov eax, dword [ebp - 8]
add esp, 0xc
add dword [edi + 0x18], eax
xor edx, edx
div ebx
cmp eax, 1
jne 0x1005d4ba
lea eax, [ebx - 3]
test eax, eax
jle 0x1005d4ac
dec eax
cmp byte [eax + esi], 0x50
jne 0x1005d49e
cmp byte [eax + esi + 1], 0x4b
jne 0x1005d49e
cmp byte [eax + esi + 2], 5
jne 0x1005d49e
cmp byte [eax + esi + 3], 6
je 0x1005d4a4
test eax, eax
jg 0x1005d482
jmp 0x1005d4ac
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
jne 0x1005d4ba
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
jb 0x1005d3d3
push esi
call fcn.10079c0c
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1005e430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x1005e4c8
cmp dword [esi + 4], 0xffffffff
jne 0x1005e4c8
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x1005e460
cmp dword [ebp + 0x10], 1
mov eax, dword [0x100a55ec]
mov dword [edi], eax
mov edi, dword [ebp + 8]
jne 0x1005e493
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x1005e493
mov eax, 0x2000000
pop edi
pop esi
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.1005d020
add esp, 8
test eax, eax
jne 0x1005e4b4
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, eax
call fcn.1005d4d0
mov dword [esi], eax
mov eax, dword [0x100c5d70]
pop edi
pop esi
pop ebp
ret 0xc
pop edi
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc

Function at 0x1005f020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
shr edx, 0x10
mov esi, ecx
push edi
test edx, edx
je 0x1005f071
cmp word [eax], 0x3c
jne 0x1005f057
push eax
call fcn.10052230
test al, al
jne 0x1005f10a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push ecx
push eax
call fcn.100523e0
test al, al
jne 0x1005f10a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [0x100c5d28]
test ecx, ecx
mov ebx, dword [ebp + 0xc]
cmove ecx, dword [0x100c5d2c]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1005f04c
mov eax, dword [0x100c5d28]
test eax, eax
push edi
cmove eax, dword [0x100c5d2c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1005f0c2
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x140], eax
mov eax, dword [0x100c5d28]
test eax, eax
push ecx
cmove eax, dword [0x100c5d2c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call fcn.10052300
test al, al
je 0x1005f04c
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [esi + 0x144], ebx
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1005f130
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10082c8c
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10082b91

Function at 0x100887fd
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100884bd
Function at 0x401480
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401492
mov eax, dword [0x4d608b]
shl eax, 2
mov dword [0x4d608f], eax
push edx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov edx, eax
call fcn.004c943c
pop edx
call fcn.004c93a0
call fcn.004c947c
push 0
call fcn.004ca8b8
pop ecx
push 0x4d6034
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4d6093], eax
push 0
jmp fcn.004cfcf8

Function at 0x401e34
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, 0x4d6414
call fcn.004c9c18
push esi
push ebx
push ecx
imul esi, esi, 0
call fcn.00401f00
push edx
xor eax, 0xdeab2ec5
cld
push ds
movsd dword es:[edi], dword [esi]
salc
stosb byte es:[edi], al
pop ecx
je 0x401e69
ficomp word [esi]
push esp
retf
fld xword [eax - 0x4bf3133b]
jmp 0x401eb3
cld
jmp 0x401ebb
push edx
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x30], eax
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004d459c
push 0
push dword [ebp - 0x30]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x30]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
jmp 0x401f94
mov esp, ebp
pop ebp
ret

Function at 0x401f00
Capabilities:
Get file size

Disassembly:
xor edx, edx
mov dword [ebp - 0x2c], edx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
mov word [ebp - 0x18], 8
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
inc dword [ebp - 0xc]
mov ecx, dword [0x4e76c8]
mov eax, dword [ecx]
call fcn.0048a544
cmp dword [ebp - 4], 0
je 0x401eb6
mov edx, dword [ebp - 4]
mov edx, 0x4d61c8
mov ecx, 0x475d1e
rcl ecx, 0x2b
pop ebx
lea ebx, [ebx + eax + 0x25]
sub ebx, eax
xor ecx, dword [esp + 0x28]
xor ecx, dword [esp + 8]
sbb ecx, 0xfffffff9
or ecx, 0xfffffff5
sub ecx, 3
mov ecx, 0x4784be
lea ecx, [ebx + edx + 0x63]
sub ecx, edx
sub ecx, 0x63
lea ebx, [ebx + eax + 0x83]
sub ebx, eax
sub esi, dword [ecx]
lea ecx, [ecx + 2]
cmp ecx, ebx
jb 0x401f3a
pop ecx
cmp esi, 0xdb1708fd
pop ebx
pop esi
nop
jmp 0x401e74
Function at 0x40f1a4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, 0x4db47c
call fcn.004c9c18
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004d4474
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
xor edx, edx
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
cmp dword [ebp + 8], 0
je 0x40f1f3
mov eax, dword [ebp + 8]
jmp 0x40f1f8
mov eax, 0x4d73a0
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x2c]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0x28], eax
push dword [ebp - 0x2c]
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0x28], 0xffffffff
jne 0x40f23c
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004d459c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40f25b
mov eax, dword [ebp - 0x28]
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004d459c
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x40f824
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x4db684
call fcn.004c9c18
call sub.kernel32.dll_GetThreadLocale
mov dword [ebp - 0x34], eax
push 2
lea edx, [ebp - 0x2e]
push edx
push 0xe
push dword [ebp - 0x34]
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jne 0x40f8a1
mov word [ebp - 0x1c], 8
mov edx, 0x4d73d3
lea eax, [ebp - 4]
call fcn.004d443c
inc dword [ebp - 0x10]
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.004d45cc
mov eax, dword [ebp + 8]
mov word [ebp - 0x1c], 0x14
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004d459c
pop eax
mov word [ebp - 0x1c], 8
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x40f8ee
mov word [ebp - 0x1c], 0x20
lea edx, [ebp - 0x2e]
lea eax, [ebp - 8]
call fcn.004d443c
inc dword [ebp - 0x10]
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.004d45cc
mov eax, dword [ebp + 8]
mov word [ebp - 0x1c], 0x2c
push eax
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004d459c
pop eax
mov word [ebp - 0x1c], 0x20
inc dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret