joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa2f395
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov dword [ebp - 0x24], 0xa
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x1c], 0xe
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], 8
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0x1000000
mov dword [ebp - 0x54], 0x2000000
mov dword [ebp - 0x50], 0x4000000
mov dword [ebp - 0x4c], 0x8000000
mov dword [ebp - 0x48], 0x10000000
mov dword [ebp - 0x44], 0x20000000
mov dword [ebp - 0x40], 0x40000000
mov dword [ebp - 0x3c], 0x80000000
mov dword [ebp - 0x38], 0x1b000000
mov dword [ebp - 0x34], 0x36000000
mov dword [ebp - 8], 0
jmp 0xa2f4a2
mov eax, dword [ebp - 8]
shl eax, 2
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
movzx eax, al
shl eax, 0x18
mov edx, eax
mov eax, dword [ebp - 8]
shl eax, 2
lea ecx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, ecx
mov al, byte [eax]
movzx eax, al
shl eax, 0x10
or edx, eax
mov eax, dword [ebp - 8]
shl eax, 2
lea ecx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, ecx
mov al, byte [eax]
movzx eax, al
shl eax, 8
mov ecx, edx
or ecx, eax
mov eax, dword [ebp - 8]
shl eax, 2
lea edx, [eax + 3]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
movzx edx, al
mov eax, dword [ebp - 8]
lea ebx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, ebx
or edx, ecx
mov dword [eax], edx
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jl 0xa2f430
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0xa2f557
mov eax, dword [ebp - 0xc]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x14]
mov eax, edx
test eax, eax
jne 0xa2f502
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00a2e00e
mov dword [esp], eax
call fcn.00a2ef48
mov ecx, eax
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x5c]
xor eax, ecx
mov dword [ebp - 0x10], eax
jmp 0xa2f52c
cmp dword [ebp - 0x14], 8
sete cl
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x14]
mov eax, edx
cmp eax, 4
sete al
and eax, ecx
test al, al
je 0xa2f52c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00a2ef48
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
lea edx, [eax*4]
mov eax, dword [ebp + 0xc]
add eax, edx
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
lea ecx, [edx*4]
mov edx, dword [ebp + 0xc]
add edx, ecx
xor eax, dword [ebp - 0x10]
mov dword [edx], eax
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
inc eax
shl eax, 2
cmp dword [ebp - 0xc], eax
jl 0xa2f4b5
nop
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x79d800
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x79d806
pop ebp
sub ebp, 6
sub ebp, 0x39d800
jmp 0x79d864
jmp 0x79d86d
mov eax, 0x39d800
add eax, ebp
add eax, 0x93
mov ecx, 0x62f
mov edx, 0xd1b9f16e
xor byte [eax], dl
inc eax
dec ecx
jne 0x79d884
jmp 0x79d897
add al, 0x2e
push es
outsb dx, byte [esi]
jle 0x79d90b
outsb dx, byte [esi]
push es
outsb dx, byte [esi]
mov byte [0xae5d6e42], al
xchg ecx, eax
sti
stosb byte es:[edi], al
into
pop esi
outsb dx, byte [esi]
in eax, 0xa3
in eax, 0xe7
push edx
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
out dx, eax
scasd eax, dword es:[edi]
xchg esi, eax
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
insd dword es:[edi], dx
mov dword [0x6e6e6ad6], eax
outsb dx, byte [esi]
aam 0x46
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
cdq
mov word [ebp - 0x5a], gs
in eax, 0xef
bound ebp, qword [esi + 0x6e]
outsb dx, byte [esi]
insd dword es:[edi], dx
stosd dword es:[edi], eax
push es
in al, dx
pop ebx
outsb dx, byte [si]
push es
adc eax, 0x6f6e5ecc
inc edx
dec edx
push es
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
xchg byte [ebx + 0x6e], ch
outsb dx, byte [esi]
outsb dx, byte [esi]
xchg dword [esi + 0x6e], eax
outsb dx, byte [esi]
outsb dx, byte [esi]
cmp edi, dword [edx]
xor esp, ebp
jmp 0x79d95c
lodsb al, byte [esi]
push 0x27
popal
jmp 0x79d8ab
pushfd
sub dword [ecx + 0x7a], ebp
dec ebx
out dx, eax
pushfd
sub dword [ecx + 0x7a], ebp
dec ebx
pop ebp
mov esp, 0x266b86ed
popal
ljmp 0xe661

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40127b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
jmp 0x40131c
mov edx, edi
call fcn.004011e2
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.0040267d
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 0
jmp 0x40135a
or bl, 1
idiv ebx
mov edx, dword [0x404050]
mov ebx, esi
add edx, eax
mov eax, 0x404054
call fcn.004011e2
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x40338d
push eax
sub edi, fcn.00402b27
push edi
push fcn.00402b27
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x4012be
mov eax, fcn.00402b27
mov ebx, esi
jmp 0x4012a6
sub ebp, 0x82
mov esi, eax
mov ebx, dword [0x404050]
cdq
jmp 0x4012cf
call fcn.00401fff
lea eax, [esi + 0x1c000]
lea ebx, [ebp - 2]
test esi, esi
je 0x40136e
add eax, eax
dec esi
and esi, 0x404054
mov edx, eax
mov eax, esi
call fcn.00402b27
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42ac90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1d000]
push edi
jmp 0x42acaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42acb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42aca0
mov eax, 1
add ebx, ebx
jne 0x42acc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42acb8
jne 0x42acd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42acb8
xor ecx, ecx
sub eax, 3
jb 0x42ace8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ad5a
mov ebp, eax
add ebx, ebx
jne 0x42acf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42ad00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ad24
inc ecx
add ebx, ebx
jne 0x42ad10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42ad05
jne 0x42ad21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ad05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ad44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ad35
jmp 0x42aca6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ad44
add edi, ecx
jmp 0x42aca6
pop esi
mov edi, esi
mov ecx, 0xd49
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ad62
cmp byte [edi], 0xe
jne 0x42ad62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ad67
lea edi, [esi + 0x28000]
mov eax, dword [edi]
or eax, eax
je 0x42add6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2a9a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2aa20]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42ad94
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2aa24]
or eax, eax
je 0x42add0
mov dword [ebx], eax
add ebx, 4
jmp 0x42adb1
call dword [esi + 0x2aa34]
mov ebp, dword [esi + 0x2aa28]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42ae0a
sub esp, 0xffffff80
jmp 0x41b2a4
Function at 0x100152d2
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064e0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x2d0c
mov dword [ebp - 0x24], 0x10008598
cmp dword [ebp - 0x20], 0x2ea3
jle 0x10015380
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xadb
push 0x14a0
push 0x1312
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
and dword [ebp - 0x14], 0
jmp 0x1001533d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7194
jge 0x10015380
and dword [ebp - 0x18], 0
jmp 0x10015353
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7c9a
jge 0x1001537e
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, edx
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0x1060e618
call fcn.1001b046
jmp 0x1001534c
jmp 0x10015336
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
jne 0x1001538e
and dword [ebp - 0x1c], 0
jmp 0x100153a9
mov esi, dword [ebp + 0xc]
sub esi, dword [ebp + 8]
call fcn.1004f865
mov edi, eax
call fcn.1004f865
imul eax, edi
cdq
idiv esi
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x1c]
jmp 0x100153f1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002132f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
mov dword [esp + 0x14], 0xfffffffb
push edi
mov dword [esp + 0x1c], 0x48f69f7f
mov dword [esp + 0x10], 0x3ab7
cmp dword [esp + 0x10], 0x3ccc
push 1
mov dword [esp + 0x28], ecx
pop ebx
jle 0x100213c7
xor esi, esi
xor edi, edi
xor eax, eax
mov dword [esp + 0x14], eax
and eax, edi
lea ecx, [esp + 0x48]
and eax, esi
cdq
push edx
push eax
call fcn.1000d5ba
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021388
mov eax, dword [eax]
push eax
call fcn.1004f716
pop ecx
push 0
push ebx
lea ecx, [esp + 0x50]
call fcn.1001b6c7
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x3db8
jl 0x1002136e
inc edi
cmp edi, 0xf85
jl 0x10021368
inc esi
cmp esi, 0x3087
jl 0x10021366
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0xc], 0x33c63384
cmp dword [esp + 0x10], 0x37b6
jge 0x100213e4
push 0x10008ec8
call fcn.1004f716
pop ecx
mov dword [esp + 0x10], 0x6eb6b9dd
lea ecx, [esp + 0x2c]
push 3
call fcn.1001b277
mov dword [esp + 0x14], 7
lea edx, [esp + 0x2c]
mov dword [esp + 0x20], 0xfffffffe
lea ecx, [esp + 0x28]
call fcn.10021310
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
add ecx, 0xea0c
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x18]
jne 0x10021448
cmp dword [esp + 0xc], 0
je 0x10021448
mov eax, ebx
jmp 0x1002144a
xor eax, eax
mov edx, dword [esp + 0x20]
xor ecx, ecx
imul edx, eax
mov eax, dword [esp + 0x10]
cmp eax, edx
setge cl
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x1c]
cmp eax, 0x49bc00ea
mov eax, dword [esp + 0x14]
setle cl
add eax, dword [esp + 0x18]
dec dword [esp + 0x14]
cmp eax, ecx
jge 0x10021485
xor ebx, ebx
neg ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], ebx
call fcn.1001b2f9
lea eax, [esp + 0x38]
push eax
call fcn.1001e0ed
mov esi, eax
lea edi, [esp + 0x30]
pop ecx
mov ecx, dword [esp + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100212cd
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov eax, dword [ecx + eax*8]
sub eax, 0x12c
mov esp, ebp
pop ebp
ret
Function at 0x10024ac5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10065419
call fcn.10064688
sub esp, 0x18
push ebx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp edx, 0x6cc5ec7e
jae 0x10024aef
add dword [0x1060e0b0], 0x54b051cb
mov dword [ebp - 0x20], 0x3186
cmp dword [ebp - 0x20], 0x3380
jle 0x10024b56
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [ebp - 0x18], 0x58a6
mov dword [ebp - 0x14], eax
mov ebx, eax
mov esi, 0x3ac3
mov eax, ebx
mov ecx, 0x1060e618
xor eax, edi
cdq
push edx
push eax
call fcn.1001b046
dec ebx
dec esi
jne 0x10024b19
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
add eax, esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x10024b12
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x801d
jl 0x10024b06
inc edi
cmp edi, 0x16a8
jl 0x10024b01
mov ebx, dword [ebp - 0x24]
mov eax, dword [0x1060f7f8]
test al, 1
jne 0x10024b71
or eax, 1
mov dword [0x1060f7f8], eax
call fcn.1002856f
mov dword [0x1060f7d4], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2f95
jge 0x10024bac
mov edx, 0x10009200
mov ecx, 0x1060e618
call fcn.1001d551
jmp 0x10024bac
mov eax, dword [0x1060f7d4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, dword fs:[eax]
mov dword [ebx], eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a990
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100656e8
call fcn.10064688
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x604e
cmp dword [ebp - 0x1c], 0x617d
push edi
mov dword [ebp - 0x10], esp
jle 0x1002aa10
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x20], 0
mov eax, esi
cdq
idiv ebx
mov esi, dword [ebp - 0x20]
mov ebx, edx
mov eax, ebx
mov ecx, 0x1060e618
and eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1001b046
inc esi
cmp esi, 0x218e
jl 0x1002a9cd
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x12d8
jl 0x1002a9bf
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x1cbe
jl 0x1002a9ba
inc edi
cmp edi, 0x123a
jl 0x1002a9b5
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5faf
jge 0x1002aa2c
mov edx, 0x10009888
mov ecx, 0x1060e618
call fcn.1001d551
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100325b3
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100325e0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push 0x7e1c
push 0x2de
push 1
push dword [ebp - 4]
call fcn.10032633
add esp, 0x10
jmp 0x1003262f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10032629
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1001b315
mov dword [eax], 0x8d3c891c
jmp 0x1003262f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x100346ef
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006598e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003481b
mov dword [ebp - 0x24], 0x7355
mov dword [ebp - 0x2c], 0x1000a418
cmp dword [ebp - 0x24], 0x754b
jle 0x100347c6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
and dword [ebp - 0x20], 0
jmp 0x10034751
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5317
jge 0x100347c6
and dword [ebp - 0x18], 0
jmp 0x10034767
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7f3
jge 0x100347c4
and dword [ebp - 0x1c], 0
jmp 0x1003477d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7527
jge 0x100347c2
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.1000d5ba
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.1001b026
push eax
call fcn.1004f716
pop ecx
lea ecx, [ebp - 0x70]
call fcn.1001b01c
jmp 0x10034776
jmp 0x10034760
jmp 0x1003474a
push 0x392c
push 0x7835
push 0
call fcn.1003c786
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x721e
jge 0x100347f0
push dword [ebp - 0x2c]
call fcn.1004f716
pop ecx
jmp 0x1003480c
or dword [ebp - 4], 0xffffffff
jmp 0x10034816
jmp 0x1003489f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10034854
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0x525a5285
jmp 0x1003489f
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10034882
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x1003489f
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.1001b315
mov dword [eax], 0xffff
jmp 0x10034877
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c04a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065b60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003c1a8
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1003c18f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x7393
mov dword [ebp - 0x34], 0x1000aac8
cmp dword [ebp - 0x24], 0x7745
jle 0x1003c137
and dword [ebp - 0x14], 0
jmp 0x1003c0c0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x31df
jge 0x1003c137
and dword [ebp - 0x18], 0
jmp 0x1003c0d6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x698a
jge 0x1003c135
and dword [ebp - 0x1c], 0
jmp 0x1003c0ec
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4ad0
jge 0x1003c133
and dword [ebp - 0x20], 0
jmp 0x1003c102
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x79da
jge 0x1003c131
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x1060e618
call fcn.1001b046
jmp 0x1003c0fb
jmp 0x1003c0e5
jmp 0x1003c0cf
jmp 0x1003c0b9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x70eb
jge 0x1003c157
mov edx, dword [ebp - 0x34]
mov ecx, 0x1060e618
call fcn.1001d551
jmp 0x1003c173
or dword [ebp - 4], 0xffffffff
jmp 0x1003c17d
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1003c18d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1003c1a6
push 0
push 0x15e5
push 0x8b6
push 0xb21
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x1003c1cd
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1003c1c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1003c1cd
push 0
push 0x1c8c
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c67a
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003c6d5
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1003c6c0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003c6be
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1003c6d3
push 0
push 0x777
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x1003c701
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push dword [eax]
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x1c]
push 0x4068
call fcn.10034acd
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x100427c2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10042842
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100427ff
push 0
push 0x928
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10042840
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
jmp 0x10042879
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.10032456
add esp, 0x18
mov esp, ebp
pop ebp
ret