joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f47552e
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x5f494baa
call sub.MSVCRT.dll__EH_prolog
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call sym.MFC42.DLL_Ordinal_533
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 4], edi
mov dword [esi + 0x1c], eax
call sym.MFC42.DLL_Ordinal_540
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call sym.MFC42.DLL_Ordinal_860
push dword [ebp + 0x14]
mov ecx, ebx
call sym.MFC42.DLL_Ordinal_860
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x5f4755be
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5f494bcc
call sub.MSVCRT.dll__EH_prolog
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call sym.MFC42.DLL_Ordinal_533
xor edi, edi
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
call sym.MFC42.DLL_Ordinal_540
mov ebx, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x5f4d3b28
mov byte [ebp - 4], 1
push dword [ebx + 0xc]
push dword [ebp + 8]
call fcn.5f475037
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call sym.MFC42.DLL_Ordinal_860
mov eax, dword [ebx + 8]
mov ecx, ebx
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call sym.MFC42.DLL_Ordinal_3772
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call sym.MFC42.DLL_Ordinal_858
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call sym.MFC42.DLL_Ordinal_800
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x5f4755ca
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x5f494bcc
call sub.MSVCRT.dll__EH_prolog
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call sym.MFC42.DLL_Ordinal_533
xor edi, edi
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
call sym.MFC42.DLL_Ordinal_540
mov ebx, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x5f4d3b28
mov byte [ebp - 4], 1
push dword [ebx + 0xc]
push dword [ebp + 8]
call fcn.5f475037
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call sym.MFC42.DLL_Ordinal_860
mov eax, dword [ebx + 8]
mov ecx, ebx
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call sym.MFC42.DLL_Ordinal_3772
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call sym.MFC42.DLL_Ordinal_858
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call sym.MFC42.DLL_Ordinal_800
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x5f477c7f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, 0xf1
push edi
push esi
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call sym.MFC42.DLL_Ordinal_1146
push esi
mov edi, eax
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x5f477cc1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5f477cc1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x5f477cc9
xor eax, eax
pop edi
pop esi
leave
ret 4
movzx eax, word [esi + 6]
shl eax, 2
push ebx
push eax
call sym.MFC42.DLL_Ordinal_823
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x5f477d00
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x5f477cea
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call sym.MFC42.DLL_Ordinal_5883
push ebx
mov edi, eax
call sym.MFC42.DLL_Ordinal_825
pop ecx
pop ebx
test edi, edi
je 0x5f477d43
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call sym.MFC42.DLL_Ordinal_6146
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call sym.MFC42.DLL_Ordinal_4147
mov edi, eax
mov eax, edi
jmp 0x5f477cc3
Function at 0x5f478076
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push sym.MFC42.DLL_Ordinal_2187
mov ecx, 0x5f4d2a1c
call sym.MFC42.DLL_Ordinal_3028
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, eax
cmp word [esi + 8], 0
jne 0x5f478104
push str.COMCTL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x5f4780e2
mov ecx, dword [ebp + 0x10]
push 5
neg ecx
sbb ecx, ecx
and ecx, 0xe
add ecx, 0x3ee
movzx ecx, cx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5f4780e2
push ebx
push edi
push eax
call sym.MFC42.DLL_Ordinal_3202
add esp, 0xc
mov eax, dword [edi]
mov eax, dword [eax - 8]
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 4], eax
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ax, word [ebx]
mov word [esi + 8], ax
push dword [esi + 4]
mov ecx, edi
call sym.MFC42.DLL_Ordinal_860
mov si, word [esi + 8]
xor eax, eax
mov word [ebx], si
cmp si, 0xffff
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
Function at 0x5f486853
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
call edi
test ax, ax
jge 0x5f48696a
or dword [esi + 0x3c], 1
or dword [esi + 0x38], 2
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sym.MFC42.DLL_Ordinal_2864
cmp dword [esi + 0x34], ebx
jne 0x5f486957
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call sym.MFC42.DLL_Ordinal_2864
cmp eax, dword [esp + 0x34]
jne 0x5f486957
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x5f4868f3
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x5f486938
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x5f486957
cmp eax, 0x205
je 0x5f486957
cmp eax, 0x201
je 0x5f486957
cmp eax, 0x204
je 0x5f486957
cmp eax, ebx
jne 0x5f48691e
cmp dword [esp + 0x1c], 0x1b
je 0x5f486957
push dword [esp + 0x2c]
lea eax, [esi + 0x24]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x34], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [sym.MFC42.DLL_Ordinal_4301]
jbe 0x5f48694d
mov dword [esi + 0x34], 1
cmp dword [esi + 0x34], 0
je 0x5f4868b0
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
push 2
call edi
test ax, ax
jge 0x5f48687d
or dword [esi + 0x3c], 2
or dword [esi + 0x38], 1
jmp 0x5f48687d
Function at 0x1005e4d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [eax - 0x15]
cmp ch, byte [eax - 0x4436fce4]
pop ss
mov al, 0xfe
mov dl, 0xbe
add al, byte [eax + edi*2]
rol byte [esp + ebp - 6], 1
push ds
sbb dword [eax], 0xffffffd2
aam 0xbb
and cl, dh
test al, 0x61
add eax, 0x5b1819c
xor ch, ah
sbb byte [esi + edx*8 - 0x200788ee], al
add ecx, 0x45
mov eax, 0x5836331c
xor dword [ecx + 0x18ec3205], 0x7712d684
clc
fild word [ebx + 0x1cb845c1]
xor esi, dword [esi]
pop eax
pop es
or dword [eax + 0x4b], esp
and eax, 0xe44087c7
push ss
pushfd
rol byte [edi - 0x19], 1
dec edi
sgdt [edi - 0x2a]
mov ah, 0xc6
dec ecx
add al, 0xc8
and eax, 0x46ac0ac
mov bh, 0xa0
ror byte [eax - 0x11], 0x4c
add dword [ecx - 0x2dfe0247], ebx
adc dh, byte [ecx - 0x10]
or dword [ecx], ebp
or bl, byte [ebp + 0x74]
jo 0x1005e4f2
invalid
Function at 0x10003d40
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], ebp
cmp ebx, ebp
je 0x10003df8
cmp dword [esp + 0x20], ebp
je 0x10003df8
push 0x10000
call fcn.10036a69
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x10003d85
lea eax, [ebp - 0xc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [ebx + 0x5c]
push 0x10000
push edi
push ebp
push ebp
push ebx
call eax
mov esi, eax
add esp, 0x14
test esi, esi
jle 0x10003de3
lea esp, [esp]
mov ecx, dword [esp + 0x20]
push ecx
mov eax, esi
cdq
push esi
add ebp, eax
adc dword [esp + 0x1c], edx
push 1
push edi
call fcn.10036dc3
add esp, 0x10
test eax, eax
jge 0x10003dc0
xor eax, eax
add dword [esp + 0x1c], eax
cmp eax, esi
jne 0x10003de3
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x5c]
push 0x10000
push edi
push edx
push ebp
push ebx
call eax
mov esi, eax
add esp, 0x14
test esi, esi
jg 0x10003da0
push edi
call fcn.10036912
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov eax, 0xffffffea
pop ebx
add esp, 8
ret
Function at 0x1002a6d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
not eax
test cl, 3
je 0x1002a700
lea esp, [esp]
test esi, esi
jbe 0x1002a700
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x240e3e8]
inc ecx
dec esi
test cl, 3
jne 0x1002a6e0
mov edx, esi
and edx, 0xfffffff0
add edx, ecx
cmp ecx, edx
jae 0x1002a847
push edi
xor eax, dword [ecx]
add ecx, 0x10
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
xor eax, dword [ecx - 0xc]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
xor eax, dword [ecx - 8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x240e3e8]
xor eax, dword [ecx - 4]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x240e3e8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x240e3e8]
cmp ecx, edx
jb 0x1002a710
pop edi
and esi, 0xf
add esi, ecx
mov edx, esi
cmp ecx, edx
jae 0x1002a86c
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x240e3e8]
inc ecx
cmp ecx, edx
jb 0x1002a852
not eax
pop esi
ret
Function at 0x10031790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [ebp]
push esi
push edi
mov edi, eax
mov eax, dword [ebp + 8]
cmp ecx, dword [eax*4 + 0x23d9220]
jb 0x100317ba
mov esi, ebp
call fcn.10031610
test eax, eax
je 0x100317ba
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
movsx eax, byte [edi]
push ebx
mov ecx, edi
mov ebx, 0x1505
test eax, eax
je 0x100317e2
lea esp, [esp]
mov edx, ebx
shl edx, 5
add edx, eax
movsx eax, byte [ecx + 1]
inc ecx
add ebx, edx
test eax, eax
jne 0x100317d0
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, ebx
div dword [ecx*4 + 0x23d9220]
mov eax, dword [ebp + 4]
lea ecx, [ebp + 0xc]
lea esi, [eax + edx*8]
mov eax, dword [esi]
cmp eax, ecx
jne 0x10031804
cmp eax, dword [esi + 4]
je 0x10031844
push ebx
push esi
call fcn.100314a0
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x10031840
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10031832
lea ecx, [esi + 4]
push ecx
call dword [0x23d60e0]
test eax, eax
jne 0x10031832
push esi
call fcn.10035f70
add esp, 4
mov edx, dword [esp + 0x1c]
pop ebx
pop edi
pop esi
mov dword [ebp + 0xc], edx
xor eax, eax
pop ebp
ret
mov ebp, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031850
sub eax, edx
add eax, 0x15
je 0x1003186c
push eax
call dword [0x240e3d8]
add esp, 4
test eax, eax
jne 0x10031874
pop ebx
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
mov ecx, dword [esp + 0x18]
mov dword [eax], ebx
lea ebx, [eax + 0x14]
mov dword [eax + 0x10], ecx
mov ecx, edi
sub ebx, edi
mov dl, byte [ecx]
mov byte [ebx + ecx], dl
inc ecx
test dl, dl
jne 0x10031884
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
add eax, 4
mov dword [eax + 4], eax
mov dword [eax], eax
mov ecx, dword [esi]
lea edx, [ebp + 0xc]
cmp ecx, edx
jne 0x100318c8
cmp ecx, dword [esi + 4]
jne 0x100318c8
mov dword [eax + 4], edx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx]
mov dword [ecx + 4], eax
pop ebx
mov dword [edx], eax
mov dword [esi + 4], eax
mov dword [esi], eax
inc dword [ebp]
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov dword [eax + 4], ecx
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx]
mov dword [edx + 4], eax
pop ebx
mov dword [ecx], eax
mov dword [esi], eax
inc dword [ebp]
pop edi
pop esi
xor eax, eax
pop ebp
ret

Function at 0x100318f0
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
push edi
mov edi, eax
movsx eax, byte [edi]
mov esi, ecx
mov edx, edi
mov ecx, 0x1505
test eax, eax
je 0x10031917
mov ebx, ecx
shl ebx, 5
add ebx, eax
movsx eax, byte [edx + 1]
inc edx
add ecx, ebx
test eax, eax
jne 0x10031905
mov ebx, dword [esi + 8]
xor edx, edx
mov eax, ecx
div dword [ebx*4 + 0x23d9220]
mov eax, dword [esi + 4]
add esi, 0xc
lea eax, [eax + edx*8]
mov edx, dword [eax]
cmp edx, esi
jne 0x10031939
cmp edx, dword [eax + 4]
je 0x10031947
push ecx
push eax
call fcn.100314a0
add esp, 8
test eax, eax
jne 0x1003194d
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebx
ret
Function at 0x10034e10
Capabilities:
Hash data using djb2

Disassembly:
test eax, eax
je 0x10034e25
cmp dword [eax], 0
jne 0x10034e25
lea ecx, [eax + 8]
mov eax, dword [esp + 4]
jmp fcn.100318f0
xor eax, eax
ret
Function at 0x10005d3f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
mov ebx, dword [edi + 4]
lea ecx, [ecx + eax + 0x18]
jbe 0x10005e00
lea esi, [ecx + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x10005da9
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
test eax, eax
mov dword [ebp - 8], eax
jle 0x10005deb
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10005e0a
mov eax, dword [esi - 4]
push dword [ebp - 8]
add eax, ebx
push eax
mov dword [esi - 8], eax
call fcn.10005c5a
pop ecx
pop ecx
jmp 0x10005deb
mov ecx, dword [esi + 4]
add ecx, eax
push ecx
call fcn.10005d23
test eax, eax
je 0x10005e0a
mov eax, dword [esi - 4]
push 4
push 0x1000
push dword [esi]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10005e0a
mov edi, dword [esi - 4]
mov ecx, dword [esi + 4]
add ecx, dword [ebp + 8]
mov edx, dword [esi]
add edi, ebx
mov eax, edi
call fcn.10005c78
mov dword [esi - 8], edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
movzx eax, word [eax + 6]
inc dword [ebp - 4]
add esi, 0x28
cmp dword [ebp - 4], eax
jl 0x10005d69
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x10005e03
Function at 0x1000677f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov ecx, dword [0x1008e184]
push ebx
mov edx, dword [0x1008e18c]
push ebp
push esi
mov esi, dword [0x1008e190]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov eax, ecx
shl eax, 2
push 4
pop ebp
sub ebp, eax
imul ebp, esi
mov eax, dword [0x1008e180]
mov ebx, edx
sub ebx, dword [0x1008e188]
sub ebx, ecx
lea ebx, [ebp + ebx*4 - 0xc]
lea ebp, [edx + esi - 2]
imul ebx, eax
imul ebp, esi
mov esi, edx
imul esi, esi, 3
add ebp, esi
add ebx, edi
sub ebp, ecx
lea ebx, [ebx + ebp*4]
lea esi, [ecx*4 - 4]
imul esi, dword [0x1008e188]
add esi, ebx
mov ebx, eax
imul ebx, eax
mov dword [esp + 0x1c], esi
lea esi, [eax + eax]
mov dword [esp + 0x10], esi
mov esi, dword [0x1008e188]
add ebx, esi
imul ebx, ebx, 5
add ebx, edi
mov dword [esp + 0x20], ebx
mov ebx, ecx
imul ebx, ebx, 3
mov ebp, edx
sub ebp, ebx
imul ebp, ebp, 5
add ebp, edi
mov dword [esp + 0x24], ebp
mov ebx, edx
imul ebx, ecx
mov ebp, edx
imul ebp, eax
inc ebx
inc ebx
imul ebx, esi
inc ebp
inc ebp
imul ebp, dword [0x1008e190]
sub ebp, ebx
lea ebx, [ecx + eax]
lea ebx, [ebp + ebx*2]
lea ebx, [edi + ebx*2]
mov dword [esp + 0x28], ebx
mov ebx, edx
imul ebx, edx
imul ebx, eax
mov ebp, esi
imul ebp, ecx
sub ebp, ebx
mov ebx, dword [0x1008e190]
lea ebp, [ecx + ebp + 2]
imul edx, ebx
imul ebp, ecx
add ebp, eax
add edx, ebp
add edx, edi
mov dword [esp + 0x30], edx
mov edx, esi
imul edx, eax
inc edx
imul edx, ebx
sub eax, edx
imul eax, ecx
mov ebp, eax
mov eax, esi
imul ebp, ebp, 3
imul eax, eax, 3
mov dword [esp + 0x34], eax
lea eax, [esi + 1]
imul eax, esi
inc ecx
imul ecx, ebx
add eax, ecx
mov ecx, dword [esp + 0x3c]
imul eax, eax, 6
add eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov esi, ecx
xor edx, edx
mov ebx, 0x572b
lea eax, [ecx + 1]
mov ecx, ebx
div ecx
mov eax, dword [esp + 0x1c]
mov ecx, edx
movzx eax, byte [eax + ecx]
add eax, esi
xor edx, edx
div ebx
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
add eax, edi
mov al, byte [eax + ecx]
mov esi, edx
mov edx, dword [esp + 0x20]
mov dl, byte [edx + esi]
mov byte [ebx + ecx], dl
mov edx, dword [esp + 0x28]
mov byte [edx + esi], al
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
add eax, edx
mov edx, dword [esp + 0x30]
movzx edx, byte [edx + ecx]
mov dword [esp + 0x18], eax
mov eax, esi
sub eax, dword [esp + 0x10]
mov ebx, 0x572b
movzx eax, byte [eax + edi]
add eax, edx
xor edx, edx
div ebx
mov eax, dword [esp + 0x18]
sub edx, dword [esp + 0x34]
add edx, ebp
mov dl, byte [edx + edi]
xor byte [eax], dl
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x22600
jb 0x100068a8
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x1000a30d
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x1004db39
call fcn.1003363e
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x3c], ebx
mov dword [ebp - 0x3c], edi
je 0x1000a42a
cmp byte [edi + 0x41], bl
je 0x1000a42a
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x1000a345
xor al, al
jmp 0x1000a42c
lea esi, [ebp - 0x30]
call fcn.10009ee8
lea eax, [edi + 0x44]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1c]
lea ebx, [ebp - 0x48]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.1000a088
mov esi, eax
call fcn.1000a471
add eax, dword [ebp - 0x34]
lea ebx, [ebp - 0x60]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.1000a088
mov esi, eax
call fcn.1000a471
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x38]
push esi
push dword [ebp - 0x34]
push eax
push dword [ebp - 0x40]
call dword [edx + 0x18]
xor ebx, ebx
sub eax, ebx
je 0x1000a3aa
dec eax
je 0x1000a3ad
dec eax
dec eax
jne 0x1000a416
mov bl, 1
jmp 0x1000a416
mov byte [edi + 0x41], bl
lea ebx, [ebp - 0x58]
lea esi, [ebp - 0x30]
call fcn.1000a088
mov esi, eax
call fcn.1000a471
mov ecx, dword [ebp - 0x38]
sub ecx, eax
mov dword [ebp - 0x34], ecx
je 0x1000a3f2
push dword [edi + 0x4c]
lea ebx, [ebp - 0x50]
push ecx
push 1
lea esi, [ebp - 0x30]
call fcn.1000a088
mov esi, eax
call fcn.1000a471
push eax
call fcn.10032871
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x1000a414
mov ecx, dword [ebp - 0x34]
cmp byte [edi + 0x41], 0
je 0x1000a3a6
test ecx, ecx
jne 0x1000a356
push ecx
push 8
pop ebx
lea edi, [ebp - 0x30]
call fcn.10009f20
mov edi, dword [ebp - 0x3c]
jmp 0x1000a356
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000a0ce
mov al, bl
jmp 0x1000a42c
mov al, 1
call fcn.100336c1
ret
Function at 0x100135da
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.100159ce
or ebx, 0xffffffff
push ebx
push 0x96
xor edi, edi
push edi
push 0x1005bb4c
lea esi, [ebp + 0xc8]
push edi
mov ecx, esi
call fcn.100144bc
push ebx
push 0x96
push edi
push 0x1005bb54
push 1
mov ecx, esi
call fcn.100144bc
push ebx
push 0x1e
push edi
push 0x1005bb64
lea esi, [ebp + 0x74]
push edi
mov ecx, esi
call fcn.100144bc
push ebx
push 0x64
push edi
push 0x10059678
push 1
mov ecx, esi
call fcn.100144bc
push ebx
push 0x50
push edi
push 0x10059680
push 2
mov ecx, esi
call fcn.100144bc
push ebx
push 0x50
push edi
push 0x1005968c
push 3
mov ecx, esi
call fcn.100144bc
push ebx
push 0x1e
push edi
push 0x10059694
push 4
mov ecx, esi
call fcn.100144bc
push ebx
push 0x50
push edi
push 0x1005969c
push 5
mov ecx, esi
call fcn.100144bc
push ebx
push 0x50
push edi
push 0x100596a8
push 6
mov ecx, esi
call fcn.100144bc
push ebx
push 0x50
push edi
push 0x100596b0
push 7
mov ecx, esi
call fcn.100144bc
push ebx
push 0x64
push edi
push 0x100596b8
push 8
mov ecx, esi
call fcn.100144bc
push ebx
push 0x50
push edi
push 0x100596c0
push 9
mov ecx, esi
call fcn.100144bc
push ebx
push 0x64
push edi
push 0x100596c8
push 0xa
mov ecx, esi
call fcn.100144bc
push ebx
push 0x28
push edi
push 0x100596d0
push 0xb
mov ecx, esi
call fcn.100144bc
push ebx
push 0x3c
push edi
push 0x100596d8
push 0xc
mov ecx, esi
call fcn.100144bc
push ebx
push 0x3c
push edi
push 0x100596e4
push 0xd
mov ecx, esi
call fcn.100144bc
push ebx
push 0x78
push edi
push 0x100596ec
push 0xe
mov ecx, esi
call fcn.100144bc
push ebx
push 0x3c
push edi
push 0x100596f8
push 0xf
mov ecx, esi
call fcn.100144bc
push ebx
push 0x3c
push edi
push 0x10059700
push 0x10
mov ecx, esi
call fcn.100144bc
push ebx
push 0x64
push edi
push 0x10059704
push 0x11
mov ecx, esi
call fcn.100144bc
push ebx
push 0x3c
push edi
push 0x10059710
push 0x12
mov ecx, esi
call fcn.100144bc
push ebx
push 0x78
push edi
push 0x10059718
push 0x13
mov ecx, esi
call fcn.100144bc
push ebx
push 0x96
push edi
push 0x10059724
push 0x14
mov ecx, esi
call fcn.100144bc
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x21
push edi
mov ebx, 0x1036
push ebx
push dword [ebp + 0x94]
call esi
push 0x21
push edi
push ebx
push dword [ebp + 0xe8]
call esi
push ebp
call fcn.100137c9
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret