joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52f978
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x55d2c8]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x52f9c3
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x539e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405d54
xor eax, eax
push ebp
push 0x539f2e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x539ef0
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405df8
mov ebx, eax
push ebx
push 0x539f3c
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
jg 0x539ee6
push 1
push 0
push ebx
push 0x539f48
push 0x539f3c
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x539f18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x539f35
lea eax, [ebp - 4]
call fcn.00405d5c
ret
Function at 0x53c76c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00405d54
xor eax, eax
push ebp
push 0x53c98a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00403680
mov esi, eax
lea eax, [ebp - 0x2d0]
xor ecx, ecx
mov edx, 0x2b4
call fcn.004035e4
cmp dword [ebp + 0x20], 0
je 0x53c827
cmp dword [ebp - 0x10], 0
je 0x53c827
mov eax, dword [ebp + 0x20]
call fcn.0040d648
test al, al
jne 0x53c7dd
mov eax, dword [ebp + 0x20]
call fcn.0040d690
test al, al
je 0x53c800
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405df8
push eax
call sub.shell32.dll_SHGetFileInfoW
jmp 0x53c821
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00405df8
push eax
call sub.shell32.dll_SHGetFileInfoW
mov esi, dword [ebp - 0x2cc]
cmp byte [ebp + 0x1c], 0
je 0x53c84e
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x53c99c
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
jmp 0x53c86d
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x53c99c
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.004088c8
test bl, bl
je 0x53c8b5
cmp byte [ebp + 0x14], 0
jne 0x53c8b5
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0043ab34
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 4]
call fcn.0053d26c
test byte [ebp + 0x14], bl
je 0x53c974
mov dl, 1
mov eax, dword [0x438144]
call fcn.0043ef84
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x53c96d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.0043f89c
call fcn.0043ab34
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2dc], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00403460
add eax, dword [ebp - 8]
mov dword [ebp - 0x2d8], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00403460
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x2e0]
mov eax, dword [ebp - 4]
call fcn.0053c68c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c974
mov eax, dword [ebp - 0x1c]
call fcn.00403d24
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c991
lea eax, [ebp + 0x20]
call fcn.00405d5c
ret
Function at 0x54dfcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x54e11f
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004033b4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040db64
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov ecx, 0x54e13c
call fcn.00406250
mov eax, dword [ebp - 8]
call fcn.0040d648
test al, al
je 0x54e09e
mov dl, 1
mov eax, dword [0x4dbb70]
call fcn.004ded0c
mov edi, eax
mov edx, dword [edi + 4]
lea eax, [ebp - 4]
mov ecx, 0x54e180
call fcn.00406250
push 0
push 0
push 0
push 0x54e1d0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x54e1e0
mov edx, 0x54e208
mov eax, dword [ebp - 4]
call fcn.00538614
mov eax, dword [ebp - 0x1c]
call fcn.00410080
fstp qword [ebp - 0x10]
wait
fld qword [ebp - 0x10]
fcomp dword [0x54e21c]
wait
fnstsw ax
sahf
je 0x54e097
call fcn.004105f0
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.0049db20
cmp eax, 0xa
jge 0x54e097
xor ebx, ebx
mov eax, edi
call fcn.00403d24
test bl, bl
je 0x54e0f7
call sub.kernel32.dll_GetTickCount_1
mov dword [esi + 0x3f0], eax
lea eax, [ebp - 0x20]
call fcn.004df77c
mov edx, dword [ebp - 0x20]
lea eax, [esi + 0x3ec]
mov ecx, 0x54e22c
call fcn.00406250
mov eax, dword [esi + 0x3ec]
call fcn.00405df8
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, dword [esi + 0x3ec]
push eax
mov ecx, 0x54e268
mov dl, 1
mov eax, dword [0x49cf0c]
call fcn.0049cf94
mov dword [esi + 0x3f4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54e126
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00405d64
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405d64
ret
Function at 0x5529fc
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x552a04
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x552c27
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x552bfa
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x3f4], 0
je 0x552bad
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3f4]
cmp byte [eax + 0x10], 0
je 0x552a53
mov bl, 1
jmp 0x552a7d
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 8]
sub eax, dword [edx + 0x3f0]
cmp eax, 0x1f40
jae 0x552a7d
push 0xa
call sub.kernel32.dll_Sleep_2
mov eax, dword [0x55e634]
mov eax, dword [eax]
call fcn.0049a8d4
jmp 0x552a40
test bl, bl
je 0x552bad
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ec]
call fcn.0040d648
test al, al
je 0x552bad
xor eax, eax
push ebp
push 0x552b0b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.004033b4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0040db64
lea eax, [ebp - 0xc]
mov edx, 0x552c44
call fcn.00406190
mov eax, dword [ebp - 0xc]
call fcn.0040d690
test al, al
jne 0x552b01
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.004033b4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040db64
lea eax, [ebp - 0x14]
mov edx, 0x552c44
call fcn.00406190
mov eax, dword [ebp - 0x14]
call fcn.0040d6b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x552b15
push 0
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004033b4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040db64
lea eax, [ebp - 0x1c]
mov edx, 0x552c64
call fcn.00406190
mov eax, dword [ebp - 0x1c]
call fcn.00405df8
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ec]
call fcn.00405df8
push eax
call sub.kernel32.dll_CopyFileW
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ec]
call fcn.00405df8
push eax
call sub.kernel32.dll_DeleteFileW
mov dl, 1
mov eax, dword [0x4dbb70]
call fcn.004ded0c
mov ebx, eax
mov edx, dword [ebx + 4]
lea eax, [ebp - 4]
mov ecx, 0x552ca8
call fcn.00406250
call fcn.004105f0
add esp, 0xfffffff8
fstp qword [esp]
wait
mov ecx, 0x552cf8
mov edx, 0x552d20
mov eax, dword [ebp - 4]
call fcn.0054d60c
mov eax, ebx
call fcn.00403d24
lea eax, [ebp - 0x24]
call fcn.004df77c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
add eax, 0x3ec
mov ecx, 0x552d40
call fcn.00406250
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ec]
call fcn.0040d648
test al, al
je 0x552bf0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3ec]
call fcn.00405df8
push eax
call sub.kernel32.dll_DeleteFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x552c04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552c2e
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00405d64
lea eax, [ebp - 4]
call fcn.00405d5c
ret
Function at 0x5ea1d6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
cmp eax, 0x7f
mov ebp, esp
push edi
push esi
push ebx
push ebx
mov dword [ebp - 0x10], edx
jg 0x5ea1f3
lea ecx, [eax - 0x41]
lea edx, [eax + 0x20]
cmp ecx, 0x19
jmp 0x5ea277
cmp eax, 0xffff
jg 0x5ea26b
or ebx, 0xffffffff
xor esi, esi
mov edi, 0xa2
lea ecx, [esi + edi]
sar ecx, 1
movzx edx, word [ecx*4 + 0x61ea0ac0]
cmp eax, edx
js 0x5ea21c
lea esi, [ecx + 1]
mov ebx, ecx
jmp 0x5ea21f
lea edi, [ecx - 1]
cmp esi, edi
jle 0x5ea204
movzx esi, word [ebx*4 + 0x61ea0ac0]
movzx ecx, byte [ebx*4 + 0x61ea0ac3]
add ecx, esi
cmp eax, ecx
jge 0x5ea25b
mov cl, byte [ebx*4 + 0x61ea0ac2]
xor esi, eax
mov ebx, ecx
and ebx, 1
test ebx, esi
jne 0x5ea25b
shr cl, 1
movzx ecx, cl
add ax, word [ecx + ecx + 0x61ea0640]
movzx eax, ax
cmp dword [ebp - 0x10], 0
je 0x5ea27a
pop ecx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.005e3fce
lea ecx, [eax - 0x10400]
lea edx, [eax + 0x28]
cmp ecx, 0x27
cmovbe eax, edx
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100011d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100011e9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001224
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10001220
lea ebx, [ebx]
cmp esi, eax
jae 0x10001224
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001210
cmp esi, eax
jb 0x1000122a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10001400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.1000a371
Function at 0x10002820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
test esi, esi
push ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 8], 0
jne 0x1000283b
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x78]
mov eax, dword [ecx + esi + 0x1c]
mov edx, dword [ecx + esi + 0x24]
add ecx, esi
push edi
mov edi, dword [ecx + 0x20]
add eax, esi
add edx, esi
add edi, esi
test ebp, 0xffff0000
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
jne 0x1000287e
and ebp, 0xffff
sub ebp, dword [ecx + 0x10]
pop edi
mov eax, dword [eax + ebp*4]
add eax, esi
mov dword [esp + 8], eax
pop ebp
add esp, 0xc
ret
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x100028e5
push ebx
mov ecx, dword [edi]
sub eax, 1
mov edx, ebp
add ecx, esi
nop
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x100028b0
test bl, bl
je 0x100028ac
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x100028b0
add ecx, 2
add edx, 2
test bl, bl
jne 0x10002890
xor ecx, ecx
jmp 0x100028b5
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x100028d0
add dword [esp + 0xc], 2
add edi, 4
test eax, eax
jne 0x10002886
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
mov ecx, dword [esp + 0xc]
movzx edx, word [ecx]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + edx*4]
add eax, esi
mov dword [esp + 0x10], eax
pop ebx
mov eax, dword [esp + 0xc]
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x10002fb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
mov ecx, dword [0x1009748c]
mov edx, dword [0x1009749c]
mov eax, edx
imul eax, ecx
push ebx
push ebp
push esi
mov esi, dword [0x10097494]
push edi
lea edi, [esi + esi]
mov ebp, edi
mov edi, dword [0x10097498]
sub ebp, eax
sub ebp, ecx
add ebp, edx
mov edx, dword [esp + 0x44]
add ebp, edi
add ebp, edx
mov dword [esp + 0x30], ebp
mov ebp, dword [0x10097490]
mov edx, ebp
imul edx, esi
mov dword [esp + 0x2c], edx
sub edx, esi
sub edx, ecx
add edx, eax
add edx, ebp
mov ebp, dword [esp + 0x44]
add edx, edi
add edx, ebp
mov dword [esp + 0x34], edx
mov edx, esi
imul edx, dword [0x1009749c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
add eax, 0xffffffff
imul eax, dword [0x1009749c]
mov edx, edi
imul edx, ecx
add eax, 2
imul eax, dword [0x10097490]
mov ebp, 1
sub ebp, edx
mov edx, dword [esp + 0x44]
imul ebp, esi
add ebp, dword [esp + 0x14]
xor ebx, ebx
add eax, ebp
add eax, edi
add eax, edx
mov dword [esp + 0x38], eax
mov eax, dword [0x10097490]
imul eax, edi
lea ebp, [eax + 1]
imul ebp, edi
mov edx, esi
imul edx, esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov eax, dword [0x1009749c]
imul edx, eax
add ebp, 3
imul ebp, ecx
sub edx, ebp
mov ebp, dword [esp + 0x1c]
sub edx, esi
sub edx, eax
add edx, dword [esp + 0x24]
mov eax, dword [esp + 0x44]
add edx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
add edx, edi
add edx, eax
mov eax, dword [0x10097490]
mov dword [esp + 0x28], edx
imul eax, eax
mov edx, 4
sub edx, ecx
imul edx, edi
imul ebp, ecx
mov dword [esp + 0x20], ebx
sub edx, ebp
lea ebp, [ecx - 2]
imul ebp, esi
add edx, ebp
mov ebp, dword [0x1009749c]
add ebp, ebp
sub edx, ebp
sub edx, dword [0x10097490]
mov ebp, dword [esp + 0x44]
add edx, eax
add edx, dword [esp + 0x14]
add edx, ebp
mov ebp, ecx
imul ebp, ecx
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x2c]
sub edx, ebp
mov ebp, dword [esp + 0x44]
add edx, ebp
mov dword [esp + 0x2c], edx
mov edx, dword [0x10097490]
imul eax, edx
mov dword [esp + 0x14], eax
lea eax, [edi - 2]
imul eax, ecx
sub eax, edx
mov edx, dword [esp + 0x48]
add eax, edx
mov dword [esp + 0x3c], eax
jmp 0x10003120
xor edx, edx
lea eax, [ebx + 1]
mov ebx, 0x628f
div ebx
mov eax, dword [esp + 0x30]
mov ebp, 0x628f
mov ebx, edx
movzx eax, byte [eax + ebx]
add eax, dword [esp + 0x18]
xor edx, edx
div ebp
mov ebp, edx
mov edx, dword [esp + 0x34]
mov al, byte [edx + ebx]
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x38]
movzx edx, byte [eax + ebp]
mov byte [eax + ebx], dl
movzx edx, byte [esp + 0x13]
mov eax, dword [esp + 0x28]
mov byte [eax + ebp], dl
mov eax, dword [esp + 0x2c]
movzx eax, byte [eax + ebx]
mov edx, dword [esp + 0x24]
movzx edx, byte [edx + ebp]
add eax, edx
xor edx, edx
mov dword [esp + 0x18], ebp
mov ebp, 0x628f
div ebp
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0x20]
add ebp, 1
mov dword [esp + 0x20], ebp
sub edx, dword [esp + 0x14]
sub edx, dword [esp + 0x1c]
sub edx, edi
sub edx, ecx
add edx, esi
movzx edx, byte [edx + eax]
mov eax, dword [esp + 0x3c]
xor byte [eax + ebp - 1], dl
cmp ebp, 0x23800
jb 0x10003120
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x10004770
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100567c8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
mov eax, dword [0x10072650]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x2c]
cmp eax, 1
je 0x100047bf
mov ecx, dword [esp + 0x30]
push ecx
push eax
mov ecx, esi
call fcn.10016f7c
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8
push 0
lea ecx, [esp + 0xc]
call fcn.10009002
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0
call fcn.10008722
mov eax, dword [esp + 0x30]
mov edx, dword [esi]
mov edx, dword [edx + 0x54]
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call edx
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.10009056
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x20
ret 8

Function at 0x10006690
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100571d0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10072650]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x1009a348]
add eax, 0xfffffff0
push eax
call fcn.10006fb0
add eax, 0x10
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.10006620
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x14]
add esp, 8
push ecx
lea edi, [esp + 0x30]
call fcn.10006230
mov ecx, dword [esp + 0x20]
push eax
mov byte [esp + 0x1c], 1
call fcn.10006e40
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000672b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000674f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x10
Function at 0x10006770
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100571a0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10072650]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x1009a344]
add eax, 0xfffffff0
push eax
call fcn.10006fb0
add eax, 0x10
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.10006620
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x14]
add esp, 8
push ecx
lea edi, [esp + 0x30]
call fcn.10006230
mov ecx, dword [esp + 0x20]
push eax
mov byte [esp + 0x1c], 1
call fcn.10006e40
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000680b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000682f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x10

Function at 0x1000a2e2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.1000ab19
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1000a319
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.10009f04
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1000a371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x1000a391
cmp dword [edi + 0x54], 0
jne 0x1000a391
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.1000ab19
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1000a338
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8