joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100868f0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101e956b
push eax
mov dword fs:[0], esp
sub esp, 0x65c
mov ecx, 0x1027b8c8
push ebx
push ebp
push esi
push edi
push str.PATH
push 0x1027b8cc
call fcn.100866c0
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x10086941
push ebp
call fcn.10041fde
add esp, 4
test eax, eax
jne 0x10086984
push ebp
call fcn.101d42fd
add esp, 4
push 0x102592d0
call fcn.10041fde
inc eax
lea esi, [eax + eax]
push esi
call fcn.101d42d4
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x10086ac8
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x102592d0
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call fcn.10041fb9
add esp, 8
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x264]
push eax
push str.oadbg_
push str._s_s_
push ecx
call fcn.1004244f
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x476]
mov word [esp + 0x474], bx
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x264]
stosw word es:[edi], ax
push edx
push ebp
lea eax, [esp + 0x46c]
push str._s_s
push eax
call fcn.1004244f
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10086abf
mov esi, dword [esp + 0x680]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x40]
push 0x10240a2c
push eax
call edi
test eax, eax
je 0x10086aa8
lea ecx, [esp + 0x40]
push 0x10240a28
push ecx
call edi
test eax, eax
je 0x10086aa8
test byte [esp + 0x14], 0x10
jne 0x10086aa8
lea edx, [esp + 0x40]
lea ecx, [esp + 0x10]
push edx
call fcn.101d3c7f
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x67c], 0
call fcn.101d2302
lea ecx, [esp + 0x10]
mov dword [esp + 0x674], 0xffffffff
call fcn.101d3c0b
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10086a44
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call fcn.101d42fd
add esp, 4
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x668
ret 8
Function at 0x10087120
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x101e964f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x10253adc]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea ebp, [esi + 0x18]
mov dword [ebp], eax
xor ebx, ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x1c], ebx
call fcn.101d2c61
lea edi, [esi + 0x30]
push ebx
mov ecx, edi
mov byte [esp + 0x20], 1
call fcn.1003e0dd
mov dword [edi], 0x101faaa4
add edi, 8
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 0x50]
mov byte [esp + 0x1c], 2
call fcn.101d2c61
lea edi, [esi + 0x64]
push ebx
mov ecx, edi
mov byte [esp + 0x20], 3
call fcn.1003e0dd
mov dword [edi], 0x101faaa4
add edi, 8
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [esi + 0x84]
mov byte [esp + 0x1c], 4
call fcn.1008a4f0
lea ecx, [esi + 0x128]
mov byte [esp + 0x1c], 5
call fcn.1008b2c0
lea ecx, [esi + 0x15c]
mov byte [esp + 0x1c], 6
call fcn.10083a80
mov ecx, dword [0x10253adc]
mov dword [esi + 0x190], ecx
mov edx, dword [esp + 0x24]
mov ecx, ebp
push edx
mov byte [esp + 0x20], 8
mov dword [esi], 0x101fe0ec
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 1
call fcn.101d3da2
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x194], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10087250
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x101e96d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x101fe0ec
mov ecx, dword [esi + 0x194]
xor ebp, ebp
cmp ecx, ebp
mov dword [esp + 0x28], 8
je 0x100872a7
call fcn.1017b850
mov ecx, dword [esi + 0x194]
cmp ecx, ebp
je 0x100872a1
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x194], ebp
lea ebx, [esi + 0x84]
mov ecx, ebx
call fcn.1008a6b0
lea ecx, [esi + 0x128]
call fcn.1008b390
lea ecx, [esi + 0x15c]
call fcn.10084180
lea edi, [esi + 0x64]
push 1
push edi
lea ecx, [esp + 0x1c]
call fcn.1003e2c4
mov eax, dword [esi + 0x58]
mov byte [esp + 0x28], 9
test eax, eax
jle 0x100872fd
mov ecx, dword [esi + 0x54]
mov ecx, dword [ecx + ebp*4]
test ecx, ecx
je 0x100872f5
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, dword [esi + 0x58]
inc ebp
cmp ebp, eax
jl 0x100872e5
lea ebp, [esi + 0x50]
push 0xffffffffffffffff
push 0
mov ecx, ebp
call fcn.101d2cc1
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 8
call fcn.1003e300
lea ecx, [esi + 0x190]
mov byte [esp + 0x28], 7
call fcn.101d3c0b
lea ecx, [esi + 0x15c]
mov byte [esp + 0x28], 6
call fcn.10083c20
lea ecx, [esi + 0x128]
mov byte [esp + 0x28], 5
call fcn.1008b300
mov ecx, ebx
mov byte [esp + 0x28], 4
call fcn.1008a5a0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [edi + 8]
push eax
mov byte [esp + 0x2c], 3
mov dword [edi], 0x101faaa4
call ebx
mov ecx, edi
call fcn.1003e108
mov ecx, ebp
mov byte [esp + 0x28], 2
call fcn.101d2c94
lea edi, [esi + 0x30]
mov byte [esp + 0x28], 1
lea ecx, [edi + 8]
mov dword [edi], 0x101faaa4
push ecx
call ebx
mov ecx, edi
call fcn.1003e108
lea ecx, [esi + 0x1c]
mov byte [esp + 0x28], 0
call fcn.101d2c94
lea ecx, [esi + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.101d3c0b
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x10087f40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e9788
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push edi
mov edi, ecx
push 1
lea ecx, [esp + 0x18]
lea eax, [edi + 0x30]
push eax
call fcn.1003e2c4
mov eax, dword [edi + 0x24]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0xc], ebx
jle 0x1008801d
push ebp
push esi
mov ecx, dword [edi + 0x20]
mov ebp, dword [ecx + ebx*4]
mov dword [esp + 0x10], ebp
mov edx, dword [ebp + 4]
mov eax, dword [edx - 8]
test eax, eax
je 0x1008800b
lea esi, [edi + 0x15c]
push 0xffffffffffffffff
mov ecx, esi
call fcn.100843b0
test eax, eax
je 0x1008800b
mov eax, dword [ebp + 4]
push 0
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.10084400
mov ebx, eax
test ebx, ebx
je 0x10087ff4
cmp dword [ebx], 0x4d465631
jne 0x10087ff4
mov eax, dword [ebx + 8]
xor esi, esi
test eax, eax
jle 0x10087ff4
lea ebp, [ebx + 0x10]
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.10051960
add esp, 8
test eax, eax
je 0x1008803f
mov eax, dword [ebx + 8]
inc esi
add ebp, 0x58
cmp esi, eax
jl 0x10087fd3
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, edi
call fcn.10087d00
lea ecx, [edi + 0x15c]
call fcn.100843e0
mov ebx, dword [esp + 0x14]
mov eax, dword [edi + 0x24]
inc ebx
cmp ebx, eax
mov dword [esp + 0x14], ebx
jl 0x10087f82
pop esi
pop ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.1003e300
mov ecx, dword [esp + 0x20]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
lea edx, [esi + esi*4]
lea eax, [esi + edx*2]
lea esi, [ebx + eax*8 + 0x10]
test esi, esi
je 0x10087ff0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
push ebx
call fcn.100aa010
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
mov ecx, dword [edi + 0x10]
xor edx, edx
mov dword [esi + 0x48], ecx
mov dx, word [edi + 0xa8]
add esp, 4
lea ecx, [edi + 0x128]
mov dword [esi + 0x4c], edx
call fcn.1008b610
push 0
lea ecx, [edi + 0x15c]
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], 0
call fcn.10084400
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
jmp 0x10087ffc
Function at 0x100891d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x101e99c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
lea ebx, [esi + 0x34]
mov dword [esi], 0x101fe138
mov dword [ebx], 0x101fe11c
mov dword [esp + 0x2c], 6
call dword [0x101fe14c]
lea ebp, [esi + 0x58]
push 1
push ebp
lea ecx, [esp + 0x20]
call fcn.1003e2c4
mov eax, dword [esi + 0x48]
mov byte [esp + 0x2c], 7
test eax, eax
jle 0x1008924e
lea ecx, [esi + 0x3c]
call fcn.101d2b1d
mov edi, eax
test edi, edi
je 0x10089247
mov ecx, edi
call fcn.10089fb0
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov eax, dword [esi + 0x48]
test eax, eax
jg 0x1008922a
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 6
call fcn.1003e300
mov eax, esi
mov ecx, dword [esi + 0xd0]
neg eax
sbb eax, eax
and eax, ebx
push eax
call fcn.10088730
lea ecx, [esi + 0xac]
mov byte [esp + 0x2c], 5
call fcn.101d2c94
lea edi, [esi + 0x8c]
mov byte [esp + 0x2c], 4
lea ecx, [edi + 8]
mov dword [edi], 0x101faaa4
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, edi
call fcn.1003e108
lea ecx, [esi + 0x78]
mov byte [esp + 0x2c], 3
call fcn.101d2c94
lea edx, [ebp + 8]
mov byte [esp + 0x2c], 2
push edx
mov dword [ebp], 0x101faaa4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, ebp
call fcn.1003e108
lea ecx, [esi + 0x3c]
mov byte [esp + 0x2c], 1
call fcn.101d29e7
mov ecx, esi
mov byte [esp + 0x2c], 0
neg ecx
sbb ecx, ecx
and ecx, ebx
call fcn.10089a80
mov ecx, esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.1008c4a0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x10089d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e9b3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x101fe184
mov eax, dword [esi + 0x38]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x14], 2
je 0x10089d74
push eax
call fcn.101d42fd
add esp, 4
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x30]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [esp + 0x14], 1
call fcn.10091c30
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], bl
call fcn.10091c30
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.1008c630
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1008aa80
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x101e9c88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
push edi
mov edi, ecx
push 1
lea ecx, [esp + 0x18]
lea eax, [edi + 0x80]
push eax
call fcn.1003e2c4
mov eax, dword [esp + 0x30]
xor ebp, ebp
cmp eax, ebp
mov eax, dword [edi + 0x70]
mov dword [esp + 0x28], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], ebp
je 0x1008ab79
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x1008ab00
lea esi, [edi + 0x64]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.101d3900
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x14]
cmp dword [esp + 0x30], ebp
jne 0x1008aadb
mov eax, dword [edi + 0x70]
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x1008ab6f
push ebx
lea ebx, [edi + 0x64]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, ebx
call fcn.101d3900
mov esi, dword [esp + 0x10]
mov ecx, dword [esi + 0x28]
cmp ecx, ebp
je 0x1008ab39
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, esi
mov dword [esi + 0x24], ebp
call fcn.1006c9b0
mov ecx, dword [esp + 0x10]
call fcn.1006ca60
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
je 0x1008ab5a
mov edx, dword [ecx]
push 1
call dword [edx]
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
je 0x1008ab68
mov eax, dword [ecx]
push 1
call dword [eax]
cmp dword [esp + 0x34], ebp
jne 0x1008ab13
pop ebx
lea ecx, [edi + 0x64]
call fcn.101d372d
jmp 0x1008abf1
neg eax
sbb eax, eax
cmp eax, ebp
mov dword [esp + 0x30], eax
je 0x1008abf1
lea esi, [edi + 0x64]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.101d3900
mov ecx, dword [esp + 0xc]
call fcn.1006cae0
test eax, eax
jne 0x1008abeb
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0x20], ebp
jne 0x1008abeb
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x1008abd1
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ecx, ebp
je 0x1008abe3
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.101d38be
cmp dword [esp + 0x30], ebp
jne 0x1008ab88
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call fcn.1003e300
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x1008ae50
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x101e9d08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x20]
mov dword [esp + 0x10], edi
cmp eax, edi
jne 0x1008ae82
xor eax, eax
jmp 0x1008af46
lea eax, [esi + 0x80]
push 1
push eax
lea ecx, [esp + 0x2c]
call fcn.1003e2c4
mov eax, dword [esi + 0x70]
mov ebx, dword [esp + 0x40]
neg eax
sbb eax, eax
mov dword [esp + 0x38], edi
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x1008aef9
lea ebp, [esi + 0x64]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, ebp
mov dword [esp + 0x4c], edi
call fcn.101d3900
mov ecx, dword [esp + 0x40]
cmp dword [ecx + 0x24], edi
je 0x1008aef3
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], edi
mov edx, dword [ecx]
lea eax, [esp + 0x24]
push eax
call dword [edx + 0x1c]
cmp bx, word [esp + 0x14]
je 0x1008af5b
cmp dword [esp + 0x18], edi
jne 0x1008aeae
push ebx
mov ecx, esi
call fcn.1008ad80
cmp eax, edi
mov dword [esp + 0x10], eax
je 0x1008af31
lea edx, [esp + 0x1c]
lea ecx, [esi + 0x64]
push edx
push eax
mov dword [esp + 0x24], edi
call fcn.101d384c
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x1008af2d
add eax, 0x20
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x10]
mov esi, eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.1003e300
mov eax, esi
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov ecx, dword [esp + 0x40]
add ecx, 0x20
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [esp + 0x10]
jmp 0x1008af33
Function at 0x1008b420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101e9d78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x10253adc]
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esi + 0x30]
push str.ListenWnd
lea edx, [esp + 0x10]
mov dword [esp + 0x4c], 0
mov eax, dword [ecx + 0x18]
push eax
push 0x10246544
push edx
call fcn.101d13e5
mov eax, dword [0x10253adc]
add esp, 0x10
mov dword [esp + 8], eax
mov ecx, dword [esi + 0x30]
mov edx, dword [esp + 0x54]
push edx
push str.ListenWnd
mov eax, dword [ecx + 0x18]
mov byte [esp + 0x50], 1
push eax
lea eax, [esp + 0x14]
push str._s__s__08x
push eax
call fcn.101d13e5
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add esp, 0x14
push ecx
push edx
call dword [sym.imp.USER32.dll_FindWindowW]
lea ecx, [esp + 8]
mov edi, eax
mov byte [esp + 0x48], 0
call fcn.101d3c0b
lea ecx, [esp + 0xc]
mov dword [esp + 0x48], 0xffffffff
call fcn.101d3c0b
test edi, edi
jne 0x1008b4e6
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret 8
push ebp
xor ebp, ebp
push ebp
lea ecx, [esp + 0x28]
call fcn.1008bb10
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x50], 2
mov eax, dword [ecx]
call dword [eax + 0xc]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x18], ebp
call fcn.1008bbb0
test eax, eax
je 0x1008b55b
mov edx, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0x12345678
mov dword [esp + 0x20], ecx
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], edx
call fcn.1008bbb0
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
push ecx
push 0x4a
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
xor edx, edx
lea ecx, [esp + 0x24]
test ebp, ebp
setne dl
mov esi, edx
mov dword [esp + 0x4c], 0xffffffff
call fcn.1008bb60
mov ecx, dword [esp + 0x44]
pop ebp
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret 8

Function at 0x10095680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x100956ce
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100956ce
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x100956d3
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x100956b9
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x100956e3
test esi, esi
jne 0x10095701
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x100956ff
mov byte [eax + esi - 1], 0
jne 0x10095708
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret
Function at 0x1009adf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1009ae40
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1009ae40
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x1009ae45
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x1009ae2b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x1009ae52
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x100a6930
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x100a697b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x100a697b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.101d42d4
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.101d42d4
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x100a69c0
test esi, esi
je 0x100a69d1
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x100a69cd
push esi
call fcn.101d42fd
add esp, 4
test ebx, ebx
jne 0x100a69e0
mov edi, dword [edi]
test edi, edi
je 0x100a69e0
push edi
call fcn.101d42fd
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret

Function at 0x100a7e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x100a7e7b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
mov esi, edi
not eax
jb 0x100a7f7d
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x101fe2b0]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101fe2b0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101fe2b0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101fe2b0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101fe2b0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x101fe2b0]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x101fe2b0]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x101fe2b0]
xor eax, edx
inc ecx
dec edi
jne 0x100a7e96
test esi, esi
je 0x100a7f9f
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x101fe2b0]
xor eax, edx
inc ecx
dec esi
jne 0x100a7f81
pop edi
pop esi
not eax
pop ebx
ret