joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b1e90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, edx
mov dword [ebp - 4], edi
cmp ebx, 0xffffffff
jle 0x100b1fb5
mov eax, dword [esi + 0x180]
test al, 2
je 0x100b1fb5
test al, 4
je 0x100b1efa
push 0x11
call ecx
bt ax, 0xf
jae 0x100b1eee
mov eax, dword [esi + 0x114]
mov edx, ebx
mov ecx, dword [eax + ebx*4]
cmp byte [ecx + 0x20], 0
sete al
mov byte [ecx + 0x20], al
mov ecx, esi
call fcn.100ae630
jmp 0x100b1faf
mov eax, dword [esi + 0x180]
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 8
je 0x100b1f65
push 0x10
call ecx
bt ax, 0xf
jae 0x100b1f65
mov edi, dword [esi + 0x118]
xor edx, edx
test edi, edi
jle 0x100b1f3f
xor ecx, ecx
mov eax, edi
test edi, edi
jle 0x100b1f38
nop dword [eax]
mov eax, dword [esi + 0x114]
inc ecx
mov eax, dword [eax + edx*4]
mov byte [eax + 0x20], 0
mov eax, dword [esi + 0x118]
cmp ecx, eax
jl 0x100b1f20
inc edx
mov edi, eax
cmp edx, eax
jl 0x100b1f15
mov edx, dword [esi + 0x1b8]
cmp ebx, edx
jge 0x100b1f4d
mov ecx, ebx
jmp 0x100b1f51
mov ecx, edx
mov edx, ebx
mov eax, dword [esi + 0x114]
mov eax, dword [eax + ecx*4]
inc ecx
mov byte [eax + 0x20], 1
cmp ecx, edx
jle 0x100b1f51
jmp 0x100b1fac
mov edi, dword [esi + 0x118]
xor edx, edx
mov dword [esi + 0x1b8], ebx
test edi, edi
jle 0x100b1f9f
xor ecx, ecx
mov eax, edi
test edi, edi
jle 0x100b1f98
nop
mov eax, dword [esi + 0x114]
inc ecx
mov eax, dword [eax + edx*4]
mov byte [eax + 0x20], 0
mov eax, dword [esi + 0x118]
cmp ecx, eax
jl 0x100b1f80
inc edx
mov edi, eax
cmp edx, eax
jl 0x100b1f77
mov eax, dword [esi + 0x114]
mov eax, dword [eax + ebx*4]
mov byte [eax + 0x20], 1
mov edi, dword [ebp - 4]
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov eax, dword [esi + 0x180]
test al, 0x10
je 0x100b207f
test al, 4
je 0x100b1fd7
push 0x11
call ecx
bt ax, 0xf
mov eax, 2
jb 0x100b1fdc
mov eax, 1
mov dword [esi + 0x1a4], eax
push dword [esi + 0x28]
mov dword [0x10177418], esi
call dword [sym.imp.USER32.dll_SetCapture]
mov edx, dword [esi + 0x1c8]
mov eax, dword [esi + 0x190]
push 0xffffffffffffffff
push 0xffffffffffffffff
sub edi, dword [edx]
mov dword [esi + 0x1a8], edi
mov ecx, dword [eax + 4]
sub ecx, dword [edx + 4]
mov eax, dword [ebp + 8]
push 0
add eax, ecx
mov dword [esi + 0x1b0], edi
push 0
push esi
mov dword [esi + 0x1ac], eax
mov dword [esi + 0x1b4], eax
mov dword [esi + 0x19c], 0xffffffff
mov dword [esi + 0x1a0], 0xffffffff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
cmp dword [esi + 0x2c], 1
jl 0x100b207f
cmp byte [esi + 0xe1], 0
jne 0x100b207f
cmp dword [esi + 0xd0], 0
jle 0x100b206b
inc dword [esi + 0xcc]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or dword [esi + 0xbc], 1
push 1
push 0x10177450
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b2af0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edx, edx
jne 0x100b2b0f
xorps xmm0, xmm0
movups xmmword [edi], xmm0
push edx
xorps xmm0, xmm0
mov dword [ebp - 0x70], 0
mov edx, ecx
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x68], 0x67452301
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
call fcn.100b20d0
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x70]
call fcn.100b2190
xorps xmm0, xmm0
xor esi, esi
movups xmmword [edi], xmm0
movups xmmword [edi + 0x10], xmm0
mov byte [edi + 0x20], 0
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0x14]
push eax
push str._02x
push edi
call fcn.100b2090
inc esi
add esp, 0xc
add edi, 4
cmp esi, 0x10
jl 0x100b2b70
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1012d671
mov esp, ebp
pop ebp
ret 8
Function at 0x100c5ae0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x10177778]
test eax, eax
je 0x100c5b78
push esi
mov esi, dword [eax + 0x168]
mov dword [eax + 0x178], 0xc4653601
mov dword [eax + 0x17c], 0
test esi, esi
je 0x100c5b5a
cmp byte [esi + 0xc], 0
jne 0x100c5b50
mov ecx, dword [esi + 4]
mov byte [esi + 0xc], 1
test ecx, ecx
je 0x100c5b50
push 0x3a98
push 0x3a98
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10177778]
mov dword [eax + 0x168], 0
mov eax, dword [eax + 0x28]
pop esi
test eax, eax
je 0x100c5b78
push 0x93
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
ret

Function at 0x100c5b80
Capabilities:
Create thread

Disassembly:
mov edx, dword [0x10177778]
test edx, edx
je 0x100c5c4c
cmp dword [edx + 0x178], 0xc4653601
je 0x100c5c4c
mov eax, dword [edx + 0x17c]
test eax, eax
je 0x100c5c4c
test ecx, ecx
je 0x100c5c4c
mov eax, dword [eax + 0x28]
cmp eax, dword [ecx + 0x28]
je 0x100c5c4c
push esi
mov esi, dword [edx + 0x168]
mov dword [edx + 0x178], 0xc4653601
mov dword [edx + 0x17c], 0
test esi, esi
je 0x100c5c2e
cmp byte [esi + 0xc], 0
jne 0x100c5c24
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 1
test eax, eax
je 0x100c5c24
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x10177778]
mov dword [edx + 0x168], 0
mov eax, dword [edx + 0x28]
pop esi
test eax, eax
je 0x100c5c4c
push 0x93
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
ret
Function at 0x100d3a30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100d3bfe
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 0xffffffff
jge 0x100d3aa5
mov edi, dword [esi + 0x190]
test edi, edi
je 0x100d3bfe
cmp byte [edi + 0xc], 0
jne 0x100d3a95
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100d3a95
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x180]
movzx ecx, ax
test eax, eax
jne 0x100d3b28
mov edi, dword [esi + 0x190]
test edi, edi
je 0x100d3b04
cmp byte [edi + 0xc], al
jne 0x100d3afa
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100d3afa
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x18c], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x18c]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x18c], eax
cmp eax, 0xfe
jle 0x100d3bb7
mov edi, dword [esi + 0x190]
mov dword [esi + 0x18c], 0xff
test edi, edi
je 0x100d3b9d
cmp byte [edi + 0xc], 0
jne 0x100d3b93
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100d3b93
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x190], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x190], 0
jne 0x100d3bfe
movsx eax, word [esi + 0x182]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.100d3a30
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x190], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100d7400
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xd
push eax
mov eax, dword [ebp + 8]
push eax
push 0x3fa
mov dword [ebp - 4], 0
push dword [eax + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esp, ebp
pop ebp
ret 4
Function at 0x100f0300
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jge 0x100f030f
xor eax, eax
pop ebp
ret 0x28
push esi
push 0x2c
call fcn.1012d684
push 0x2c
mov esi, eax
push 0
push esi
call fcn.1012f3e0
add esp, 0x10
cmp dword [ebp + 0x20], 0xffffffff
jne 0x100f0343
mov ecx, dword [ebp + 0x24]
mov eax, dword [ecx]
mov dword [eax], esi
mov eax, dword [ecx + 4]
mov dword [ebp + 0x20], eax
mov eax, dword [ecx + 8]
mov dword [esi], eax
mov eax, dword [ecx + 0xc]
jmp 0x100f0346
mov eax, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x24], eax
push edi
test ebx, ebx
jns 0x100f0359
mov ebx, 0x19
jmp 0x100f0363
mov eax, 1
cmp ebx, eax
cmovl ebx, eax
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jns 0x100f0384
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x3e8
xor edi, edx
sub edi, edx
cdq
idiv ebx
mov ecx, eax
mov eax, edi
cdq
idiv ecx
mov ecx, eax
mov edx, dword [ebp + 8]
cmp ecx, 1
mov eax, 0xa
mov dword [esi + 8], ebx
cmovl ecx, eax
mov dword [esi + 0x14], edx
cmp dword [ebp + 0x2c], 0
mov dword [esi + 4], ecx
setne al
cmp dword [ebp + 0x28], 0
mov byte [esi + 0x21], al
mov eax, dword [ebp + 0x20]
setne cl
mov dword [esi + 0x1c], eax
xor ebx, ebx
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x10], eax
mov eax, edx
mov byte [esi + 0x28], cl
mov ecx, 0x10
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.1012d6c2
push ebx
mov edi, eax
push 0
push edi
call fcn.1012f3e0
xor edx, edx
mov dword [esi + 0x18], edi
add esp, 0x10
cmp dword [esi + 0x14], edx
jle 0x100f0417
mov edi, dword [ebp + 0x14]
xor ecx, ecx
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x18]
lea ecx, [ecx + 0x10]
inc edx
mov dword [ecx + eax - 0xc], ebx
mov eax, dword [esi + 0x18]
mov ebx, dword [ebp + 0xc]
mov dword [ecx + eax - 8], edi
mov eax, dword [esi + 0x18]
mov dword [ecx + eax - 0x10], ebx
mov ebx, dword [ebp + 0x10]
cmp edx, dword [esi + 0x14]
jl 0x100f03f3
mov edi, dword [ebp + 0x28]
mov eax, dword [esi + 4]
push 0
push edi
push 0
push esi
push 0x100f00a0
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
test eax, eax
je 0x100f047e
test edi, edi
je 0x100f0475
cmp byte [esi + 0x21], 0
jne 0x100f0475
cmp byte [esi + 0x20], 0
jne 0x100f0475
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100f045a
push eax
call fcn.1012d67f
add esp, 4
mov dword [esi + 0x18], 0
push 0
push 0
push esi
push 0x100f67a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret 0x28
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100f0495
push eax
call fcn.1012d67f
add esp, 4
mov dword [esi + 0x18], 0
push 0x2c
push esi
call fcn.1012d6b4
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret 0x28
Function at 0x100f0530
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100f05fc
cmp byte [esi + 0x20], 0
jne 0x100f05fc
push edi
mov edi, dword [esi + 0x24]
mov byte [esi + 0x20], 1
test edi, edi
je 0x100f0598
cmp byte [edi + 0xc], 0
jne 0x100f0598
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100f0598
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x10102b10
push 0
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100f059e
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [esi + 0x21], 0
je 0x100f05d7
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100f05bb
push eax
call fcn.1012d67f
add esp, 4
mov dword [esi + 0x18], 0
push 0
push 0
push esi
push 0x100f67a0
push 0
push 0
call edi
pop edi
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esi + 0x28], 0
jne 0x100f05fb
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100f05f4
push eax
call fcn.1012d67f
add esp, 4
mov dword [esi + 0x18], 0
mov ecx, esi
call fcn.100f67c0
pop edi
pop esi
pop ebp
ret 4
Function at 0x100f3b60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
jl 0x100f3d2e
mov esi, dword [ebp + 0x1c]
cmp dword [esi + 0x2c], 1
jge 0x100f3bd5
mov edi, dword [esi + 0x1b0]
test edi, edi
je 0x100f3d2e
cmp byte [edi + 0xc], 0
jne 0x100f3bc5
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100f3bc5
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x1a0]
movzx ecx, ax
test eax, eax
jne 0x100f3c58
mov edi, dword [esi + 0x1b0]
test edi, edi
je 0x100f3c34
cmp byte [edi + 0xc], al
jne 0x100f3c2a
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100f3c2a
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
mov dword [esi + 0x1ac], 0xff
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
mov eax, dword [esi + 0x1ac]
movsx ecx, cx
add eax, ecx
mov dword [esi + 0x1ac], eax
cmp eax, 0xfe
jle 0x100f3ce7
mov edi, dword [esi + 0x1b0]
mov dword [esi + 0x1ac], 0xff
test edi, edi
je 0x100f3ccd
cmp byte [edi + 0xc], 0
jne 0x100f3cc3
mov eax, dword [edi + 4]
mov byte [edi + 0xc], 1
test eax, eax
je 0x100f3cc3
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push edi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b0], 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
pop edi
pop esi
pop ebp
ret 0x18
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
push esi
call sym.ExuiKrnln_X32.dll_ControlAddRedrawRect
push esi
call sym.ExuiKrnln_X32.dll_ControlRedraw
cmp dword [esi + 0x1b0], 0
jne 0x100f3d2e
movsx eax, word [esi + 0x1a2]
mov ecx, 0x21
push 0
push 0
push 0
push esi
test eax, eax
push fcn.100f3b60
cmove eax, ecx
push eax
push eax
call sym.ExuiKrnln_X32.dll_CreateTimerEx
mov dword [esi + 0x1b0], eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x100f3f40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push 0x1015d878
movzx eax, dx
push eax
push dword [0x10177520]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x10177520]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x10177520]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
mov edx, esi
mov ecx, eax
pop esi
jmp fcn.100f4950

Function at 0x100f3f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
test ecx, ecx
je 0x100f3fab
cmp dword [ecx + 4], 8
jne 0x100f3fab
cmp dword [ecx + 0xc], 0x7e3
jne 0x100f3fab
mov edx, dword [ecx + 8]
jmp fcn.100f3f40
xor eax, eax
ret

Function at 0x100f64d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ecx, ecx
je 0x100f65eb
mov esi, dword [ecx + 4]
lea eax, [ecx + 8]
cmp esi, 4
jle 0x100f6554
mov ecx, dword [eax]
cmp ecx, 0x3b9ac9ff
je 0x100f65eb
cmp ecx, 0x5f5e100
je 0x100f65eb
mov dword [ebx], eax
cmp esi, 8
jne 0x100f6556
push 0x1015d878
movzx eax, cx
push eax
push dword [0x10177520]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x10177520]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
push dword [0x10177520]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x100f65eb
cmp esi, 5
jl 0x100f65eb
mov eax, dword [ecx + 4]
add ecx, 8
mov esi, dword [ebp + 0xc]
mov dword [ebx], ecx
xor ebx, ebx
mov ecx, 4
mov dword [esi], eax
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.1012d6c2
push ebx
push 0
push eax
mov dword [ebp + 8], eax
call fcn.1012f3e0
xor edi, edi
add esp, 0x10
cmp dword [esi], edi
jle 0x100f65df
mov eax, dword [ebp - 4]
xor ebx, ebx
mov ecx, 4
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.1012d6c2
push ebx
mov esi, eax
push 0
push esi
call fcn.1012f3e0
mov eax, dword [ebp + 8]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [eax + edi*4], esi
inc edi
cmp edi, dword [ecx]
jl 0x100f65a1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x100f67c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push ecx
push 0x100f67a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x10102d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10102d9e
cmp byte [esi + 0xc], 0
jne 0x10102d9e
mov eax, dword [esi + 4]
mov byte [esi + 0xc], 1
test eax, eax
je 0x10102d9e
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push esi
push 0x10102b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
ret 4

Function at 0x10102db0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10102e66
cmp byte [esi + 0xc], 0
jne 0x10102e66
cmp dword [esi + 0x24], 0
mov ecx, dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
jle 0x10102e03
mov eax, dword [esi + 4]
test eax, eax
je 0x10102e03
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], ebx
test ebx, ebx
js 0x10102e6b
test edi, edi
js 0x10102e6b
push edi
push ebx
push eax
push 0
call ecx
test eax, eax
jne 0x10102e64
mov ecx, dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov edx, dword [esi + 4]
lea eax, [esi + 4]
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], ebx
test edx, edx
je 0x10102e48
push 0x3a98
push 0x3a98
push edx
push 0
call ecx
push 0
push 0
push dword [esi + 4]
push 0x10102b60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 4]
mov dword [eax], 0
test ebx, ebx
js 0x10102e64
test edi, edi
js 0x10102e64
push dword [esi + 0x28]
push edi
push ebx
push esi
push 0x10102b80
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
push 0x3a98
push 0x3a98
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
push 0
push 0
push dword [esi + 4]
push 0x10102b60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov dword [esi + 4], 0
pop esi
pop ebp
ret 0xc
Function at 0x1011a320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp word [0x101783a0], 0
push esi
push edi
mov esi, ecx
jne 0x1011a409
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, str.C:ExuiKrnln_win32.ini
push ebx
push 0
push 0
push 3
push 0
push 1
test esi, esi
mov eax, str.C:ExuiKrnln_win64.ini
push Ordinal_1
cmove eax, ecx
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1011a38d
push 0
push 0
push 3
push 0
push 1
mov ecx, str.D:ExuiKrnln_win32.ini
test esi, esi
mov eax, str.D:ExuiKrnln_win64.ini
push Ordinal_1
cmove eax, ecx
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1011a408
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
push 0x104
push 0x101783a0
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1011a401
mov eax, dword [ebp - 4]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x1011a420
xor ecx, ecx
mov word [eax + 0x101783a0], cx
mov ecx, 0x101783a0
call fcn.100f5de0
mov esi, eax
mov ecx, 0x82
mov edi, 0x101783a0
mov eax, 0x206
rep movsd dword es:[edi], dword [esi]
cmp word [eax + 0x101783a0], 0x5c
je 0x1011a401
cmp eax, 0x208
jae 0x1011a420
xor ecx, ecx
mov word [eax + 0x101783a0], cx
sub eax, 2
jns 0x1011a3e2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, 0x82
mov esi, 0x101783a0
mov edi, 0x101785a8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1012d7ed
int3