joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60908c70
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push ebx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x118], 0x200
xor esi, esi
lea ebx, [ebp - 0x110]
push ebx
push 0x104
push eax
push edx
call sym._winFullPathname
add esp, 0x10
test eax, eax
jne 0x60908d6f
add esp, 0xfffffff4
push ebx
call sym._convertUtf8Filename
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x60908d61
call sym._isNT
test eax, eax
je 0x60908d18
mov edx, ebx
movzx eax, word [ebx]
test ax, ax
je 0x60908cfa
cmp ax, 0x5c
jne 0x60908ce4
mov word [ebx], 0
jmp 0x60908cfa
add edx, 2
movzx eax, word [edx]
test ax, ax
je 0x60908cfa
cmp ax, 0x5c
jne 0x60908ce4
mov word [edx], 0
add esp, 0xfffffff4
lea edx, [ebp - 0x114]
push edx
push edx
lea eax, [ebp - 0x118]
push eax
push edx
push ebx
call sub.KERNEL32.dll_GetDiskFreeSpaceW
jmp 0x60908d53
mov edx, ebx
mov al, byte [ebx]
test al, al
je 0x60908d3a
cmp al, 0x5c
jne 0x60908d2c
mov byte [ebx], 0
jmp 0x60908d3a
inc edx
mov al, byte [edx]
test al, al
je 0x60908d3a
cmp al, 0x5c
jne 0x60908d2c
mov byte [edx], 0
add esp, 0xfffffff4
lea edx, [ebp - 0x114]
push edx
push edx
lea eax, [ebp - 0x118]
push eax
push edx
push ebx
call sub.KERNEL32.dll_GetDiskFreeSpaceA
mov esi, eax
add esp, 0xc
add esp, 0xfffffff4
push ebx
call sym._free
test esi, esi
jne 0x60908d6f
mov dword [ebp - 0x118], 0x200
mov eax, dword [ebp - 0x118]
lea esp, [ebp - 0x138]
pop ebx
pop esi
leave
ret

Function at 0x6091540c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.60914fcb
push eax
push esi
push dword [ebp + 8]
call fcn.60914f80
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.60914fbb
adc eax, eax
push 0xffffffffffffff93
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
invalid
invalid
invalid

Function at 0x60916838
Capabilities:
Contain obfuscated stackstrings

Disassembly:
movsd dword es:[edi], dword [esi]
mov ebp, 0xfffff8
mov byte [ebp - 0x742], 2
and byte [ebp - 0x741], 0
mov byte [ebp - 0x740], 0xb1
mov byte [ebp - 0x73f], 0x92
mov byte [ebp - 0x73e], 0x9c
mov byte [ebp - 0x73d], 0x99
mov byte [ebp - 0x73c], 0xb1
mov byte [ebp - 0x73b], 0x94
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
mov byte [ebp - 0x735], 0xbc
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.60914fcb
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.60914f80
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.60914fbb
Function at 0x60958b08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
test edx, edx
jg 0x60958b30
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [ecx - 1]
test edx, edx
jle 0x60958b42
nop
mov eax, ebx
shl eax, 3
xor ebx, eax
movsx eax, byte [esi]
xor ebx, eax
inc esi
dec edx
test edx, edx
jg 0x60958b30
and ebx, 0x7fffffff
mov eax, ebx
pop ebx
pop esi
pop edi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004258f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100425c8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
push 1
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0x46bd
push 0x11b3
call fcn.10042732
add esp, 0x14
jmp 0x1004272e
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10042602
push 0x456
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1004272e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x10042647
mov dword [ebp - 0xc], 1
jmp 0x1004264b
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10042684
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
je 0x1004266d
mov dword [ebp - 8], 1
jmp 0x10042671
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 8], eax
jne 0x10042684
mov dword [ebp - 0x10], 1
jmp 0x10042688
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jl 0x10042699
mov dword [ebp - 0x60], 1
jmp 0x1004269d
and dword [ebp - 0x60], 0
xor eax, eax
jne 0x100426aa
mov dword [ebp - 0x14], 1
jmp 0x100426ae
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jg 0x100426c1
mov dword [ebp - 0x18], 1
jmp 0x100426c5
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x100426d8
mov dword [ebp - 0x20], 1
jmp 0x100426dc
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jge 0x100426ef
mov dword [ebp - 0x28], 1
jmp 0x100426f3
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, dword [ebp - 0x28]
jne 0x1004270c
mov eax, 0xffff
test eax, eax
jne 0x1004270c
and dword [ebp - 0x2c], 0
jmp 0x10042713
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x2c], 5
jge 0x10042722
mov dword [ebp - 0x30], 1
jmp 0x10042726
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004781c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100478c2
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10047875
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10047873
push 0x456
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x100478c0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100478a3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x100478c0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1000c132
mov dword [eax], 0x93e623b4
jmp 0x10047898
jmp 0x100478e8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push 0x467
push 0x1c7b
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
call fcn.1004d84f
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1004924a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100492fb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100492cb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100492ac
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x100492c9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000c132
mov dword [eax], 0xb2e5f58c
jmp 0x100492a1
jmp 0x100492f9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100492f9
push 0
push 0x1ec5
push 0
push 0
push 0x26cd
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1004931d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push 0x3202
push 0xee0
push 0x7c03
push 0
push dword [ebp - 0x2c]
call fcn.1004bcbb
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1006ef85
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10079768]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005fc18
mov dword [ebp - 0x14], eax
cmp dword [0x10666ad8], esi
jne 0x1006f078
push 0x800
push esi
push 0x1000a5d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006f005
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006f158
push esi
push esi
push 0x1000a5d8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006f158
push 0x1000a5f0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006f158
push eax
call ebx
push 0x1000a5fc
push edi
mov dword [0x10666ad8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000a60c
push edi
mov dword [0x10666adc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000a620
push edi
mov dword [0x10666ae0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10666ae8], eax
test eax, eax
je 0x1006f075
push 0x1000a63c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10666ae4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006f09d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006f090
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006f0b2
push 4
pop eax
jmp 0x1006f15a
cmp dword [ebp - 0x14], esi
je 0x1006f0b2
push dword [0x10666ad8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006f097
mov eax, dword [0x10666ae4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006f110
cmp dword [0x10666ae8], edi
je 0x1006f110
push eax
call ebx
push dword [0x10666ae8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006f110
test eax, eax
je 0x1006f110
call ecx
test eax, eax
je 0x1006f105
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006f105
test byte [ebp - 8], 1
jne 0x1006f110
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006f140
mov eax, dword [0x10666adc]
cmp eax, edi
je 0x1006f13d
push eax
call ebx
test eax, eax
je 0x1006f13d
call eax
mov esi, eax
test esi, esi
je 0x1006f13d
mov eax, dword [0x10666ae0]
cmp eax, edi
je 0x1006f13d
push eax
call ebx
test eax, eax
je 0x1006f13d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10666ad8]
call ebx
test eax, eax
je 0x1006f158
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006f15a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005cc7c
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x402278
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x404608
call fcn.004029fb
push 1
call fcn.00402540
pop ecx
test al, al
jne 0x40212f
push 7
call fcn.004027bd
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040250b
mov byte [ebp - 0x24], al
mov eax, dword [0x4063c4]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x402128
test eax, eax
jne 0x402199
mov dword [0x4063c4], ecx
push 0x404164
push 0x404154
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40217c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402272
push 0x404150
push 0x404148
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4063c4], 2
jmp 0x40219e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004026ad
pop ecx
call fcn.004027b1
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4021ce
push esi
call fcn.00402623
pop ecx
test al, al
je 0x4021ce
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004029f5
call esi
call fcn.004027b7
mov esi, eax
cmp dword [esi], edi
je 0x4021ec
push esi
call fcn.00402623
pop ecx
test al, al
je 0x4021ec
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.004028d3
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00402906
test al, al
jne 0x402217
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x402220
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004026ca
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x402272
call fcn.00402a40
ret
call fcn.00401fc1
jmp 0x402110
Function at 0x42db1e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42db4c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42db6a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042da88
jmp 0x42db6a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42db6a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0042da88
test edi, edi
mov eax, edi
jne 0x42db54
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x44617c]
test ecx, ecx
je 0x42dc1d
jmp 0x42db1d
ret 8

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x40d3d8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408a8b
mov dword [ebp - 0x14], eax
cmp dword [0x812fc4], esi
jne 0x40d4cb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d458
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d5ab
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d5ab
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d5ab
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x812fc4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x812fc8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x812fcc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x812fd4], eax
test eax, eax
je 0x40d4c8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x812fd0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d4f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d4e3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d505
push 4
pop eax
jmp 0x40d5ad
cmp dword [ebp - 0x14], esi
je 0x40d505
push dword [0x812fc4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d4ea
mov eax, dword [0x812fd0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d563
cmp dword [0x812fd4], edi
je 0x40d563
push eax
call ebx
push dword [0x812fd4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d563
test eax, eax
je 0x40d563
call ecx
test eax, eax
je 0x40d558
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d558
test byte [ebp - 8], 1
jne 0x40d563
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d593
mov eax, dword [0x812fc8]
cmp eax, edi
je 0x40d590
push eax
call ebx
test eax, eax
je 0x40d590
call eax
mov esi, eax
test esi, esi
je 0x40d590
mov eax, dword [0x812fcc]
cmp eax, edi
je 0x40d590
push eax
call ebx
test eax, eax
je 0x40d590
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x812fc4]
call ebx
test eax, eax
je 0x40d5ab
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d5ad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f8b
mov esp, ebp
pop ebp
ret
Function at 0x1000cc3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002d770
call fcn.10016ea3
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ccbb
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ccbb
call fcn.10005a09
mov esi, eax
jmp 0x1000cd92
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000ccde
call fcn.10005a09
jmp 0x1000cd85
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ccd4
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000cd0e
mov esi, 0x8007000e
jmp 0x1000cd87
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10028d71
jmp 0x1000cd34
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cd07
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ccd4
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10028d71
mov esi, eax
test edi, edi
je 0x1000cd92
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000cdab
lea ecx, [ebp - 0x418]
call fcn.1000c3cf
mov eax, esi
call fcn.10016df0
ret 0x10
Function at 0x10012247
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002dc29
call fcn.10016e01
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x100304d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.10028d71
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x100122f2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10028d71
mov ecx, dword [esi]
test al, al
je 0x100122d4
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10028d71
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x100122eb
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.10028d71
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009b23
cmp dword [ebx + 0x24], 0
je 0x10012312
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10028d71
test al, al
je 0x10012312
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016dca
ret