joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006fb90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101856d2
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0
push 0x2e
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1006fd79
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
push eax
lea ecx, [ebp - 0x21c]
call fcn.10016670
lea ecx, [ebp - 0x225]
mov dword [ebp - 4], 0
call fcn.10068cc0
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1001cb20
add esp, 0xc
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.1001c9f0
mov edx, dword [ebp - 0x224]
or esi, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006fc54
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x10193fcc
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x220], 0
call fcn.10016670
push 0x1019984c
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.10016670
push str.UserDataSet
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 3
call fcn.10016670
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.100c9c20
add esp, 0x14
mov edx, dword [ebp - 0x22c]
mov eax, esi
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006fce6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x230]
mov eax, esi
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006fd07
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x224]
mov eax, esi
mov byte [ebp - 4], 8
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006fd28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x220]
mov ecx, edi
push eax
call fcn.1001c9f0
mov edx, dword [ebp - 0x220]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1006fd57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1006fd79
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x100745f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10185cf3
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa4]
push 0x84
push 0
push eax
call fcn.10150460
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0xa4]
add esp, 0xc
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push str.closebtn
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 0
call fcn.100dc602
test al, al
je 0x1007469f
mov eax, dword [edi + 0x77c]
test eax, eax
jne 0x10074681
push eax
push str.ProtectPlugin
push eax
push eax
push str.download_fail_close
jmp 0x1007475f
cmp eax, 1
jne 0x1007476b
push 0
push str.ProtectPlugin
push 0
push 0
push str.install_fail_close
jmp 0x1007475f
push str.openbtn
lea ecx, [ebp - 0xa4]
call fcn.100dc602
test al, al
je 0x10074774
xorps xmm0, xmm0
mov byte [ebp - 0xa5], 0
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
call fcn.100a2403
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xa5]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0x10058ed0
push 0x101e5d5c
call fcn.100a32ce
add esp, 0x10
test eax, eax
je 0x1007479c
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
call fcn.100a243d
mov eax, dword [0x101e5d58]
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [eax]
push 1
push 0
push 0
push dword [eax + 0x7c]
push 0x101951bc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [edi + 0x77c]
test eax, eax
jne 0x1007474a
push eax
push str.ProtectPlugin
push eax
push eax
push str.download_fail_click
jmp 0x1007475f
cmp eax, 1
jne 0x1007476b
push 0
push str.ProtectPlugin
push 0
push 0
push str.install_fail_click
call fcn.1001e650
mov ecx, eax
call fcn.100caab0
push 1
mov ecx, edi
call fcn.100dbc4c
lea ecx, [ebp - 0xa4]
call fcn.100dc53c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
call fcn.100a245e
add esp, 4
mov byte [ebp - 4], 2
test al, al
jne 0x100747b9
call fcn.100a32e6
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.10016d00
call fcn.10019c10
int3
Function at 0x100774c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push edi
push eax
mov ecx, esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], 0x4b0048
mov dword [ebp - 0x48], 0x590045
mov dword [ebp - 0x44], 0x4c005f
mov dword [ebp - 0x40], 0x43004f
mov dword [ebp - 0x3c], 0x4c0041
mov dword [ebp - 0x38], 0x4d005f
mov dword [ebp - 0x34], 0x430041
mov dword [ebp - 0x30], 0x490048
mov dword [ebp - 0x2c], 0x45004e
mov dword [ebp - 0x28], 0x53005c
mov dword [ebp - 0x24], 0x46004f
mov dword [ebp - 0x20], 0x570054
mov dword [ebp - 0x1c], 0x520041
mov dword [ebp - 0x18], 0x5c0045
mov dword [ebp - 0x14], 0x75004c
mov dword [ebp - 0x10], 0x610064
mov dword [ebp - 0xc], 0x680073
mov dword [ebp - 8], 0x69
call fcn.10021dd0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10128191
mov esp, ebp
pop ebp
ret 4

Function at 0x10077580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x4d005c
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x101e7bf0
mov dword [ebp - 0x5c], 0x6c0075
push edi
mov dword [ebp - 0x58], 0x690074
mov edx, 0x2d
mov dword [ebp - 0x54], 0x43002d
sub esi, eax
mov dword [ebp - 0x50], 0x300032
mov dword [ebp - 0x4c], 0x390045
mov dword [ebp - 0x48], 0x440034
mov dword [ebp - 0x44], 0x2d0031
mov dword [ebp - 0x40], 0x370032
mov dword [ebp - 0x3c], 0x310043
mov dword [ebp - 0x38], 0x34002d
mov dword [ebp - 0x34], 0x340044
mov dword [ebp - 0x30], 0x2d0044
mov dword [ebp - 0x2c], 0x340039
mov dword [ebp - 0x28], 0x340031
mov dword [ebp - 0x24], 0x31002d
mov dword [ebp - 0x20], 0x420032
mov dword [ebp - 0x1c], 0x440030
mov dword [ebp - 0x18], 0x350038
mov dword [ebp - 0x14], 0x340037
mov dword [ebp - 0x10], 0x350045
mov dword [ebp - 0xc], 0x5c0042
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x10077660
movzx ecx, word [esi + eax]
test cx, cx
je 0x10077660
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10077642
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x10077860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push edi
push eax
mov ecx, esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x4b0048
mov dword [ebp - 0x50], 0x590045
mov dword [ebp - 0x4c], 0x4c005f
mov dword [ebp - 0x48], 0x43004f
mov dword [ebp - 0x44], 0x4c0041
mov dword [ebp - 0x40], 0x4d005f
mov dword [ebp - 0x3c], 0x430041
mov dword [ebp - 0x38], 0x490048
mov dword [ebp - 0x34], 0x45004e
mov dword [ebp - 0x30], 0x53005c
mov dword [ebp - 0x2c], 0x46004f
mov dword [ebp - 0x28], 0x570054
mov dword [ebp - 0x24], 0x520041
mov dword [ebp - 0x20], 0x5c0045
mov dword [ebp - 0x1c], 0x610048
mov dword [ebp - 0x18], 0x6f006c
mov dword [ebp - 0x14], 0x650044
mov dword [ebp - 0x10], 0x6b0073
mov dword [ebp - 0xc], 0x6f0074
mov dword [ebp - 8], 0x70
call fcn.10021dd0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10128191
mov esp, ebp
pop ebp
ret 4

Function at 0x10077930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x58]
push edi
push eax
mov ecx, esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], 0x4b0048
mov dword [ebp - 0x54], 0x590045
mov dword [ebp - 0x50], 0x4c005f
mov dword [ebp - 0x4c], 0x43004f
mov dword [ebp - 0x48], 0x4c0041
mov dword [ebp - 0x44], 0x4d005f
mov dword [ebp - 0x40], 0x430041
mov dword [ebp - 0x3c], 0x490048
mov dword [ebp - 0x38], 0x45004e
mov dword [ebp - 0x34], 0x53005c
mov dword [ebp - 0x30], 0x46004f
mov dword [ebp - 0x2c], 0x570054
mov dword [ebp - 0x28], 0x520041
mov dword [ebp - 0x24], 0x5c0045
mov dword [ebp - 0x20], 0x44004c
mov dword [ebp - 0x1c], 0x470053
mov dword [ebp - 0x18], 0x6d0061
mov dword [ebp - 0x14], 0x4d0065
mov dword [ebp - 0x10], 0x730061
mov dword [ebp - 0xc], 0x650074
mov dword [ebp - 8], 0x72
call fcn.10021dd0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
Function at 0x10077ad0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018610b
mov eax, dword fs:[0]
push eax
mov eax, 0x2018
call fcn.10128a30
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x2020], eax
mov eax, dword [ebp + 0x10]
push 0x2000
mov dword [ebp - 0x2024], eax
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.10150460
add esp, 0xc
lea eax, [ebp - 0x2014]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x10077c53
cmp eax, 0x1fff
ja 0x10077c53
lea ecx, [ebp - 0x2010]
push ecx
push eax
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10077c53
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x201c]
push eax
push 0x1019606c
lea eax, [ebp - 0x2010]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10077c53
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp - 0x201c]
je 0x10077ba3
mov ebx, dword [eax + 8]
mov edi, dword [eax + 0xc]
jmp 0x10077ba9
mov ebx, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
mov eax, dword [ebp - 0x2020]
test eax, eax
je 0x10077bb5
mov dword [eax], ebx
mov eax, dword [ebp - 0x2024]
test eax, eax
je 0x10077bc1
mov dword [eax], edi
test esi, esi
je 0x10077c4c
lea ecx, [ebp - 0x2020]
mov dword [ebp - 0x2020], 0
call fcn.100218b0
movzx eax, di
push eax
shr edi, 0x10
push edi
movzx eax, bx
push eax
shr ebx, 0x10
lea eax, [ebp - 0x2020]
push ebx
push str._d._d._d._d
push eax
mov dword [ebp - 4], 0
call fcn.1001e580
mov edx, dword [ebp - 0x2020]
add esp, 0x18
mov ecx, 0x104
sub edx, esi
lea eax, [ecx + 0x7ffffefa]
test eax, eax
je 0x10077c34
movzx eax, word [edx + esi]
test ax, ax
je 0x10077c34
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x10077c16
test ecx, ecx
lea eax, [esi - 2]
cmovne eax, esi
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x2020]
call fcn.100170c0
mov eax, 1
jmp 0x10077c55
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x10078990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10185e5b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.100db410
add esp, 4
push 0x58
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
call fcn.100daa4c
push 0x84
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.10150460
lea eax, [ebp - 0x94]
push eax
call fcn.100d6296
add esp, 0x14
mov dword [ebp - 4], 0
call fcn.100d6449
dec eax
cmp eax, 3
ja case.default.0x10078a16
jmp dword [eax*4 + 0x10078b6c]
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100dc6a8
lea ecx, [ebp - 0x94]
call fcn.10031970
push eax
call fcn.100db3c7
add esp, 4
push 0
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.1003bd30
mov ecx, eax
call fcn.100f4090
jmp case.default.0x10078a16
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100dc6a8
lea ecx, [ebp - 0x94]
call fcn.10031970
push eax
call fcn.100db3c7
add esp, 4
push 0x101960a4
push ecx
mov eax, esp
mov dword [eax], str.IDR_RES
call fcn.1003bd30
mov ecx, eax
call fcn.100f4090
jmp case.default.0x10078a16
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100dc6a8
lea ecx, [ebp - 0x94]
call fcn.10031970
push eax
call fcn.100db3c7
push 0
push 1
push str.skin.zip
call fcn.100db4e6
add esp, 0x10
jmp 0x10078a41
push 0x101960d0
push 0x65
call fcn.100d6434
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je case.default.0x10078a16
push esi
call fcn.100d6434
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10078b3e
push esi
call fcn.100d6434
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x10078b3e
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.100db41d
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.1003bd30
mov ecx, eax
call fcn.100f4090
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x94]
call fcn.100dc53c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x10078ad7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10185e5b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.100db410
add esp, 4
push 0x58
push 0
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
call fcn.100daa4c
push 0x84
lea eax, [ebp - 0x94]
push 0
push eax
call fcn.10150460
lea eax, [ebp - 0x94]
push eax
call fcn.100d6296
add esp, 0x14
mov dword [ebp - 4], 0
call fcn.100d6449
dec eax
cmp eax, 3
ja case.default.0x10078a16
jmp dword [eax*4 + 0x10078b6c]
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100dc6a8
lea ecx, [ebp - 0x94]
call fcn.10031970
push eax
call fcn.100db3c7
add esp, 4
push 0
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.1003bd30
mov ecx, eax
call fcn.100f4090
jmp case.default.0x10078a16
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100dc6a8
lea ecx, [ebp - 0x94]
call fcn.10031970
push eax
call fcn.100db3c7
add esp, 4
push 0x101960a4
push ecx
mov eax, esp
mov dword [eax], str.IDR_RES
call fcn.1003bd30
mov ecx, eax
call fcn.100f4090
jmp case.default.0x10078a16
push str.skin_
lea ecx, [ebp - 0x94]
call fcn.100dc6a8
lea ecx, [ebp - 0x94]
call fcn.10031970
push eax
call fcn.100db3c7
push 0
push 1
push str.skin.zip
call fcn.100db4e6
add esp, 0x10
jmp 0x10078a41
push 0x101960d0
push 0x65
call fcn.100d6434
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je case.default.0x10078a16
push esi
call fcn.100d6434
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10078b3e
push esi
call fcn.100d6434
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x10078b3e
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.100db41d
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.1003bd30
mov ecx, eax
call fcn.100f4090
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [ebp - 0x94]
call fcn.100dc53c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x10085030
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101879a0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
push 0x10084f50
mov dword [ebp - 0x30], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x100850c7
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
jmp 0x10085205
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x34]
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x4c], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x100850ae
push 4
push 0x1000
push 0x10
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x1008512e
push 0
push 0
push 0x1004
push dword [ebp - 0x40]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x10085147
push 0x8000
push eax
push dword [ebp - 0x38]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
jmp 0x100851fe
mov dword [ebp - 0x3c], 0
test eax, eax
je 0x100851c7
mov edi, dword [ebp - 0x18]
push 0
push 0x10
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x38]
movups xmmword [ebp - 0x2c], xmm0
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x100e
push dword [ebp - 0x40]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x10
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x38]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x14], edi
je 0x100851a8
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [edi], xmm0
add edi, 0x10
mov dword [ebp - 0x18], edi
jmp 0x100851b8
lea eax, [ebp - 0x2c]
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.10084ba0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, dword [ebp - 0x44]
jb 0x10085155
mov edi, dword [ebp - 0x48]
push 0x8000
push 0
push dword [ebp - 0x38]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x1c]
call fcn.10084e00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x100860f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x68], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x68]
mov eax, 0x101e7df8
mov dword [ebp - 0x64], 0x700074
push edi
mov dword [ebp - 0x60], 0x2f003a
mov edx, 0x31
mov dword [ebp - 0x5c], 0x25002f
sub esi, eax
mov dword [ebp - 0x58], 0x2f0073
mov dword [ebp - 0x54], 0x750061
mov dword [ebp - 0x50], 0x680074
mov dword [ebp - 0x4c], 0x69002f
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x2f0066
mov dword [ebp - 0x40], 0x650067
mov dword [ebp - 0x3c], 0x540074
mov dword [ebp - 0x38], 0x690070
mov dword [ebp - 0x34], 0x70003f
mov dword [ebp - 0x30], 0x6f0072
mov dword [ebp - 0x2c], 0x750064
mov dword [ebp - 0x28], 0x740063
mov dword [ebp - 0x24], 0x25003d
mov dword [ebp - 0x20], 0x260073
mov dword [ebp - 0x1c], 0x680063
mov dword [ebp - 0x18], 0x6e0061
mov dword [ebp - 0x14], 0x65006e
mov dword [ebp - 0x10], 0x3d006c
mov dword [ebp - 0xc], 0x730025
lea ecx, [edx + 0x7fffffcd]
test ecx, ecx
je 0x100861de
movzx ecx, word [esi + eax]
test cx, cx
je 0x100861de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100861c0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret

Function at 0x10086200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x68], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x68]
mov eax, 0x101e7e68
mov dword [ebp - 0x64], 0x700074
push edi
mov dword [ebp - 0x60], 0x2f003a
mov edx, 0x31
mov dword [ebp - 0x5c], 0x25002f
sub esi, eax
mov dword [ebp - 0x58], 0x2f0073
mov dword [ebp - 0x54], 0x750061
mov dword [ebp - 0x50], 0x680074
mov dword [ebp - 0x4c], 0x69002f
mov dword [ebp - 0x48], 0x74006e
mov dword [ebp - 0x44], 0x2f0066
mov dword [ebp - 0x40], 0x650067
mov dword [ebp - 0x3c], 0x540074
mov dword [ebp - 0x38], 0x690070
mov dword [ebp - 0x34], 0x70003f
mov dword [ebp - 0x30], 0x6f0072
mov dword [ebp - 0x2c], 0x750064
mov dword [ebp - 0x28], 0x740063
mov dword [ebp - 0x24], 0x25003d
mov dword [ebp - 0x20], 0x260073
mov dword [ebp - 0x1c], 0x680063
mov dword [ebp - 0x18], 0x6e0061
mov dword [ebp - 0x14], 0x65006e
mov dword [ebp - 0x10], 0x3d006c
mov dword [ebp - 0xc], 0x730025
lea ecx, [edx + 0x7fffffcd]
test ecx, ecx
je 0x100862ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x100862ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100862d0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret