joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c998
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push ebx
call sub.ADVAPI32.DLL_CryptAcquireContextA
add esp, 0xc
test eax, eax
je 0x41c9d4
sub esp, 0xc
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0x8003
push dword [ebx]
call sub.ADVAPI32.DLL_CryptCreateHash
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x71cc015c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x62572e16
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401ced
Capabilities:
Delete directory
Delete file

Disassembly:
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
cmp dword [ebx + 0x18], esi
je 0x401d14
test esi, esi
js 0x401d30
cmp esi, dword [ebx + 0x18]
jge 0x401d30
mov eax, dword [ebx + 0x14]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, dword [ebx + 0x18]
jne 0x401cf9
lea ecx, [ebx + 0x14]
call fcn.00402e1e
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
lea ecx, [ebx + 0x20]
pop ebx
jmp fcn.0040317b
push 1
push 0xc000008c
call fcn.004010aa
int3

Function at 0x401f2d
Capabilities:
Get common file path
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x420f4c
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x401f5c
xor al, al
jmp 0x401f90
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x401f75
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0xc], ebx
ja 0x401f8c
cmp dword [ebp - 0x10], 0x40000000
jb 0x401f8e
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret

Function at 0x401fa0
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
mov edi, ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401fd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401fd7
xor al, al
jmp 0x40204b
mov dword [ebp - 8], ebx
call fcn.0040132b
push eax
lea ecx, [ebp - 8]
call fcn.00403531
push 0x104
lea ecx, [ebp - 8]
call fcn.00403115
push eax
push ebx
push 0x4227e0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004030e9
test esi, esi
je 0x40203e
cmp esi, 0x6f
je 0x40203e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40203e
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 0x20]
call fcn.00403012
mov bl, 1
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401302
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret 4
Function at 0x4081f0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40822f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40822f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40822f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40822f
cmp dword [ecx + 0x74], 0xe
jbe 0x40822f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x418680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4186ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4186ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x1000106b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100010a2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1000109e
jmp 0x10001090
cmp esi, eax
jae 0x100010a2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001090
cmp esi, eax
jb 0x100010a9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10001770
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d888
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1016039c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.10001210
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp + 0x10], esi
cmp dword [esi - 4], 1
mov edi, dword [esi - 0xc]
mov dword [ebp - 4], 0
jle 0x100017c7
push edi
lea ecx, [ebp + 0x10]
call fcn.100012d0
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push edi
push esi
push 1
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
mov eax, dword [esi - 8]
push eax
push esi
call fcn.100f682a
add esp, 8
test eax, eax
js 0x10001832
cmp eax, dword [esi - 8]
jg 0x10001832
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000181f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.10001030
int3
Function at 0x10001b50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d8c9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1016039c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.10008288
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x10001b9d
push 0x80004005
call fcn.10001030
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov edx, dword [ebp + 0xc]
mov edi, dword [edx]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x100
or eax, ecx
mov dword [ebp - 4], 0
jge 0x10001bdd
push 0x100
mov ecx, esi
call fcn.10001630
mov eax, dword [esi]
mov ecx, dword [0x101618d8]
push edi
push 0x100
push eax
mov eax, dword [0x101618dc]
push 0x1011cefc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x10001c15
push ecx
push eax
call fcn.100f682a
add esp, 8
test eax, eax
js 0x10001c38
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x10001c38
mov dword [ecx - 0xc], eax
mov edx, dword [esi]
mov byte [eax + edx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.10001030
int3
Function at 0x10001fc0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010d911
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x1016039c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
call fcn.10008288
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x1000200d
push 0x80004005
call fcn.10001030
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xbc], eax
push esi
lea ecx, [ebp - 0xb8]
push 0x10161870
push ecx
mov dword [ebp - 4], ebx
call fcn.10001f00
add esp, 0xc
push eax
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 1
call fcn.10001e30
mov eax, dword [ebp - 0xb8]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000206c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0xbc]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0xb4]
call fcn.10003bc0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 2
call fcn.10003c00
cmp al, 1
jne 0x10002114
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc0], eax
cmp eax, ebx
je 0x10002114
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x10002107
lea ecx, [ebp - 0xb8]
push ecx
push 0xf013f
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xb8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x10002107
mov edx, dword [ebp - 0xb8]
push ebx
push 0x100
push 0x1011cefc
push edx
call edi
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], bl
call fcn.10003bf0
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10002145
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f6fd5
mov esp, ebp
pop ebp
ret
Function at 0x10003d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x10003dd1
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x10003dd1
mov edx, dword [ebp + 0x10]
push esi
lea ecx, [ebp - 4]
push ecx
push edi
push edx
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x10003dc1
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.10003f3a
mov edi, eax
add esp, 4
test edi, edi
je 0x10003dbc
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push esi
push edi
call fcn.100f7040
add esp, 0xc
cmp dword [ebp - 4], esi
jbe 0x10003dc1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
push edi
push eax
push esi
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x10003dc1
push edi
call fcn.10003f45
mov edx, dword [ebp - 8]
add esp, 4
xor edi, edi
mov dword [edx], esi
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, 0xe
mov edx, dword [ebp - 8]
mov dword [edx], esi
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, edi
pop edi
mov dword [ecx], 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10004555
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1016039c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x1000459d
push 0x1011d400
push 4
push eax
call fcn.100f863b
push eax
call fcn.100041ba
add esp, 0x10
jmp 0x100045b3
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10004636
push edi
call fcn.100f899c
mov edi, dword [eax]
call fcn.100f899c
and dword [eax], 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.100f8939
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.100f899c
cmp dword [eax], 0
je 0x1000460a
call fcn.100f899c
push dword [eax]
call fcn.10004434
pop ecx
jmp 0x10004611
call fcn.100f899c
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
pop edi
je 0x10004636
cmp dword [ebp - 0x11c], esi
jae 0x10004636
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x10004638
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100f6fd5
leave
ret
Function at 0x10004645
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x1016039c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.10004495
pop ecx
cmp eax, esi
je 0x1000472f
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x1000472f
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.100f7040
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x1000472f
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x1000472f
cmp esi, 0x14
jge 0x1000472f
push 0x10
push 0
push edi
call fcn.100f8bc2
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000471e
call fcn.100f899c
cmp dword [eax], 0x22
je 0x1000471e
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.100f89e5
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x100046f4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x101619b8], 0
jne 0x100047ba
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x100047e3
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.10004555
pop ecx
pop ecx
test eax, eax
jne 0x100047e5
inc edi
cmp edi, esi
jl 0x100047c0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f6fd5
leave
ret 8
Function at 0x1000e4d1
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1016039c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1000e506
xor eax, eax
jmp 0x1000e559
lea eax, [ebp - 0x210]
push eax
call fcn.100f89e5
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x1000e537
push 0x1011e0cc
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.100fb07f
add esp, 0xc
test eax, eax
jne 0x1000e502
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.100fb07f
add esp, 0xc
test eax, eax
jne 0x1000e502
lea eax, [ebp - 0x210]
push eax
call fcn.1000be11
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100f6fd5
leave
ret

Function at 0x100160c1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x10016108
call fcn.100090c2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10016108
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x10016124
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.10015bc6
mov esi, eax
test edi, edi
je 0x10016122
test ebx, ebx
je 0x10016122
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10016503
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x1010dd9c
call fcn.100f826b
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x10016528
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1001657a
call fcn.10008288
push eax
lea ecx, [ebp - 0x10]
call fcn.10001500
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100fa33b
push eax
call fcn.100041ba
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10001100
mov eax, esi
call fcn.100f8343
ret 8
Function at 0x1003fd23
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100090c2
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1003fd5c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.1003f965
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x1003fdba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x1003fdde
cmp dword [edi + 0x74], 0
jne 0x1003fdde
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.100090c2
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1003fd7b
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10041c7f
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.1004193e
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10041cc9
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10008182
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.100014b0
jmp 0x10041cd4
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.1000b744
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10041cda
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.100161cd
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x10041d17
call fcn.1004193e
mov dword [esi + 0xc], 1
jmp 0x10041d1c
call fcn.1004193e
cmp dword [esi], 0
je 0x10041d65
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x10041d3d
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10008182
jmp 0x10041d4f
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.10001730
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.100014b0
jmp 0x10041d89
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x10041d89
push dword [esi]
push dword [ebp + 8]
call fcn.1000b744
pop esi
pop ebp
ret 0xc

Function at 0x1005c91c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lcall 0xc635, 0x9b45c633
inc ebp
pushfd
xor al, 0xc6
inc ebp
popfd
and dh, al
inc ebp
sahf
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1005c557
push eax
push esi
push dword [ebp + 8]
call fcn.1005c50c
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1005c557
push eax
push esi
push dword [ebp + 8]
call fcn.1005c50c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1005c547
pop ebx
mov ebp, 0x9d8812c4
jl 0x1005c9cc
invalid
invalid