joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d18c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 8]
xor ecx, ecx
mov esi, edx
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x10001ef4
push 0x80000002
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x1000d28d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push eax
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x1000d28d
cmp dword [ebp - 0xc], 1
jne 0x1000d21a
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d1fd
sub ecx, edx
push ecx
push edi
push 1
push 0
push 0x100019eb
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
test esi, esi
mov esi, dword [ebp + 0xc]
je 0x1000d243
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d226
sub ecx, edx
push ecx
push esi
push 1
push 0
push 0x10001f74
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
cmp dword [ebp + 8], 0
je 0x1000d26b
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d24e
sub ecx, edx
push ecx
push esi
push 1
push 0
push 0x10001f7c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d270
sub ecx, edx
push ecx
push edi
push 1
push 0
push 0x100019eb
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
cmp dword [ebp - 4], 0
je 0x1000d29c
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x1000d2ab
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x100146a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub dword [edx], 0x1a
lea eax, [ebp - 0x58]
push eax
call fcn.1001440b
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.100143c0
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x100146e9
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.100143fb
sal byte [ebp + 0x458d667a], 0xc0
push eax
call fcn.1001440b
push eax
push esi
push dword [ebp + 8]
call fcn.100143c0
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.100143fb
inc edi
jge 0x10014793
lea eax, cs:[ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
invalid

Function at 0x100148c1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
ja 0x10014889
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x10014891
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x10014899
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.100143fb
sal esp, cl
lcall 0xffff, 0x7c858d2a
call dword [eax - 0x18]
sbb al, 0xfb
invalid
ja 0x10014889
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid

Function at 0x10014988
Capabilities:
Inspect section memory permissions

Disassembly:
test byte [ebp + 2], bl
add byte [eax], al
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x100149a0
cmp dword [eax + 0xc], ebx
je 0x10014a43
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.100143fb
cmp eax, 0x399fbc8e
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
call fcn.100143fb
movsd dword es:[edi], dword [esi]
out dx, al
mov dword [ecx], esi
Function at 0x10014a4c
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x10014aaf
add eax, esi
cmp dword [eax], ebx
je 0x10014aaf
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10014aaa
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
add byte [ebp + 0x13], dh
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10014a9c
cmp edx, ebx
jne 0x10014bea
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10014a6b
add eax, dword [eax + 4]
jmp 0x10014a58
mov dword [ebp + 0xc], ebx
jmp 0x10014aba
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10014ad2
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10014af0
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja fcn.10014b4e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10014b35
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10014b3e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10014b48
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10014b2a
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10014b4e
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10014ab4
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10014b9b
dec eax
je 0x10014b92
sub eax, 3
je 0x10014b89
mov dword [ebp - 4], 0x40
jmp 0x10014bb8
mov dword [ebp - 4], 4
jmp 0x10014b9e
mov dword [ebp - 4], 0x20
jmp 0x10014b9e
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10014bea
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10014b6a
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100143fb
adc esp, esp
inc eax
push ebx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x10014bf6

Function at 0x10014c1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add dh, al
test dword [esi - 0x25000004], ebp
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
invalid
invalid
mov dl, 0xfc
invalid
invalid

Function at 0x10014c8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x3a]
test dword [esi + 0x25fffffc], edi
Function at 0x10014ce1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
invalid
test dword [ecx - 4], eax
invalid
Function at 0x10017696
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x100176d3
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x100176cc
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x100176d8
add edx, 0x28
cmp edx, esi
jne 0x100176bd
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x100176d5
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x517b63e5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x8076a5a
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10001911
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x3004]
mov eax, 0x3004
call fcn.100588e0
push 0xffffffffffffffff
push 0x100b7f19
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1011ca44]
xor eax, ebp
mov dword [ebp + 0x3000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x3c
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.1005c640
mov edx, dword [ebx + 4]
lea eax, [ebp]
mov dword [ebp - 0x58], eax
mov ecx, 0x800
lea eax, [ebp + 0x1000]
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x4c], eax
add esp, 0xc
mov dword [ebp - 0x54], ecx
lea eax, [ebp + 0x2000]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
test edx, edx
je 0x10001997
mov ecx, dword [edx]
jmp 0x10001999
mov ecx, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1000199c
sub ecx, esi
sar ecx, 1
test edx, edx
je 0x100019b3
mov eax, dword [edx]
jmp 0x100019b5
mov eax, edi
lea edx, [ebp - 0x5c]
push edx
push edi
push ecx
push eax
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
mov ax, word [ebp - 0x44]
lea ecx, [ebp - 0x20]
mov word [ebx + 0x1c], ax
lea eax, [ebp + 0x1000]
push eax
call fcn.10001727
mov edi, eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
push 0x100c05d8
call fcn.10001727
mov esi, eax
lea eax, [ebp]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x18]
call fcn.10001727
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.1000183e
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
push ecx
mov ecx, eax
call fcn.1000183e
push eax
lea ecx, [ebx + 0x18]
call fcn.10001795
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10001a3a
call fcn.10001b26
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x10001a3c
xor esi, esi
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10001a4b
call fcn.10001b26
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10001a5a
call fcn.10001b26
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10001a69
call fcn.10001b26
mov dword [ebp - 0x1c], esi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10001a7c
call fcn.10001b26
mov dword [ebp - 0x20], esi
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebx + 0x14]
call fcn.100017c2
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10001aca
cmp eax, 1
je 0x10001aca
movzx ecx, word [ebp + eax*2 + 0x1ffe]
sub eax, 2
push 0x2f
pop edx
cmp word [ebp + eax*2 + 0x2000], dx
je 0x10001ab2
dec eax
jmp 0x10001aa5
cmp cx, dx
jne 0x10001ac2
lea ecx, [ebp + 0x2000]
lea eax, [ecx + eax*2]
jmp 0x10001ad0
lea ecx, [ebp + 0x2002]
jmp 0x10001abd
lea eax, [ebp + 0x2000]
push eax
lea ecx, [ebx + 0xc]
call fcn.100017c2
add ebx, 0x10
cmp dword [ebp - 0x2c], 0
mov ecx, ebx
je 0x10001ae9
push dword [ebp - 0x30]
jmp 0x10001aee
push 0x100c05e0
call fcn.100017c2
cmp dword [ebp - 0x24], 0
je 0x10001b03
push dword [ebp - 0x28]
mov ecx, ebx
call fcn.100017c2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3000]
xor ecx, ebp
call fcn.100587af
add ebp, 0x3004
leave
ret
Function at 0x10005baf
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1074
call fcn.100588e0
mov eax, dword [0x1011ca44]
xor eax, esp
mov dword [esp + 0x1070], eax
push esi
mov esi, dword [esp + 0x107c]
push edi
mov edi, dword [esp + 0x1084]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
push 0
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor eax, eax
push eax
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 0x58
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
call esi
push 0x5a
push dword [esp + 0x1c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esp + 0x1c], xmm0
call esi
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x100c4ef4]
push 1
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm0, dword [0x100c4f18]
cvttss2si eax, xmm0
mov dword [esp + 0xc], eax
imul eax, dword [esp + 0x108c], 0xa
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm2
divss xmm0, dword [0x100c4f18]
cvttss2si eax, xmm0
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x20]
call dword [sym.imp.GDI32.dll_DPtoLP]
movd xmm0, dword [esp + 0xc]
mov ecx, 0x800
cvtdq2pd xmm0, xmm0
push ecx
andps xmm0, xmmword [0x100c4f30]
divsd xmm0, qword [0x100c4f00]
addsd xmm0, qword [0x100c4ef8]
cvttsd2si eax, xmm0
xorps xmm0, xmm0
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x7c]
push eax
push 0x1002
push ecx
movups xmmword [esp + 0x30], xmm0
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
push 5
lea eax, [esp + 0x7c]
push 0x100c2e18
push eax
call fcn.10093ade
test eax, eax
mov ecx, 0x100c2e24
lea eax, [esp + 0x44]
cmovne ecx, edi
push ecx
push 0x20
push eax
call fcn.10093ade
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push dword [esp + 0x10]
mov esi, eax
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [esp + 0x1078]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.100587af
add esp, 0x1074
ret 0xc
Function at 0x1000fffd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x134
mov eax, dword [0x1011ca44]
xor eax, ebp
mov dword [ebp + 0x70], eax
movzx eax, word [ebp + 0x7c]
push esi
mov esi, dword [0x1011fbe8]
push edi
push 0xf0
push eax
xor edi, edi
mov dword [ebp - 0x98], ecx
push esi
inc edi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x1001016e
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x1001016e
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1001016e
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x1001016d
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x9c], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x100100e7
push 3
lea eax, [ebp - 0x90]
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x94], eax
call fcn.10010db8
push dword [ebp - 0x94]
mov eax, dword [ebp - 0x98]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x90]
cmove edi, ecx
cmp dword [ebp - 0x94], eax
je 0x1001015f
push dword [ebp - 0x94]
call fcn.10093ade
pop ecx
jmp 0x1001015f
mov ecx, 0x1234
cmp cx, ax
jne 0x1001015f
or dword [ebp - 0xbc], 0xffffffff
lea eax, [ebp - 0x90]
push 3
push esi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0x94], eax
call fcn.10010db8
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xb8], eax
cmp eax, ecx
je 0x10010139
push eax
call fcn.10093ade
pop ecx
lea eax, [ebp - 0xc0]
push eax
mov eax, dword [ebp - 0x98]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x9c]
test edi, edi
jne 0x1001005e
pop ebx
mov ecx, dword [ebp + 0x70]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.100587af
add ebp, 0x74
leave
ret 4
Function at 0x10010183
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x4a8
mov eax, dword [0x1011ca44]
xor eax, esp
mov dword [esp + 0x4a4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x4b4]
lea eax, [esp + 0x2a4]
push esi
mov esi, dword [esp + 0x4bc]
mov ebx, 0x208
push edi
push ebx
push 0
push eax
call fcn.1005c640
push ebx
lea eax, [esp + 0xb4]
push 0
push eax
call fcn.1005c640
push 0x44
pop edi
push edi
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.1005c640
push ebp
lea eax, [esp + 0x2d4]
mov dword [esp + 0x88], edi
push ebx
push eax
call fcn.10093ade
push esi
push ebp
push 0x100c6a40
lea eax, [esp + 0xe0]
push ebx
push eax
call fcn.10093ade
add esp, 0x44
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x64]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x2d0]
push eax
call fcn.10093ade
mov ebx, dword [sym.imp.kernel32.dll_GetLastError]
add esp, 0x28
test eax, eax
jne 0x100102c7
call ebx
mov esi, eax
mov edi, 0x2e4
cmp esi, edi
jne 0x100102c0
lea eax, [esp + 0xa4]
mov dword [esp + 0x24], 0x3c
xor ecx, ecx
mov dword [esp + 0x34], eax
xorps xmm0, xmm0
mov dword [esp + 0x28], 0x40
lea eax, [esp + 0x24]
movlpd qword [esp + 0x48], xmm0
push eax
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], 0x100c6a4c
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 5
mov dword [esp + 0x48], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x100102fa
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x100102fa
mov dword [esp + 0x14], eax
jmp 0x100102cb
call fcn.10093ade
jmp 0x100102f8
mov eax, dword [esp + 0x14]
push eax
call fcn.10004cff
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
je 0x100102ea
mov esi, dword [esp + 0x10]
jmp 0x100102ee
call ebx
mov esi, eax
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, esi
push ebp
call fcn.10093ade
pop ecx
mov ecx, dword [esp + 0x4b4]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100587af
add esp, 0x4a8
ret