joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022af0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x1014de0c], edx
push ebx
push esi
push edi
push ebp
jbe 0x10022cf7
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x1014dcd0
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x10022cf7
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x10022b59
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x10022b6a
push 2
push 0
push edx
call fcn.10020210
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x10022c06
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x10022c3f
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x10022bcd
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x10022bbb
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x10022ba2
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10022c35
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x10022b8d
jmp 0x10022c3f
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10022c35
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x10022c3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x10022ce6
cmp dword [esp + 0x10], 0
je 0x10022c98
cmp dword [esp + 0x10], 5
jne 0x10022c7b
mov dword [0x10112de0], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x10112de4], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.1001fbd0
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x10022cc2
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x10022cc2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x10112de0], 0x1c
mov dword [0x10112de4], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x10112de0], 9
mov dword [0x10112de4], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x10024840
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.1001c260
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1014]
push ebp
cmp dword [0x1014de0c], esi
jbe 0x1002498d
mov eax, esi
mov ecx, esi
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
mov edx, dword [eax + 0x1014dcd0]
test byte [edx + ecx*8 + 4], 1
je 0x1002498d
push 1
push ebx
push esi
call fcn.10020210
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x1002497d
push 2
push ebx
push esi
call fcn.10020210
add esp, 0xc
cmp eax, 0xffffffff
je 0x1002497d
mov ecx, dword [esp + 0x101c]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x10024923
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.100254f0
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebp, eax
jge 0x100248e6
mov eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.10022af0
add esp, 0xc
cmp eax, 0xffffffff
je 0x10024902
sub ebp, eax
test ebp, ebp
jg 0x100248db
jmp 0x10024917
cmp dword [0x10112de4], 5
jne 0x10024915
mov dword [0x10112de0], 0xd
mov ebx, eax
push edi
push esi
call fcn.100254f0
add esp, 8
jmp 0x10024960
jge 0x10024960
push 0
push ecx
push esi
call fcn.10020210
add esp, 0xc
push esi
call fcn.10022980
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x10024960
mov dword [0x10112de0], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x10112de4], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.10020210
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x10112de0], 9
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x100261f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10026215
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1001fbd0
add esp, 4
mov eax, 0xffffffff
ret
test al, 1
je 0x1002623a
test byte [esp + 8], 2
je 0x1002623a
mov dword [0x10112de0], 0xd
mov dword [0x10112de4], 5
mov eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x100262d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100262f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1001fbd0
add esp, 4
mov eax, 0xffffffff
pop esi
ret
test byte [esp + 0xc], 0x80
je 0x10026303
and eax, 0xfffffffe
jmp 0x10026306
or eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x10026328
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1001fbd0
add esp, 4
mov eax, 0xffffffff
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10024f60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10024f84
xor eax, eax
jmp 0x10025004
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10024f9b
xor eax, eax
jmp 0x10025004
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10024fe7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10024fe7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x10024fbe
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10024ff3
xor eax, eax
jmp 0x10025004
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10025001
xor eax, eax
jmp 0x10025004
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10025750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1023be34]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x10025777
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1002577e
mov al, 1
jmp 0x10025859
call fcn.10003450
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10003450
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10027a20
add esp, 8
movzx eax, al
test eax, eax
je 0x100257ba
xor al, al
jmp 0x10025859
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.1002a780
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x100257f6
cmp dword [ebp - 0x30], 1
je 0x100257fd
cmp dword [ebp - 0x30], 3
je 0x1002584c
jmp 0x10025857
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x1002582c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.101a3bc4
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x1002582c
xor al, al
jmp 0x10025859
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10025840
mov dword [ebp - 0x38], 1
jmp 0x10025847
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x10025859
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x10025859
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1019bdf7
mov esp, ebp
pop ebp
ret
Function at 0x10029590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1023be34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.10003450
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.10027a20
add esp, 8
movzx edx, al
test edx, edx
je 0x100295d5
lea eax, [ebp + 8]
push eax
call fcn.10029440
add esp, 4
jmp 0x10029756
mov ecx, dword [ebp - 0x2c]
call fcn.10029920
test eax, eax
je 0x10029617
mov ecx, dword [ebp - 0x2c]
call fcn.10029920
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.10027a00
cmp esi, eax
jae 0x10029617
lea ecx, [ebp + 8]
push ecx
call fcn.1002a3f0
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.10026370
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x10029756
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x1002962a
call fcn.10003450
jmp 0x10029756
mov ecx, dword [ebp - 0x2c]
call fcn.10026440
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x10029679
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.1002a3f0
add esp, 4
movzx ecx, al
push ecx
call fcn.100046f0
add esp, 8
movzx edx, al
test edx, edx
je 0x10029669
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x10029671
call fcn.10003450
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x10029756
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.1002a3f0
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.10029550
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10029751
cmp dword [ebp - 0x34], 1
jle 0x100296d4
cmp dword [ebp - 0x34], 3
je 0x10029721
jmp 0x10029751
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x10029706
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.101a3bc4
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10029706
call fcn.10003450
jmp 0x10029756
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x1002971a
mov eax, dword [ebp + 8]
jmp 0x10029756
call fcn.10003450
jmp 0x10029756
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.100046f0
add esp, 8
movzx eax, al
test eax, eax
je 0x10029744
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x1002974c
call fcn.10003450
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x10029756
call fcn.10003450
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1019bdf7
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x1002a8b0
jl 0x1002a8a7
cmp dword [ebp + 0xc], 0
ja 0x1002a8b0
xor eax, eax
xor edx, edx
jmp 0x1002a9e7
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x1002a8d2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.1002a9f0
jmp 0x1002a9e7
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.10025b50
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x1002a941
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10002150
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.10028e90
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10003380
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.10027bd0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x1002a9d8
mov ecx, dword [ebp - 8]
call fcn.10026440
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x1002a9b1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.101a353d
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x1002a9af
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1002a9e7
jmp 0x1002a95d
cmp dword [ebp - 4], 0
jbe 0x1002a9d8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.101a353d
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006a2ae
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x1006a301
push esi
push dword [ebp + 8]
call fcn.1006a49a
mov edi, eax
test edi, edi
je 0x1006a2fc
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1006a2fc
mov eax, dword [ebp - 8]
jmp 0x1006a313
mov eax, dword [ebp + 0x10]
jmp 0x1006a313
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x1006a319
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c97e1
mov eax, dword fs:[0]
push eax
mov eax, 0x1018
call fcn.1019c150
mov eax, dword [0x1023be34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x58], 0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1024], eax
je 0x1006a44d
push 0
push edx
call fcn.1006a49a
mov ebx, eax
test ebx, ebx
jne 0x1006a381
push esi
jmp 0x1006a475
call fcn.1006702c
push eax
lea ecx, [ebp - 0x1014]
call fcn.10006730
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x1024]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x101c], eax
test eax, eax
jne 0x1006a40c
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.10016d70
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x1024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x101c], eax
call fcn.100443f0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x101c], 0
jne 0x1006a43a
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.1000a540
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.10016e40
jmp 0x1006a47c
push esi
mov ecx, edi
call fcn.10006860
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x1006a433
test esi, esi
jne 0x1006a456
mov esi, 0x101e07cd
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.10006860
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1019bdf7
leave
ret 0x10
Function at 0x1006c2ac
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x101c99a8
call fcn.1019c91b
mov esi, ecx
mov dword [ebp - 0x14], esi
lea eax, [esi + 0x1c]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x1006c3b6
cmp ebx, dword [esi + 0xc]
jge 0x1006c3b6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x1006c303
cmp ebx, dword [edi + 8]
jl 0x1006c3a4
cmp dword [ebp + 0xc], 0
je 0x1006c3a4
xor ebx, ebx
jmp 0x1006c33d
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
call fcn.1006bd0a
mov edi, eax
test edi, edi
je 0x1006c31d
mov dword [edi], vtable.CThreadData.0
jmp 0x1006c31f
mov edi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x14]
push edi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call fcn.1006c1d8
mov ecx, dword [esi + 0x14]
mov dword [eax], ecx
mov dword [esi + 0x14], edi
mov esi, dword [ebp - 0x14]
cmp dword [edi + 0xc], ebx
jne 0x1006c358
push 4
push dword [esi + 0xc]
call fcn.10066e7b
pop ecx
pop ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x1006c370
push 2
push 4
push dword [esi + 0xc]
call fcn.10066e7b
pop ecx
pop ecx
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x1006c3dd
mov ecx, dword [edi + 8]
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push ebx
push eax
call fcn.1019f490
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [edi + 8], eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x1006c3b6
cmp ebx, dword [edi + 8]
jge 0x1006c3b6
mov eax, dword [ebp + 0xc]
mov dword [ecx + ebx*4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1019c879
ret 8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10065a3b
int3

Function at 0x10070b2c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x10070b6b
call fcn.1006764c
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10070b6b
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10070b73
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.1007d9c8
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10071569
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x100715f5
cmp dword [esi + 0x20], 0
je 0x100715f5
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100715f5
cmp dword [ebp + 8], 0
je 0x100715f5
xor edi, edi
mov ebx, edi
call fcn.1006764c
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x100715d9
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100715f5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1007e4c9
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100715f1
mov ecx, esi
call fcn.1007130b
mov eax, edi
jmp 0x100715f7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10075b89
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101c973b
call fcn.1019c8b0
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x10075baf
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10075c0f
call fcn.1006702c
push eax
lea ecx, [ebp - 0x10]
call fcn.10006730
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x101d7cb0]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.101a7b6f
push eax
call fcn.1000a360
add esp, 0x14
test esi, esi
je 0x10075c02
push esi
call fcn.101a7bf0
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10016e40
mov eax, ebx
call fcn.1019c879
ret 8