joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ad5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x42f5e4
call fcn.0042f4e8
mov eax, 0x1428
call fcn.00411080
push ebx
push esi
xor esi, esi
cmp dword [0x4e4fc0], 0x5b1
push edi
jne 0x403b81
push esi
lea eax, [ebp - 0x434]
push eax
push esi
push 0x402f5c
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
lea eax, [ebp - 0x34]
call fcn.00403e0a
mov dword [ebp - 4], esi
call fcn.004049ad
push 0x402f88
lea ecx, [ebp - 0x18]
call fcn.00403560
lea ecx, [ebp - 0x18]
call fcn.0040357c
lea ecx, [ebp - 0x18]
call fcn.004035c2
lea ecx, [ebp - 0x18]
call fcn.004035db
push esi
push esi
call fcn.00404f0f
push esi
call fcn.00404ee0
push esi
call fcn.00404ec9
push esi
call fcn.0040521d
add esp, 0x10
mov dword [esp], esi
call fcn.00403714
fstp st(0)
push esi
call fcn.00404ec9
pop ecx
call fcn.00404fd8
add dword [0x4e4fc0], 0x1134b
push dword [0x4e4fc0]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4e3f10], eax
call fcn.00403a20
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d47
jg 0x403bca
inc edi
cmp edi, 0x4f6a4
jl 0x403baa
mov eax, dword [0x4e4fc0]
xor ecx, ecx
cmp eax, esi
jbe 0x403bf0
mov edx, dword [0x4e4fc4]
mov dl, byte [edx + ecx + 0x1134b]
mov edi, dword [0x4e3f10]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x403bd5
xor edi, edi
lea ecx, [eax + edi]
cmp ecx, 0xe
jne 0x403c3f
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [ebp - 0x434]
push eax
push esi
push 0x402f98
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402fb0
push 0x402fe4
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
mov eax, dword [0x4e4fc0]
inc edi
cmp edi, 0x39621
jl 0x403bf2
call fcn.0040390a
xor edi, edi
call ebx
cmp edi, 0x26
jne 0x403c5b
call fcn.00403a06
inc edi
cmp edi, 0x6753f
jl 0x403c4f
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x7b
pop ebx
cmp dword [0x4e4fc0], 0x86
jne 0x403cb6
push 0x402ff4
push 0x403030
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push esi
lea eax, [ebp - 0xc34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp dword [0x4e4fc0], 0xf
jne 0x403cd7
push esi
push esi
call edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0x403078
push 0x4030bc
call edi
dec ebx
jne 0x403c6d
push 0x4030f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40591b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4317dc]
jne 0x405925
repz ret
jmp fcn.0040a70c
Function at 0x40eb2b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407e02
and dword [ebp - 4], 0
cmp dword [0x435b34], 0
mov ebx, eax
jne 0x40ebdc
push 0x402c6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ec8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c60
push edi
call esi
test eax, eax
je 0x40ec8d
push eax
call fcn.00407d90
mov dword [esp], 0x402c50
push edi
mov dword [0x435b34], eax
call esi
push eax
call fcn.00407d90
mov dword [esp], 0x402c3c
push edi
mov dword [0x435b38], eax
call esi
push eax
call fcn.00407d90
mov dword [esp], 0x402c20
push edi
mov dword [0x435b3c], eax
call esi
push eax
call fcn.00407d90
pop ecx
mov dword [0x435b44], eax
test eax, eax
je 0x40ebdc
push 0x402c08
push edi
call esi
push eax
call fcn.00407d90
pop ecx
mov dword [0x435b40], eax
mov eax, dword [0x435b40]
cmp eax, ebx
je 0x40ec34
cmp dword [0x435b44], ebx
je 0x40ec34
push eax
call fcn.00407e0b
push dword [0x435b44]
mov esi, eax
call fcn.00407e0b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ec34
test edi, edi
je 0x40ec34
call esi
test eax, eax
je 0x40ec2b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ec2b
test byte [ebp - 0xc], 1
jne 0x40ec34
or dword [ebp + 0x10], 0x200000
jmp 0x40ec6d
mov eax, dword [0x435b38]
cmp eax, ebx
je 0x40ec6d
push eax
call fcn.00407e0b
pop ecx
test eax, eax
je 0x40ec6d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ec6d
mov eax, dword [0x435b3c]
cmp eax, ebx
je 0x40ec6d
push eax
call fcn.00407e0b
pop ecx
test eax, eax
je 0x40ec6d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435b34]
call fcn.00407e0b
pop ecx
test eax, eax
je 0x40ec8d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ec8f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e017
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000e08c
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000e080
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1000e08a
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1000e0c5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
push 0x68ce
push 0x7b41
push 0x5e99
push 1
push dword [ebp - 0x2c]
push 0x35da
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1000d234
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x10013c41
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10013c76
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.10013cd8
add esp, 0x10
jmp 0x10013cd4
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10013cb1
mov byte [ebp - 1], 0
push 0x39ee
push 0
lea eax, [ebp - 1]
push eax
push 0x46b6
push 0
push 0x13ca
call fcn.10013c41
add esp, 0x18
jmp 0x10013cd4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10013cd4
push 0x2455
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x10017034
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001709e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10017092
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10017090
push 1
push 0x7f17
push 0x10ae
push 0
push 0x6b7d
push 0x3b7e
push 1
call fcn.10017034
add esp, 0x1c
jmp 0x1001709c
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10017111
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100170ea
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.1000f696
or dword [eax], 0xffffffff
jmp 0x10017111
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10017111
push 0x7c1
push 0
push 1
call fcn.10013898
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10028134
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100281f7
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100281d7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100281bd
mov ecx, dword [ebp - 4]
call fcn.100291bf
movzx eax, al
test eax, eax
jne 0x100281d5
push dword [ebp - 0x30]
mov ecx, dword [ebp - 4]
call fcn.1002914e
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov byte [eax], 1
jmp 0x100281f5
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x100281f5
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x10028214
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
push 0x323a
push dword [ebp - 0x44]
push 0x6e60
push 0
call fcn.10013bf8
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1002b1a1
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002b221
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002b1d7
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1002b21f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002b205
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002b21f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000f696
or dword [eax], 0xffffffff
jmp 0x1002b1fa
jmp 0x1002b258
push 0x4a02
push 0x3a7e
push 0x6749
push 0x368b
push 0x3a35
push 0x77be
push 0xe8e
push 0x29d2
push 0
push 0x3c41
call fcn.1002aba8
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x1002f9e4
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002fa36
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x5e77
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x6c67
push 0x4ecb
push dword [ebp - 0x14]
push 1
push 0x89f
push dword [ebp - 0x18]
call fcn.1002fab0
add esp, 0x24
jmp 0x1002faac
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002fa4e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1002faac
mov dword [ebp - 0x20], 1
mov dword [ebp - 8], 0
jmp 0x1002fa65
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x1002fa78
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x2c], 0xa6847dfa
jmp 0x1002fa5e
lea eax, [ebp - 0x20]
push eax
push 0x2da7
push 0
push 0x1984
call fcn.10033d03
add esp, 0x10
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x7761
push 0
push 0x5adf
call fcn.1004146a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10033aba
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10033aef
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10033ae5
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x10033aed
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x10033b0c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x3ea9
push dword [ebp - 8]
push 0x4548
push 0
call fcn.10035458
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10033d25
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10033ded
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10033da6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10033d87
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10033da4
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.1000f696
mov dword [eax], 0xee7d214c
jmp 0x10033d7c
jmp 0x10033deb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 2
jmp 0x10033dc8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jl 0x10033deb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10033de9
push 0x2455
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x10033dbd
jmp 0x10033e43
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10033e0d
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x10033e43
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10033e43
push 0
push 0x408
push 0x647d
push 0x43e9
push 0x30ad
push 1
call fcn.10033c82
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1003578f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10074d95
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100358f6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100358c1
mov dword [ebp - 0x1c], 0x36e0
mov dword [ebp - 0x28], 0x10008650
cmp dword [ebp - 0x1c], 0x39de
jle 0x1003586d
and dword [ebp - 0x14], 0
jmp 0x100357fb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1ac3
jge 0x10035856
and dword [ebp - 0x18], 0
jmp 0x10035811
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1760
jge 0x10035854
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.1000ab1b
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.1000f3b7
push eax
call fcn.1005d2b3
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.1000f3ad
jmp 0x1003580a
jmp 0x100357f4
push 0x1cfb
push 0xd52
push 0x16cf
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x36a0
jge 0x10035899
push dword [ebp - 0x28]
call fcn.1005d2b3
pop ecx
jmp 0x100358b5
or dword [ebp - 4], 0xffffffff
jmp 0x100358bf
jmp 0x100358f4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x100358f4
push 0x8e0
push 0x2741
push 1
push 0
push 1
push 0x6165
call fcn.100422c9
add esp, 0x18
jmp 0x10035917
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
push 0x12b3
push dword [ebp - 0x38]
push 0
push dword [ebp - 0x3c]
call fcn.1002bf46
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039d7b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10039ddc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10039dc8
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10039dc6
push 0
push 1
push 0x3327
call fcn.10039d7b
add esp, 0xc
jmp 0x10039dda
push 0x2652
push 0
push 0x1b61
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10039dea
push 0
push 0x4ef1
call fcn.1002fdd6
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100409d4
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10040a05
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push 0x61d0
call fcn.10040a51
add esp, 0x10
jmp 0x10040a4d
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10040a3b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10040a39
push 0
call fcn.1003710b
pop ecx
jmp 0x10040a4d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10040a4d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret
Function at 0x10041084
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10075087
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100411f6
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0x5f8b
mov dword [ebp - 0x58], 0x10008970
cmp dword [ebp - 0x1c], 0x6121
jle 0x10041150
and dword [ebp - 0x14], 0
jmp 0x100410f4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x530b
jge 0x10041150
and dword [ebp - 0x18], 0
jmp 0x1004110a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3237
jge 0x1004114e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x80]
call fcn.1000ab1b
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.1000f3b7
push eax
call fcn.1005d2b3
pop ecx
lea ecx, [ebp - 0x80]
call fcn.1000f3ad
jmp 0x10041103
jmp 0x100410ed
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1004117c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1004117a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x100411b8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [ecx], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5be1
jge 0x100411ce
push dword [ebp - 0x58]
call fcn.1005d2b3
pop ecx
jmp 0x100411ea
or dword [ebp - 4], 0xffffffff
jmp 0x100411f4
jmp 0x10041212
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x60], eax
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push 0
call fcn.1002be36
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret