joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ee0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x100cdbe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x100a8812]
mov byte [ebp - 0x110], al
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.10082470
add esp, 0xc
mov dword [ebp - 0x114], 0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x114]
movsx eax, byte [edx]
test eax, eax
je 0x10008fd7
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x114]
mov edx, dword [ebp - 0x114]
mov al, byte [ecx]
mov byte [ebp + edx - 0x110], al
mov ecx, dword [ebp - 0x114]
movsx edx, byte [ebp + ecx - 0x110]
cmp edx, 0x5c
jne 0x10008fc3
mov eax, dword [ebp - 0x114]
mov byte [ebp + eax - 0x110], 0
mov ecx, dword [ebp - 0x114]
movsx edx, byte [ebp + ecx - 0x111]
cmp edx, 0x3a
je 0x10008fab
lea eax, [ebp - 0x110]
push eax
call fcn.10008db0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10008fab
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10008fab
xor al, al
jmp 0x1000901b
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x114]
mov dl, byte [eax]
mov byte [ebp + ecx - 0x110], dl
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
jmp 0x10008f1e
cmp dword [ebp - 0x114], 0
jle 0x10009019
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x114]
movsx edx, byte [ecx - 1]
cmp edx, 0x5c
je 0x10009019
mov eax, dword [ebp + 8]
push eax
call fcn.10008db0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10009019
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
neg eax
sbb eax, eax
neg eax
jmp 0x1000901b
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10081238
mov esp, ebp
pop ebp
ret
Function at 0x1000da80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea ecx, [ebp - 8]
call fcn.100657c0
push 0
push 0
push 0x2001f
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 8]
call fcn.10006590
test eax, eax
jne 0x1000dbc7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
neg edx
sbb edx, edx
neg edx
push edx
push str.UsePlotStyle
lea ecx, [ebp - 8]
call fcn.10006770
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 1]
neg ecx
sbb ecx, ecx
neg ecx
push ecx
push str.UsePenSet
lea ecx, [ebp - 8]
call fcn.10006770
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 2]
neg eax
sbb eax, eax
neg eax
push eax
push str.ModelSpaceOnly
lea ecx, [ebp - 8]
call fcn.10006770
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 3]
neg edx
sbb edx, edx
neg edx
push edx
push str.ScaleLineWeight
lea ecx, [ebp - 8]
call fcn.10006770
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push ecx
push str.ColorMode
lea ecx, [ebp - 8]
call fcn.10006770
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x1c]
push eax
push str.BkColorForAllLayouts
lea ecx, [ebp - 8]
call fcn.10006770
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
push edx
push str.BkColor
lea ecx, [ebp - 8]
call fcn.10006770
push 8
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
push 3
push 0
push str.LineWeightScale
lea ecx, [ebp - 8]
call fcn.1000abd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov ecx, dword [ebp + 0xc]
add ecx, 0x14
push ecx
push 3
push 0
push str.MinPenWidth
lea ecx, [ebp - 8]
call fcn.1000abd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 8]
call fcn.10006540
mov esi, dword [ebp + 0xc]
mov ecx, 8
mov edi, 0x100cf380
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 9], 1
lea ecx, [ebp - 8]
call fcn.100064f0
mov al, byte [ebp - 9]
jmp 0x1000dbd6
mov byte [ebp - 0xa], 0
lea ecx, [ebp - 8]
call fcn.100064f0
mov al, byte [ebp - 0xa]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ea90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009f519
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100cdbe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x14]
call fcn.100657c0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x100d0494
call fcn.10002ae0
mov ecx, dword [ebp - 0x24]
call sym.GsUI.dll_public:_void___thiscall_GsUI::PrintPenSet::CheckMinWidth_void_
push 0
push 0
push 0x2001f
push 0
push 0
push 0x100a9cec
push SysReAllocStringLen
lea ecx, [ebp - 0x14]
call fcn.10006590
test eax, eax
jne 0x1000ec6b
lea ecx, [ebp - 0x1c]
call fcn.10009d30
mov byte [ebp - 4], 1
push 8
push 0x100cf3a0
push 3
push 0
push 0x100a9d10
lea ecx, [ebp - 0x14]
call fcn.1000abd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, 0x100d0494
call fcn.10005060
movzx ecx, al
test ecx, ecx
je 0x1000eb4f
push 0x100a9d1c
mov ecx, 0x100d0494
call fcn.10002ae0
push 1
mov ecx, 0x100d0494
call fcn.1000abd0
push eax
push str.CurPenWidthColorSets
lea ecx, [ebp - 0x14]
call fcn.100067a0
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
call fcn.10006540
cmp dword [ebp - 0x18], 0
jne 0x1000ec5f
push str.SoftwareDWGToolCommonPenWidths_
lea ecx, [ebp - 0x1c]
call fcn.10002ae0
push 0x100d0494
lea ecx, [ebp - 0x1c]
call fcn.1000fdf0
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.1000abd0
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x14]
call fcn.10006590
test eax, eax
jne 0x1000ec5f
mov dword [ebp - 0x20], 0
jmp 0x1000ebd5
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0x100
jge 0x1000ec57
mov eax, dword [ebp - 0x20]
push eax
push 0x100a9d60
lea ecx, [ebp - 0x1c]
push ecx
call fcn.100072a0
add esp, 0xc
push 8
mov edx, dword [ebp - 0x20]
shl edx, 4
add edx, 0x100cf3a8
push edx
push 3
push 0
lea ecx, [ebp - 0x1c]
call fcn.1000abd0
push eax
lea ecx, [ebp - 0x14]
call fcn.1000abd0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x20]
push eax
push 0x100a9d64
lea ecx, [ebp - 0x1c]
push ecx
call fcn.100072a0
add esp, 0xc
mov edx, dword [ebp - 0x20]
shl edx, 4
movsx eax, word [edx + 0x100cf3b4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000abd0
push eax
lea ecx, [ebp - 0x14]
call fcn.10006770
jmp 0x1000ebcc
lea ecx, [ebp - 0x14]
call fcn.10006540
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.10009d50
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100064f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f100
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009f590
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100cdbe8]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x230], ecx
mov ecx, dword [ebp + 8]
call fcn.10010fb0
lea ecx, [ebp - 0x14]
call fcn.100657c0
mov dword [ebp - 4], 0
push 0x2001f
push 0x100a9d84
push SysReAllocStringLen
lea ecx, [ebp - 0x14]
call fcn.10006600
test eax, eax
jne 0x1000f1d3
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x200
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x234], eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 0x234]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
test eax, eax
jne 0x1000f1cb
cmp dword [ebp - 0x20], 0
jbe 0x1000f1c2
lea edx, [ebp - 0x22c]
push edx
mov ecx, dword [ebp + 8]
call fcn.10010fd0
mov dword [ebp - 0x20], 0x200
jmp 0x1000f171
lea ecx, [ebp - 0x14]
call fcn.10006540
mov ecx, dword [ebp + 8]
call fcn.10047580
test eax, eax
jne 0x1000f1ec
push str.Default
mov ecx, dword [ebp + 8]
call fcn.10010fd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100064f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.10081238
mov esp, ebp
pop ebp
ret 4
Function at 0x10018ce0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009fff6
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x40
mov eax, dword [0x100cdbe8]
xor eax, ebp
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, 0x1c
mov word [ebp - 0x24], ax
push 0x100abb38
mov ecx, dword [ebp + 8]
push ecx
call fcn.10083f23
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10018d39
xor al, al
jmp 0x10018eaf
mov edx, dword [ebp - 0x1c]
push edx
movzx eax, word [ebp - 0x24]
push eax
push 1
lea ecx, [ebp - 0x48]
push ecx
call fcn.10083e42
add esp, 0x10
mov edx, dword [ebp - 0x1c]
push edx
push 2
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.10083e42
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10083b6e
add esp, 4
test eax, eax
jne 0x10018d7c
movsx edx, word [ebp - 0x14]
test edx, edx
jg 0x10018d8f
mov eax, dword [ebp - 0x1c]
push eax
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x10018eaf
mov ecx, dword [ebp - 0x1c]
push ecx
push 2
push 1
lea edx, [ebp - 0x18]
push edx
call fcn.10083e42
add esp, 0x10
movzx eax, word [ebp - 0x18]
test eax, eax
je 0x10018dbe
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x10018eaf
mov dword [ebp - 4], 0
movsx edx, word [ebp - 0x14]
lea eax, [edx*4 - 2]
mov dword [ebp - 0x20], eax
push 1
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.100839f6
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
push 1
push 1
lea ecx, [ebp - 0x4c]
push ecx
call fcn.10083e42
add esp, 0x10
movsx edx, byte [ebp - 0x4c]
test edx, edx
jne 0x10018e03
jmp 0x10018e05
jmp 0x10018de5
mov eax, dword [ebp - 0x1c]
push eax
push 1
push 1
lea ecx, [ebp - 0x49]
push ecx
call fcn.10083e42
add esp, 0x10
mov edx, dword [ebp - 0x1c]
push edx
push 1
push 1
lea eax, [ebp - 0x4a]
push eax
call fcn.10083e42
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
push ecx
push 1
push 1
lea edx, [ebp - 0x4b]
push edx
call fcn.10083e42
add esp, 0x10
movzx eax, byte [ebp - 0x4b]
cmp eax, 2
jg 0x10018e5e
movzx ecx, byte [ebp - 0x4a]
movzx edx, byte [ebp - 0x49]
cmp ecx, edx
jg 0x10018e5e
movzx eax, byte [ebp - 0x49]
test eax, eax
jne 0x10018e6e
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x10018eaf
jmp 0x10018e93
mov dword [ebp - 4], 0xffffffff
jmp 0x10018ea1
mov eax, dword [ebp - 0x1c]
push eax
call fcn.10083af2
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.10081238
mov esp, ebp
pop ebp
ret
Function at 0x10018ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100cdbe8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov eax, 0x19
mov word [ebp - 0x14], ax
push 0x100abb3c
mov ecx, dword [ebp + 8]
push ecx
call fcn.10083f23
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10018f0a
xor al, al
jmp 0x10019056
mov edx, dword [ebp - 0xc]
push edx
movzx eax, word [ebp - 0x14]
push eax
push 1
lea ecx, [ebp - 0x3c]
push ecx
call fcn.10083e42
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
push 1
push 2
lea eax, [ebp - 4]
push eax
call fcn.10083e42
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 2
lea edx, [ebp - 8]
push edx
call fcn.10083e42
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
call fcn.10083b6e
add esp, 4
test eax, eax
jne 0x10018f69
movsx ecx, word [ebp - 4]
test ecx, ecx
jle 0x10018f69
movzx edx, word [ebp - 8]
test edx, edx
je 0x10018f7c
mov eax, dword [ebp - 0xc]
push eax
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x10019056
push 1
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100839f6
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
push 1
push 1
lea eax, [ebp - 0x3d]
push eax
call fcn.10083e42
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10083b6e
add esp, 4
test eax, eax
je 0x10018fc3
mov edx, dword [ebp - 0xc]
push edx
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x10019056
movsx eax, byte [ebp - 0x3d]
test eax, eax
jne 0x10018fcd
jmp 0x10018fcf
jmp 0x10018f8c
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 1
lea edx, [ebp - 0xd]
push edx
call fcn.10083e42
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
push 1
push 1
lea ecx, [ebp - 0x15]
push ecx
call fcn.10083e42
add esp, 0x10
mov edx, dword [ebp - 0xc]
push edx
push 1
push 1
lea eax, [ebp - 0x16]
push eax
call fcn.10083e42
add esp, 0x10
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10083b6e
add esp, 4
test eax, eax
jne 0x10019038
movzx edx, byte [ebp - 0x16]
cmp edx, 2
jg 0x10019038
movzx eax, byte [ebp - 0xd]
movzx ecx, byte [ebp - 0x15]
cmp eax, ecx
jl 0x10019038
movzx edx, byte [ebp - 0xd]
test edx, edx
jne 0x10019048
mov eax, dword [ebp - 0xc]
push eax
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x10019056
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10083af2
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10081238
mov esp, ebp
pop ebp
ret
Function at 0x100352f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a24eb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100cdbe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.1002e660
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.1002e660
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004a950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x100b3260
mov ecx, dword [ebp + 8]
call fcn.10006bd0
push eax
call fcn.10083f23
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
call fcn.1004a8e0
cmp dword [ebp - 4], 0
je 0x1004aa1f
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.100839f6
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10087247
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.100839f6
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.1004a860
movzx ecx, al
test ecx, ecx
jne 0x1004a9d6
mov edx, dword [ebp - 4]
push edx
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x1004aa21
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.10083e42
add esp, 0x10
cmp eax, 1
je 0x1004aa0f
mov ecx, dword [ebp - 0xc]
call fcn.1004a8e0
mov edx, dword [ebp - 4]
push edx
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x1004aa21
mov eax, dword [ebp - 4]
push eax
call fcn.10083af2
add esp, 4
mov al, 1
jmp 0x1004aa21
xor al, al
mov esp, ebp
pop ebp
ret 4

Function at 0x1004aa30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x100b3264
mov ecx, dword [ebp + 8]
call fcn.10006bd0
push eax
call fcn.10083f23
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004aa99
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.10087417
add esp, 0x10
cmp eax, 1
je 0x1004aa89
mov edx, dword [ebp - 4]
push edx
call fcn.10083af2
add esp, 4
xor al, al
jmp 0x1004aa9b
mov eax, dword [ebp - 4]
push eax
call fcn.10083af2
add esp, 4
mov al, 1
jmp 0x1004aa9b
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x1004b520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1004bad0
push str.LanguageText
movzx eax, word [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1004b552
xor al, al
jmp 0x1004b5a1
mov ecx, dword [ebp - 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1004b56b
xor al, al
jmp 0x1004b5a1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1004b582
xor al, al
jmp 0x1004b5a1
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.1004b5b0
mov esp, ebp
pop ebp
ret 4

Function at 0x1004ddb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
call fcn.10013ec0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 0
je 0x1004ddf3
cmp dword [ebp - 0x10], 0
jne 0x1004ddf7
xor eax, eax
jmp 0x1004de2b
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
cmp ecx, 0x4d42
je 0x1004de16
xor eax, eax
jmp 0x1004de2b
mov edx, dword [ebp - 0xc]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1004d8c0
mov esp, ebp
pop ebp
ret 8
Function at 0x10052360
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x1005237b
xor eax, eax
jmp 0x1005249a
push 0
push 0
push 0
push 0x100b32d8
call dword [sym.imp.GDI32.dll_CreateDCA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x30], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 8], eax
push 0xa
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
jge 0x100523ea
mov dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0
jge 0x100523f7
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 8]
jle 0x10052405
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0xc]
jle 0x10052413
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1c], eax
push 0xcc0020
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x1006b38e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x1006b3b2
cmp dword [edi + 0x54], 0
jne 0x1006b3b2
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.10071ec7
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1006b34f
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10070994
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x100709db
call fcn.10071ec7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x100709db
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x100709f7
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1007050e
mov esi, eax
test edi, edi
je 0x100709f5
test ebx, ebx
je 0x100709f5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100714d1
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x100a49e2
call fcn.10087e64
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x100714f6
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1007153c
lea ecx, [ebp - 0x10]
call fcn.10009d30
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10071079
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10002b00
mov eax, esi
call fcn.10087f3c
ret 8
Function at 0x10074d3b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x10074d53
mov edi, dword [esi + 0xc]
jmp 0x10074d93
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x10074d6c
call fcn.1007864e
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x10074d81
call fcn.1007864e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x10074d93
call fcn.1007864e
call fcn.10071ec7
cmp dword [eax + 0x3c], 0
je 0x10074da8
push edi
mov ecx, ebx
call fcn.10073c22
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.10074c61
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x10074dc6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x10074dd2
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10081238
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100cdbe8]
jne 0x10081242
repz ret
jmp fcn.10089976