joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b1d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, 1
mov ecx, 0x10049960
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
je 0x1003b225
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp esi, 0x20
jae 0x1003b209
push 0
jmp 0x1003b20b
push 1
call ebx
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x10049960
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1003b200
mov ebx, dword [ebp - 4]
cmp dword [0x10049964], 0
je 0x1003b2f8
test ebx, ebx
jne 0x1003b244
mov ecx, edi
call fcn.1003ada0
mov edi, eax
jmp 0x1003b2fd
mov ecx, dword [0x1004a798]
xor esi, esi
test ecx, ecx
je 0x1003b264
mov edx, dword [0x1004a790]
mov eax, edx
cmp ebx, dword [eax]
je 0x1003b26e
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x1003b258
mov edi, 4
jmp 0x1003b2fd
cmp esi, 0xffffffff
je 0x1003b264
imul eax, esi, 0x2c
movzx eax, byte [eax + edx + 0x14]
shr eax, 1
and eax, 1
cmp eax, edi
je 0x1003b2ef
push 1
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.1003ab50
add esp, 4
mov edx, edi
mov ecx, esi
call fcn.1003aca0
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
test eax, eax
je 0x1003b2fd
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1003b2de
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1003b2d2
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x1003b2b1
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x10049964]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003b2fd
neg edi
sbb edi, edi
add edi, 6
jmp 0x1003b2fd
mov edi, 2
xor eax, eax
mov ecx, 0x10049960
xchg dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001be13
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001be52
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001be52
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001be52
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001be52
cmp dword [ecx + 0x74], 0xe
jbe 0x1001be52
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001ead0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001eb6d
push ebx
push esi
call fcn.1001ea99
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001ea2d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001eb1a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001eb6c
push edi
push eax
call fcn.1001fa8d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001eb3a
call fcn.1001d574
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001eb6b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001ea2d
add esp, 0x20
test eax, eax
jne 0x1001eb59
push edi
call fcn.1001d574
jmp 0x1001eb61
push ebx
call fcn.1001d574
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001edda
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cc8
push 0x10026cc0
push str.FlsAlloc
push 0x1f
call fcn.1001ecf6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001ee0e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10025150]
call esi
jmp 0x1001ee14
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001ee58
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026cd8
push 0x10026cd0
push str.FlsGetValue
push 0x21
call fcn.1001ecf6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001ee8f
push dword [ebp + 8]
mov ecx, esi
call dword [0x10025150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001ee97
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10026ce0
push 0x10026cd8
push str.FlsSetValue
push 0x22
call fcn.1001ecf6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001eed1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10025150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10024560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002458d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002458d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002904
Capabilities:
Get common file path

Disassembly:
push 8
mov eax, 0x100e36dc
call fcn.100bf4b7
call fcn.10002632
push eax
lea ecx, [ebp - 0x10]
call fcn.10002388
push dword [ebp + 0x10]
xor esi, esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.10003055
push 0x104
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1000218d
push esi
push esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x10002978
mov ecx, dword [ebp + 8]
push 0x101057bc
call fcn.10003055
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.100026dd
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.100026dd
mov eax, dword [ebp + 8]
jmp 0x10002a41
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.1000316d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
mov eax, dword [eax - 0xc]
dec eax
push eax
call fcn.10002aee
cmp ax, 0x5c
je 0x100029ae
mov esi, 0x101057f4
push esi
call fcn.10002333
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.10002c8b
push dword [ebp + 0xc]
call fcn.10002333
pop ecx
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.10002c8b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
push dword [eax - 0xc]
mov ecx, dword [edi - 0xc]
sub ecx, dword [eax - 0xc]
lea eax, [ebp + 0xc]
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.10002b12
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0
je 0x10002a49
push dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
push esi
call fcn.100c5d76
pop ecx
pop ecx
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
mov ebx, eax
call fcn.100026dd
test ebx, ebx
je 0x10002a1b
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push dword [eax - 0xc]
push eax
call fcn.10002c8b
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
push edi
call fcn.100030c2
mov esi, dword [ebp + 8]
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 0x14]
mov dword [esi], eax
lea ecx, [ecx - 0x10]
call fcn.100026dd
mov ecx, edi
call fcn.100026dd
mov eax, esi
call fcn.100bf480
ret 0x10
push 0x80004005
call fcn.1000236b
int3

Function at 0x10003199
Capabilities:
Get session information
Get session user name

Disassembly:
push 0x28
mov eax, 0x100e3756
call fcn.100bf4eb
mov esi, dword [ebp + 8]
xor edi, edi
push str.Kernel32.dll
mov dword [ebp - 0x30], esi
inc edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100031d1
push str.WTSGetActiveConsoleSessionId
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100031d1
call eax
mov edi, eax
xor ecx, ecx
mov dword [ebp - 0x18], 7
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], ecx
push eax
push 5
push edi
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x10003213
push dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
call fcn.10004129
push dword [ebp - 0x30]
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.10005441
lea ecx, [ebp - 0x2c]
call fcn.10005474
mov eax, esi
call fcn.100bf495
ret 4
Function at 0x10003230
Capabilities:
Get user security identifier

Disassembly:
push 0x234
mov eax, 0x100e3786
call fcn.100bf4eb
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov ebx, dword [ebp + 0xc]
xor edi, edi
push 0x208
mov dword [ebp - 0x240], esi
push edi
push eax
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x238], edi
call fcn.100c1710
xor eax, eax
mov dword [ebp - 0x220], edi
add esp, 0xc
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x240]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x238]
push eax
push edi
lea eax, [ebp - 0x234]
push eax
push edi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push dword [ebp - 0x234]
call fcn.100c5eeb
mov edi, eax
pop ecx
test edi, edi
je 0x10003317
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x234]
push eax
push edi
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10003310
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x230]
call fcn.10004129
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call fcn.100c5ef6
pop ecx
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.10005441
lea ecx, [ebp - 0x230]
call fcn.10005474
mov eax, esi
call fcn.100bf495
ret 8

Function at 0x1000333a
Capabilities:
List user accounts

Disassembly:
push 0x38
mov eax, 0x100e37cf
call fcn.100bf4eb
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2c]
push eax
push 2
push 1
push ebx
call dword [sym.imp.NETAPI32.dll_NetUserEnum]
mov dword [ebp - 0x40], eax
test eax, eax
je 0x1000339a
cmp eax, 0xea
jne 0x100033ed
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x10003404
cmp dword [ebp - 0x30], 0
jbe 0x100033f0
test esi, esi
je 0x100033ed
push dword [esi]
lea ecx, [ebp - 0x28]
call fcn.10003c8d
push str.Guest
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.10003c55
test eax, eax
je 0x100033d8
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.10003be0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
add esi, 0x20
call fcn.10005474
inc ebx
cmp ebx, dword [ebp - 0x30]
jb 0x100033a7
mov esi, dword [ebp - 0x2c]
test esi, esi
je 0x10003402
push esi
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
jmp 0x10003404
xor ebx, ebx
cmp dword [ebp - 0x40], 0xea
je 0x1000336f
mov eax, edi
call fcn.100bf495
ret 4
Function at 0x10005260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x10005272
push 0xd
pop eax
jmp 0x100052a4
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000527b
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x1000c5cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, ecx
push edi
push esi
call fcn.1003e820
mov dword [esp], 0x1010643c
push 0x84
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x1000c644
push esi
call fcn.10036c90
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1000c63d
push esi
call fcn.10036c90
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x1000c63d
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.1003ec50
add esp, 0xc
push 0
push ecx
mov eax, esp
mov dword [eax], 0x101057bc
call fcn.1000c55b
mov ecx, eax
call fcn.10067150
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
ret

Function at 0x1000c670
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x100e435b
call fcn.100bf4b7
mov edi, edx
mov esi, ecx
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
lea ecx, [ebp - 0x10]
call fcn.10003055
and dword [ebp - 4], 0
push esi
call fcn.10002333
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.10002c8b
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.100026dd
call fcn.100bf480
ret
Function at 0x1000cb77
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x1011b3bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
mov dword [ebp - 0x25c], ebx
test ebx, ebx
je 0x1000cd61
xor eax, eax
lea edi, [ebp - 0x220]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x100
je 0x1000cc27
xor eax, eax
lea edi, [ebp - 0x230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x228]
mov eax, dword [ebp - 0x218]
sub ecx, dword [ebp - 0x230]
sub eax, dword [ebp - 0x220]
cmp eax, ecx
jne 0x1000cd61
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x214]
sub ecx, dword [ebp - 0x22c]
sub eax, dword [ebp - 0x21c]
cmp eax, ecx
jne 0x1000cd61
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x260]
push eax
push ebx
call edi
xor esi, esi
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x1000cc53
lea ecx, [ebp - 0x264]
push ecx
push eax
call edi
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x264]
je 0x1000cd61
xor eax, eax
cmp dword [ebp - 0x220], eax
push esi
cmovge eax, dword [ebp - 0x220]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x220], eax
xor eax, eax
cmp dword [ebp - 0x21c], eax
cmovge eax, dword [ebp - 0x21c]
xor ebx, ebx
cmp dword [ebp - 0x218], ebx
mov dword [ebp - 0x270], eax
cmovge ebx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], eax
xor eax, eax
cmp dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ebx
cmovge eax, dword [ebp - 0x214]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x214], eax
call esi
push 1
mov edi, eax
call esi
sub ebx, dword [ebp - 0x268]
cmp ebx, edi
jl 0x1000cd61
mov ecx, dword [ebp - 0x26c]
sub ecx, dword [ebp - 0x270]
cmp ecx, eax
jl 0x1000cd61
mov esi, dword [ebp - 0x25c]
lea edi, [ebp - 0x258]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push esi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov ebx, eax
mov dword [ebp - 0x258], 0x28
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x1000cd45
xor ecx, ecx
mov eax, ebx
cmp dword [ebp - 0x234], 1
cmovne eax, ecx
mov dword [ebp - 0x25c], eax
mov edi, eax
push 0x208
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.USER32.dll_RealGetWindowClassW]
xor eax, eax
test edi, edi
setne al
jmp 0x1000cd63
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100be7ca
leave
ret
Function at 0x1000cd72
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x1000cdbc
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x1000cdab
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x1000cdbc
push esi
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x1000cdbe
xor eax, eax
pop esi
leave
ret
Function at 0x1000ec22
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100e453c
call fcn.100bf559
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000ec9f
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000ec9f
call fcn.1000d77b
mov esi, eax
jmp 0x1000ed96
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1000ecc2
call fcn.1000d77b
jmp 0x1000ed89
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000ecb8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea ecx, [esi + 1]
cmp ecx, esi
jae 0x1000ecf5
mov esi, 0x8007000e
jmp 0x1000ed8b
push 2
pop edx
mov byte [ebp - 4], 2
call fcn.1000dbfb
cmp eax, 0x400
jbe 0x1000ed16
push eax
lea ecx, [ebp - 0x418]
call fcn.1000d756
jmp 0x1000ed38
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x1000ed38
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x1000eceb
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000ecb8
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000eacd
mov esi, eax
test edi, edi
je 0x1000ed96
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000edaf
lea ecx, [ebp - 0x418]
call fcn.1000d741
mov eax, esi
call fcn.100bf4a6
ret 0x10
Function at 0x10011467
Capabilities:
Set registry value

Disassembly:
push 0x1c
mov eax, 0x100e48df
call fcn.100bf4b7
mov edi, ecx
xor esi, esi
xor ebx, ebx
inc esi
cmp dword [ebp + 0xc], 0xf060
jne 0x1001152b
push ebx
push str.ppmgr
lea ecx, [ebp - 0x28]
call fcn.10003b5c
mov dword [ebp - 0x28], 0x100eb9bc
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
push str.MiniTabCloseTip
lea ecx, [ebp - 0x24]
call fcn.1000c22a
mov ecx, dword [ebp - 0x10]
test eax, eax
cmovne ecx, esi
test ecx, ecx
je 0x1001151f
mov ecx, dword [edi + 0xfb8]
test ecx, ecx
je 0x1001151f
add ecx, 0x550
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
je 0x1001151f
push ecx
push ecx
mov ecx, dword [edi + 4]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
call fcn.10010ddc
add esp, 0xc
cmp eax, 2
jne 0x100114fd
lea ecx, [ebp - 0x28]
call fcn.10003b2a
xor eax, eax
jmp 0x100115be
xor eax, eax
cmp dword [ebp - 0x10], eax
push 4
sete al
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
push ebx
push str.MiniTabCloseTip
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003b2a
push dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_IsZoomed]
call esi
push dword [ebp + 0x10]
mov ebx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
push dword [edi + 4]
mov dword [ebp + 0xc], eax
call esi
cmp eax, ebx
je 0x100115bb
push str.sysmaxbutton
lea ecx, [edi + 0x30]
call fcn.10035fa0
test ebx, ebx
jne 0x1001158e
test eax, eax
je 0x10011579
mov edx, dword [eax]
mov ecx, eax
push ebx
call dword [edx + 0x100]
push str.sysrestorebutton
lea ecx, [edi + 0x30]
call fcn.10035fa0
test eax, eax
je 0x100115bb
push 1
jmp 0x100115b1
test eax, eax
je 0x1001159e
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0x100]
push str.sysrestorebutton
lea ecx, [edi + 0x30]
call fcn.10035fa0
test eax, eax
je 0x100115bb
push 0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x100]
mov eax, dword [ebp + 0xc]
call fcn.100bf480
ret 0x10
Function at 0x1001244f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1011b3bc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
push 4
pop eax
test edi, edi
mov dword [ebp - 0x1c], edi
lea ebx, [edi - 0x7a4]
cmove ebx, eax
push dword [ebx]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001252a
push dword [edi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1001252a
push dword [ebx]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x1001251f
push dword [ebx]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x1001251f
push dword [ebx]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1001251f
lea eax, [ebp - 0x18]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea esi, [edi + 0x768]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x2c]
lea esi, [ebp - 0x18]
sub dword [ebp - 0x18], eax
lea edi, [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0xc], eax
lea eax, [ebp - 0x2c]
cmp dword [ebp + 8], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1001250e
mov ecx, dword [ebp - 0x1c]
push 1
push eax
lea ecx, [ecx + 8]
call fcn.1000537e
jmp 0x1001252a
push ecx
mov ecx, dword [ebp - 0x1c]
push eax
push dword [ebx]
lea ecx, [ecx + 8]
call fcn.10012426
jmp 0x1001252a
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100be7ca
leave
ret 4