joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f650
Capabilities:
Create pipe
Get thread local storage value
Read file on windows
Write file on windows
Write pipe

Disassembly:
sub esp, 0x4a8
cmp dword [0x88c68c], 0xa76
jne 0x40f725
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
xor eax, eax
push eax
lea ecx, [esp + 4]
push ecx
push eax
lea edx, [esp + 0xb4]
push edx
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringA]
mov eax, dword [0x8b801c]
mov edx, dword [0x87ab94]
mov cl, byte [eax + esi + 0xa2401]
mov byte [edx + esi], cl
add esp, 0x4a8
ret
Function at 0x40f750
Capabilities:
Connect pipe
Read .ini file
Read pipe
Write pipe

Disassembly:
sub esp, 0x458
cmp dword [0x88c68c], 0x13f7
mov eax, dword [esp + 0x45c]
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [eax + 4]
mov eax, dword [0x41ce70]
mov dword [esp + 8], 0xc6ef3720
mov dword [esp + 0x14], 0x9e3779b9
mov dword [esp + 0x1c], eax
jne 0x40f793
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
cmp dword [0x88c68c], 0xf57
mov ecx, dword [0x41ce74]
mov edx, dword [0x41ce78]
mov eax, dword [0x41ce7c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
jne 0x40f7d6
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x6c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push esi
mov dword [esp + 0x10], 0x20
push edi
mov edi, ebx
shl edi, 4
cmp dword [0x88c68c], 0x36f
jne 0x40f7f9
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov esi, ebx
shr esi, 5
add esi, dword [esp + 0x20]
add edi, eax
add ecx, ebx
xor edi, ecx
cmp dword [0x88c68c], 0x3f5
mov dword [0x87ab98], 0xe9ea0636
jne 0x40f83b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
xor esi, edi
cmp dword [0x88c68c], 0x6e6
jne 0x40f87d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x30
lea eax, [esp + 0x3c]
push 0
push eax
mov dword [esp + 0x40], 0
call fcn.00403820
add esp, 0xc
push 0
lea ecx, [esp + 0x38]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigA]
sub ebp, esi
cmp dword [0x88c68c], 0x839
jne 0x40f8b5
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteTapemark]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
mov esi, ebp
shl esi, 4
cmp dword [0x88c68c], 0x78c
jne 0x40f8dc
push 0
lea edx, [esp + 0x34]
push edx
push 0
lea eax, [esp + 0x74]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
add esi, dword [esp + 0x24]
cmp dword [0x88c68c], 0x196
mov ecx, dword [esp + 0x10]
lea edi, [ecx + ebp]
jne 0x40f8f9
call dword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
mov edx, ebp
shr edx, 5
add edx, dword [esp + 0x18]
mov dword [0x87aba0], 0xcbd61084
xor edx, edi
xor edx, esi
mov dword [0x87aba4], 0xffffffff
sub ebx, edx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x10], eax
sub dword [esp + 0x14], 1
jne 0x40f7e0
cmp dword [0x88c68c], 0x8d4
pop edi
pop esi
jne 0x40f94c
push 0
push 0
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
mov eax, dword [esp + 0x464]
mov dword [eax + 4], ebp
pop ebp
mov dword [eax], ebx
pop ebx
add esp, 0x458
ret 4
Function at 0x40f980
Capabilities:
Copy file
Delete file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov esi, dword [0x87ab94]
push edi
mov edi, dword [0x88c68c]
cmp edi, 0x124b
jne 0x40f9a5
push 0
push 0
push 0
call ebx
cmp dword [0x88c68c], 0xc00
jne 0x40f9d5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll__lclose]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
shr edi, 3
test edi, edi
jbe 0x40fa1d
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileExA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esp, [esp]
cmp dword [0x88c68c], 0xec9
jne 0x40fa0e
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
call ebp
push esi
call fcn.0040f750
add esi, 8
sub edi, 1
jne 0x40f9f0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40fd50
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x838
push ebx
push ebp
push esi
mov eax, 0x41e278
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fd68
sub eax, edx
xor esi, esi
cmp eax, 0xbe943
jne 0x40fd84
push esi
push esi
call fcn.00402611
add esp, 8
mov ebx, dword [sym.imp.GDI32.dll_GetBitmapDimensionEx]
mov ebp, dword [sym.imp.GDI32.dll_GetBoundsRect]
xor edi, edi
push esi
push esi
call ebx
push esi
push esi
push esi
call ebp
cmp dword [0x88c68c], 0x769
jne 0x40fdd4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x4c]
push ecx
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
lea edx, [esp + 0x44c]
push edx
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
cmp edi, 0x114f2a
mov dword [0x87ab9c], esi
jle 0x40fe0e
cmp dword [esp + 0x14], 0x50854379
je 0x40fe0e
cmp dword [esp + 0x2c], 0x2b1a6577
je 0x40fe0e
cmp dword [0x88c68c], 0x1b5
jne 0x40fe0e
push esi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
inc edi
cmp edi, 0x4a5e5a
jl 0x40fd92
mov edi, dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov ebp, dword [sym.imp.KERNEL32.dll_SetSystemTime]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLocalTime]
mov dword [esp + 0x14], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
jmp 0x40fe40
cmp dword [0x88c68c], 0xfc
jne 0x40fe84
lea ecx, [esp + 0x18]
push ecx
push 0
call esi
push 0
push 0
push 0
push 0
call edi
xor eax, eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
lea eax, [esp + 0x20]
xor edx, edx
push eax
mov word [esp + 0x24], dx
call ebp
push 0
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x88c68c], 0x1264
jne 0x40fea9
mov ecx, dword [esp + 0x18]
push 0
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
mov eax, dword [esp + 0x14]
cmp eax, 0x18f9a6
jle 0x40fec8
cmp dword [esp + 0x34], 0x8a392
je 0x40fec8
cmp dword [esp + 0x18], 0x14d7d90b
jne 0x40fed8
inc eax
cmp eax, 0x3532b7b1
mov dword [esp + 0x14], eax
jl 0x40fe40
call fcn.0040fa30
cmp dword [0x88c68c], 0xbee
jne 0x40ff23
call dword [sym.imp.KERNEL32.dll_GetACP]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor eax, eax
lea edx, [esp + 0x20]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push edx
lea eax, [esp + 0x1c]
push eax
push 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403e57
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp byte [edi], 0x25
jne 0x403ed4
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call fcn.00403093
lea eax, [ebp + eax - 0x105]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x25
jne 0x403ebc
and byte [eax], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x104]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push eax
push 0x4016ec
call esi
pop edi
pop esi
leave
ret 0x18

Function at 0x4041d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40422c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404223
cmp dword [ebp + 8], esi
jne 0x404223
cmp dword [ebp - 4], esi
jne 0x404223
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x3eb21807
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x1e870aea
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6a
nop
nop
sub eax, 0x403d10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x412284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x40105e
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.00402c9d
add esp, 0x14
lea eax, [ebp - 0x804]
push eax
push 0x410a3c
call fcn.00401fb4
add eax, 0x40
push eax
call fcn.00401c10
add esp, 0xc
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ad5
leave
ret
Function at 0x1001399e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100139f9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100139da
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100139f7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016ff9
mov dword [eax], 8
jmp 0x100139cf
jmp 0x10013a1c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10013a1c
push 0x16bb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x1001ac67
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ac81
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1001accc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001acaf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001accc
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016ff9
mov dword [eax], 0xfffffffe
jmp 0x1001aca4
mov esp, ebp
pop ebp
ret
Function at 0x1002be4e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002be96
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1002beb6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002beb6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x1002f255
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f279
xor eax, eax
jmp 0x1002f3fb
lea eax, [ebp - 0x10]
push eax
push 0x524e
lea eax, [ebp - 8]
push eax
push 0x7c10
lea eax, [ebp + 8]
push eax
push 0x6926
push 1
call fcn.1002f020
add esp, 0x1c
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f2b0
xor eax, eax
jmp 0x1002f3fb
push 1
push 0x2387
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002f0a5
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002f2d4
xor eax, eax
jmp 0x1002f3fb
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002f109
add esp, 0x18
push 0x5547
push dword [ebp - 4]
push 0
push 0x3934
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1002d80d
add esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
push 0x5010
lea eax, [ebp - 0x14]
push eax
call fcn.1002f191
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x1002f359
push 0x2ff9
push dword [ebp - 0x14]
push 0x58c6
push 0x53bf
push 0x52ca
push 0x7cb6
push dword [ebp - 4]
push 1
call fcn.10029389
add esp, 0x20
push dword [ebp - 4]
call fcn.1002cf9c
pop ecx
test eax, eax
jne 0x1002f36d
xor eax, eax
jmp 0x1002f3fb
push 0x2032
push 0x3e90
push 0x13ba
push 0x5f42
push 0
push 0x1074
push dword [ebp - 4]
call fcn.1002e734
add esp, 0x1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f3e3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f3b2
xor eax, eax
jmp 0x1002f3fb
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f3cb
xor eax, eax
jmp 0x1002f3fb
push 1
push 0x7b70
push 0x5d3a
lea eax, [ebp - 4]
push eax
call fcn.1002f1fe
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f3f4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f3f8
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10041495
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x10041647
push ebx
push dword [esi]
xor ebx, ebx
push ebx
push dword [esi + 4]
call fcn.10023e88
push dword [esi + 4]
call fcn.10072432
mov eax, 0xb4e1a362
add esp, 0x10
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0xc], 0x5f84255e
mov dword [ebp - 0x18], 0x656540f2
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x100414f8
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [ebp - 0x40], ebx
je 0x100415b2
mov dword [ebp - 8], 0x28405cef
mov dword [ebp - 0x10], 0x90ae735
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x10], 0xffffffff
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10041537
push 0x26bd
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov edx, dword [ebp - 8]
add edx, 0xa165
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
neg edx
push 8
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 2
pop ecx
setne al
cmp ecx, eax
mov eax, dword [ebp - 8]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0xc]
jl 0x10041590
cmp dword [ebp - 0x40], ebx
je 0x10041590
xor ecx, ecx
inc ecx
jmp 0x10041592
mov ecx, ebx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x100415d3
mov dword [ebp - 0x14], 0xffff
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x100415d0
push ebx
push ebx
push 0x233c
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
dec dword [ebp - 0x14]
mov dword [esi + 4], ebx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0x2a2c7c8a
mov dword [ebp - 0x18], 0xa1bf2b29
mov dword [ebp - 0x18], 0xf09cc25f
push 2
call fcn.10016f88
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xab5457d6
mov dword [ebp - 8], ebx
jmp 0x10041618
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x30], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x1004160a
mov dword [ebp - 8], ebx
jmp 0x10041633
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov dword [eax + ecx*4], 1
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10041623
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
call fcn.10017898
mov dword [esi], ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004410a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004412a
push 0x16bb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100441db
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
and dword [ebp - 8], 0
jmp 0x10044174
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0x28
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 8], eax
jge 0x100441db
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
jb 0x100441d9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
push dword [eax + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [eax + 8]
call fcn.10043ec6
pop ecx
pop ecx
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x28]
jae 0x100441d9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
jmp 0x100441db
jmp 0x10044160
mov esp, ebp
pop ebp
ret

Function at 0x1004520d
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10045229
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x10045274
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10045257
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10045274
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016ff9
mov dword [eax], 7
jmp 0x1004524c
mov esp, ebp
pop ebp
ret