joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4901c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x490428
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x49022b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0048fc90
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040df04
cmp al, 1
jne 0x49022b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0048ffa8
test al, al
je 0x4903b7
cmp dword [ebp - 8], 0
jge 0x490249
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0048fc90
mov eax, dword [ebp - 0x210]
call fcn.0040500c
cmp ebx, eax
jge 0x490293
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0048fc90
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x51a3d8]
and eax, 0xff
bt dword [edx], eax
jae 0x490293
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4902a7
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004901a4
cmp ebx, dword [ebp - 8]
je 0x4903a9
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4902d3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404160
and eax, 0x7f
movzx eax, word [eax*2 + 0x519128]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x490396
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404160
and eax, 0x7f
movzx eax, word [eax*2 + 0x519128]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00451f34
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404160
and eax, 0x7f
movzx eax, word [eax*2 + 0x519128]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00451f34
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49039d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x49040a
cmp dword [ebp - 8], 0
jge 0x4903c2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0048fc90
mov eax, dword [ebp - 0x218]
call fcn.0040500c
cmp eax, dword [ebp - 8]
jg 0x4903fc
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0048fc90
mov eax, dword [ebp - 0x21c]
call fcn.0040500c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004901a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49042f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404d78
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x35b16aa4
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x138819f9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x100114bc
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
mov ebx, ecx
mov dword [ebp - 4], edi
mov esi, edi
call fcn.10011a24
push dword [ebp - 4]
push edi
push 4
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
mov dword [ebx], eax
test eax, eax
je 0x1001151a
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [ebx + 4], eax
test eax, eax
jne 0x1001152f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10011511
movzx esi, si
or esi, 0x80070000
mov ecx, ebx
call fcn.10019c7a
jmp 0x1001152f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1001152f
movzx esi, si
or esi, 0x80070000
cmp dword [ebx + 4], edi
jne 0x1001153f
mov edi, 0x80004005
test esi, esi
jns 0x1001153f
mov edi, esi
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100118ab
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x1005c160]
push esi
xor esi, esi
test eax, eax
jne 0x100118cb
push esi
push esi
push 1
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
mov dword [0x1005c160], eax
test eax, eax
je 0x1001191d
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
lock inc dword [0x1005bef4]
push 0x1005c168
push esi
push 0x1005c154
push 0x1000fde0
push esi
push esi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [0x1005c164], eax
test eax, eax
je 0x1001190b
push 0xffffffffffffffff
push dword [0x1005c160]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
push dword [0x1005c160]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [0x1005c160], esi
pop esi
ret
Function at 0x10012f40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1005b330]
push ebx
mov bl, cl
cmp eax, 0xffffffff
je 0x10012f6f
push esi
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10012f69
test bl, bl
jne 0x100216a7
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0xc
call fcn.10019caa
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
je 0x100216c5
push edi
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
jmp 0x100216c7
xor esi, esi
push esi
push dword [0x1005b330]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov eax, esi
jmp 0x10012f69

Function at 0x10012f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1005b330]
cmp eax, 0xffffffff
je 0x10012f99
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test eax, eax
jne 0x100216db
ret
push eax
call fcn.10019cd9
add esp, 4
push 0
push dword [0x1005b330]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
ret

Function at 0x10014db0
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x1005b328]
xor eax, esp
mov dword [esp + 0x88], eax
cmp byte [0x1005c5e5], 0
push ebx
push esi
push edi
mov edi, ecx
jne 0x10014e1f
push 0x30
pop esi
push esi
xor ebx, ebx
lea eax, [esp + 0x1c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x18], esi
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
cmp dword [esp + 0x24], ebx
je 0x10014e1f
push ebx
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
cmp eax, esi
je 0x100217b5
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001a260
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x100217c2
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
push 0x48
lea eax, [esp + 0x4c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x14], ebx
xor eax, eax
lea ecx, [esp + 0x48]
mov word [esp + 0x10], ax
mov word [esp + 0xc], ax
call fcn.1002576b
test eax, eax
js 0x10021806
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x50]
call fcn.10025ec2
push dword [esp + 0xc]
lea edx, [esp + 0x4c]
mov ecx, edi
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.10056bd7
jmp 0x10014e1f
Function at 0x100167b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [0x1005ba24], 2
jne 0x1001681e
cmp byte [0x1005c0cc], 0
jne 0x10016824
mov eax, dword [0x1005c494]
test eax, eax
je 0x1002189f
cmp dword [eax + 0x2c], 0
je 0x10016824
mov cl, 1
cmp byte [0x1005c0cd], 0
jne 0x100218bb
test cl, cl
je 0x10016805
mov edx, dword [ebp + 0x10]
xor cl, cl
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.10016830
mov eax, dword [0x1005b330]
cmp eax, 0xffffffff
je 0x1001681e
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
test eax, eax
jne 0x100218cf
mov esp, ebp
pop ebp
ret 0x1c
xor cl, cl
jmp 0x100167df
mov ecx, 0x1005c490
call fcn.100114bc
mov eax, dword [0x1005c494]
test eax, eax
je 0x10016824
jmp 0x100167d7
mov eax, dword [ebp + 0x1c]
cmp eax, dword [0x1005c0c0]
je 0x10016805
jmp 0x100167ec
mov ecx, dword [eax]
test ecx, ecx
je 0x1001681e
sub esp, 0x14
push dword [ebp + 0xc]
push ecx
call fcn.1004f675
jmp 0x1001681e
Function at 0x10017b27
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x20019
push ebx
push 0x10005e60
push 0x80000002
mov dword [ebp - 8], ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10017b8f
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10005e38
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x10017b8f
cmp dword [ebp - 8], ebx
setne bl
mov al, bl
pop ebx
leave
ret

Function at 0x10017e24
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [0x1005c0e4]
push ebx
xor ebx, ebx
push esi
inc ebx
push edi
mov edi, ecx
cmp eax, ebx
jne 0x10017e4c
mov eax, dword [0x1005c088]
xor esi, esi
cmp dword [eax], esi
jne 0x10021913
mov dword [edi], esi
mov eax, ebx
pop edi
pop esi
pop ebx
ret
cmp dword [0x1005c468], ebx
jne 0x10017e96
mov esi, dword [0x1005c030]
test esi, esi
jne 0x10021903
test eax, eax
jne 0x100218f4
cmp dword [0x1005c020], 5
jb 0x100218ea
mov eax, dword fs:[0x30]
mov ecx, 0x1005c0e4
mov eax, dword [eax + 0xa0]
add eax, 0xc
mov dword [0x1005c088], eax
mov eax, ebx
xchg dword [ecx], eax
jmp 0x10017e35
push ebx
jmp 0x100218f6
mov dword [0x1005c0e4], 2
push 0x32
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
xor eax, eax
jmp 0x10017e48
push edi
mov ecx, esi
call dword [0x1005d484]
call esi
jmp 0x10017e48
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov ecx, dword [0x1005c088]
cmp dword [ecx], eax
jne 0x10017e44
mov esi, ebx
jmp 0x10017e44
Function at 0x100193b0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1005b328]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x20c]
mov eax, edx
push esi
mov esi, 0x104
sub ecx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
lea eax, [esi + 0x7ffffefa]
test eax, eax
je 0x1001940d
movzx eax, word [ecx + edx]
test ax, ax
je 0x10019406
mov word [edx], ax
add edx, 2
sub esi, 1
jne 0x100193e6
jmp 0x1001940a
test esi, esi
jne 0x1001940d
sub edx, 2
xor eax, eax
mov ecx, 0x104
mov word [edx], ax
lea eax, [ebp - 0x20c]
lea ecx, [ecx]
cmp word [eax], 0
je 0x1001942e
add eax, 2
sub ecx, 1
jne 0x10019420
mov edx, 0x104
mov esi, ecx
mov eax, edx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x10019488
lea eax, [ebp - 0x20c]
lea eax, [eax + esi*2]
push edi
sub edx, esi
je 0x1001947f
mov edi, 0x10006694
mov ecx, 0x7ffffffe
sub edi, eax
lea ecx, [ecx]
test ecx, ecx
je 0x10019482
movzx esi, word [edi + eax]
test si, si
je 0x1001947b
mov word [eax], si
dec ecx
add eax, 2
sub edx, 1
jne 0x10019460
jmp 0x1001947f
test edx, edx
jne 0x10019482
sub eax, 2
xor ecx, ecx
mov word [eax], cx
pop edi
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], esi
call fcn.1001bcd5
test al, al
jne 0x100194d0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x1001950a
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc9
call fcn.1002919b
mov esi, eax
jmp 0x1001950c
lea edx, [ebp - 0x210]
mov dword [ebp - 0x210], 0
mov ecx, esi
call fcn.10019540
mov esi, eax
test esi, esi
jns 0x100194fe
push esi
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xcf
call fcn.100291e4
jmp 0x1001950c
mov eax, dword [ebp - 0x210]
cdq
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor esi, esi
lea ecx, [ebp - 0x214]
call fcn.1001bb7d
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a260
mov esp, ebp
pop ebp
ret 8

Function at 0x10019970
Capabilities:
Set global application hook

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x1005c05c], 0
jne 0x100199fa
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
cmp byte [ebp + 0xc], 0
push 0
push dword [0x1005ba38]
mov dword [0x1005c05c], eax
je 0x100199b2
push sym.tiptsf.dll_RestrictedModeMsgWndProc
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x1005c04c], eax
mov eax, 1
pop ebp
ret 8
push 0x10019a40
push 0xa
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0
push dword [0x1005ba38]
mov dword [0x1005c058], eax
push 0x100150c0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
push 0
push dword [0x1005ba38]
mov dword [0x1005c054], eax
push 0x10017c30
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x1005c050], eax
jmp 0x100199a9
xor eax, eax
jmp 0x100199ae
Function at 0x1001a8e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1001a91e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1001a916
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1001a920
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1001a906
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1001aa00
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001aa2f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001aa2f
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1001ce76
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1001cf25
call fcn.10012bd0
mov ecx, dword [0x1005ba24]
cmp ecx, 2
je 0x1001cea4
xor eax, eax
cmp ecx, 1
sete al
jmp 0x1001cf9f
push 0x1005c0f8
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
push ecx
push ecx
call fcn.1001cfa9
call fcn.10013110
sub esp, 0xc
call fcn.10013060
mov eax, dword [ebp + 8]
push 0x10006718
mov dword [0x1005ba38], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10006ad0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x100069d8
mov dword [0x1005ba30], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10006a98
mov dword [0x1005ba34], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x10006754
mov dword [0x1005ba2c], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x1005ba28], eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov dword [0x1005b330], eax
mov cl, 1
jmp 0x1001cf2c
cmp eax, 2
jne 0x1001cf33
xor cl, cl
call fcn.10012690
jmp 0x1001cf9c
cmp eax, 3
jne 0x1001cf4b
call fcn.10012f20
xor cl, cl
call fcn.10013390
call fcn.10012f80
jmp 0x1001cf9c
test eax, eax
jne 0x1001cf9c
mov ecx, dword [0x1005ba24]
cmp ecx, 2
jne 0x1001ce97
mov cl, 1
call fcn.10013390
call fcn.10012f20
call fcn.10012f80
mov eax, dword [0x1005b330]
cmp eax, 0xffffffff
je 0x1001cf87
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
or dword [0x1005b330], 0xffffffff
call fcn.1001cfdc
push 0x1005c0f8
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
call fcn.10013270
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x1002271f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ecd1
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1005b328]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x174]
mov dword [ebx], 0x10004170
mov dword [ebx + 4], 0x1000414c
mov dword [ebx + 8], 0x10004128
mov dword [ebx + 0xc], 0x10004110
mov dword [ebx + 0x10], 0x100040f8
mov dword [ebx + 0x14], 0x100040e4
mov dword [ebx + 0x18], 0x100040d0
mov dword [ebx + 0x1c], 0x100040c0
mov dword [ebx + 0x20], 0x100040a8
mov dword [ebx + 0x24], 0x10004090
mov dword [ebx + 0x28], 0x1000407c
mov dword [ebx + 0x2c], 0x1000406c
mov dword [ebx + 0x30], 0x1000405c
mov dword [ebx + 0x34], 0x10004040
mov dword [ebx + 0x38], 0x10004030
mov dword [ebx + 0x3c], 0x10004010
mov dword [ebx + 0x40], 0x10004000
mov dword [ebx + 0x44], 0x10003ff0
mov dword [ebx + 0x48], 0x10003fdc
mov dword [ebx + 0x4c], 0x10003fb8
mov dword [ebx + 0x50], 0xc0000001
test eax, eax
je 0x100227f2
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [ebx + 0x174], 0
push 0
mov ecx, ebx
call fcn.1002ff9f
mov edi, dword [0x1005ba20]
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x1005d484]
mov ecx, edi
call esi
mov ecx, ebx
call fcn.1002df0a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10027f94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1001f403
call fcn.1001d405
mov edx, dword [ebp + 0x10]
xor esi, esi
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x428], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x10027ff5
call fcn.10023e28
mov esi, eax
jmp 0x1002810d
push esi
push ebx
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FindResourceExW]
mov ebx, eax
test ebx, ebx
jne 0x10028014
call fcn.10023e28
jmp 0x10028104
push ebx
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x1002800a
push ebx
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
lea ecx, [ebx + 1]
cmp ecx, ebx
jae 0x10028060
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10028056
lea ecx, [ebp - 0x418]
call fcn.1002575b
mov esi, 0x8007000e
jmp 0x10028126
push 2
pop edx
mov byte [ebp - 4], 2
call fcn.10021ab2
cmp eax, 0x400
jbe 0x10028087
push eax
lea ecx, [ebp - 0x418]
call fcn.10023bca
mov eax, dword [ebp - 0x418]
jmp 0x10028093
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x100280bd
test eax, eax
jne 0x100280c8
mov esi, 0x8007000e
jmp 0x10028106
push ebx
push eax
push ebx
push dword [ebp - 0x424]
push esi
push 3
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1002800a
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.10027e44
mov esi, eax
push edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10028126
lea ecx, [ebp - 0x418]
call fcn.1002575b
lea ecx, [ebp - 0x428]
call fcn.10022384
mov eax, esi
call fcn.1001d33f
ret 0x10
Function at 0x10029605
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
push edi
test edx, edx
jne 0x10029622
mov ecx, 0x80004005
call fcn.10023ed1
xor eax, eax
mov edi, edx
mov dword [ebp - 4], eax
mov esi, eax
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x10029633
sub ecx, dword [ebp - 8]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x1002962b
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1002966f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test edx, edx
jne 0x1002968a
mov ecx, 0x80004005
call fcn.10023ed1
mov ecx, edx
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10029691
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc