joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c028
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x1028aa8]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0xffffffffffffffff
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 0x20d], 0
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
test eax, eax
jne 0x100c14d
push 0x208
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x100c14d
and word [edi], ax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x21c]
push eax
push 1
push 0
push 0x1002a78
push 0x80000002
call esi
test eax, eax
jne 0x100c14c
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push ebx
push dword [ebp - 0x21c]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x100c144
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x1002a50
push dword [ebp - 0x218]
mov esi, 0x104
mov dword [ebp - 0x220], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c13c
cmp dword [ebp - 0x214], 2
jne 0x100c11e
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
mov byte [ebp - 0x20d], 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x100c11e
mov dword [ebp - 0x214], 1
cmp dword [ebp - 0x214], 1
jne 0x100c13c
lea eax, [ebp - 0x20c]
push eax
push edi
mov byte [ebp - 0x20d], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x218]
call ebx
push dword [ebp - 0x21c]
call ebx
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
pop edi
pop ebx
call fcn.0100b845
leave
ret 8
Function at 0x100c58e
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1028aa8]
push ebx
xor ebx, ebx
cmp dword [0x102e20c], ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], ebx
jne 0x100c6ba
push esi
push 7
xor esi, esi
call fcn.0100ca78
test eax, eax
je 0x100c615
call fcn.0100c4a8
cmp ax, bx
mov word [0x102e208], ax
je 0x100c6a5
push 0x10
lea ecx, [ebp - 0x30]
push ecx
movzx eax, ax
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c6a5
test byte [ebp - 0x21], 8
je 0x100c6a5
xor eax, eax
mov ax, word [0x102e208]
push eax
call fcn.0100c528
test eax, eax
je 0x100c6a5
jmp 0x100c6a2
push 5
call fcn.0100ca78
test eax, eax
je 0x100c6a5
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x100c6a5
lea eax, [ebp - 0x38]
push eax
push 0x20019
push ebx
push 0x1002b00
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c6a5
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x1002afc
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0xc
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x38]
mov byte [ebp - 5], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0100c3b2
test eax, eax
je 0x100c6a5
mov eax, dword [ebp - 0x34]
and eax, 0x3ff
cmp eax, 1
je 0x100c69c
cmp eax, 0xd
jne 0x100c6a5
mov word [0x102e208], ax
xor esi, esi
inc esi
xor eax, eax
cmp esi, ebx
sete al
inc eax
push eax
push 0x102e20c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop esi
cmp dword [0x102e20c], 1
jne 0x100c6d0
cmp edi, ebx
je 0x100c6d0
mov ax, word [0x102e208]
mov word [edi], ax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x102e20c], 1
pop edi
sete al
pop ebx
call fcn.0100b845
leave
ret 4
Function at 0x100c6fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x100c75d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x100c754
cmp dword [ebp - 0xc], 4
je 0x100c754
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x100c7a0
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x100c797
cmp dword [ebp - 0xc], esi
je 0x100c797
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x100c7af
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1028aa8]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, [ebp - 0x10c]
push edx
push 1
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100c825
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.0100b845
leave
ret 0xc

Function at 0x100c991
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x1002bf0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c9e3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1002bd4
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x100c9ed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1028af0]
cmp eax, 0xffffffff
jne 0x100ca71
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x1002c74
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ca60
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002c68
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100ca57
cmp dword [ebp - 0xc], 4
jne 0x100ca57
cmp dword [ebp - 0x10], eax
je 0x100ca57
mov dword [0x1028af0], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1028af0]
cmp eax, 0xffffffff
jne 0x100ca71
xor eax, eax
mov dword [0x1028af0], eax
leave
ret
Function at 0x100d080
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019e1f
test eax, eax
je 0x100d0b6
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0xc]
mov word [eax + 2], 6
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
pop ebp
ret 8

Function at 0x100d0bf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019e1f
test eax, eax
je 0x100d0f5
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0xc]
mov word [eax + 2], 7
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
pop ebp
ret 8

Function at 0x100d14d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019e1f
test eax, eax
je 0x100d181
mov ecx, dword [ebp + 8]
mov word [eax + 2], 9
mov byte [eax + 8], 2
mov dword [eax + 0xc], ecx
mov dword [eax + 4], 1
pop ebp
ret 4

Function at 0x100d18a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019e1f
test eax, eax
je 0x100d1c6
mov cl, byte [ebp + 0x10]
mov byte [eax + 8], cl
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov word [eax + 2], 9
mov dword [eax + 0x10], ecx
mov dword [eax + 4], 1
pop ebp
ret 0xc

Function at 0x100d1cf
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019e1f
test eax, eax
je 0x100d211
mov cl, byte [ebp + 0x14]
mov byte [eax + 8], cl
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0x10]
mov word [eax + 2], 9
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 1
pop ebp
ret 0x10

Function at 0x100d21a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019e1f
test eax, eax
je 0x100d254
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov word [eax + 2], 9
mov byte [eax + 8], 5
mov dword [eax + 0x10], ecx
mov dword [eax + 4], 1
pop ebp
ret 8

Function at 0x100d25d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019e1f
test eax, eax
je 0x100d29d
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0x10]
mov word [eax + 2], 9
mov byte [eax + 8], 6
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 1
pop ebp
ret 0xc
Function at 0x100d2df
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov bl, byte [ebp + 0xc]
cmp bl, 2
mov esi, dword [eax + 8]
je 0x100d306
cmp bl, 7
jne 0x100d31b
push dword [ebp + 8]
call fcn.01015609
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x100d31e
mov edi, dword [ebp + 8]
test edi, edi
jne 0x100d329
xor eax, eax
jmp 0x100d41c
mov ecx, esi
call fcn.01019e1f
mov esi, eax
test esi, esi
je 0x100d41a
mov al, byte [ebp + 0x18]
mov cl, byte [ebp + 0x14]
and dword [esi + 0xc], 0
or al, 0xfe
shl al, 1
and cl, 1
or al, cl
mov cl, byte [esi + 0x14]
shl al, 5
and cl, 0x1c
or al, cl
mov byte [esi + 0x14], al
lea eax, [ebp - 0x18]
push eax
push 0x18
push edi
mov word [esi + 2], 0xb
mov dword [esi + 8], edi
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ax, word [ebp - 0x14]
mov word [esi + 0x10], ax
mov ax, word [ebp - 0x10]
mov word [esi + 0x12], ax
mov al, bl
shl al, 2
xor al, byte [esi + 0x14]
and al, 0x1c
xor byte [esi + 0x14], al
test bl, bl
je 0x100d40f
jbe 0x100d413
cmp bl, 2
jbe 0x100d3a8
cmp bl, 3
je 0x100d3b0
cmp bl, 6
je 0x100d3fe
cmp bl, 7
jne 0x100d413
mov al, byte [ebp + 0x10]
mov byte [esi + 0x15], al
jmp 0x100d413
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xffffffff
jne 0x100d401
cmp dword [esi + 8], 0
je 0x100d401
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x100d401
push dword [esi + 8]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
call edi
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x18], eax
call dword [sym.imp.GDI32.dll_GetPixel]
push dword [ebp + 0x18]
mov ebx, eax
push dword [ebp + 0xc]
call edi
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x100d401
mov ebx, dword [ebp + 0x10]
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bh
shr ebx, 0x10
mov byte [esi + 0x17], bl
jmp 0x100d413
mov byte [esi + 0x15], 0
mov dword [esi + 4], 1
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100d428
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax + 8]
call fcn.01019e1f
mov esi, eax
test esi, esi
je 0x100d4d3
mov cl, byte [esi + 0x14]
mov eax, dword [ebp + 8]
and dword [esi + 0xc], 0
and cl, 0xfd
or cl, 1
test eax, eax
mov word [esi + 2], 0xb
mov dword [esi + 8], eax
mov byte [esi + 0x14], cl
je 0x100d4ab
push edi
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetIconInfo]
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ax, word [ebp - 0x28]
push dword [ebp - 8]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
mov word [esi + 0x10], ax
mov ax, word [ebp - 0x24]
mov word [esi + 0x12], ax
call edi
push dword [ebp - 4]
call edi
pop edi
mov al, byte [ebp + 0x10]
mov cl, byte [ebp + 0xc]
or al, 0xfe
and cl, 1
shl al, 1
or al, cl
mov cl, byte [esi + 0x14]
shl al, 5
and cl, 3
or al, cl
mov byte [esi + 0x15], 0
mov byte [esi + 0x14], al
mov dword [esi + 4], 1
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x100df88
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x100df99
ret
mov eax, dword [eax + 0xc]
ret
Function at 0x100f772
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x1028cf0]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp byte [ebp + 0xc], 0
mov ebx, dword [eax + 0xc]
je 0x100f839
test byte [ebp + 0xa], 1
je 0x100f821
test byte [esi + 0x65], 4
je 0x100f7cd
mov ecx, esi
call fcn.0100eeda
mov ebx, eax
mov edi, 0xf000
test edi, ebx
je 0x100f7cd
call fcn.0100df65
test al, al
je 0x100f7cd
push edi
push ebx
mov ecx, esi
call fcn.01011966
jmp 0x100f821
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.01007311
mov edi, eax
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.01007336
mov ecx, dword [edi]
mov edx, dword [eax]
lea ebx, [edx + ecx]
cmp ebx, ecx
jl 0x100f811
mov eax, dword [eax + 4]
mov ebx, dword [edi + 4]
add ebx, eax
cmp ebx, dword [edi + 4]
mov dword [ebp + 0xc], eax
jl 0x100f811
push 0xb
push eax
push edx
push dword [edi + 4]
push ecx
push dword [esi + 4]
call dword [sym.imp.DUSER.dll_SetGadgetRect]
mov ecx, dword [ebp - 4]
call fcn.010072f8
mov ecx, dword [ebp - 8]
call fcn.010072f8
test byte [ebp + 0xa], 2
je 0x100f8df
push dword [esi + 4]
call dword [sym.imp.DUSER.dll_InvalidateGadget]
jmp 0x100f8df
test byte [ebp + 8], 5
je 0x100f886
mov eax, esi
mov edi, eax
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100f850
cmp dword [edi + 0x44], 0xfffffffe
jne 0x100f841
test byte [ebp + 8], 1
je 0x100f867
or byte [esi + 0x66], 2
mov ecx, dword [ebx + 0x14]
push 1
push 1
push edi
call fcn.0100e044
test byte [ebp + 8], 4
je 0x100f886
mov eax, dword [esi + 0x68]
and eax, 0xfffffffd
push 1
or eax, 1
push 1
mov dword [esi + 0x68], eax
mov ecx, dword [ebx + 0x10]
push edi
call fcn.0100e044
test byte [ebp + 8], 0xa
je 0x100f8df
mov eax, esi
xor edi, edi
mov esi, eax
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100f8a5
test edi, edi
jne 0x100f89f
mov edi, eax
cmp dword [esi + 0x44], 0xfffffffe
jne 0x100f890
test edi, edi
je 0x100f8df
test byte [ebp + 8], 2
je 0x100f8c0
or byte [edi + 0x66], 2
mov ecx, dword [ebx + 0x14]
push 1
push 1
push esi
call fcn.0100e044
test byte [ebp + 8], 8
je 0x100f8df
mov eax, dword [edi + 0x68]
and eax, 0xfffffffd
push 1
or eax, 1
push 1
mov dword [edi + 0x68], eax
mov ecx, dword [ebx + 0x10]
push esi
call fcn.0100e044
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10158ff
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1028aa8]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push esi
push 0x1003c6c
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd0]
push 0x65
push eax
mov ebx, ecx
call dword [sym.imp.msvcrt.dll__snwprintf]
and word [ebp - 8], 0
add esp, 0x18
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x1015959
push dword [ebp + 0x10]
push edi
push esi
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b845
leave
ret 0xc

Function at 0x101708c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1028aa8]
push ebx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, ecx
push edi
mov dword [esi + 0x43c], eax
mov word [esi + 0x2c], cx
mov word [esi + 0x234], cx
jne 0x10170c9
lea eax, [esi + 0x440]
mov dword [eax], ecx
mov dword [esi + 0x43c], eax
mov eax, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x58]
push 0x1003e98
push eax
mov byte [esi + 0xc], 0
call dword [sym.imp.msvcrt.dll_swprintf]
mov eax, dword [esi + 0x43c]
mov edi, dword [eax]
add esp, 0xc
push 0x1003e88
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1017133
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1017133
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x5c]
mov ecx, esi
call fcn.01016cf6
test eax, eax
jl 0x1017135
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b845
leave
ret 0xc

Function at 0x1017709
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1028aa8]
push edi
push 0x25
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 5
pop edi
jb 0x1017756
xor eax, eax
inc eax
cmp dword [ebp - 0x90], eax
jae 0x1017758
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0100b845
leave
ret
Function at 0x1017882
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1028cf0]
cmp eax, 0xffffffff
push ebx
push esi
push edi
jne 0x10178a1
mov edi, 0x80004005
jmp 0x10179a0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
cmp eax, ebx
je 0x10178b8
inc dword [eax + 4]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0x1c
call fcn.0100de67
mov esi, eax
cmp esi, ebx
jne 0x10178cf
mov edi, 0x8007000e
jmp 0x1017963
push esi
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [esi + 8]
push eax
push ebx
push 0x30
push 0x18
call fcn.01019ebc
mov edi, eax
cmp edi, ebx
jl 0x1017963
lea eax, [esi + 0xc]
push eax
call fcn.0100fe76
mov edi, eax
cmp edi, ebx
jl 0x1017963
lea eax, [esi + 0x10]
push eax
push 8
call fcn.0101c469
mov edi, eax
cmp edi, ebx
jl 0x1017963
mov dword [esi + 4], 1
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], ebx
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
cmp dword [0x102e2f8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
setne cl
push 2
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x14
mov dword [ebp - 8], ebx
add ecx, eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.DUSER.dll_InitGadgets]
cmp eax, ebx
mov dword [esi], eax
jne 0x10178b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, ebx
je 0x10179a0
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x1017973
call fcn.0101c45b
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x1017980
push eax
call fcn.0100d7ca
mov eax, dword [esi]
cmp eax, ebx
je 0x101798d
push eax
call dword [sym.imp.DUSER.dll_DeleteHandle]
push esi
call fcn.01008235
push ebx
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
jmp 0x10178b3

Function at 0x10179ac
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1028cf0]
cmp eax, 0xffffffff
jne 0x10179bc
mov eax, 0x80004005
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10179d1
mov eax, 0x8004000a
pop esi
ret
dec dword [esi + 4]
cmp dword [esi + 4], 0
jg 0x1017a1a
push dword [esi]
call dword [sym.imp.DUSER.dll_DeleteHandle]
cmp byte [esi + 0x14], 0
je 0x10179ee
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esi + 0x10]
call fcn.0101c45b
push dword [esi + 0xc]
call fcn.0100d7ca
mov ecx, dword [esi + 8]
call fcn.0101c45b
push esi
call fcn.01008235
push 0
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
ret
Function at 0x40af50
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x482b4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047705a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40afd2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00474e3d
mov eax, dword [eax]
push 0x4a1d10
push eax
call fcn.004668d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004772e5
test bl, bl
je 0x40afd2
push 0x4a1d10
lea ecx, [esp + 0xc]
call fcn.00477675
push 0x4a1d1c
lea ecx, [esp + 0xc]
call fcn.00477675
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40b00e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004772e5
jmp 0x40b0d9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40b092
lea edx, [esp + 0x7c]
push 0x4a1d18
push edx
call fcn.004668d4
add esp, 8
test eax, eax
je 0x40b092
lea eax, [esp + 0x7c]
push 0x4a1d14
push eax
call fcn.004668d4
add esp, 8
test eax, eax
je 0x40b092
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b022
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004772e5
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40b8e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b942
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc