joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022a10
Capabilities:
Reference absolute stream path on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3348
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10229fec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
sub esp, 0xc
call fcn.10022c30
test eax, eax
jne 0x10022a6a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10181d22
mov esp, ebp
pop ebp
ret 4
mov edi, 0x46
nop
push dword [ebp + 8]
lea eax, [ebp - 0x30]
push str..COM_d:115200_N_8_0
push eax
call fcn.10022bd0
add esp, 8
mov esi, esp
mov dword [ebp - 0x38], esi
call fcn.1004b6ac
test eax, eax
je 0x10022b0c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
test eax, 0xffff0000
jne 0x10022ac7
movzx ebx, ax
push ebx
call fcn.1004b877
test eax, eax
je 0x10022acf
push ebx
push eax
mov ecx, esi
call fcn.10017e10
jmp 0x10022acf
push eax
mov ecx, esi
call fcn.10021910
mov esi, dword [ebp - 0x34]
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.10022d10
test eax, eax
je 0x10022aea
cmp dword [esi + 0xc], 0
jne 0x10022b05
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
dec edi
test eax, eax
jne 0x10022a70
jmp 0x10022a4a
mov al, 1
jmp 0x10022a4c
push 0x80004005
call fcn.100170b0
int3

Function at 0x10023050
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10229fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], 0
push edi
lea ecx, [ebp + 0xc]
lea ebx, [esi + 0x2c]
push ebx
push ecx
push dword [ebp + 0xc]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100230cd
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x3e5
jne 0x1002310b
push 1
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x100230cd
nop dword [eax + eax]
call edi
cmp eax, 0x3e4
jne 0x100230e5
push 1
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x100230b0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10181d22
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10181d22
mov esp, ebp
pop ebp
ret 8
cmp eax, 5
jne 0x100230e5
jmp 0x100230f6
Function at 0x10023120
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10229fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov esi, ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test ebx, ebx
jne 0x1002316b
mov ebx, dword [ebp - 0xc]
cmp dword [esi + 0x10], ebx
cmovb ebx, dword [esi + 0x10]
lea edi, [esi + 0x18]
push edi
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x1c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x14], 0
jne 0x100231d3
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [ebp - 0x1c], eax
cmp eax, 0x3e5
jne 0x10023217
push 1
lea eax, [ebp - 0x14]
push eax
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x100231d3
nop dword [eax]
call ebx
mov edi, eax
cmp edi, 0x3e4
jne 0x100231e9
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [esi + 0x18]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x100231b0
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10181d22
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0xc]
mov eax, dword [sym.imp.KERNEL32.dll_ClearCommError]
call eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10181d22
mov esp, ebp
pop ebp
ret 8
cmp eax, 5
jne 0x10023238
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10181d22
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0xc]
mov eax, dword [sym.imp.KERNEL32.dll_ClearCommError]
call eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10181d22
mov esp, ebp
pop ebp
ret 8
Function at 0x100270b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3a93
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10229fec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
call fcn.10036610
mov dword [ebp - 4], 0
call fcn.10039e10
push eax
lea ecx, [edi + 0x14]
call fcn.10036610
mov al, byte [ebp + 0xc]
mov byte [ebp - 4], 1
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], al
mov word [edi + 0x35], 0x100
mov byte [edi + 0x37], 0
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0xc]
test esi, esi
je 0x1002713e
lea eax, [esi - 1]
lea eax, [ecx + eax*4]
cmp dword [eax], 0
jne 0x10027165
sub eax, 4
sub esi, 1
jne 0x10027131
mov eax, 1
push eax
lea ecx, [edi + 0x14]
mov dword [edi + 0x28], eax
call fcn.10037910
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test esi, esi
je 0x1002713e
lea ecx, [ecx + esi*4]
add ecx, 0xfffffffc
call fcn.10024420
shl esi, 5
add eax, 0xffffffe0
add eax, esi
cmp eax, 0x11
jbe 0x1002713e
cmp eax, 0x18
ja 0x1002718d
mov eax, 2
jmp 0x10027143
cmp eax, 0x46
ja 0x10027199
mov eax, 3
jmp 0x10027143
cmp eax, 0xc5
ja 0x100271a7
mov eax, 4
jmp 0x10027143
cmp eax, 0x21b
ja 0x100271b5
mov eax, 5
jmp 0x10027143
mov ecx, 0x59a
cmp ecx, eax
sbb eax, eax
neg eax
add eax, 6
jmp 0x10027143

Function at 0x10028340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3c29
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10229fec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [0x10237564], 0
jne 0x1002838d
call fcn.10034e50
mov dword [0x10237564], 0x1002a5a0
mov esi, dword [ebp + 8]
mov ecx, 2
mov dword [esi], vtable.CryptoPP::Integer.0
mov dword [esi + 8], 2
call fcn.10028140
mov ecx, 8
call fcn.10041190
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
push 1
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, edi
push dword [ebp + 0xc]
mov edx, dword [edi]
push esi
mov dword [ebp - 0x10], 1
call dword [edx + 0x30]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003ba40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b1596
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10229fec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.10185dd4
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1003ba8f
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x1003baa0
push 0x44
push esi
call fcn.101822b8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1003c5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b1596
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10229fec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x50]
xor al, al
mov ecx, dword [esi + 0x4c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.10185dd4
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.10185dd4
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1003c631
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x1003c642
push 0x60
push esi
call fcn.101822b8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100404f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movaps xmm0, xmmword [eax]
lea edx, [esi - 1]
pxor xmm0, xmmword [edi]
movaps xmmword [eax], xmm0
cmp edx, 1
jbe 0x1004053d
add edx, 0xfffffffe
lea ecx, [edi + 0x10]
shr edx, 1
inc edx
nop dword [eax]
movaps xmm0, xmmword [eax]
lea ecx, [ecx + 0x20]
aesdec xmm0, xmmword [ecx - 0x20]
movaps xmmword [eax], xmm0
aesdec xmm0, xmmword [ecx - 0x10]
movaps xmmword [eax], xmm0
sub edx, 1
jne 0x10040520
movaps xmm0, xmmword [eax]
add esi, esi
aesdec xmm0, xmmword [edi + esi*8 - 0x10]
movaps xmmword [eax], xmm0
aesdeclast xmm0, xmmword [edi + esi*8]
pop edi
movaps xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10040560
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
sub esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movaps xmm1, xmmword [eax]
movaps xmm0, xmmword [ecx]
mov eax, dword [ebp + 0x14]
pxor xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
push esi
mov esi, dword [ebp + 0x10]
pxor xmm0, xmm1
movaps xmmword [edx], xmm0
push edi
mov edi, dword [ebp + 0x1c]
movaps xmm0, xmmword [esi]
pxor xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
pxor xmm0, xmm1
movaps xmmword [eax], xmm0
cmp edi, 1
jbe 0x100405fd
mov edi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
add edi, 0x10
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
nop
sub dword [esp + 0xc], 1
lea edi, [edi + 0x10]
movaps xmm1, xmmword [edi - 0x10]
movaps xmm0, xmmword [ecx]
aesdec xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
aesdec xmm0, xmm1
movaps xmmword [edx], xmm0
movaps xmm0, xmmword [esi]
aesdec xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
aesdec xmm0, xmm1
movaps xmmword [eax], xmm0
jne 0x100405c0
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
add edi, edi
movaps xmm0, xmmword [ecx]
movaps xmm1, xmmword [eax + edi*8]
mov eax, dword [ebp + 0x14]
aesdeclast xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
aesdeclast xmm0, xmm1
movaps xmmword [edx], xmm0
movaps xmm0, xmmword [esi]
aesdeclast xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
aesdeclast xmm0, xmm1
pop edi
movaps xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10040f20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, ecx
mov ecx, esi
mov dword [esp + 0xc], edx
push edi
shr ecx, 2
xor ebx, ebx
xor edi, edi
test ecx, ecx
je 0x10040fe9
cmp ecx, 8
jb 0x10040fc0
mov ebx, ecx
lea eax, [edx + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edx
xorps xmm3, xmm3
mov dword [esp + 0x14], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edi*4]
add edi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x10040f70
mov edx, dword [esp + 0x10]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edi, ecx
jae 0x10040fe9
mov esi, ebp
lea edx, [edx + edi*4]
sub esi, dword [esp + 0x10]
sub ecx, edi
add edi, ecx
mov eax, dword [edx + esi]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or ebx, eax
sub ecx, 1
jne 0x10040fd1
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
shl edi, 2
sub esi, edi
jne 0x10040fff
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 0xc
ret
add edx, edi
mov eax, ebx
mov dword [esp + 0x10], edx
add ebp, edi
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x14], edx
test esi, esi
je 0x100410d6
cmp esi, 0x20
jb 0x100410b7
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, ebp
and ecx, 0xffffffe0
sub edx, eax
xorps xmm3, xmm3
mov dword [esp + 0x18], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ecx
jb 0x10041052
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebx, dword [esp + 0x10]
cmp edi, esi
jae 0x100410d6
sub ebp, ebx
lea ecx, [edi + ebx]
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x100410c6
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 0xc
ret
Function at 0x10050a5c
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x10050aaf
push esi
push dword [ebp + 8]
call fcn.10050c4f
mov edi, eax
test edi, edi
jne 0x10050a7f
mov eax, dword [ebp + 0x10]
jmp 0x10050ac1
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10050a7a
mov eax, dword [ebp - 8]
jmp 0x10050ac1
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1005871b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x10058760
call fcn.1004d08e
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10058760
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x1005877c
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.10063498
mov ebx, eax
test edi, edi
je 0x1005877a
test esi, esi
je 0x1005877a
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10059169
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10059227
cmp dword [esi + 0x20], 0
je 0x10059227
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10059227
cmp dword [ebp + 8], 0
je 0x10059227
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.1004d08e
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100591f8
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10059227
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.1006404b
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x10059218
test edi, edi
je 0x10059218
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x10059223
mov ecx, esi
call fcn.10058f0c
mov eax, ebx
jmp 0x10059229
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d71b
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101be501
call fcn.101829b8
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x1005d741
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1005d7a0
call fcn.1004b6ac
push eax
lea ecx, [ebp - 0x10]
call fcn.10017f20
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.1018297b
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.10197cd3
push eax
call fcn.10017020
add esp, 0x14
test esi, esi
je 0x1005d793
push esi
call fcn.10197b4e
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10017170
mov eax, ebx
call fcn.10182981
ret 8

Function at 0x10061f74
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.1005d665
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x10061fb0
call fcn.10062196
mov dword [esi + 0xc], 1
jmp 0x10061fb5
call fcn.10062196
cmp dword [esi], 0
je 0x10061ffe
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x10061fd8
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.1004b8e9
jmp 0x10061fe9
push 0xff
mov ecx, esi
call fcn.10017ee0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.10021ab0
jmp 0x10062022
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x10062022
push dword [esi]
push dword [ebp - 4]
call fcn.1005ee4b
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100620eb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.10062196
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10062133
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1004b8e9
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.10021ab0
jmp 0x1006213e
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.1005ee4b
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10064684
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x100646af
cmp dword [ebx + 0x80], 0
jne 0x100646af
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.1004d08e
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.10064942
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100646e9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.1004d08e
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x10064720
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.10064741
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006682f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x10066849
mov edi, dword [esi + 0xc]
jmp 0x10066889
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10066862
call fcn.10055604
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x10066877
call fcn.10055604
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x10066889
call fcn.10055604
call fcn.1004d08e
cmp dword [eax + 0x3c], 0
je 0x1006689e
push edi
mov ecx, ebx
call fcn.10065f68
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.10066a7b
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x100668c7
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x100668d3
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8