joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ea20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017c413
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x101e26c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7c], ecx
call fcn.1003ebe5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x1000ea68
push 0x80004005
call fcn.10003370
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x70], eax
mov ecx, dword [sym.imp.CfgDll55.dll_m_pCfg]
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov edx, dword [edx + 0x54c]
push 0x50
lea eax, [ebp - 0x6c]
push eax
push 0xa
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 4], 0
call edx
mov eax, dword [ebp - 0x78]
mov byte [ebp + eax - 0x6c], 0
lea eax, [ebp - 0x6c]
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000eab0
sub eax, ecx
push eax
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x70]
call fcn.10005ae0
push 1
lea edx, [ebp - 0x74]
push edx
lea ecx, [ebp - 0x70]
call fcn.100058f0
mov eax, dword [eax]
push 0x1018c33c
push eax
call fcn.101293f9
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x74]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000eb08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x1000eb1b
push 1
push 0x1018c33c
lea ecx, [ebp - 0x70]
call fcn.10005ca0
push 8
push str.pkpm.ini
lea ecx, [ebp - 0x70]
call fcn.10005ca0
mov esi, dword [ebp - 0x70]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push esi
push 0
push 0x1018d220
push 0x1018d214
call edi
mov ebx, dword [ebp - 0x7c]
push esi
push 0xffffffffffffff9d
push 0x1018d208
push 0x1018d214
mov dword [ebx + 0x184f7c], eax
call edi
mov dword [ebx + 0x184f80], eax
cmp eax, 0xffffff9d
jne 0x1000eb93
mov ecx, dword [sym.imp.PmsrwData.dll_class_CStruct4Ref_gr]
mov edx, dword [ecx + 0x21c]
mov eax, dword [edx]
cmp eax, 7
je 0x1000eb81
cmp eax, 8
je 0x1000eb81
xor eax, eax
jmp 0x1000eb86
mov eax, 1
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x184f80], ecx
push esi
push 0
push 0x1018d1f4
push 0x1018d214
call edi
mov dword [0x1053fb60], eax
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000ebca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128fd0
mov esp, ebp
pop ebp
ret
Function at 0x10019370
Capabilities:
Delete file

Disassembly:
mov eax, dword [sym.imp.PmsrwData.dll_class_CStruct4Ref_gr]
push esi
mov esi, ecx
mov ecx, dword [eax + 0x21c]
mov eax, dword [ecx]
cmp eax, 7
je 0x1001938a
cmp eax, 8
jne 0x1001939b
mov ecx, esi
mov dword [esi + 0x184f88], 1
call fcn.10018e20
mov dword [esi + 0x184f88], 0
mov ecx, esi
pop esi
jmp fcn.10018e20

Function at 0x1001f3b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x101e26c8]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x1036e350], 1
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov byte [0x1036df50], 0
jne 0x1001f413
or dword [0x1036e350], 1
call fcn.1003ebe5
test eax, eax
jne 0x1001f3f5
push 0x80004005
call fcn.10003370
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
push 0x10189530
mov dword [0x1036df48], eax
call fcn.10129e76
add esp, 4
mov ecx, dword [0x1036df48]
cmp dword [ecx - 0xc], 0
jne 0x1001f452
lea edx, [ebp - 0x104]
push edx
call fcn.1001f210
lea eax, [ebp - 0x104]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001f437
sub eax, edx
push eax
lea eax, [ebp - 0x104]
push eax
mov ecx, 0x1036df48
call fcn.10005ae0
push esi
lea ecx, [ebp - 0x10c]
push 0x1036df48
push ecx
call fcn.1001fa90
mov edx, dword [ebp - 0x10c]
push 0
push edx
call fcn.10129d3b
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1001f4ed
mov eax, 2
test byte [0x1036e350], al
jne 0x1001f497
or dword [0x1036e350], eax
call fcn.1001f2d0
mov dword [0x1036df44], eax
call fcn.1003ebe5
test eax, eax
jne 0x1001f4aa
push 0x80004005
call fcn.10003370
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ecx, [ebp - 0x108]
push ecx
add eax, 0x10
push edi
mov ecx, 0x1036e354
mov dword [ebp - 0x108], eax
call fcn.1001fc00
mov esi, dword [ebp - 0x108]
test eax, eax
je 0x1001f551
mov edx, 0x1036df50
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001f4e1
jmp 0x1001f551
mov ecx, dword [ebp - 0x10c]
push ecx
push 0x400
push 0x1036df50
push 0x1018c312
push edi
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1001f56d
push 0x1036df50
lea ecx, [ebp - 0x108]
call fcn.100060a0
push 0x1018d7cc
push 0x1018d7c8
lea ecx, [ebp - 0x108]
call fcn.1001f6d0
mov esi, dword [ebp - 0x108]
mov edx, 0x1036df50
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1001f547
lea eax, [esi - 0x10]
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001f56d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1001f58f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 0x1036df50
pop esi
call fcn.10128fd0
mov esp, ebp
pop ebp
ret
Function at 0x100372f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100403da
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1003732b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.10036f34
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x10037389
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x100373ad
cmp dword [edi + 0x74], 0
jne 0x100373ad
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.100403da
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1003734a
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1003ea35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x1003ea7c
call fcn.100403da
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1003ea7c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1003ea98
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1003e53a
mov esi, eax
test edi, edi
je 0x1003ea96
test ebx, ebx
je 0x1003ea96
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10040835
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x1017e70d
call fcn.1012cd7a
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x1004085a
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x100408ac
call fcn.1003ebe5
push eax
lea ecx, [ebp - 0x10]
call fcn.10005550
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1012ce84
push eax
call fcn.100032e0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100034e0
mov eax, esi
call fcn.1012ce52
ret 8
Function at 0x100414c6
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.10040f8d
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x10041510
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10037804
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.100377d5
jmp 0x1004151b
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.10047d70
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10041521
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.100404ff
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x1004155e
call fcn.10040f8d
mov dword [esi + 0xc], 1
jmp 0x10041563
call fcn.10040f8d
cmp dword [esi], 0
je 0x100415ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
jle 0x10041584
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10037804
jmp 0x10041596
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.100059e0
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.100377d5
jmp 0x100415d0
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x100415d0
push dword [esi]
push dword [ebp + 8]
call fcn.10047d70
pop esi
pop ebp
ret 0xc

Function at 0x100428ee
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101e26c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x10042936
push 0x10191750
push 4
push eax
call fcn.1012a739
push eax
call fcn.100032e0
add esp, 0x10
jmp 0x1004294c
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x100429cf
push edi
call fcn.1012d3ce
mov edi, dword [eax]
call fcn.1012d3ce
and dword [eax], 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.1012a04d
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.1012d3ce
cmp dword [eax], 0
je 0x100429a3
call fcn.1012d3ce
push dword [eax]
call fcn.10035f6b
pop ecx
jmp 0x100429aa
call fcn.1012d3ce
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
pop edi
je 0x100429cf
cmp dword [ebp - 0x11c], esi
jae 0x100429cf
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x100429d1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10128fd0
leave
ret
Function at 0x100429de
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x101e26c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.1003a042
pop ecx
cmp eax, esi
je 0x10042ac8
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x10042ac8
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.10129410
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x10042ac8
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x10042ac8
cmp esi, 0x14
jge 0x10042ac8
push 0x10
push 0
push edi
call fcn.1012ee01
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10042ab7
call fcn.1012d3ce
cmp dword [eax], 0x22
je 0x10042ab7
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.1012cecb
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x10042a8d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x103e9408], 0
jne 0x10042b53
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x10042b7c
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.100428ee
pop ecx
pop ecx
test eax, eax
jne 0x10042b7e
inc edi
cmp edi, esi
jl 0x10042b59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10128fd0
leave
ret 8
Function at 0x1004a5b7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101e26c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1004a5ec
xor eax, eax
jmp 0x1004a63f
lea eax, [ebp - 0x210]
push eax
call fcn.1012cecb
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x1004a61d
push 0x10192248
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.1012f84a
add esp, 0xc
test eax, eax
jne 0x1004a5e8
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.1012f84a
add esp, 0xc
test eax, eax
jne 0x1004a5e8
lea eax, [ebp - 0x210]
push eax
call fcn.1003a0c8
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10128fd0
leave
ret

Function at 0x10050919
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.1008772b
call fcn.1003fdf7
cmp dword [eax + 0x14], 0
jne 0x10050936
mov ecx, esi
pop esi
jmp fcn.10050400
pop esi
ret

Function at 0x100540a8
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.100da471
call fcn.1003fdf7
cmp dword [eax + 0x14], 0
jne 0x100540c5
mov ecx, esi
pop esi
jmp fcn.10053a7b
pop esi
ret

Function at 0x1008b602
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x1008b61c
call fcn.100403da
mov esi, dword [eax + 0xc]
push dword [0x103eb1a4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1008b63a
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x1008b632
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x1008b667
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x1008b634
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.1008b530
mov esi, eax
jmp 0x1008b659
Function at 0x1010e8ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x1010e8d2
mov edi, dword [esi + 0xc]
jmp 0x1010e912
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1010e8eb
call fcn.10046b5e
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x1010e900
call fcn.10046b5e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x1010e912
call fcn.10046b5e
call fcn.100403da
cmp dword [eax + 0x3c], 0
je 0x1010e927
push edi
mov ecx, ebx
call fcn.1010d6f6
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.1010e7d4
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x1010e945
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x1010e951
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10128fd0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101e26c8]
jne 0x10128fda
repz ret
jmp fcn.101333ec

Function at 0x10129cbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10129ce3
call fcn.1012d3e1
mov dword [eax], esi
call fcn.1012d3ce
push 0x16
pop esi
mov dword [eax], esi
call fcn.101320f6
mov eax, esi
jmp 0x10129d38
test dword [ebp + 0xc], 0xfffffff9
jne 0x10129cc9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10129d10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1012d3f4
pop ecx
call fcn.1012d3ce
mov eax, dword [eax]
jmp 0x10129d38
test al, 0x10
jne 0x10129d36
test al, 1
je 0x10129d36
test byte [ebp + 0xc], 2
je 0x10129d36
call fcn.1012d3e1
mov dword [eax], 5
call fcn.1012d3ce
mov dword [eax], 0xd
jmp 0x10129d07
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10140fb9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101e26c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10132dde
and dword [ebp - 0x14], 0
cmp dword [0x103edca0], 0
mov dword [ebp - 0x18], eax
jne 0x1014106c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10141114
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10141114
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x101b6720
push ebx
mov dword [0x103edca0], eax
call edi
push eax
call esi
push 0x101b670c
push ebx
mov dword [0x103edca4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x103edca8], eax
call edi
push eax
call esi
mov dword [0x103edcb0], eax
test eax, eax
je 0x1014106c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x103edcac], eax
mov eax, dword [0x103edcac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x101410c5
cmp dword [0x103edcb0], ecx
je 0x101410c5
push eax
call esi
push dword [0x103edcb0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x101410c5
test ebx, ebx
je 0x101410c5
call edi
test eax, eax
je 0x101410bc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x101410bc
test byte [ebp - 8], 1
jne 0x101410c5
or dword [ebp + 0x10], 0x200000
jmp 0x101410f8
mov eax, dword [0x103edca4]
cmp eax, dword [ebp - 0x18]
je 0x101410f8
push eax
call esi
test eax, eax
je 0x101410f8
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x101410f8
mov eax, dword [0x103edca8]
cmp eax, dword [ebp - 0x18]
je 0x101410f8
push eax
call esi
test eax, eax
je 0x101410f8
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x103edca0]
call esi
test eax, eax
je 0x10141114
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10141116
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10128fd0
leave
ret
Function at 0x1014a0d0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ebx
mov ebx, 1
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0
push 1
push 0x103ee390
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x1014a15c
mov eax, 0x51eb851f
mov ecx, ebx
imul ebx
sar edx, 5
mov eax, ebx
sar ecx, 0x1f
sub edx, ecx
imul esi, edx, 0x64
sub eax, esi
jne 0x1014a15c
cmp ebx, 0x15f90
jl 0x1014a153
cmp ebx, 0x1d4c0
jge 0x1014a130
mov eax, 0x32
jmp 0x1014a155
cmp ebx, 0x2bf20
jge 0x1014a13f
mov eax, 0x64
jmp 0x1014a155
mov eax, 0x1482
cmp ebx, 0x57d78
jl 0x1014a155
mov eax, 0xfa
jmp 0x1014a155
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x1014a170
inc ebx
cmp ebx, 0x57e40
jl 0x1014a0e8
mov eax, dword [ebp - 4]
test eax, eax
je 0x1014a18a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.10157620
add esp, 4
mov eax, dword [0x103ee394]
test eax, eax
jne 0x1014a1c0
cmp dword [0x101e5360], 1
je 0x1014a244
xor ebx, ebx
xor esi, esi
cmp dword [0x103ee38c], 0
je 0x1014a204
mov dword [0x103ee394], 1
cmp dword [0x101e5360], 1
je 0x1014a1ef
mov dword [0x103ee390], 0
push dword [0x103ee388]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1014a262
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.1013c702
push ebx
push 0x16
call fcn.1013c702
add esp, 0x10
jmp 0x1014a1c0
mov dword [0x103ee38c], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x103ee388], eax
cmp eax, 0xffffffff
jne 0x1014a228
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1014a1ad
push 0x1014a0b0
call fcn.10129e76
push 0x1014a070
call fcn.10129e76
add esp, 8
jmp 0x1014a1ad
push 1
push 2
call fcn.1013c702
mov esi, eax
push 1
push 0x16
call fcn.1013c702
add esp, 0x10
mov ebx, eax
jmp 0x1014a1a4
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.10146480
add esp, 0xc
test eax, eax
je 0x1014a28c
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x101e52bc]
mov dword [eax + edx - 4], ecx
mov ebx, dword [edx + 0x101e52b8]
mov dword [eax + edx - 8], ebx
mov esi, dword [edx + 0x101e52b4]
mov dword [eax + edx - 0xc], esi
mov ecx, dword [edx + 0x101e52b0]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x1014a294
push dword [ebp - 0x10]
push dword [0x103ee388]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x1014a1de